a47a44fa64fb011abca6e81d17646153861e56c5f4d5c3f798e5d5399b569b97

Sharing

Copy URL Twitter E-mail

General

Target

a47a44fa64fb011abca6e81d17646153861e56c5f4d5c3f798e5d5399b569b97
Size

933KB
MD5

a1de176b1ed06a5d9cbb3adcdbaa425f
SHA1

97f299de04ae589855f675075c5a63ca19b83f6b
SHA256

a47a44fa64fb011abca6e81d17646153861e56c5f4d5c3f798e5d5399b569b97
SHA512

4d446843bb76d2e8b33d1ce8dd2423eee748b8a891c504a517ec6a95f63875c1e4c016deded2986f76fd3f7d279aed843c29bc22f6a63ee0bcc00483d82898fb
SSDEEP

12288:R72x5b/cvDpFc3p51qvii3mmm6AV5Cqylkg5ZQnXlV5Za5Za5Zj:x6Qep5kRhAVdcpmt44F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a47a44fa64fb011abca6e81d17646153861e56c5f4d5c3f798e5d5399b569b97

Files

a47a44fa64fb011abca6e81d17646153861e56c5f4d5c3f798e5d5399b569b97
.exe windows x64

f50b24291eb2e67109e2dadb0e67b951

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

TraceMessage
TraceEvent
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegDeleteValueW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegCreateKeyExW
RegGetValueW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
EventRegister
EventWrite
EventUnregister

kernel32

LocalAlloc
GetSystemPowerStatus
FormatMessageW
SetEvent
CreateEventW
DeleteCriticalSection
InitializeCriticalSection
LocalFree
GlobalUnlock
GlobalLock
GlobalAlloc
SizeofResource
LockResource
LoadResource
FindResourceW
CreateProcessW
Sleep
InterlockedPushEntrySList
VirtualAlloc
InterlockedPopEntrySList
GetProcessHeap
VirtualFree
HeapFree
HeapAlloc
GetVersionExA
GetSystemDirectoryW
CreateThread
lstrcmpW
GetCommandLineW
SetLastError
CloseHandle
RegisterApplicationRestart
ReleaseMutex
CreateMutexW
SetUnhandledExceptionFilter
GetModuleHandleW
HeapSetInformation
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
ExpandEnvironmentStringsW
LoadLibraryW
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
GetLastError
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
OutputDebugStringA
MulDiv
RaiseException
GetStartupInfoW

gdi32

GetDeviceCaps
SetBkColor
GetBkColor
GetTextExtentPoint32W
BitBlt
SetBrushOrgEx
SetViewportOrgEx
SetLayout
GetLayout
SelectClipRgn
CreateRectRgn
GdiGradientFill
LineTo
MoveToEx
SetDCPenColor
CreateDIBSection
SetTextColor
DeleteObject
CreateFontIndirectW
CreateCompatibleDC
SelectObject
GetTextMetricsW
DeleteDC
CreateSolidBrush
GetObjectW
GetStockObject
SetBkMode
GdiAlphaBlend
Polygon

user32

EnumDisplaySettingsExW
SystemParametersInfoW
GetSysColor
QueryDisplayConfig
GetDisplayConfigBufferSizes
EndPaint
DrawEdge
BeginPaint
PtInRect
SetRect
GetWindowLongW
ValidateRect
LoadStringW
UnregisterClassA
SetClassLongPtrW
UnhookWindowsHookEx
GetWindowLongPtrW
GetActiveWindow
UpdateWindow
ScrollWindow
GetScrollInfo
SetScrollInfo
SetWindowsHookExW
GetWindowInfo
CopyRect
GetWindowRect
GetMonitorInfoW
GetSysColorBrush
GetSystemMetrics
LoadCursorW
SetWindowLongPtrW
UnregisterPowerSettingNotification
RegisterPowerSettingNotification
UnregisterDeviceNotification
RegisterDeviceNotificationW
GetClassLongPtrW
FrameRect
MonitorFromRect
GetWindowPlacement
GetNextDlgTabItem
InvalidateRect
GetFocus
MapWindowPoints
GetClientRect
CreateWindowExW
GetParent
OffsetRect
ChangeDisplaySettingsExW
PostMessageW
GetDlgItem
CallWindowProcW
SetWindowTextW
EnumChildWindows
EnableWindow
GetWindowTextW
SetDlgItemTextW
KillTimer
ReleaseDC
GetDC
NotifyWinEvent
CallNextHookEx
GetDlgCtrlID
GetKeyState
DrawIconEx
InflateRect
DestroyWindow
CreateDialogParamW
SendMessageW
DestroyIcon
LoadImageW
AllowSetForegroundWindow
GetIconInfo
PostQuitMessage
EnumDisplayDevicesW
FindWindowW
SetForegroundWindow
GetForegroundWindow
IsIconic
DrawFocusRect
DrawTextW
ShowWindow
GetClassInfoW
IsWindowEnabled
FillRect
DefWindowProcW
SetTimer
SetWindowPos
SendDlgItemMessageW
MoveWindow
RegisterClassW
LoadIconW
GetMessageW
IsDialogMessageW
TranslateMessage
DispatchMessageW
UnregisterClassW

msvcrt

ceilf
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
_errno
realloc
??1type_info@@UEAA@XZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_acmdln
exit
_cexit
_ismbblead
_exit
_XcptFilter
__getmainargs
__C_specific_handler
memset
_purecall
__RTDynamicCast
wcstok
wcscspn
wcstol
_wcsicmp
free
memmove_s
??_U@YAPEAX_K@Z
_vsnwprintf
??2@YAPEAX_K@Z
??_V@YAXPEAX@Z
??3@YAXPEAX@Z
_initterm
memcpy

oleaut32

SafeArrayGetElement
SysAllocString
SysFreeString
VariantClear
VariantInit

powrprof

PowerDeterminePlatformRole
PowerSettingAccessCheck
PowerReadDCValue
PowerSetActiveScheme
PowerGetActiveScheme
PowerReadFriendlyName
GetPwrCapabilities

batmeter

CleanupBatteryData
SubscribeBatteryUpdateNotification
CreateBatteryData
UnsubscribeBatteryUpdateNotification
BatMeterOnDeviceChange
UpdateBatteryDataAsync
QueryBatteryData
GetBatteryStatusText
SetBatteryLevel

winmm

waveOutGetNumDevs
PlaySoundW

shell32

ShellExecuteW
ord100
SHGetKnownFolderIDList
ord155
DuplicateIcon
ShellExecuteExW

shlwapi

PathFileExistsW
ord618
ord437
StrTrimW
ord219
PathGetArgsW
PathRemoveBlanksW

ole32

CLSIDFromString
CoCreateInstance
CoSetProxyBlanket
CreateStreamOnHGlobal
CoInitializeSecurity
CoUninitialize
CoInitialize

ntdll

EtwTraceMessage
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

slc

SLGetWindowsInformationDWORD

rpcrt4

UuidFromStringW

gdiplus

GdipCloneImage
GdipDisposeImage
GdipAlloc
GdiplusShutdown
GdiplusStartup
GdipGetImageWidth
GdipCreateFromHDC
GdipDrawLine
GdipFillPath
GdipCreatePath
GdipCreatePen1
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipGetImageHeight
GdipFillRectangle
GdipImageRotateFlip
GdipFree
GdipCreateBitmapFromStream
GdipCreateSolidFill
GdipDeletePath
GdipAddPathLine
GdipDeleteBrush
GdipDeleteGraphics
GdipCreateLineBrush
GdipSetSmoothingMode
GdipDeletePen

uxtheme

OpenThemeData
BufferedPaintInit
BufferedPaintUnInit
BeginBufferedPaint
DrawThemeTextEx
EndBufferedPaint
BufferedPaintSetAlpha
GetThemePartSize
GetThemeBackgroundContentRect
GetThemeTextExtent
DrawThemeText
GetThemeColor
CloseThemeData
DrawThemeBackground

wlanapi

WlanCloseHandle
WlanGetInterfaceCapability
WlanSetInterface
WlanFreeMemory
WlanOpenHandle
WlanRegisterNotification
WlanQueryInterface
WlanEnumInterfaces

wmi

WmiOpenBlock
WmiExecuteMethodW
WmiNotificationRegistrationW
WmiCloseBlock
WmiQueryAllDataW
WmiQuerySingleInstanceW

dwmapi

DwmIsCompositionEnabled
DwmExtendFrameIntoClientArea

wtsapi32

WTSUnRegisterSessionNotification
WTSRegisterSessionNotification

Sections

.text
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 779KB - Virtual size: 780KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f50b24291eb2e67109e2dadb0e67b951

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

oleaut32

powrprof

batmeter

winmm

shell32

shlwapi

ole32

ntdll

slc

rpcrt4

gdiplus

uxtheme

wlanapi

wmi

dwmapi

wtsapi32

Sections

.text Size: 143KB - Virtual size: 142KB

.data Size: 2KB - Virtual size: 5KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 779KB - Virtual size: 780KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 143KB - Virtual size: 142KB

.data
Size: 2KB - Virtual size: 5KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 779KB - Virtual size: 780KB

.reloc
Size: 3KB - Virtual size: 2KB