029cae97b0dfe7bd66d638907fc0cf7a8f031e1ac25cf48a08278524d7e143ae

Sharing

Copy URL Twitter E-mail

General

Target

029cae97b0dfe7bd66d638907fc0cf7a8f031e1ac25cf48a08278524d7e143ae
Size

5.6MB
MD5

2504a4fe68d742715f324f199bd75b31
SHA1

570e755083f412ef29a54c185c4173cee38cd8fa
SHA256

029cae97b0dfe7bd66d638907fc0cf7a8f031e1ac25cf48a08278524d7e143ae
SHA512

e69621c2cdbaded576168452d77221ae8ef5a3edf1cac69d9224379f5c6ed05217568f52d663680a257b5f0a7ac38a039b0e31d63c20ba1afb4b0735a7fafd3c
SSDEEP

98304:HSyTnxlbxdr0tH9z0dVlo7RODR249KTIbYUzsJvugrCG5f14uQ:Hbx6DzMo7A1z9AIbYnJvugrD5fI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
029cae97b0dfe7bd66d638907fc0cf7a8f031e1ac25cf48a08278524d7e143ae

Files

029cae97b0dfe7bd66d638907fc0cf7a8f031e1ac25cf48a08278524d7e143ae
.exe windows x86

44439dfac2c7fc5810483bfb874bc018

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
GetFileSizeEx
GetFileInformationByHandle
InterlockedCompareExchange
SystemTimeToFileTime
GetSystemTime
ReadConsoleA
SetConsoleMode
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
DeleteFiber
SwitchToFiber
GetDriveTypeW
GetSystemDirectoryA
ExpandEnvironmentStringsA
PeekNamedPipe
SleepEx
FormatMessageA
GetTempPathW
SetCurrentDirectoryW
WideCharToMultiByte
OutputDebugStringA
InterlockedDecrement
InterlockedIncrement
CreateFileW
VerifyVersionInfoA
SystemTimeToTzSpecificLocalTime
WritePrivateProfileStringW
ReadFile
GetFileSize
Sleep
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetExitCodeThread
TerminateThread
CreateThread
QueryDosDeviceW
GetWindowsDirectoryW
LoadLibraryW
GetLogicalDriveStringsW
lstrcmpiW
DeleteFileW
GlobalAlloc
GlobalLock
GetModuleFileNameW
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
SwitchToThread
GetCurrentThread
GetCurrentThreadId
TryEnterCriticalSection
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
FormatMessageW
MulDiv
MultiByteToWideChar
LocalFree
GetFileAttributesW
MoveFileExW
SetFileTime
SetFileAttributesW
LocalFileTimeToFileTime
FindClose
FindFirstFileW
FindNextFileW
FileTimeToDosDateTime
DosDateTimeToFileTime
GetSystemInfo
FileTimeToLocalFileTime
ResetEvent
ReleaseSemaphore
CreateSemaphoreW
GetCurrentProcessId
GetVersionExW
WriteFile
SetEndOfFile
GetSystemDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
GetModuleHandleA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
GetPrivateProfileStringW
GetLongPathNameW
GetEnvironmentVariableW
GlobalFree
LocalAlloc
GetExitCodeProcess
lstrcpyW
CreateProcessW
DecodePointer
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
GetVolumeInformationW
FileTimeToSystemTime
DeviceIoControl
SetPriorityClass
FlushInstructionCache
HeapCreate
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceW
GetFullPathNameW
GetLocalTime
GetVersionExA
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
OutputDebugStringW
EncodePointer
GetThreadTimes
FreeLibraryAndExitThread
LoadLibraryExW
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
ExitThread
GetModuleHandleExW
ExitProcess
GetStdHandle
GetACP
GetFileType
GetStringTypeW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetConsoleCtrlHandler
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetTimeZoneInformation
WriteConsoleW
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
GetConsoleCP
FlushFileBuffers
LoadLibraryA
GlobalUnlock
SetLastError
GetProcessHeap
HeapFree
HeapAlloc
VirtualProtect
VirtualFree
VirtualAlloc
GetProcAddress
FreeLibrary
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WTSGetActiveConsoleSessionId
OpenFileMappingW
CreateFileMappingW
CreateEventW
OpenMutexW
CreateMutexW
lstrlenW
UnmapViewOfFile
MapViewOfFile
CloseHandle
WaitForMultipleObjects
WaitForSingleObject
ReleaseMutex
SetEvent
GetLastError
OpenProcess

user32

ScreenToClient
DestroyIcon
LoadBitmapW
CreateIconFromResource
LoadImageW
CharNextW
GetMessageW
ClientToScreen
EnableMenuItem
GetSysColor
GetSystemMetrics
MessageBoxW
IsWindowVisible
DrawTextW
SystemParametersInfoA
CharLowerBuffW
MapVirtualKeyA
UpdateLayeredWindow
IsMenu
IsWindowEnabled
CreatePopupMenu
DestroyMenu
GetMenuItemCount
AppendMenuW
TrackPopupMenu
GetMenuInfo
SetMenuInfo
GetMenuItemInfoW
SetMenuContextHelpId
MsgWaitForMultipleObjects
DestroyWindow
DestroyCursor
LoadCursorW
IntersectRect
GetKeyState
wsprintfW
SetWindowLongW
GetWindowLongW
GetForegroundWindow
HideCaret
UnregisterClassW
GetClassNameW
PeekMessageW
DispatchMessageW
TranslateMessage
LoadStringW
CharPrevExA
CharUpperW
GetIconInfo
DrawIconEx
OffsetRect
InflateRect
ReleaseDC
GetDC
KillTimer
SetCursor
SetRect
CopyRect
UnionRect
IsRectEmpty
EqualRect
PtInRect
SendMessageW
ShowWindow
SetWindowPos
SetWindowTextW
IsWindow
SetForegroundWindow
FindWindowW
GetCaretBlinkTime
CreateCaret
GetCursorPos
InvalidateRect
EndPaint
BeginPaint
UpdateWindow
ReleaseCapture
SetCapture
GetCapture
IsZoomed
IsIconic
SetLayeredWindowAttributes
GetActiveWindow
GetDlgItem
CreateWindowExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
GetFocus
SetFocus
SetTimer
AnimateWindow
SystemParametersInfoW
GetUserObjectInformationW
GetProcessWindowStation
PostQuitMessage
PostMessageW
TrackMouseEvent
SetCaretPos
GetMonitorInfoW
MonitorFromWindow
GetWindow
GetParent
MapWindowPoints
GetWindowRect
GetClientRect

advapi32

RegQueryValueExW
RegGetValueW
RegDeleteTreeW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
CheckTokenMembership
DuplicateTokenEx
CreateProcessAsUserW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
FreeSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RevertToSelf
ImpersonateLoggedOnUser
SetTokenInformation
LookupAccountSidW
RegEnumKeyW
RegOpenKeyW

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW
SHFileOperationW
SHCreateDirectoryExW
ShellExecuteExW
ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW

ole32

OleInitialize
CoUninitialize
CoInitialize
CLSIDFromProgID
OleUninitialize
CoCreateGuid
CreateBindCtx
CLSIDFromString
CoCreateInstance
CreateStreamOnHGlobal
OleLockRunning

psapi

EnumProcesses
EnumProcessModules
GetProcessImageFileNameW
GetModuleFileNameExW

shlwapi

StrToIntExW
SHCreateStreamOnFileEx
PathFileExistsW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

wtsapi32

WTSQueryUserToken

gdiplus

GdipCloneImage
GdipGetImageWidth
GdiplusStartup
GdipFree
GdipAlloc
GdipDisposeImage
GdipGetImageGraphicsContext
GdiplusShutdown
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItem
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipImageSelectActiveFrame
GdipGetImageHeight
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectI
GdipGraphicsClear
GdipGetPropertyItemSize
GdipSaveImageToFile
GdipDrawImageI
GdipDeleteGraphics

ntdll

VerSetConditionMask

imm32

ImmReleaseContext
ImmGetContext
ImmAssociateContext

gdi32

DeleteDC
EnumFontFamiliesExW
GetCharABCWidthsW
GetFontData
GetGlyphOutlineW
StretchBlt
SetBkMode
Rectangle
GetStockObject
GdiFlush
GetTextFaceW
ExtTextOutW
CreateSolidBrush
CreateFontIndirectW
SetGraphicsMode
GetDeviceCaps
CreateBitmap
CreateRoundRectRgn
EnumFontsW
BitBlt
GetViewportOrgEx
GetCurrentObject
SetViewportOrgEx
GetObjectW
CreateDIBSection
SelectObject
SelectClipRgn
IntersectClipRect
GetRegionData
ExtCreateRegion
DeleteObject
CreateCompatibleDC
SetWorldTransform
GetTextMetricsW
SetTextAlign
SetTextColor
RemoveFontMemResourceEx
AddFontMemResourceEx
GetTextExtentPointI
GetGlyphIndicesW
GetFontUnicodeRanges
GetOutlineTextMetricsW

oleaut32

SysFreeString
VariantClear
SysAllocStringLen
VariantCopy
SysAllocString

crypt32

CryptQueryObject
CryptMsgClose
CryptMsgGetParam
CertCloseStore
CertGetNameStringW
CertFreeCertificateContext
CertFindCertificateInStore

wldap32

ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord46
ord211
ord143
ord60
ord50

ws2_32

send
recv
WSASetLastError
bind
closesocket
WSACleanup
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSAIoctl
getaddrinfo
freeaddrinfo
recvfrom
sendto
accept
listen
ioctlsocket
gethostname
WSAStartup
WSAGetLastError
connect
select
__WSAFDIsSet

usp10

ScriptItemize
ScriptShape
ScriptFreeCache

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 953KB - Virtual size: 953KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 84KB - Virtual size: 211KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024KB - Virtual size: 46.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 195KB - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

44439dfac2c7fc5810483bfb874bc018

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

psapi

shlwapi

userenv

wtsapi32

gdiplus

ntdll

imm32

gdi32

oleaut32

crypt32

wldap32

ws2_32

usp10

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 953KB - Virtual size: 953KB

.data Size: 84KB - Virtual size: 211KB

.rsrc Size: 1024KB - Virtual size: 46.7MB

.reloc Size: 195KB - Virtual size: 195KB

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 953KB - Virtual size: 953KB

.data
Size: 84KB - Virtual size: 211KB

.rsrc
Size: 1024KB - Virtual size: 46.7MB

.reloc
Size: 195KB - Virtual size: 195KB