de5edad3d5452c309e7bc550c3854b4e5b014d0108faaab37b37666c842e5e61

Sharing

Copy URL Twitter E-mail

General

Target

de5edad3d5452c309e7bc550c3854b4e5b014d0108faaab37b37666c842e5e61
Size

1.6MB
MD5

762fecfabf0ab74dadd5062d39ab4c93
SHA1

f07ae1ccaaa6f960e6b7e3873f14cf7f8f48ccca
SHA256

de5edad3d5452c309e7bc550c3854b4e5b014d0108faaab37b37666c842e5e61
SHA512

a038e8a33fa669ad329a914a4ad545695cad25917f9cf49bc53b30eebefb4a40b64ba6b6441017e1f8498403abcc2c3e9b93f5c32b33e17dc1a4c9b184e75d0c
SSDEEP

49152:tz3cepA2qk6JSX7ovXvhDTzA2cKHqCAbjvobtcX2uMUNMgVWi2F5seF5FFnJNo9c:tz3cqA2qz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de5edad3d5452c309e7bc550c3854b4e5b014d0108faaab37b37666c842e5e61

Files

de5edad3d5452c309e7bc550c3854b4e5b014d0108faaab37b37666c842e5e61
.exe windows x86

3022a6088c0d2b1c40bc95352ed9d26b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
LCMapStringA
LCMapStringW
HeapSize
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetOEMCP
GetCPInfo
HeapCreate
VirtualAlloc
CreateThread
DeleteCriticalSection
GetModuleFileNameA
GetStdHandle
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
HeapReAlloc
GetStartupInfoW
HeapAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryA
GetProcessHeap
HeapFree
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
GetStringTypeA
GetStringTypeW
GetConsoleCP
DeviceIoControl
TerminateProcess
GetTickCount
Sleep
DeleteFileW
GetFileSize
CreateFileMappingW
MapViewOfFile
GetModuleFileNameW
IsDebuggerPresent
RaiseException
FreeLibrary
ExitProcess
GetCurrentProcessId
FindResourceW
LoadResource
LockResource
SizeofResource
CreateFileW
GetLastError
WriteFile
IsBadWritePtr
GetConsoleMode
SetStdHandle
FlushFileBuffers
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
lstrcmpiW
lstrcpynW
InterlockedIncrement
InterlockedDecrement
FreeResource
LocalFileTimeToFileTime
SystemTimeToFileTime
LocalFree
FormatMessageW
OutputDebugStringW
MulDiv
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetACP
GetWindowsDirectoryW
MoveFileExW
SetFilePointer
SetEndOfFile
GetCommandLineW
ReadFile
GetTempPathW
LoadLibraryW
CreateEventW
SetEvent
GetComputerNameW
ResetEvent
CreateProcessW
GlobalAlloc
GlobalLock
GlobalUnlock
GetLocalTime
RtlUnwind
lstrlenW
lstrcpyW
GetModuleHandleW
GetProcAddress
WideCharToMultiByte
GetNativeSystemInfo
GetCurrentProcess
CloseHandle
MultiByteToWideChar
IsBadReadPtr
VirtualFree

user32

IsIconic
GetMonitorInfoW
MonitorFromWindow
GetWindow
GetParent
GetWindowRect
PostQuitMessage
GetSystemMetrics
SetTimer
KillTimer
GetCursorPos
IsWindowVisible
GetClientRect
GetWindowRgn
FillRect
DrawTextW
SetRect
CharPrevW
SendMessageW
PostMessageW
CloseClipboard
UpdateLayeredWindow
MoveWindow
GetWindowTextW
SetClipboardData
EmptyClipboard
OpenClipboard
SetForegroundWindow
ShowWindow
FindWindowW
MessageBoxW
CreateCaret
DefWindowProcW
CreateWindowExW
SetWindowLongW
IsWindow
EnableWindow
GetMessageW
SetFocus
TranslateMessage
DispatchMessageW
LoadImageW
LoadCursorW
RegisterClassW
GetClassInfoExW
RegisterClassExW
GetWindowLongW
CallWindowProcW
SetPropW
GetPropW
AdjustWindowRectEx
GetMenu
OffsetRect
InflateRect
UnionRect
SetCursor
CharNextW
ScreenToClient
GetKeyState
DestroyWindow
ReleaseDC
GetDC
GetActiveWindow
BeginPaint
EndPaint
GetUpdateRect
ShowCaret
HideCaret
GetCaretPos
GetWindowTextLengthW
SetWindowTextW
SetWindowRgn
SetCapture
GetFocus
IsZoomed
InvalidateRect
GetSysColor
ReleaseCapture
PtInRect
MapWindowPoints
IntersectRect
IsRectEmpty
SetCaretPos
ClientToScreen
GetCaretBlinkTime
CreatePopupMenu
AppendMenuW
EnableMenuItem
TrackPopupMenu
DestroyMenu
IsWindowEnabled
EqualRect
InvalidateRgn
CreateAcceleratorTableW
GetGUIThreadInfo
wsprintfA
DrawTextA
MapVirtualKeyExW
GetKeyboardLayout
GetKeyNameTextW
SetWindowPos

gdi32

SetBitmapBits
GetBitmapBits
GetTextExtentPointA
GdiFlush
TextOutW
GetTextExtentPoint32W
GetCharABCWidthsW
SetBkColor
GetObjectA
RoundRect
LineTo
MoveToEx
CreatePenIndirect
SetStretchBltMode
StretchBlt
CombineRgn
ExtSelectClipRgn
CreateRectRgnIndirect
GetClipBox
SelectClipRgn
PtInRegion
CreateRectRgn
CreateDIBSection
CreateSolidBrush
CreatePatternBrush
SetTextColor
SetBkMode
CreateRoundRectRgn
PlayEnhMetaFile
CreateCompatibleBitmap
GetDeviceCaps
GetEnhMetaFileHeader
CreateDIBitmap
AddFontMemResourceEx
GetTextMetricsW
CloseEnhMetaFile
CreateEnhMetaFileW
SetWindowOrgEx
Rectangle
RestoreDC
BitBlt
SaveDC
SelectObject
CreateCompatibleDC
DeleteDC
RemoveFontMemResourceEx
DeleteObject
CreatePen
CreateFontIndirectW
GetStockObject
GetObjectW

winspool.drv

ConnectToPrinterDlg

comdlg32

GetSaveFileNameW

advapi32

OpenServiceW
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenSCManagerW
StartServiceW
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegOpenKeyExW
GetAce
GetSecurityDescriptorDacl
IsValidSecurityDescriptor
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
LookupAccountNameW
ChangeServiceConfigW
QueryServiceConfigW
QueryServiceStatus
RegDeleteKeyW
SetFileSecurityW
GetSecurityDescriptorControl
EqualSid
AddAce
GetAclInformation
GetFileSecurityW

shell32

SHGetPathFromIDListW
SHBrowseForFolderW
DragQueryFileW
ShellExecuteW

ole32

RegisterDragDrop
DoDragDrop
OleDuplicateData
CLSIDFromString
ReleaseStgMedium
CoTaskMemFree
CoCreateInstance
CreateStreamOnHGlobal
OleLockRunning
CLSIDFromProgID
StringFromCLSID

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

imagehlp

ImageNtHeader
CheckSumMappedFile
MapFileAndCheckSumW

comctl32

ord17
_TrackMouseEvent
InitCommonControlsEx

gdiplus

GdipGetImageHeight
GdipGetImageWidth
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipDrawString
GdipMeasureString
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDrawImageRectI
GdipSetStringFormatTrimming
GdipImageSelectActiveFrame
GdipStringFormatGetGenericTypographic
GdipCloneStringFormat
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawRectangleI
GdipSetPenMode
GdipDeletePen
GdipCreatePen1
GdipFillRectangleI
GdipDeleteBrush
GdipCreateSolidFill
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipCloneImage
GdipAlloc
GdipFree
GdipLoadImageFromStream
GdiplusShutdown
GdiplusStartup
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdipSetStringFormatFlags
GdipDeleteStringFormat

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

iphlpapi

CreateIpNetEntry
DeleteIpNetEntry
GetPerAdapterInfo
GetAdaptersAddresses
GetAdaptersInfo
SendARP

netapi32

NetShareEnum
NetConnectionEnum
NetSessionEnum
NetGetJoinInformation
NetUserGetInfo
NetUserSetInfo
NetShareGetInfo
NetShareAdd
NetSessionDel
NetShareDel
NetShareSetInfo
NetApiBufferFree

mpr

WNetAddConnection2W

ws2_32

inet_ntoa
select
ntohl
WSAStartup
recv
send
connect
gethostname
gethostbyname
inet_addr
WSAAsyncSelect
WSACleanup
recvfrom
WSAGetLastError
socket
setsockopt
sendto
closesocket
ntohs
htons
htonl

wininet

InternetOpenUrlW
InternetOpenW
InternetCloseHandle
HttpQueryInfoW
InternetReadFile

shlwapi

PathFileExistsW
PathIsNetworkPathW

Sections

.text
Size: 570KB - Virtual size: 570KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3022a6088c0d2b1c40bc95352ed9d26b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

imagehlp

comctl32

gdiplus

imm32

iphlpapi

netapi32

mpr

ws2_32

wininet

shlwapi

Sections

.text Size: 570KB - Virtual size: 570KB

.rdata Size: 131KB - Virtual size: 131KB

.data Size: 14KB - Virtual size: 290KB

.rsrc Size: 1.8MB - Virtual size: 1.8MB

.reloc Size: 48KB - Virtual size: 47KB

.text
Size: 570KB - Virtual size: 570KB

.rdata
Size: 131KB - Virtual size: 131KB

.data
Size: 14KB - Virtual size: 290KB

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

.reloc
Size: 48KB - Virtual size: 47KB