7aaf9d22ae496d18f2917464965df595bdcf0aca751a810daf9d27bcd4ef8d5c

Sharing

Copy URL

Twitter E-mail

General

Target

7aaf9d22ae496d18f2917464965df595bdcf0aca751a810daf9d27bcd4ef8d5c
Size

1.1MB
MD5

36879cb5555d9de75bbc055d45d3a7fe
SHA1

bda75b065d104378f48d3ac243c43867401b8467
SHA256

7aaf9d22ae496d18f2917464965df595bdcf0aca751a810daf9d27bcd4ef8d5c
SHA512

26f3c070bd0637f23949429a5c5f8a20c63438d380e7d642aa3041acc7ce483882103a797cea7a51aa54971a4269864dd3f140ea334d0c1ba2f8ff6784eee953
SSDEEP

24576:JEHUsNLfogcxRMHZnAYHrujgcHWmz1b+56GhscJ34IF:JmUGjrcxRMHZHruDHRzk6vcJ34IF

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/PEAT.exe
unpack001/fpaCore.dll

Files

7aaf9d22ae496d18f2917464965df595bdcf0aca751a810daf9d27bcd4ef8d5c
.zip
PEAT.exe
.exe windows x86

0e8ebb9090986f0e5fee78429e13c3c0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

avifil32

AVIFileInit
AVIStreamOpenFromFileA
AVIStreamInfoA
AVIStreamGetFrameOpen
AVIStreamGetFrameClose
AVIStreamGetFrame
AVIFileRelease
AVIFileExit
AVIStreamWrite
AVIFileOpenA
AVIFileCreateStreamA
AVIStreamSetFormat
AVIStreamRelease

winmm

timeSetEvent
timeKillEvent

kernel32

TerminateProcess
IsDebuggerPresent
HeapCreate
VirtualFree
GetStdHandle
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
GetFileType
GetConsoleOutputCP
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
SizeofResource
LockResource
LoadResource
FindResourceA
WideCharToMultiByte
GetConsoleWindow
FindClose
FindFirstFileA
lstrcpynA
GetLocalTime
FreeLibrary
GetProcAddress
LoadLibraryA
QueryPerformanceCounter
QueryPerformanceFrequency
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
GetTickCount
FreeResource
GlobalFree
GlobalUnlock
GlobalLock
GetVersionExA
GetModuleHandleA
lstrcmpW
MultiByteToWideChar
SetLastError
GetLastError
CompareStringA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
SetStdHandle
HeapSize
ExitProcess
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapReAlloc
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
RaiseException
GetStartupInfoA
GetCommandLineA
GetSystemTimeAsFileTime
GetCurrentThreadId
lstrlenA
MulDiv
LocalFree
HeapAlloc
HeapFree
RtlUnwind
GetSystemDirectoryW
LoadLibraryW
SetErrorMode
GetFileSizeEx
LocalFileTimeToFileTime
GetFileAttributesExA
GetCurrentDirectoryA
SystemTimeToFileTime
GetModuleHandleW
GetOEMCP
GetCPInfo
InterlockedIncrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GlobalFlags
CreateFileA
GetShortPathNameA
GetVolumeInformationA
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
lstrcmpiA
FormatMessageA
GetThreadLocale
GetStringTypeExA
DeleteFileA
MoveFileA
GetDiskFreeSpaceA
GetFullPathNameA
GetTempFileNameA
GetFileTime
SetFileTime
GetFileAttributesA
LocalAlloc
DeleteCriticalSection
InitializeCriticalSection
FileTimeToLocalFileTime
FileTimeToSystemTime
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
LoadLibraryExA
lstrcmpA
GetCurrentProcessId
GetModuleFileNameA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
InterlockedDecrement
GetModuleFileNameW
WaitForSingleObject
CloseHandle
GlobalAlloc
WriteConsoleA

user32

CopyAcceleratorTableA
CharNextA
DestroyIcon
UnregisterClassA
GetMenuItemInfoA
SetParent
GetSystemMenu
DeleteMenu
DestroyCursor
WindowFromPoint
CharUpperA
RegisterClipboardFormatA
SetWindowContextHelpId
MapDialogRect
UnpackDDElParam
ReuseDDElParam
LoadMenuA
DestroyMenu
LoadAcceleratorsA
InsertMenuItemA
CreatePopupMenu
BringWindowToTop
TranslateAcceleratorA
ShowOwnedPopups
PostQuitMessage
GetWindowThreadProcessId
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetMessageA
TranslateMessage
GetCursorPos
ValidateRect
GetMenuStringA
AppendMenuA
InsertMenuA
RemoveMenu
ShowWindow
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
LoadIconA
SendDlgItemMessageA
WinHelpA
IsChild
SetWindowsHookExA
InvalidateRgn
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetWindowTextLengthA
GetLastActivePopup
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
IsWindowVisible
PostMessageA
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
SetWindowPos
IntersectRect
SystemParametersInfoA
IsIconic
GetWindow
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
FrameRect
InflateRect
GetWindowLongA
LoadImageA
SetWindowRgn
CopyRect
ReleaseCapture
SetCapture
GetCapture
GetCursor
GetNextDlgGroupItem
MessageBeep
PostThreadMessageA
LoadCursorA
SetCursor
LockWindowUpdate
GetDCEx
GetTabbedTextExtentA
CreateMenu
CallNextHookEx
DrawIcon
UpdateWindow
TrackMouseEvent
GetSysColorBrush
FillRect
OffsetRect
SetRectEmpty
SetRect
PtInRect
IsRectEmpty
GetDlgCtrlID
KillTimer
SetTimer
InvalidateRect
LoadBitmapA
IsWindowEnabled
SetFocus
GetFocus
GetParent
GetSysColor
SendMessageA
GetForegroundWindow
GetWindowTextA
MessageBoxA
GetWindowPlacement
SetWindowPlacement
GetWindowRect
MoveWindow
GetDC
ReleaseDC
IsWindow
GetSystemMetrics
IsZoomed
GetClientRect
EnableWindow
DispatchMessageA

gdi32

StretchDIBits
Rectangle
Ellipse
SetDIBColorTable
CreateEllipticRgn
GetDIBColorTable
GetStockObject
RoundRect
GetClipBox
SetTextColor
SetBkColor
CreateBitmap
CreateDCA
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetMapMode
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
SetTextAlign
SelectClipRgn
GetViewportExtEx
GetWindowExtEx
GetPixel
StartDocA
GetDeviceCaps
RectVisible
TextOutA
ExtTextOutA
Escape
SetViewportOrgEx
OffsetViewportOrgEx
GetTextMetricsA
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ExtSelectClipRgn
CreatePatternBrush
CreatePen
ExtCreatePen
CreateSolidBrush
CreateFontIndirectA
CreateRectRgnIndirect
GetMapMode
PatBlt
DPtoLP
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
GetViewportOrgEx
GetCharWidthA
GetBkColor
GetTextColor
GetRgnBox
LPtoDP
GetNearestColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextAlign
GetTextFaceA
GetTextExtentPointA
GetWindowOrgEx
SetViewportExtEx
StretchBlt
GetTextExtentPoint32A
FillRgn
CombineRgn
SetRectRgn
CreateRoundRectRgn
CreatePolygonRgn
CreateRectRgn
CreateFontA
CreateHatchBrush
GetObjectA
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
GetDIBits
DeleteObject
PtVisible
DeleteDC

comdlg32

GetFileTitleA

winspool.drv

GetJobA
ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegSetValueA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyA
RegQueryValueA
SetFileSecurityA
GetFileSecurityA
RegCreateKeyA
RegCloseKey

shell32

SHGetFolderPathA
DragFinish
DragQueryFileA
SHGetFileInfoA
ExtractIconA
ShellExecuteA

comctl32

ord17

shlwapi

PathFindExtensionA
PathFindFileNameA
UrlUnescapeA
PathStripToRootA
PathRemoveFileSpecW
PathIsUNCA

oledlg

ord8

ole32

OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CLSIDFromString
CLSIDFromProgID
CoInitializeEx
CoCreateInstance
CoUninitialize
CoGetClassObject
CoTaskMemFree
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoRevokeClassObject
CoRegisterMessageFilter
OleIsCurrentClipboard
OleFlushClipboard
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
IsAccelerator
OleTranslateAccelerator
CoTaskMemAlloc

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
SysAllocStringByteLen
SysFreeString
SysStringLen
SysAllocStringLen
VariantInit
VariantChangeType
OleCreateFontIndirect
SysAllocString
VariantClear

gdiplus

GdiplusShutdown

wininet

InternetConnectA
HttpSendRequestA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetOpenA
InternetGetLastResponseInfoA
InternetCloseHandle
InternetQueryDataAvailable
InternetCanonicalizeUrlA
InternetCrackUrlA
HttpOpenRequestA

Sections

.text
Size: 475KB - Virtual size: 474KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
fpaCore.dll
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

fpaCoreClose
fpaCoreGetDefaultConfiguration
fpaCoreGetExtraResults
fpaCoreGetTestInfoData
fpaCoreGetVersion
fpaCoreGetVersionCode
fpaCoreOpen
fpaProcessImage

Sections

CODE
Size: 336KB - Virtual size: 336KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 290B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
license.txt
readme.txt

Sharing

General

Malware Config

Signatures

Files

0e8ebb9090986f0e5fee78429e13c3c0

Headers

DLL Characteristics

File Characteristics

Imports

avifil32

winmm

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

gdiplus

wininet

Sections

.text Size: 475KB - Virtual size: 474KB

.rdata Size: 122KB - Virtual size: 121KB

.data Size: 13KB - Virtual size: 28KB

.rsrc Size: 5.4MB - Virtual size: 5.4MB

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 336KB - Virtual size: 336KB

DATA Size: 4KB - Virtual size: 3KB

BSS Size: - Virtual size: 4KB

.idata Size: 8KB - Virtual size: 7KB

.edata Size: 512B - Virtual size: 290B

.reloc Size: 21KB - Virtual size: 21KB

.rsrc Size: 13KB - Virtual size: 13KB

.text
Size: 475KB - Virtual size: 474KB

.rdata
Size: 122KB - Virtual size: 121KB

.data
Size: 13KB - Virtual size: 28KB

.rsrc
Size: 5.4MB - Virtual size: 5.4MB

CODE
Size: 336KB - Virtual size: 336KB

DATA
Size: 4KB - Virtual size: 3KB

BSS
Size: - Virtual size: 4KB

.idata
Size: 8KB - Virtual size: 7KB

.edata
Size: 512B - Virtual size: 290B

.reloc
Size: 21KB - Virtual size: 21KB

.rsrc
Size: 13KB - Virtual size: 13KB