cb77c86c831220b98e47af3ef98ac63cf11e2bbd4ce9c6509e2cfeb46d401be9

Sharing

Copy URL Twitter E-mail

General

Target

cb77c86c831220b98e47af3ef98ac63cf11e2bbd4ce9c6509e2cfeb46d401be9
Size

2.5MB
MD5

e5effd891a96f91f2a2da118bb19c772
SHA1

a7e5b719fb4af442abbbd5689cd224de28e1a1ae
SHA256

cb77c86c831220b98e47af3ef98ac63cf11e2bbd4ce9c6509e2cfeb46d401be9
SHA512

3d8366f7d1bd768393f225e951b74ea501e40faa587b160929bcf7d406ed78fb53f6a615ff0e5beb7db98289e48f41152e51bf6368c569822ee46b01e78e0890
SSDEEP

49152:9nC242o1hjvo5v9sSWMPeJdvHxWKgPNxkeUSaHPqGhUUk6zP6uUlAmUP:9Cx2o1hLT7IKsJUzyGhUUkKP6uwAmG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cb77c86c831220b98e47af3ef98ac63cf11e2bbd4ce9c6509e2cfeb46d401be9

Files

cb77c86c831220b98e47af3ef98ac63cf11e2bbd4ce9c6509e2cfeb46d401be9
.exe windows x86

2aad6fcbac3999c409c54105eaf896dd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
SystemTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
InterlockedExchange
GetCurrentDirectoryA
PeekNamedPipe
GetFullPathNameA
GetDriveTypeA
InterlockedCompareExchange
GetLocalTime
QueryDosDeviceW
GetVolumeNameForVolumeMountPointW
GetDiskFreeSpaceExW
GlobalAddAtomW
CreateFileMappingW
GetEnvironmentVariableW
GetCurrentProcess
GetLogicalDriveStringsW
GetCurrentThreadId
GetWindowsDirectoryW
GetDriveTypeW
GlobalAlloc
GlobalFree
GetTickCount
GetCommandLineW
LoadLibraryExW
MultiByteToWideChar
lstrcmpiW
FormatMessageA
ExpandEnvironmentStringsA
GetSystemDirectoryA
VerSetConditionMask
VerifyVersionInfoA
FreeResource
GetSystemWindowsDirectoryW
lstrcmpiA
lstrcmpA
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
LeaveCriticalSection
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoA
SetHandleCount
GetFileType
SetStdHandle
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTimeZoneInformation
GetModuleHandleA
HeapCreate
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
GetStartupInfoW
FindAtomW
GetSystemTime
TerminateProcess
GetCurrentThread
CreateProcessW
GlobalDeleteAtom
GetFileSize
CreateMutexW
PostQueuedCompletionStatus
CreateIoCompletionPort
GetQueuedCompletionStatus
CreateThread
TerminateThread
MulDiv
OutputDebugStringW
GetFileSizeEx
EnterCriticalSection
SetLastError
lstrlenW
lstrcpyW
DeleteCriticalSection
InitializeCriticalSection
RaiseException
FindFirstFileW
FindNextFileW
FindClose
LocalAlloc
GetVersionExW
CopyFileW
MoveFileW
MoveFileExW
GetPrivateProfileStringW
GlobalFindAtomW
Sleep
GetFileAttributesW
WriteFile
CreateDirectoryW
GetTempPathW
GetTempFileNameW
WritePrivateProfileStringW
SetFileAttributesW
InterlockedDecrement
RemoveDirectoryW
DeleteFileW
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
GetSystemDirectoryW
ReadFile
SetFilePointer
GetCurrentProcessId
CreateFileW
DeviceIoControl
LoadLibraryW
InterlockedIncrement
GetModuleFileNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CloseHandle
WaitForSingleObject
GetModuleHandleW
GetProcAddress
GetSystemInfo
GlobalMemoryStatusEx
FreeLibrary
LocalFree
FindResourceExW
FindResourceW
LoadResource
LockResource
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
ExitThread
TlsFree
ReleaseMutex
HeapWalk
HeapLock
OpenThread
HeapUnlock
SetFilePointerEx
GetSystemTimeAsFileTime
CreateFileA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapSize
HeapReAlloc
HeapDestroy
TlsAlloc
LockFile
GetStdHandle
SetConsoleTextAttribute
GetFileInformationByHandle
LocalFileTimeToFileTime
DosDateTimeToFileTime
TlsGetValue
GetFileAttributesA
TlsSetValue
ResetEvent
SetEvent
CreateEventW
ReadProcessMemory
OpenMutexW
GetExitCodeProcess
GetLongPathNameW
MapViewOfFile
LockFileEx
GetFileAttributesExW
UnlockFile
FindNextFileA
FindFirstFileA
GetVersion
QueryPerformanceFrequency
GetFullPathNameW
CompareFileTime
OpenProcess
GetVolumeInformationW
FormatMessageW
SetFileTime
SetEndOfFile
FlushInstructionCache
WideCharToMultiByte
UnmapViewOfFile
QueryPerformanceCounter
WriteConsoleA
SizeofResource

user32

wvsprintfW
PostMessageW
GetActiveWindow
SendMessageW
SendMessageTimeoutW
FindWindowW
CharNextW
IsWindow
EnableWindow
GetDlgItem
IsWindowEnabled
ShowWindow
SetDlgItemTextW
IsWindowVisible
SetForegroundWindow
EndDialog
GetWindowLongW
SetWindowTextW
MoveWindow
SetWindowPos
GetClientRect
ScreenToClient
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetWindowRect
GetWindow
GetParent
GetDC
ReleaseDC
UnregisterClassA
ExitWindowsEx
wsprintfW
SetWindowLongW
GetWindowTextW
FindWindowExW
BringWindowToTop
SetTimer
KillTimer
IsDialogMessageW
OffsetRect
SetFocus
GetWindowTextLengthW
SetWindowRgn
RedrawWindow
CopyRect
DefWindowProcW
CallWindowProcW
BeginPaint
EndPaint
DialogBoxParamW
EnableMenuItem
DestroyWindow
GetSystemMenu
GetClassInfoExW
LoadCursorW
InflateRect
PostQuitMessage
IsIconic
SystemParametersInfoW
InvalidateRect
LoadIconW
RegisterClassExW
CreateWindowExW
LoadImageW
GetSystemMetrics
CreateDialogParamW
DispatchMessageW
TranslateMessage
GetShellWindow
GetWindowThreadProcessId
PostThreadMessageW
UpdateLayeredWindow
UpdateWindow
PeekMessageW
GetMessageW
MessageBoxW

gdi32

CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteDC
CombineRgn
CreateRectRgn
SetViewportOrgEx
DeleteObject

advapi32

RegCloseKey
ImpersonateLoggedOnUser
RevertToSelf
OpenProcessToken
DuplicateTokenEx
GetSecurityDescriptorSacl
IsValidSid
CopySid
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
CloseServiceHandle
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenThreadToken
ImpersonateSelf
AllocateAndInitializeSid
FreeSid
GetSecurityInfo
SetSecurityInfo
RegQueryValueExW
RegQueryInfoKeyW
GetExplicitEntriesFromAclW
GetTrusteeNameW
DeleteAce
LookupAccountSidW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyW
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegEnumValueW
CryptCreateHash
RegDeleteKeyW
GetUserNameW
LookupAccountNameW
GetFileSecurityW
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
GetAce
EqualSid
AddAce
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
SetFileSecurityW
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
CryptHashData
RegOpenKeyExA
RegQueryValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegEnumValueA
ChangeServiceConfigW
ControlService
GetTokenInformation
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CryptDestroyHash
CryptGetHashParam

shell32

SHGetSpecialFolderPathA
SHGetPathFromIDListW
SHFileOperationW
SHChangeNotify
ShellExecuteW
SHGetSpecialFolderPathW
CommandLineToArgvW
SHGetSpecialFolderLocation
SHGetMalloc
SHCreateDirectoryExW
ord165
SHBrowseForFolderW
ShellExecuteExW
ord680

ole32

CoInitializeSecurity
CoSetProxyBlanket
CoInitializeEx
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateGuid
CoTaskMemFree
OleRun

oleaut32

VariantChangeType
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
VariantClear
VariantInit
SysFreeString
SysStringLen
SysAllocString
VarUI4FromStr

shlwapi

PathAddBackslashW
StrStrIA
StrCmpNIW
PathFindFileNameW
PathRemoveExtensionW
StrCatW
StrCpyW
PathIsPrefixW
PathIsDirectoryEmptyW
PathIsSameRootW
PathCombineA
PathUnquoteSpacesW
PathRemoveArgsW
SHSetValueW
PathFileExistsW
SHGetValueW
SHDeleteValueW
PathFileExistsA
SHGetValueA
PathCombineW
PathAppendW
PathIsRelativeW
SHDeleteKeyW
StrStrIW
PathRemoveFileSpecW
StrCmpIW
PathFindExtensionW
StrTrimA
SHSetValueA
PathAppendA
wnsprintfW
PathCommonPrefixW
PathIsDirectoryW

comctl32

InitCommonControlsEx

crypt32

CertDeleteCertificateFromStore
CertCompareCertificate
CertDuplicateCertificateContext
CertCloseStore
CertGetNameStringW
CertEnumCertificatesInStore
CertOpenStore
CryptStringToBinaryA
CertGetCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateChain
CertGetNameStringA
CryptQueryObject
CertAddCertificateContextToStore
CertFindCertificateInStore
CertCreateCertificateChainEngine
CertFreeCertificateContext

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

psapi

EnumProcesses
GetModuleFileNameExW
GetProcessImageFileNameW

rpcrt4

RpcStringBindingComposeW
NdrClientCall2
RpcBindingFromStringBindingW
RpcStringFreeW
RpcBindingFree
NdrAsyncClientCall
NdrAsyncServerCall
NdrServerCall2

gdiplus

GdiplusStartup
GdiplusShutdown
GdipDrawImageRectRectI
GdipDrawImagePointRectI
GdipCreateFromHDC
GdipDeleteGraphics
GdipCloneImage
GdipDrawImageRectRect
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipAlloc
GdipFree

urlmon

URLDownloadToFileW
URLDownloadToCacheFileW

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState
InternetCrackUrlW
InternetOpenW
InternetCloseHandle
InternetConnectW
HttpOpenRequestW
HttpQueryInfoW
HttpSendRequestW
InternetQueryOptionW
InternetSetOptionW

netapi32

NetApiBufferFree
NetWkstaGetInfo

setupapi

SetupIterateCabinetW

ws2_32

__WSAFDIsSet
WSAGetLastError
select
recv
WSASetLastError
send
closesocket

Sections

.text
Size: 705KB - Virtual size: 705KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 197KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 53KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8.0MB - Virtual size: 8.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2aad6fcbac3999c409c54105eaf896dd

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

crypt32

version

psapi

rpcrt4

gdiplus

urlmon

iphlpapi

wininet

netapi32

setupapi

ws2_32

Sections

.text Size: 705KB - Virtual size: 705KB

.rdata Size: 197KB - Virtual size: 196KB

.data Size: 53KB - Virtual size: 75KB

.rsrc Size: 8.0MB - Virtual size: 8.0MB

.reloc Size: 80KB - Virtual size: 79KB

.text
Size: 705KB - Virtual size: 705KB

.rdata
Size: 197KB - Virtual size: 196KB

.data
Size: 53KB - Virtual size: 75KB

.rsrc
Size: 8.0MB - Virtual size: 8.0MB

.reloc
Size: 80KB - Virtual size: 79KB