05011999[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

05011999.exe
Size

250KB
MD5

feab55fce91c7e28bf309ae2918905e0
SHA1

d855dd800880ecf2884c59ab7d42b3b4f2d88f82
SHA256

2d4b95127eb877a1890b53da71b61767ca6ce6afa8152312dbfa8601faf24978
SHA512

40449898e6745855b7a954500c27c1cc1fa44c78582edcbe20c796ba9d227ad9714ae2d717653aced4c6b9d48a0731b6e0b6ee06186c4a68f09f3f8a0885ff8f
SSDEEP

3072:V09hYHbuq0/DB6KvN7xm8L69ekGsytvDRe6N5lNJAgFx9kqJFXFkvmUXa/JeobRO:V09hY7u59K8Gek1y1DgcHJ1BaJQeP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
05011999.exe

Files

05011999.exe
.exe windows x64

8a8dc8ce5095001627500b8a055afd28

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
EventWrite
ImpersonateLoggedOnUser
OpenProcessToken
DuplicateTokenEx
AdjustTokenPrivileges
EventRegister
EventUnregister
RevertToSelf
GetTokenInformation
CreateWellKnownSid
IsValidSid
SetTokenInformation
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
OpenSCManagerW
StartServiceW
ControlService
OpenThreadWaitChainSession
GetThreadWaitChain
CloseThreadWaitChainSession

kernel32

CallbackMayRunLong
OpenProcess
TrySubmitThreadpoolCallback
IsWow64Process
GetPriorityClass
GetTimeFormatW
GetExitCodeThread
GetTempPathW
CreateFileW
DuplicateHandle
GetModuleFileNameW
LocalFree
GetLogicalProcessorInformationEx
GetNumaHighestNodeNumber
SetEvent
CreateToolhelp32Snapshot
Thread32First
OpenThread
Thread32Next
Sleep
lstrcmpW
GetComputerNameW
GetCommandLineW
LoadLibraryExA
DelayLoadFailureHook
ReadProcessMemory
lstrcmpiW
CompareStringW
lstrlenW
GetLocaleInfoW
GetNumberFormatW
GetTickCount
HeapSize
MulDiv
HeapReAlloc
FormatMessageW
CloseThreadpoolCleanupGroup
SetProcessShutdownParameters
CreateEventW
CreateThreadpoolCleanupGroup
GetErrorMode
SetErrorMode
GetCurrentProcessId
ProcessIdToSessionId
SetPriorityClass
DeviceIoControl
SetLastError
LockResource
LoadResource
FindResourceExW
HeapSetInformation
CreateMutexW
FreeLibrary
GetProcAddress
LoadLibraryW
GetVersionExW
WaitForSingleObject
CreateProcessW
ExpandEnvironmentStringsW
CreateThread
CloseHandle
ReleaseMutex
CloseThreadpoolCleanupGroupMembers
GetCurrentDirectoryW
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
HeapFree
GetProcessHeap
HeapAlloc
GetLastError
QueryFullProcessImageNameW
UnhandledExceptionFilter
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW

gdi32

SetBkMode
GetCurrentObject
GetObjectW
CreateFontIndirectW
GetCharWidth32W
CreateCompatibleBitmap
SetBkColor
DeleteDC
CreateCompatibleDC
SetTextColor
GetDeviceCaps
Rectangle
BitBlt
LineTo
MoveToEx
SelectObject
DeleteObject
GetStockObject
CreatePen

user32

SendMessageTimeoutW
SetProcessDPIAware
RegisterWindowMessageW
MessageBoxW
CreateDialogParamW
ChangeWindowMessageFilterEx
GetMessageW
TranslateAcceleratorW
IsDialogMessageW
TranslateMessage
DispatchMessageW
LoadMenuW
RemoveMenu
DestroyMenu
CreateWindowExW
DrawTextW
InvalidateRect
UpdateWindow
GetWindowLongPtrW
GetSysColor
GetDlgCtrlID
EnableMenuItem
AppendMenuW
DialogBoxParamW
SetScrollInfo
GetScrollInfo
SetScrollPos
EndDialog
GetSystemMetrics
GetGuiResources
EnableWindow
TrackPopupMenuEx
GetWindowTextW
SetDlgItemTextW
IsHungAppWindow
SetThreadDesktop
IsWindowVisible
EndTask
AllowSetForegroundWindow
EnumDesktopsW
GetProcessWindowStation
OpenDesktopW
EnumDesktopWindows
CloseDesktop
GetWindow
InternalGetWindowText
ShowWindowAsync
SetMenuDefaultItem
GetLastActivePopup
IsWindow
SwitchToThisWindow
TileWindows
GetDesktopWindow
CascadeWindows
PeekMessageW
GetCursorPos
CheckDlgButton
IsDlgButtonChecked
GetWindowTextLengthW
SetCursor
LoadCursorW
SetRect
MsgWaitForMultipleObjects
FindWindowW
SetFocus
GetNextDlgTabItem
GetClassNameW
GetFocus
GetParent
GetMonitorInfoW
MonitorFromPoint
LoadAcceleratorsW
PostQuitMessage
MessageBeep
RedrawWindow
MoveWindow
GetClassLongPtrW
GetWindowThreadProcessId
DefWindowProcW
GetMenuItemID
GetSubMenu
IsZoomed
IsIconic
SetForegroundWindow
OpenIcon
KillTimer
DestroyWindow
PostMessageW
LoadImageW
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
ShowWindow
GetShellWindow
SetWindowLongPtrW
GetMenuItemInfoW
SetTimer
LoadIconW
GetThreadDesktop
GetDialogBaseUnits
GetWindowRect
PostThreadMessageW
GetForegroundWindow
SendMessageW
MapWindowPoints
GetDlgItem
SetMenu
SetWindowPos
DeleteMenu
CheckMenuItem
CheckMenuRadioItem
GetMenu
SetWindowTextW
LoadStringW
RegisterClassW
GetClassInfoW
ReleaseDC
GetDC
SystemParametersInfoW
GetKeyState
CallWindowProcW
GetSysColorBrush
FillRect
GetClientRect
GhostWindowFromHungWindow
HungWindowFromGhostWindow
SetWindowLongW
GetWindowLongW
DestroyIcon

msvcrt

?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_cexit
_XcptFilter
__C_specific_handler
__wgetmainargs
_wtol
??3@YAXPEAX@Z
swscanf_s
memmove
_ui64tow_s
wcsstr
_i64tow_s
_wcsicmp
wcsrchr
_vsnwprintf
_wcsdup
??2@YAPEAX_K@Z
memset
_exit
memcpy
free
towlower

iphlpapi

GetIfEntry2
NhGetInterfaceNameFromDeviceGuid
GetAdaptersAddresses

pcwum

PcwCollectData
PcwAddQueryItem
PcwCreateQuery

shlwapi

StrFormatByteSizeW
ord16
PathAddExtensionW
PathRemoveExtensionW
PathAppendW
StrStrW
ord348
ord618
ord437
ord158

shell32

ord61
ShellAboutW
ShellExecuteExW
ord245
ord75
SHParseDisplayName
SHOpenFolderAndSelectItems
CommandLineToArgvW
ord100
DuplicateIcon
Shell_NotifyIconW

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlTryEnterCriticalSection
NtSetInformationFile
NtSetInformationProcess
NtOpenProcessToken
NtOpenThreadToken
NtOpenFile
RtlTimeToElapsedTimeFields
RtlLeaveCriticalSection
RtlEnterCriticalSection
NtQueryInformationProcess
NtQueryTimerResolution
RtlInitUnicodeString
RtlNtStatusToDosError
RtlDeleteCriticalSection
RtlInitializeCriticalSection
NtQuerySystemInformation
WinSqmAddToStream
NtQueryInformationToken
NtClose

secur32

GetUserNameExW

uxtheme

IsThemeActive
SetWindowTheme

wevtapi

EvtSubscribe
EvtClose

credui

CredUIPromptForCredentialsW

Sections

.text
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8a8dc8ce5095001627500b8a055afd28

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

iphlpapi

pcwum

shlwapi

shell32

ntdll

secur32

uxtheme

wevtapi

credui

Sections

.text Size: 152KB - Virtual size: 152KB

.data Size: 2KB - Virtual size: 15KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 88KB - Virtual size: 92KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 152KB - Virtual size: 152KB

.data
Size: 2KB - Virtual size: 15KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 88KB - Virtual size: 92KB

.reloc
Size: 1KB - Virtual size: 1KB