goldenspy | 817887f4e977443cb446579f080ae848a2235b79f8c174e7201cebf62e9ccd94

Sharing

Copy URL

Twitter E-mail

General

Target

817887f4e977443cb446579f080ae848a2235b79f8c174e7201cebf62e9ccd94
Size

4.0MB
MD5

2f47656cafc2c6ed0c5a5d7bcbdc74c0
SHA1

ddbac1755c6d1f564d54e11f4cb2fb24e9a86dfb
SHA256

817887f4e977443cb446579f080ae848a2235b79f8c174e7201cebf62e9ccd94
SHA512

b4bcd5095c1213e772cc5a944735609a5d7a72994d0f23a737081ae6d46615bd2d1856054f884ff4512c0080deb6f08d6229f5220afb76fc452c555205a00d8c
SSDEEP

98304:tIcJscuUR3xeh6p2znoHWoet6MerdCEE5yJ2FLOAkGkzdnEVomFHKnPO:tIcKcD3Zet6Merdp2FLOyomFHKnP

Score

10^/10

goldenspy

Malware Config

Signatures

GoldenSpy Payload 1 IoCs

Processes:

resource	yara_rule
sample	goldenspy_svm_payload

Goldenspy family
goldenspy

Files

817887f4e977443cb446579f080ae848a2235b79f8c174e7201cebf62e9ccd94
.exe windows x86

9afef6c0fc518496be6921859f3efdf4

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

libeay32

ord654
ord78
ord52
ord421
ord2821
ord224
ord316
ord254
ord269
ord95
ord498
ord3109
ord281
ord66
ord510
ord2630
ord2604
ord2936

crypt32

CertCreateCertificateContext
CertNameToStrA
CertFreeCertificateContext
CryptStringToBinaryA
CertFindExtension

wininet

HttpSendRequestA
InternetConnectA
InternetReadFile
InternetCloseHandle
HttpQueryInfoA
HttpOpenRequestA
InternetWriteFile
HttpEndRequestA
InternetOpenA
HttpSendRequestExA
HttpAddRequestHeadersA
InternetSetOptionA

kernel32

SetEndOfFile
UnlockFile
DuplicateHandle
GetCurrentProcess
lstrcmpiA
GetVolumeInformationA
GetThreadLocale
FileTimeToLocalFileTime
GetFileAttributesExA
GetFileSizeEx
GetFileTime
GetACP
VirtualProtect
GetOEMCP
GetSystemDefaultUILanguage
GetProfileIntA
SearchPathA
SetErrorMode
GetWindowsDirectoryA
GetTempFileNameA
GetUserDefaultLCID
FindResourceExW
GetFullPathNameA
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
SwitchToThread
CompareStringW
LCMapStringW
GetStringTypeW
GetLocaleInfoW
SetStdHandle
HeapQueryInformation
QueryPerformanceFrequency
VirtualQuery
VirtualAlloc
GetSystemInfo
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
RtlUnwind
OutputDebugStringW
LockFile
FlushFileBuffers
GlobalFlags
UnhandledExceptionFilter
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
CopyFileA
FormatMessageA
LocalFree
GlobalSize
MulDiv
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetSystemDirectoryW
GetUserDefaultUILanguage
EncodePointer
VerifyVersionInfoA
lstrcpyA
VerSetConditionMask
GlobalFree
GlobalUnlock
GlobalAddAtomA
GetCurrentProcessId
WritePrivateProfileStringA
CompareStringA
lstrcmpA
GlobalDeleteAtom
GlobalLock
GlobalAlloc
LoadLibraryExW
GetCurrentThread
LoadLibraryW
GetModuleHandleW
GetModuleFileNameW
SetLastError
OutputDebugStringA
ResumeThread
SetThreadPriority
SetEvent
GetPrivateProfileStringA
GetPrivateProfileIntA
FindResourceW
CreateThread
Sleep
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
HeapFree
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
GetFileAttributesA
SystemTimeToFileTime
GetModuleHandleA
FreeLibrary
GetProcAddress
LoadLibraryA
SetCurrentDirectoryA
GetCurrentDirectoryA
WideCharToMultiByte
GetFileSize
MultiByteToWideChar
CreateFileW
SetFilePointer
WriteFile
IsDBCSLeadByteEx
ReadFile
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
CreateMutexA
Process32Next
GetLastError
CreateToolhelp32Snapshot
TerminateProcess
Process32First
GetTickCount
WinExec
CloseHandle
GetVersionExA
CreateFileA
SystemTimeToTzSpecificLocalTime
DeleteFileA
GetTempPathA
FindClose
FindNextFileA
FindFirstFileA
GetModuleFileNameA
SetFileAttributesA
LoadResource
LockResource
FreeResource
FindResourceA
SizeofResource
GetLocalTime
FileTimeToSystemTime
GetFileType
ExitProcess
GetStdHandle
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
IsValidLocale
EnumSystemLocalesW
GetFileAttributesExW
GetTimeZoneInformation
FindFirstFileExA
IsValidCodePage
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetCPInfo
WriteConsoleW

user32

EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
MonitorFromPoint
SetParent
IntersectRect
InvalidateRect
RemoveMenu
AppendMenuA
InsertMenuA
GetMenuState
GetMenuStringA
ClientToScreen
GetWindowDC
TabbedTextOutA
GrayStringA
DrawTextExA
DrawTextA
IsDialogMessageA
SetWindowTextA
SendDlgItemMessageA
CheckDlgButton
MoveWindow
ShowWindow
MonitorFromWindow
WinHelpA
GetScrollInfo
SetScrollInfo
LoadIconA
GetTopWindow
GetClassNameA
GetClassLongA
SetWindowLongA
PtInRect
EqualRect
ScreenToClient
AdjustWindowRectEx
RemovePropA
GetPropA
SetPropA
ShowScrollBar
GetScrollRange
SetScrollRange
ScrollWindow
EndPaint
BeginPaint
SetForegroundWindow
GetForegroundWindow
TrackPopupMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
SetMenu
GetMenu
GetCapture
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
IsChild
IsMenu
CreateWindowExA
GetClassInfoExA
RegisterClassA
CallWindowProcA
GetMessageTime
GetMessagePos
GetWindowTextLengthA
GetWindowTextA
GetScrollPos
SetScrollPos
GetAsyncKeyState
EnumDisplayMonitors
GetMonitorInfoA
SystemParametersInfoA
LoadCursorW
LoadCursorA
SetRectEmpty
SetLayeredWindowAttributes
GetClassInfoA
DefWindowProcA
LoadBitmapW
SetMenuItemInfoA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
LoadImageA
CheckMenuItem
UnhookWindowsHookEx
CopyRect
ReleaseDC
GetDC
MapVirtualKeyA
GetKeyNameTextA
MapDialogRect
GetWindow
SetWindowContextHelpId
SetWindowPos
SetActiveWindow
GetNextDlgTabItem
GetDlgItem
EndDialog
CreateDialogIndirectParamA
DestroyWindow
IsWindow
KillTimer
SetTimer
WaitMessage
GetLastActivePopup
GetWindowThreadProcessId
GetWindowLongA
MessageBoxA
IsWindowEnabled
SetCursor
ShowOwnedPopups
PostQuitMessage
PostMessageA
DrawIconEx
GetParent
SetCapture
ReleaseCapture
LoadMenuW
GetSystemMetrics
GetDesktopWindow
UnregisterClassA
EnableWindow
IsIconic
IsRectEmpty
OffsetRect
InflateRect
FillRect
DrawFocusRect
GetSysColorBrush
GetSysColor
MapWindowPoints
GetWindowRect
RedrawWindow
SetWindowRgn
DrawStateA
GetFocus
DrawFrameControl
DrawEdge
RegisterWindowMessageA
GetSystemMenu
DeleteMenu
MessageBeep
GetWindowRgn
DestroyCursor
InvertRect
HideCaret
CreateMenu
GetComboBoxInfo
CallNextHookEx
SetWindowsHookExA
NotifyWinEvent
TranslateMDISysAccel
DefMDIChildProcA
WindowFromPoint
DrawMenuBar
LoadImageW
UpdateWindow
GetClientRect
SendMessageA
LoadIconW
DrawIcon
GetMessageA
TranslateMessage
DispatchMessageA
PeekMessageA
IsWindowVisible
GetActiveWindow
GetKeyState
ValidateRect
GetCursorPos
MapVirtualKeyExA
IsCharLowerA
PostThreadMessageA
DestroyIcon
CopyImage
TrackMouseEvent
IsZoomed
EnableMenuItem
CharUpperA
IsClipboardFormatAvailable
FrameRect
ReuseDDElParam
UnpackDDElParam
InsertMenuItemA
LoadMenuA
TranslateAcceleratorA
LoadAcceleratorsA
CharUpperBuffA
RegisterClipboardFormatA
SubtractRect
UpdateLayeredWindow
CreateAcceleratorTableA
LoadAcceleratorsW
ToAsciiEx
GetKeyboardState
GetKeyboardLayout
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableA
CharNextA
RealChildWindowFromPoint
GetUpdateRect
SetClassLongA
DestroyAcceleratorTable
ModifyMenuA
SetMenuDefaultItem
GetMenuDefaultItem
GetMenuItemInfoA
CopyIcon
GetIconInfo
GetDoubleClickTime
EnableScrollBar
DestroyMenu
LockWindowUpdate
CreatePopupMenu
BringWindowToTop
UnionRect
SetRect
SetCursorPos
SetFocus
DefFrameProcA

gdi32

CreateCompatibleDC
CreateDIBitmap
CreateFontIndirectA
CreatePen
CreatePatternBrush
DeleteObject
EnumFontFamiliesA
GetDeviceCaps
GetStockObject
GetTextCharsetInfo
GetObjectA
SetBkColor
SetTextColor
Escape
ExcludeClipRect
GetClipBox
GetObjectType
GetPixel
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectObject
SelectPalette
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
CreateBitmap
MoveToEx
TextOutA
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CopyMetaFileA
CreateDCA
GetMapMode
SetRectRgn
DPtoLP
RealizePalette
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateRoundRectRgn
Rectangle
GetRgnBox
OffsetRgn
RoundRect
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
EnumFontFamiliesExA
LPtoDP
ExtFloodFill
SetPaletteEntries
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
GetViewportOrgEx
GetWindowOrgEx
SetPixelV
GetTextFaceA
GetTextMetricsA
Polyline
Polygon
CreatePolygonRgn
ExtTextOutA
PatBlt
GetTextExtentPoint32A
GetTextColor
GetBkColor
Ellipse
CreateSolidBrush
CreateRectRgnIndirect
CreateRectRgn
CreateHatchBrush
CreateEllipticRgn
CombineRgn
DeleteDC
BitBlt
CreateCompatibleBitmap

msimg32

TransparentBlt
AlphaBlend

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegEnumKeyA
RegDeleteValueA
RegEnumValueA
RegQueryValueA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA

shell32

SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderLocation
DragFinish
DragQueryFileA
ShellExecuteA
SHGetFileInfoA
SHAppBarMessage
SHGetDesktopFolder
SHBrowseForFolderA

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameA
StrFormatKBSizeA
PathIsUNCA
PathStripToRootA
PathRemoveFileSpecW
PathFindExtensionA

uxtheme

GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
GetWindowTheme
DrawThemeText
IsAppThemed
DrawThemeParentBackground
GetCurrentThemeName
GetThemeColor
DrawThemeBackground
CloseThemeData
OpenThemeData

ole32

OleDuplicateData
ReleaseStgMedium
CreateStreamOnHGlobal
CoDisconnectObject
CoGetClassObject
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
OleFlushClipboard
OleIsCurrentClipboard
DoDragDrop
OleGetClipboard
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleLockRunning
CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
CoCreateGuid
CoInitializeEx
CoFreeUnusedLibraries
OleInitialize
OleUninitialize
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
CoRegisterMessageFilter
CoRevokeClassObject

oleaut32

SysAllocString
OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
SysStringLen
SysAllocStringByteLen
VariantCopy
VarBstrFromDate
LoadTypeLi
SysAllocStringLen
VariantChangeType
VariantClear
VariantInit
SysFreeString

oledlg

ord8

gdiplus

GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdiplusShutdown
GdipAlloc
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipDrawImageI

ws2_32

WSASetLastError
WSACleanup
WSAStartup

skinmagic

ord2
ord1
ord3
ord5
ord8

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundA

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 383KB - Virtual size: 382KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9afef6c0fc518496be6921859f3efdf4

Code Sign

Headers

DLL Characteristics

File Characteristics

Imports

libeay32

crypt32

wininet

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

ws2_32

skinmagic

oleacc

imm32

winmm

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 383KB - Virtual size: 382KB

.data Size: 24KB - Virtual size: 42KB

.rsrc Size: 1.8MB - Virtual size: 1.8MB

.reloc Size: 147KB - Virtual size: 147KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 383KB - Virtual size: 382KB

.data
Size: 24KB - Virtual size: 42KB

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

.reloc
Size: 147KB - Virtual size: 147KB