d7dc23d4db61c24290e6dad688ed13a79051da3fef6f585ec1c45a9fccea1e66

Sharing

Copy URL

Twitter E-mail

General

Target

d7dc23d4db61c24290e6dad688ed13a79051da3fef6f585ec1c45a9fccea1e66
Size

1.6MB
MD5

065289418d009123c212d8aa19045e45
SHA1

b712f329807be29e34757a8bdbef456bd387960e
SHA256

d7dc23d4db61c24290e6dad688ed13a79051da3fef6f585ec1c45a9fccea1e66
SHA512

6c8b271d74ebb74e6e7a80da95600dadd00a0050cee6ddbdf196c8f3ab573fdd35437d235a278e9621b0c7b8acae4aa671fbec2564414beb758857e60b410007
SSDEEP

49152:6GOSNk+4bphHDtVLL6rBeQI3AAqYXRAeWm9:6GOLRbphjzStzI3AATBAH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d7dc23d4db61c24290e6dad688ed13a79051da3fef6f585ec1c45a9fccea1e66

Files

d7dc23d4db61c24290e6dad688ed13a79051da3fef6f585ec1c45a9fccea1e66
.exe windows x86

5188891e13bb5b3856557034865652cf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CertCreateCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateChain
CertFindExtension
CryptDecodeObjectEx
CryptQueryObject
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertOpenStore
CryptStringToBinaryW
CertCloseStore
CertFindCertificateInStore
PFXImportCertStore
CertFreeCertificateContext

kernel32

GetAtomNameW
GetDriveTypeA
SetEnvironmentVariableA
FindClose
DeleteFileA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
OpenEventA
LCMapStringW
LCMapStringA
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSectionAndSpinCount
HeapReAlloc
HeapSize
GetTimeZoneInformation
GetCurrentDirectoryA
GetProcessHeap
HeapAlloc
SetStdHandle
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
GetConsoleMode
GetConsoleCP
VirtualFree
HeapFree
HeapCreate
HeapDestroy
GetStartupInfoA
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
OutputDebugStringW
WriteConsoleW
OutputDebugStringA
DebugBreak
VirtualQuery
GetEnvironmentVariableA
GetTickCount
GetProcAddress
LoadLibraryA
FindFirstFileW
CreateDirectoryA
lstrlenW
WideCharToMultiByte
GetModuleFileNameA
Sleep
GetLastError
FindFirstFileExW
FindNextFileW
ExpandEnvironmentStringsW
CreateEventA
MultiByteToWideChar
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
SetFilePointer
CreateFileW
CloseHandle
ReadFile
SystemTimeToFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
CreateDirectoryW
GetFileAttributesW
SetFileTime
WriteFile
FormatMessageW
SetLastError
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
GetSystemDirectoryW
LoadLibraryW
GetModuleHandleW
QueryPerformanceFrequency
QueryPerformanceCounter
WaitForSingleObject
VerifyVersionInfoW
VerSetConditionMask
GetModuleHandleA
GetCurrentProcessId
PeekNamedPipe
WaitForMultipleObjects
GetFileType
GetStdHandle
MoveFileExW
SleepEx
GetFileSizeEx
GetModuleFileNameW
EnumResourceLanguagesW
ConvertDefaultLocale
GetLocaleInfoW
GetCurrentThreadId
GetCurrentThread
lstrcmpA
GlobalDeleteAtom
GlobalAlloc
lstrcmpW
GlobalLock
InterlockedExchange
CompareStringA
GlobalUnlock
SetEvent
GlobalAddAtomW
FreeResource
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
GlobalFree
GetVersionExA
GlobalFindAtomW
GlobalGetAtomNameW
GetVersionExW
CompareStringW
GetFileTime
GetTempFileNameW
GetFullPathNameW
GetDiskFreeSpaceW
MulDiv
InterlockedDecrement
InterlockedIncrement
SetErrorMode
GlobalFlags
LocalFree
LocalAlloc
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
GetSystemInfo
lstrlenA
VirtualProtect
DuplicateHandle
GetCurrentProcess
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
MoveFileW
DeleteFileW
GetVolumeInformationW
GetStringTypeExW
GetThreadLocale
lstrcmpiW
GetShortPathNameW
FileTimeToSystemTime
GetStartupInfoW
RtlUnwind
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
CreateThread
ExitThread
FileTimeToLocalFileTime
GetDriveTypeW
GetFileInformationByHandle
GetTimeFormatA
GetDateFormatA
HeapValidate
IsBadReadPtr
ExitProcess
VirtualAlloc
CreateFileA

user32

GetMessageW
ValidateRect
SetWindowsHookExW
GetCursorPos
PeekMessageW
CallNextHookEx
GetKeyState
SetCursor
GetWindowThreadProcessId
EnableWindow
IsWindowEnabled
GetLastActivePopup
GetParent
GetWindowLongW
MessageBoxW
DrawMenuBar
GetSystemMenu
IsIconic
IsZoomed
SetWindowRgn
BringWindowToTop
GetWindowRect
GetClientRect
MapWindowPoints
UnregisterClassW
GetTabbedTextExtentA
IsRectEmpty
PtInRect
MessageBeep
CopyAcceleratorTableW
CharNextW
SystemParametersInfoW
DestroyIcon
CharUpperW
GetClipboardFormatNameW
GetClipboardFormatNameA
RemoveMenu
ModifyMenuW
InsertMenuItemW
InsertMenuW
GetMenuItemInfoW
GetMenuStringW
GetMenuState
EnableMenuItem
CheckMenuItem
AppendMenuW
DeleteMenu
CreatePopupMenu
CreateMenu
GrayStringW
DrawTextExW
DrawTextW
DrawIcon
GetSysColorBrush
SetRectEmpty
GetMenuItemID
DefMDIChildProcW
IsMenu
TranslateMDISysAccel
DefFrameProcW
FillRect
TranslateMessage
GetMenuItemCount
GetSubMenu
UnpackDDElParam
ReuseDDElParam
ReleaseCapture
TranslateAcceleratorW
RegisterWindowMessageW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
SendDlgItemMessageA
GetSysColor
AdjustWindowRectEx
EqualRect
DeferWindowPos
BeginDeferWindowPos
CopyRect
EndDeferWindowPos
ScrollWindow
GetScrollInfo
SetScrollInfo
WinHelpW
TrackPopupMenu
GetClassLongW
GetClassNameW
SetPropW
UnhookWindowsHookEx
GetPropW
CallWindowProcW
RemovePropW
DefWindowProcW
SetMenu
GetMenu
GetMessageTime
GetMessagePos
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetSystemMetrics
EndDialog
CreateDialogIndirectParamW
DestroyWindow
RegisterClipboardFormatW
DestroyMenu
LoadMenuW
LoadAcceleratorsW
SetFocus
ShowWindow
SetWindowPos
MoveWindow
SetWindowLongW
GetDlgCtrlID
GetWindowTextLengthW
ScreenToClient
BeginPaint
EndPaint
GetDC
GetWindowDC
GetWindowTextW
SetWindowTextW
IsDialogMessageW
SetDlgItemTextW
SendDlgItemMessageW
GetDlgItem
LoadIconW
LoadCursorW
PostThreadMessageW
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetWindowContextHelpId
DispatchMessageW
GetMenuCheckMarkDimensions
LoadBitmapW
SetMenuItemBitmaps
GetFocus
TabbedTextOutW
GetForegroundWindow
SetForegroundWindow
PostMessageW
SendMessageW
IsWindow
MapDialogRect
PostQuitMessage
DestroyCursor
wsprintfW
ReleaseDC
UpdateWindow
InflateRect
SetRect
InvalidateRect
InvalidateRgn
IsWindowVisible
ShowOwnedPopups
GetDCEx
LockWindowUpdate
RedrawWindow
SetTimer
KillTimer
GetActiveWindow
SetActiveWindow
GetCapture
SetCapture
GetDesktopWindow
GetNextDlgGroupItem
GetNextDlgTabItem
ShowScrollBar
GetTopWindow
GetWindow
IsChild
SetParent
WindowFromPoint
ClientToScreen

gdi32

GetTextExtentPoint32A
GetTextExtentPointW
ExtSelectClipRgn
SetTextAlign
LineTo
MoveToEx
IntersectClipRect
ExcludeClipRect
SelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
EndDoc
AbortDoc
SetAbortProc
EndPage
StartPage
StartDocW
Escape
GetTextMetricsW
GetTextFaceW
GetTextAlign
GetTextExtentPoint32W
TextOutW
GetPixel
BitBlt
PatBlt
Rectangle
Ellipse
GetCurrentPositionEx
RectVisible
PtVisible
LPtoDP
DPtoLP
GetWindowExtEx
GetWindowOrgEx
GetViewportExtEx
GetViewportOrgEx
GetMapMode
GetTextColor
GetStretchBltMode
GetROP2
GetPolyFillMode
GetBkMode
GetBkColor
GetNearestColor
GetDeviceCaps
GetRgnBox
CombineRgn
SetRectRgn
CreateEllipticRgn
CreateRectRgnIndirect
CreateRectRgn
CreateFontIndirectW
CreatePatternBrush
CreateSolidBrush
CreatePen
GetObjectType
CreateFontW
GetCharWidthW
DeleteObject
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
StretchDIBits
GetStockObject
DeleteDC
CreateDCW
GetObjectW
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
ExtTextOutW

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
GetJobW
ClosePrinter

advapi32

GetFileSecurityW
RegOpenKeyW
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
CryptGenRandom
CryptDestroyKey
CryptEncrypt
CryptImportKey
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegQueryValueW
OpenThreadToken
RevertToSelf
SetThreadToken
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyW
RegSetValueW
RegSetValueExW
SetFileSecurityW
RegDeleteValueW
RegEnumKeyW

shell32

DragFinish
DragQueryFileW
SHGetFileInfoW
ExtractIconW

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathIsUNCW
PathFindExtensionW
PathStripToRootW

oledlg

OleUIBusyW

ole32

StringFromCLSID
CoTaskMemAlloc
CoCreateInstance
CoInitializeEx
CoUninitialize
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
StringFromGUID2
CoRegisterMessageFilter
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
OleTranslateAccelerator
IsAccelerator
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
CoTaskMemFree
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CLSIDFromString
CLSIDFromProgID

oleaut32

SysFreeString
SysAllocStringLen
VariantClear
VariantChangeType
VariantInit
SysStringLen
OleCreateFontIndirect
SafeArrayDestroy
SysAllocString
VariantCopy
VariantTimeToSystemTime
SystemTimeToVariantTime

ws2_32

gethostname
ioctlsocket
getpeername
__WSAFDIsSet
select
WSAIoctl
recvfrom
sendto
socket
htonl
setsockopt
bind
getsockname
listen
connect
accept
recv
htons
getaddrinfo
freeaddrinfo
WSASetLastError
ntohs
WSACloseEvent
WSAEventSelect
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
WSAResetEvent
getsockopt
WSACreateEvent
WSAStartup
WSACleanup
WSAGetLastError
send
closesocket

wldap32

ord117
ord14
ord219
ord145
ord208
ord26
ord133
ord147
ord127
ord142
ord79
ord167
ord301
ord27
ord41
ord46
ord216
ord73

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 270KB - Virtual size: 269KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5188891e13bb5b3856557034865652cf

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

ws2_32

wldap32

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 270KB - Virtual size: 269KB

.data Size: 15KB - Virtual size: 33KB

.rsrc Size: 25KB - Virtual size: 28KB

.reloc Size: 108KB - Virtual size: 107KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 270KB - Virtual size: 269KB

.data
Size: 15KB - Virtual size: 33KB

.rsrc
Size: 25KB - Virtual size: 28KB

.reloc
Size: 108KB - Virtual size: 107KB