1[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1.exe
Size

540KB
MD5

3a4eb489127284ff8e8fac0d9dc2d1ca
SHA1

93ba180edca73b986ed7558eb783e2531f3f4f50
SHA256

1e76a57a08e4843223de4265d8c27c8b8197571ec0382b1c28e9b37149a0cc2b
SHA512

5665a77dc291a5ad6d9cbbec4ae0aba7cb1771400fcc72dbde2f7510edc939f9a1584215b5272ddaec2a054d2c51469842e5f47bffc9929fdd26cd49a604deb7
SSDEEP

12288:rYz3PMFLBruDthx/5txg+45ne3tY60lCqoR0z2:rk3t/y+wytnh

Score

N/A

Malware Config

Signatures

Files

1.exe
.dll windows x64

a6d49a78d3e9f16f4bfcab71745f4749

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_itoa_s
_wcsicmp
iswalpha
wcschr
wcsncmp
_XcptFilter
_amsg_exit
malloc
_initterm
__C_specific_handler
_lock
_unlock
__dllonexit
_onexit
memset
memmove
memcmp
?terminate@@YAXXZ
sprintf_s
rand_s
isalnum
strnlen
wcsnlen
wcsncpy_s
_vsnwprintf_s
_ltow
_wcsnicmp
__CxxFrameHandler3
_wcslwr
wcstol
wcstok_s
iswspace
_wcstoui64
_wtoi
free
_ultow_s
_itow_s
memmove_s
memcpy_s
_vsnwprintf
wcscmp

ntdll

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
VerSetConditionMask
NtQueryLicenseValue
NtClose

advapi32

CryptAcquireContextW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceConfigW
EventWriteTransfer
CheckTokenMembership
CryptVerifySignatureW
CryptSetKeyParam
CryptGetHashParam
CryptSetHashParam
CryptDestroyKey
CryptDestroyHash
CreateWellKnownSid
RegDeleteKeyW
EventWriteEx
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumKeyW
RegDeleteTreeW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
EventUnregister
EventRegister
EventSetInformation
RegEnumValueW
RegCreateKeyExA
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptDeriveKey
DuplicateToken
GetTokenInformation
OpenThreadToken
ConvertSidToStringSidW
RegGetValueW
CryptGenRandom
CryptReleaseContext
CryptEncrypt
CryptGetKeyParam
CryptCreateHash
CryptHashData

kernel32

DeleteFileW
GetLastError
FormatMessageW
GetCurrentThreadId
HeapAlloc
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
GetModuleHandleW
GetProcAddress
IsDebuggerPresent
OutputDebugStringW
SetLastError
CloseHandle
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
WaitForSingleObject
OpenSemaphoreW
GetFileAttributesW
SetFileAttributesW
GetCurrentProcess
WideCharToMultiByte
GetSystemDirectoryW
ExpandEnvironmentStringsW
GetWindowsDirectoryW
SetThreadPriority
EnterCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GlobalAlloc
CreateThreadpoolTimer
InitializeCriticalSection
GetLocaleInfoW
QueueUserWorkItem
GetModuleHandleExA
GetCurrentThread
LoadLibraryA
GetCurrentDirectoryW
GetProcessHeap
CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
GetFileSizeEx
ReadFile
OpenProcess
GetVersionExW
VerifyVersionInfoW
GetVersionExA
InitOnceExecuteOnce
HeapFree
LocalFree
LocalAlloc
FindClose
FindNextFileW
FindFirstFileW
MultiByteToWideChar
LocalReAlloc
GetSystemDefaultLangID
GetLocaleInfoA
GetACP
GetUserDefaultUILanguage
LeaveCriticalSection
GetTickCount
FreeLibrary
LoadLibraryW
GlobalFree
ReleaseSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockShared
WaitForThreadpoolTimerCallbacks
GetUserDefaultLCID
LoadLibraryExW
lstrcmpW
IsWow64Process
CreateProcessW
CreateFileW
SetFilePointer
GetLocalTime
CloseThreadpoolTimer
RaiseException
RaiseFailFastException
QueryPerformanceCounter
SleepConditionVariableSRW
WakeAllConditionVariable
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
GetModuleFileNameW
MulDiv
GetSystemTimeAsFileTime
RemoveDirectoryW
GetNativeSystemInfo
InitializeSRWLock
CompareStringW
OpenFileMappingW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
QueryFullProcessImageNameW
TlsGetValue
GetSystemDefaultLCID
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
GetThreadPriority
CompareStringEx
GetCurrentProcessId
GetSystemTime
OpenMutexW
CreateMutexW
DuplicateHandle
GetFullPathNameW
LCMapStringW
CompareFileTime
FlushViewOfFile
SetThreadpoolTimer
WriteFile
QueryPerformanceFrequency
GetProductInfo
GetUserPreferredUILanguages
GetSystemInfo
LocaleNameToLCID
FindFirstFileExW
CreateFile2
ResolveDelayLoadedAPI
DelayLoadFailureHook
CreateMutexExW
CreateSemaphoreExW
AcquireSRWLockExclusive

user32

DispatchMessageW
LoadImageW
GetWindowLongW
EnumWindows
SetFocus
GetDlgItem
SendMessageW
EndDialog
SetWindowLongPtrW
ShowWindow
GetParent
MoveWindow
GetWindow
DrawEdge
GetDlgItemTextW
BeginPaint
EndPaint
GetTopWindow
CharNextW
SendMessageA
CheckRadioButton
SetPropW
GetWindowTextLengthW
GetWindowLongA
SetWindowLongA
GetPropW
DialogBoxParamW
PostMessageW
GetSysColor
GetCursorPos
MapWindowPoints
GetDesktopWindow
GetWindowLongPtrW
DestroyWindow
GetShellWindow
ReleaseDC
GetDC
LoadStringW
MessageBoxW
SetDlgItemInt
GetWindowThreadProcessId
AllowSetForegroundWindow
SendDlgItemMessageW
IsDlgButtonChecked
ExitWindowsEx
SetDlgItemTextW
GetClientRect
CheckDlgButton
EnableWindow
GetDlgItemInt
SetThreadDpiAwarenessContext
SystemParametersInfoW
GetWindowRect
SetWindowPos
SetWindowTextW
GetWindowTextW
MsgWaitForMultipleObjects
PeekMessageW
RemovePropW
CallWindowProcW
DefWindowProcW
RegisterWindowMessageW
LoadIconW
GetFocus
FindWindowA
DrawIconEx
DestroyIcon
SetWindowLongW
MessageBeep
TrackPopupMenu
DestroyMenu
GetSystemMetrics
IsWindowEnabled
GetSysColorBrush
OffsetRect
DrawTextW
InflateRect
DrawFocusRect
FrameRect
InvalidateRect
GetAncestor
PostThreadMessageW
GetMessageW
SetRectEmpty
IsRectEmpty
FillRect
SystemParametersInfoA
GetPropA
SetPropA
RemovePropA
CreateWindowExW
LoadMenuW
GetSubMenu
RemoveMenu
GetClassNameW
GetMonitorInfoW
MonitorFromRect
SendMessageTimeoutW
IsIconic
MonitorFromWindow
TranslateMessage

gdi32

GetDeviceCaps
TextOutW
SetBkMode
CreateSolidBrush
EnumFontFamiliesExW
EnumFontsW
GetTextExtentPoint32W
GetTextMetricsW
SetTextColor
SetBkColor
GetStockObject
GetObjectW
CreateFontIndirectW
GetTextExtentExPointW
SelectObject
ExtTextOutW
CreateFontIndirectA
GetObjectA
DeleteObject
GetLayout

ieframe

ord317
CreateExtensionGuidEnumerator
ord172
ord327
ord315
ord235
IELaunchManageAddOnsUI
ord232
ord159
ord167
ord264
ord260
ord211
ord259
ord262
ord265
ord261
ord238
ord263
ord247
ord241
ord242
ord240
ord244
ord168
ord218

shlwapi

PathQuoteSpacesW
SHSetValueW
SHGetValueW
ord217
PathIsNetworkPathW
StrRetToBufW
ord2
StrPBrkW
UrlCombineW
ord215
PathUnquoteSpacesW
ord219
SHStrDupW
ord154
SHDeleteKeyW
StrChrW
PathIsURLW
UrlCanonicalizeW
UrlCreateFromPathW
UrlApplySchemeW
StrCmpNW
StrCmpNIA
ord158
UrlUnescapeW
UrlEscapeW
ord487
StrCmpNA
ord15
StrDupW
StrStrW
StrCmpW
StrToIntW
SHRegSetUSValueW
StrToIntA
StrCmpIW
SHDeleteValueW
ord156
ord172
ord433
PathFileExistsW
StrRChrW
SHCopyKeyW
AssocQueryStringByKeyW
PathFindFileNameW
AssocQueryKeyW
StrRStrIW
SHRegQueryUSValueW
ord553
ord388
StrCmpNIW
SHAutoComplete
StrStrIW
StrTrimW
UrlGetPartW
SHRegGetUSValueW
ord16

shell32

ShellExecuteW
ord195
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFolderPathW
ord16
ord155
ord176
SHGetInstanceExplorer
ExtractAssociatedIconW
SHCreateItemFromParsingName
SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHGetKnownFolderPath
SHBindToParent
SHBindToObject
SHBindToFolderIDListParent
ord169
ord102
ord167
ord168
ord18

uxtheme

GetThemeBackgroundContentRect
CloseThemeData
OpenThemeData
IsAppThemed
DrawThemeBackground
GetThemeSysColor

ole32

CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemFree
CoCreateGuid
CoSetProxyBlanket
CoInitializeEx
StringFromGUID2
CoGetObject
CreateBindCtx
PropVariantClear
CoTaskMemAlloc

oleaut32

SysAllocString
SysAllocStringLen
SysStringLen
SysFreeString
SysStringByteLen
VarBstrCmp
VariantClear
VarBstrCat
SysAllocStringByteLen
VariantCopy

wininet

InternetSetOptionW
ord102
FindFirstUrlCacheEntryExA
SetUrlCacheConfigInfoA
FindNextUrlCacheEntryExA
FindCloseUrlCache
UrlCacheSetGlobalLimit
UpdateUrlCacheContentPath
AppCacheGetIEGroupList
AppCacheFreeGroupList
UrlCacheFindFirstEntry
DeleteUrlCacheEntryW
UrlCacheFreeEntryInfo
UrlCacheFindNextEntry
GetUrlCacheConfigInfoW
FreeUrlCacheSpaceW
FindFirstUrlCacheEntryExW
FindNextUrlCacheEntryW
InternetQueryOptionW
InternetInitializeAutoProxyDll
IncrementUrlCacheHeaderData
AppCacheFreeIESpace
InternetReadFile
AppCacheDeleteIEGroup
ord117
InternetSetPerSiteCookieDecisionW
InternetClearAllPerSiteCookieDecisions
InternetEnumPerSiteCookieDecisionW
PrivacyGetZonePreferenceW
PrivacySetZonePreferenceW
DeleteWpadCacheForNetworks
UrlCacheReloadSettings
DeleteUrlCacheContainerW
HttpQueryInfoW
InternetCrackUrlW
HttpSendRequestW
InternetCloseHandle
HttpOpenRequestW
InternetConnectW
InternetCanonicalizeUrlW
InternetOpenW
GetUrlCacheConfigInfoA

cryptui

CryptUIDlgCertMgr

ieadvpack

RegInstallW

iertutil

ord42
CreateUri
ord796
ord153
ord151
ord45
ord791
ord138
ord74
ord79
ord85
ord30
ord44
ord150
ord155
ord166
ord157
ord686
ord795
ord681
ord685
ord211
ResetIDNLanguageData
ord171
ord683
ord29
ord170
ResetIERegistrySettings
ord208
ResetIEExtensibility
ord682
ord820
ord597
ord594
ord91
ord76
ord111
ord110
ord57
ord690
ord50
ord72
ord67
ord70
ord61
ord64
ord68
ord63
ord62
ord163
CreateIUriBuilder
ord139
ord134
ord89
ord398
ord466
ord58
ord793
ord81
ord90
ord32
ord700
ord654
ord652
ord662
ord658
ord672
ord677
ord660
ord653
ord678
ord670
ord650
ord657
ord655
ord651
ord665
ord675
ord656
ord78
ord701
ord916

urlmon

ord545
ord448
ord443
CoInternetCreateZoneManager
ord101
ord414
CoInternetGetSecurityUrl
ord410
ord455
ord111
ord458
ord493
CoInternetCreateSecurityManager
GetAddSitesFileUrl
ord452

msimg32

GradientFill

rpcrt4

UuidEqual

kernelbase

GetUserDefaultLocaleName
OpenGlobalizationUserSettingsKey
GetSystemDefaultLocaleName

crypt32

CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CryptStringToBinaryA
CertCreateCertificateContext
CertAddCertificateContextToStore
CryptImportPublicKeyInfo
CryptBinaryToStringA
CryptStringToBinaryW
CertGetCertificateContextProperty
CertCloseStore
CertEnumCertificatesInStore
CertOpenStore
CryptHashCertificate
CertFindCertificateInStore
CertGetNameStringW
CertGetCertificateChain

mlang

ord123

Exports

Exports

AddInternetPropertySheets
AddInternetPropertySheetsEx
CPlApplet
ClearMyTracksByProcessW
ClearTracksWithUserPreference
DisplayPopupWindowManagementDialog
DllInstall
GetAddSitesDisplayUrl
LaunchAddSitesDialog
LaunchConnectionDialog
LaunchInternetControlPanel
LaunchPerSitePrivacyActionDialog
LaunchPopupWindowManagementDialog
LaunchPrivacyDialog
LaunchSecurityDialog
LaunchSecurityDialogEx
LaunchSiteCertDialog
OpenFontsDialog
OpenFontsDialogEx
OpenLanguageDialog
ResetIEtoDefaults
ShowDeleteBrowsingHistoryDialog
ShowFeedOptionsDialog
ShowHelpPageW
ShowLanguageDialog
ShowWebsiteDataSettings

Sections

.text
Size: 398KB - Virtual size: 397KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a6d49a78d3e9f16f4bfcab71745f4749

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

advapi32

kernel32

user32

gdi32

ieframe

shlwapi

shell32

uxtheme

ole32

oleaut32

wininet

cryptui

ieadvpack

iertutil

urlmon

msimg32

rpcrt4

kernelbase

crypt32

mlang

Exports

Exports

Sections

.text Size: 398KB - Virtual size: 397KB

.rdata Size: 116KB - Virtual size: 116KB

.data Size: 4KB - Virtual size: 17KB

.pdata Size: 15KB - Virtual size: 14KB

.didat Size: 512B - Virtual size: 304B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 398KB - Virtual size: 397KB

.rdata
Size: 116KB - Virtual size: 116KB

.data
Size: 4KB - Virtual size: 17KB

.pdata
Size: 15KB - Virtual size: 14KB

.didat
Size: 512B - Virtual size: 304B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 3KB - Virtual size: 2KB