0ea760a56dd207100e054e1e9d6a28be3279ca8efa50c92b63f3614f51e083c2

Sharing

Copy URL Twitter E-mail

General

Target

0ea760a56dd207100e054e1e9d6a28be3279ca8efa50c92b63f3614f51e083c2
Size

4.3MB
MD5

6a1bb7851529ea9ba4b1fe024d471e06
SHA1

97a485fe5fefc3977957a04449c506c81751c634
SHA256

0ea760a56dd207100e054e1e9d6a28be3279ca8efa50c92b63f3614f51e083c2
SHA512

9a279aab0a1eb9b2c96aa58c5a10717e271d29d85acd62096c040020415461cda8e9510c03b9d36e387b011f488db71d8a5a2c0f699f555c9e86f4ea2426d761
SSDEEP

98304:8JmUcjodHAP+nkq18vxIvGoxW4RcvKT5RUm:ROgPhIluCTEm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ea760a56dd207100e054e1e9d6a28be3279ca8efa50c92b63f3614f51e083c2

Files

0ea760a56dd207100e054e1e9d6a28be3279ca8efa50c92b63f3614f51e083c2
.exe windows x86

6f2a8f812a5cbfc19bbfbd1d0025155a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesW
GetFileAttributesExW
GetFileSizeEx
GetFileTime
SetFileAttributesW
GetCommandLineW
RtlUnwind
ExitProcess
GetModuleHandleExW
AreFileApisANSI
ExitThread
IsDebuggerPresent
IsProcessorFeaturePresent
HeapQueryInformation
GetStdHandle
GetFileType
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
IsValidCodePage
GetOEMCP
GetCPInfo
GetTimeZoneInformation
OutputDebugStringW
GetDateFormatW
GetTimeFormatW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
SetStdHandle
WriteConsoleW
ReadConsoleW
SetEnvironmentVariableA
GetSystemDefaultLangID
GetTempFileNameW
CreateFileA
MapViewOfFile
UnmapViewOfFile
GetDriveTypeW
GetLogicalDrives
GetSystemDefaultLCID
GetSystemPowerStatus
GetSystemDirectoryA
GetTempPathW
CreateFileMappingW
QueryDosDeviceW
GetSystemInfo
GetTempPathA
FindResourceA
MoveFileExW
GetLogicalDriveStringsW
OpenProcess
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
TryEnterCriticalSection
InterlockedCompareExchange
InterlockedExchange
FindVolumeClose
SetVolumeMountPointW
GetDriveTypeA
GetVolumeInformationA
DeleteVolumeMountPointW
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
DefineDosDeviceW
SetVolumeLabelW
DeviceIoControl
GetDiskFreeSpaceExA
GetDiskFreeSpaceExW
FindFirstVolumeW
FileTimeToLocalFileTime
OpenFile
SystemTimeToTzSpecificLocalTime
CreateDirectoryW
GetFileAttributesA
FindFirstFileA
RemoveDirectoryW
FindNextFileW
GetLocalTime
lstrlenW
PeekNamedPipe
GetExitCodeProcess
CreatePipe
CreateProcessW
InterlockedDecrement
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSectionAndSpinCount
HeapDestroy
RaiseException
GetLastError
DeleteFileA
GetSystemTime
GetVersionExA
GetDiskFreeSpaceA
CreateFileMappingA
GetDiskFreeSpaceW
LockFileEx
HeapValidate
HeapCreate
FormatMessageA
UnlockFileEx
FlushViewOfFile
HeapCompact
CreateMutexW
SetDllDirectoryW
InitializeSListHead
GetThreadTimes
WaitForSingleObjectEx
HeapSize
DecodePointer
DeleteCriticalSection
GetModuleHandleW
WaitForSingleObject
CloseHandle
CreateThread
GetCurrentProcessId
GetExitCodeThread
WaitForMultipleObjects
CopyFileExW
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
GetFullPathNameA
GetFileInformationByHandle
FindFirstFileExW
SystemTimeToFileTime
SetErrorMode
FileTimeToSystemTime
GetVolumeNameForVolumeMountPointW
GetTickCount
MultiByteToWideChar
WideCharToMultiByte
GetACP
OutputDebugStringA
SetLastError
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryW
GetCurrentThread
GetCurrentThreadId
GetVersionExW
FreeLibrary
LoadLibraryExW
LoadResource
LockResource
SizeofResource
GlobalAlloc
GlobalLock
GlobalDeleteAtom
lstrcmpA
lstrcmpW
FindResourceW
EncodePointer
EnterCriticalSection
LeaveCriticalSection
GetSystemDirectoryW
FreeResource
LoadLibraryA
GlobalAddAtomW
GlobalFindAtomW
GlobalUnlock
GlobalFree
SetEvent
CreateEventW
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
MulDiv
LocalFree
FormatMessageW
CopyFileW
InitializeCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalAlloc
LocalReAlloc
GetCurrentDirectoryW
CompareStringW
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GlobalFlags
DeleteFileW
CreateFileW
FindClose
FindFirstFileW
FlushFileBuffers
GetFileSize
GetFullPathNameW
GetVolumeInformationW
LockFile
ReadFile
SetEndOfFile
SetFilePointer
UnlockFile
WriteFile
DuplicateHandle
GetCurrentProcess
lstrcmpiW

user32

CreateWindowExW
IsWindow
DestroyWindow
SetWindowPos
IsWindowVisible
GetClassInfoExW
PostMessageW
RegisterClassW
CallWindowProcW
DefWindowProcW
SendMessageW
IsWindowEnabled
GetParent
DrawTextW
ReleaseDC
SendDlgItemMessageA
GetDesktopWindow
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadBitmapW
GetMessageW
TranslateMessage
GetCursorPos
SetCursor
GetWindowThreadProcessId
MoveWindow
GetDlgItem
GetDlgCtrlID
SetFocus
GetFocus
GetKeyState
GetCapture
GetMenu
SetMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
UpdateWindow
SetActiveWindow
GetForegroundWindow
SetForegroundWindow
ValidateRect
RedrawWindow
GetMessageTime
SetWindowTextW
IsDialogMessageW
DrawTextExW
GrayStringW
TabbedTextOutW
GetWindowDC
BeginPaint
EndPaint
ClientToScreen
SetCapture
ReleaseCapture
WindowFromPoint
LoadCursorW
SystemParametersInfoW
RealChildWindowFromPoint
InvalidateRect
GetSystemMetrics
DestroyMenu
GetSysColorBrush
IsIconic
DestroyIcon
CharUpperW
IntersectRect
GetDC
CopyRect
EnableWindow
GetMessagePos
PostQuitMessage
UnhookWindowsHookEx
PeekMessageW
DispatchMessageW
SetPropW
GetPropW
OffsetRect
SetRect
GetCaretPos
SetWindowRgn
IsZoomed
DestroyCaret
GetWindowRgn
RegisterClassExW
SendMessageA
wsprintfW
RemovePropW
GetWindowTextW
GetClientRect
GetWindowRect
AdjustWindowRectEx
UnregisterClassW
GetClassInfoW
LoadIconW
MessageBoxW
KillTimer
SetTimer
ShowWindow
CreateDesktopW
CloseDesktop
ScreenToClient
MapWindowPoints
GetSysColor
EqualRect
PtInRect
GetWindowLongW
SetWindowLongW
GetClassLongW
GetClassNameW
GetTopWindow
GetLastActivePopup
GetWindow
GetActiveWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
SetWindowsHookExW
CallNextHookEx
WinHelpW
ExitWindowsEx
EnumWindows
GetAsyncKeyState
RegisterWindowMessageW
MonitorFromWindow
GetMonitorInfoW

shell32

SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation
SHGetSpecialFolderPathA
ord165
ShellExecuteW
DragQueryFileW
SHGetFileInfoW
ShellExecuteExW
DragAcceptFiles

shlwapi

PathIsDirectoryW
PathFileExistsW
PathIsRootW
PathCanonicalizeW
PathIsRootA
PathFileExistsA
PathFindExtensionW
PathFindFileNameW
PathIsUNCW
PathStripToRootW

oleacc

LresultFromObject
CreateStdAccessibleObject

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

imagehlp

MakeSureDirectoryPathExists

winmm

timeGetDevCaps
timeSetEvent
timeKillEvent

gdi32

EnumFontFamiliesExW
FillRgn
CreatePolygonRgn
SetPixel
CreateRoundRectRgn
PtInRegion
CreateDIBSection
GetDIBits
CreateFontW
CreateCompatibleBitmap
GetTextExtentPoint32W
ScaleWindowExtEx
ScaleViewportExtEx
OffsetViewportOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
ExtTextOutW
TextOutW
MoveToEx
SetMapMode
SetBkMode
SelectObject
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
GetStockObject
GetDeviceCaps
GetClipBox
Escape
DeleteObject
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePen
CreateCompatibleDC
BitBlt
CreateBitmap
GetObjectW
SetTextColor
SetBkColor

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

ControlService
UnlockServiceDatabase
ChangeServiceConfigW
QueryServiceStatus
StartServiceW
LockServiceDatabase
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
LsaFreeMemory
LsaRetrievePrivateData
LsaNtStatusToWinError
LsaClose
LsaOpenPolicy
RegOpenKeyExA
RegQueryValueExA
RevertToSelf
ImpersonateLoggedOnUser
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegEnumKeyW
RegCloseKey
RegQueryInfoKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
LookupAccountNameW
GetSidSubAuthorityCount
GetUserNameW
GetSidSubAuthority
OpenProcessToken
GetSidIdentifierAuthority
RegEnumValueW
RegQueryValueW

ole32

CoInitialize
CoTaskMemFree
CoCreateInstance
CoInitializeEx
CoSetProxyBlanket
CoInitializeSecurity
CoCreateGuid
CreateStreamOnHGlobal
CoUninitialize

oleaut32

VariantInit
VariantClear
VariantChangeType
VariantTimeToSystemTime
SysAllocString
VarDateFromStr
SysFreeString

msimg32

AlphaBlend

comctl32

_TrackMouseEvent

gdiplus

GdipCreateHBITMAPFromBitmap
GdipLoadImageFromStream
GdipCreateBitmapFromFile
GdipCreatePath
GdipImageSelectActiveFrame
GdipImageGetFrameDimensionsCount
GdipGetImageWidth
GdipGetImageHeight
GdipDrawPath
GdipDeletePen
GdipCreatePen1
GdipResetClip
GdipSetClipPath
GdipAddPathRectangleI
GdipAddPathEllipseI
GdipResetPath
GdipDrawImageRectRect
GdipSetSmoothingMode
GdipDisposeImage
GdipCloneImage
GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateSolidFill
GdipDeleteBrush
GdipFillPath
GdipSetPenDashStyle
GdipDrawLineI
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetTextRenderingHint
GdipDrawString
GdipDeletePath
GdipClosePathFigure
GdipAddPathLineI
GdipAddPathArcI
GdipImageGetFrameDimensionsList

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow

ws2_32

select
WSAGetLastError
htons
inet_addr
setsockopt
WSACleanup
recv
socket
closesocket
gethostbyname
send
WSAStartup
shutdown
ioctlsocket
connect

iphlpapi

GetAdaptersInfo

wininet

InternetCanonicalizeUrlA
InternetCrackUrlA

wlanapi

WlanCloseHandle
WlanGetProfile
WlanOpenHandle
WlanEnumInterfaces
WlanFreeMemory
WlanGetProfileList

rpcrt4

UuidFromStringW
UuidToStringW
RpcStringFreeW

setupapi

SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW

crypt32

CryptStringToBinaryW
CryptUnprotectData

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 500KB - Virtual size: 499KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 191KB - Virtual size: 234KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 508KB - Virtual size: 508KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 196KB - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 27.1MB - Virtual size: 27.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6f2a8f812a5cbfc19bbfbd1d0025155a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

shlwapi

oleacc

version

imagehlp

winmm

gdi32

winspool.drv

advapi32

ole32

oleaut32

msimg32

comctl32

gdiplus

imm32

ws2_32

iphlpapi

wininet

wlanapi

rpcrt4

setupapi

crypt32

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.rdata Size: 500KB - Virtual size: 499KB

.data Size: 191KB - Virtual size: 234KB

.vmp0 Size: 508KB - Virtual size: 508KB

.reloc Size: 196KB - Virtual size: 195KB

.rsrc Size: 27.1MB - Virtual size: 27.1MB

.text
Size: 2.9MB - Virtual size: 2.9MB

.rdata
Size: 500KB - Virtual size: 499KB

.data
Size: 191KB - Virtual size: 234KB

.vmp0
Size: 508KB - Virtual size: 508KB

.reloc
Size: 196KB - Virtual size: 195KB

.rsrc
Size: 27.1MB - Virtual size: 27.1MB