3dc28f464f4ebd73f1a96dfca5ff04bb0757e30b815a4384d8c41e61fed02218

Sharing

Copy URL

Twitter E-mail

General

Target

3dc28f464f4ebd73f1a96dfca5ff04bb0757e30b815a4384d8c41e61fed02218
Size

2.5MB
MD5

bfe618215a4d4d24f6065356ab0f511c
SHA1

f0317146d4b49ebbdfa1620f947e824bca690766
SHA256

3dc28f464f4ebd73f1a96dfca5ff04bb0757e30b815a4384d8c41e61fed02218
SHA512

bc691e93a092e3d8aef0c0ed4445d0c145a8c37c24c22883fdfcb13055f2f91f0315156739e27deee2e8eb8602ac2c8bd0cf73d1d36d76be036e96faff696f5b
SSDEEP

49152:0xR/y1hF6f42PbDv5dMqew9dKDlZWVTQqXTMUi:0jKr6Q2PPn/ewXKDlZWN4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3dc28f464f4ebd73f1a96dfca5ff04bb0757e30b815a4384d8c41e61fed02218

Files

3dc28f464f4ebd73f1a96dfca5ff04bb0757e30b815a4384d8c41e61fed02218
.exe windows x86

6f422ac8d922199c1289672e968edccf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadConsoleW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
GetFileSizeEx
HeapReAlloc
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
HeapAlloc
HeapFree
WriteConsoleW
GetFileType
SetStdHandle
GetConsoleMode
GetConsoleCP
GetModuleHandleExW
ExitThread
RtlUnwind
UnregisterWaitEx
OutputDebugStringW
CreateEventW
GetUserDefaultLangID
LoadLibraryExW
lstrcmpiW
FindResourceW
LoadResource
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
SizeofResource
FreeLibrary
GetProcAddress
LoadLibraryW
GetLogicalDriveStringsW
OpenProcess
WaitForSingleObject
RegisterWaitForSingleObject
lstrlenW
GetVolumeInformationW
CloseHandle
CreateMutexW
SetThreadUILanguage
GetCurrentThreadId
ExitProcess
GetStartupInfoW
WinExec
GetModuleHandleW
Sleep
CreateDirectoryW
CopyFileW
GetModuleFileNameW
GetTickCount
DeleteCriticalSection
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualProtect
VirtualAlloc
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
GetPrivateProfileStringW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
InitializeCriticalSection
lstrcmpA
DeviceIoControl
TerminateThread
SuspendThread
IsBadReadPtr
GetDiskFreeSpaceExW
CancelWaitableTimer
CreateWaitableTimerW
SetWaitableTimer
IsBadWritePtr
FlushFileBuffers
SetFilePointerEx
SetEndOfFile
SetFileTime
CreateThread
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
GetLocalTime
RtlCaptureStackBackTrace
LockResource
GetVersionExW
MapViewOfFile
GetTempFileNameW
ReplaceFileW
GetFileAttributesExW
UnmapViewOfFile
GetFileAttributesW
FindClose
GetTempPathW
RemoveDirectoryW
GetLongPathNameW
FindNextFileW
WaitForMultipleObjects
LocalFree
GetCommandLineW
HeapSetInformation
GetSystemInfo
ResumeThread
AssignProcessToJobObject
GetStdHandle
ReadFile
GetThreadLocale
SystemTimeToFileTime
FormatMessageA
CreateProcessW
DeleteFileW
GetModuleHandleA
ReleaseMutex
CreateFileW
SetFilePointer
OutputDebugStringA
WriteFile
InitializeSListHead
GetCurrentProcessId
FlushInstructionCache
LoadLibraryExA
CreateTimerQueue
VirtualQuery
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionEx
IsProcessorFeaturePresent
TerminateProcess
WideCharToMultiByte
TryEnterCriticalSection
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
SwitchToThread
GetCurrentThread
GetNativeSystemInfo
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
QueryPerformanceCounter
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
IsDebuggerPresent
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter

user32

GetWindow
GetParent
GetWindowLongW
PostMessageW
IsWindowVisible
SetWindowPos
ShowWindow
IsWindow
FindWindowW
SetWindowLongW
IsIconic
GetIconInfo
MessageBoxW
IsZoomed
GetSystemMetrics
GetWindowRect
GetWindowTextW
InvalidateRect
SetForegroundWindow
UpdateWindow
PtInRect
KillTimer
GetClientRect
FlashWindowEx
SetParent
mouse_event
GetClassNameW
RegisterRawInputDevices
SetFocus
GetMessagePos
SendMessageW
MapWindowPoints
WindowFromPoint
GetDoubleClickTime
DrawFrameControl
DrawFocusRect
FrameRect
InvertRect
InflateRect
SetCursorPos
GetCursorPos
UnregisterClassW
CallWindowProcW
SetLayeredWindowAttributes
GetWindowDC
SendMessageTimeoutW
GetWindowPlacement
EnumDisplayMonitors
RedrawWindow
ReleaseDC
SetScrollInfo
SetWindowTextW
BeginPaint
EndPaint
GetKeyState
GetPropW
CreateWindowExW
CallNextHookEx
RegisterClassExW
LoadStringW
UnhookWindowsHookEx
SetPropW
SetCapture
SetWindowsHookExW
UpdateLayeredWindow
ReleaseCapture
SendInput
DefWindowProcW
CharNextW
AdjustWindowRectEx
GetClassLongW
GetLastActivePopup
MonitorFromPoint
FindWindowExW
GetDC
MonitorFromWindow
CharLowerW
wsprintfW
PostQuitMessage
TranslateMessage
GetQueueStatus
CallMsgFilterW
MsgWaitForMultipleObjectsEx
PeekMessageW
DispatchMessageW
WaitMessage
DestroyWindow
MoveWindow
GetGuiResources
DrawTextW
FillRect
DrawIconEx
CreateIconIndirect
GetSysColor
IsChild
GetActiveWindow
LoadCursorW
LoadIconW
DestroyIcon
RegisterClipboardFormatW
IsClipboardFormatAvailable
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
SetRectEmpty
EnableWindow
EnableMenuItem
SetRect
SetCursor
GetUpdateRect
IntersectRect
IsRectEmpty
IsWindowEnabled
TrackMouseEvent
ValidateRect
SetWindowPlacement
GetCapture
OffsetRect
NotifyWinEvent
UnionRect
SetWindowRgn
MonitorFromRect
GetFocus
GetSystemMenu
DrawEdge
GetMenuInfo
EndMenu
DrawTextExW
DestroyMenu
SetMenuInfo
SetMenuItemInfoW
GetSubMenu
TrackPopupMenu
CreatePopupMenu
GetMenuItemCount
InsertMenuItemW
GetMenuState
GetMenuItemInfoW
MapVirtualKeyW
GetClassInfoExW
ActivateKeyboardLayout
GetKeyboardLayout
GetCaretPos
GetWindowTextLengthW
CopyRect
GetWindowInfo
GetSysColorBrush
GetComboBoxInfo
RegisterWindowMessageW
EnumChildWindows
GetMonitorInfoW
GetTopWindow
GetDesktopWindow
GetAncestor
SystemParametersInfoW
EnumWindows
EnumThreadWindows
GetWindowRgn
GetWindowThreadProcessId
keybd_event
SetActiveWindow
ScreenToClient
LoadAcceleratorsW
CopyAcceleratorTableW
GetAsyncKeyState
SetTimer
ClientToScreen
GetRawInputData
AttachThreadInput
GetForegroundWindow

gdi32

SetBkColor
TextOutW
SetPixel
SetBkMode
SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteDC
LineTo
CreatePen
MoveToEx
GetDeviceCaps
BitBlt
PtInRegion
GetPixel
CreatePolygonRgn
DeleteObject
SetWorldTransform
ExtTextOutW
SetTextAlign
GetOutlineTextMetricsW
GetObjectW
GetBitmapBits
StretchBlt
CreateBitmap
CreateRectRgn
PatBlt
SetTextColor
GetBkColor
CreateSolidBrush
EqualRgn
ExcludeClipRect
GetRgnBox
CreateCompatibleBitmap
SetLayout
SetViewportOrgEx
GetTextMetricsW
GetTextExtentPoint32W
SetMapMode
SaveDC
GetStockObject
RestoreDC
IntersectClipRect
GdiAlphaBlend
SetBrushOrgEx
AbortPath
BeginPath
CreateRectRgnIndirect
PolyBezier
PathToRegion
SetPolyFillMode
EndPath
SelectClipRgn
SetArcDirection
SetDCBrushColor
SetStretchBltMode
SetROP2
SetDCPenColor
SetGraphicsMode
GdiFlush
GetFontData
GetGlyphIndicesW
GetGlyphOutlineW
CreateFontIndirectW

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

RegQueryInfoKeyW
RegDeleteKeyW
RegEnumKeyExW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
CreateProcessAsUserW

shell32

ShellExecuteA
SHGetFileInfoA
DragFinish
SHGetMalloc
ShellExecuteW
SHGetFileInfoW
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW
SHCreateItemFromIDList
SHGetDesktopFolder
SHAppBarMessage
SHGetSpecialFolderPathW
CommandLineToArgvW
SHFileOperationW
DragQueryFileW
Shell_NotifyIconW

ole32

DoDragDrop
ReleaseStgMedium
RegisterDragDrop
CoInitialize
CoCreateGuid
RevokeDragDrop
CoTaskMemRealloc
OleInitialize
CoTaskMemAlloc
OleUninitialize
CoTaskMemFree
CoCreateInstance
OleDuplicateData

oleaut32

LoadRegTypeLi
LoadTypeLi
SysStringLen
SysFreeString
VariantClear
SysAllocString
VariantInit
VarUI4FromStr

shlwapi

PathIsUNCA
UrlCreateFromPathW
StrStrIW
PathGetDriveNumberW
PathRemoveExtensionW
PathIsUNCW
PathFindExtensionW
UrlCreateFromPathA
PathFindFileNameW
PathFileExistsW
PathIsURLA
PathIsURLW
PathCreateFromUrlA
PathStripPathW
PathCreateFromUrlW
PathFileExistsA
PathIsDirectoryA
PathIsDirectoryW
PathRemoveFileSpecW
PathStripToRootW
SHEnumValueW
ord176
SHDeleteValueW
PathAppendW
SHSetValueW
SHGetValueW

gdiplus

GdipSetPenStartCap
GdipSetSmoothingMode
GdiplusStartup
GdipSetPenEndCap
GdipDeleteGraphics
GdipDeletePen
GdipCreatePen1
GdipCreateFromHDC
GdipDrawLineI

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

dbghelp

SymGetLineFromAddr64
SymFromAddr
SymSetOptions
SymInitialize

wininet

InternetSetStatusCallbackW
HttpQueryInfoA
InternetReadFile
InternetSetOptionW
InternetOpenW
HttpSendRequestExW
InternetWriteFile
InternetQueryOptionW
HttpOpenRequestW
FtpCommandW
FtpOpenFileW
FtpGetFileSize
InternetSetOptionA
InternetCrackUrlW
HttpQueryInfoW
HttpEndRequestW
InternetConnectW
InternetReadFileExA
HttpAddRequestHeadersW
HttpSendRequestW
HttpAddRequestHeadersA
InternetCloseHandle
InternetGetLastResponseInfoW

netapi32

Netbios

usp10

ScriptShape
ScriptItemize
ScriptFreeCache

psapi

GetProcessMemoryInfo

oleacc

LresultFromObject
ObjectFromLresult
AccessibleObjectFromWindow

imm32

ImmGetCompositionStringW
ImmReleaseContext
ImmGetContext

comctl32

ImageList_Destroy
ImageList_Create
ImageList_ReplaceIcon

msimg32

AlphaBlend

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 371KB - Virtual size: 370KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 431KB - Virtual size: 430KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6f422ac8d922199c1289672e968edccf

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

winmm

userenv

version

dbghelp

wininet

netapi32

usp10

psapi

oleacc

imm32

comctl32

msimg32

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 371KB - Virtual size: 370KB

.data Size: 38KB - Virtual size: 65KB

.rsrc Size: 431KB - Virtual size: 430KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 371KB - Virtual size: 370KB

.data
Size: 38KB - Virtual size: 65KB

.rsrc
Size: 431KB - Virtual size: 430KB