9d4b5594d6e5d566c2db8e3c133e12a4a3d601f153cba5708558fecc10476020

Sharing

Copy URL

Twitter E-mail

General

Target

9d4b5594d6e5d566c2db8e3c133e12a4a3d601f153cba5708558fecc10476020
Size

1.4MB
MD5

1595ca91b213eed000029588abdec105
SHA1

a7c1119c244360ce6988944a7067f0dee5e8e859
SHA256

9d4b5594d6e5d566c2db8e3c133e12a4a3d601f153cba5708558fecc10476020
SHA512

d115a66efd03985a99212a47eff14b6ec1973af8f3000e15fa8a5bbcd35264b732cda059696249cb969cea32fcce24b4d9ead2064dccdcaf14b327a6d5be97a5
SSDEEP

24576:374UW1LQuxdI5ySJyuGprRP4/dWxAcxPF3nvJGTOqYwCD8G+LHidITw68l+Lhf:374UYkN57yuGprtVF3nvkTk/oLDw6G2J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9d4b5594d6e5d566c2db8e3c133e12a4a3d601f153cba5708558fecc10476020

Files

9d4b5594d6e5d566c2db8e3c133e12a4a3d601f153cba5708558fecc10476020
.exe windows x86

f63582cf43a36fb647dcaf5d3e3fead6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemTimeAsFileTime
HeapReAlloc
ExitThread
GetCommandLineA
GetStartupInfoA
RtlUnwind
ExitProcess
SetStdHandle
GetFileType
HeapSize
VirtualFree
HeapCreate
GetStdHandle
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetHandleCount
GetConsoleCP
SetErrorMode
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
CompareStringW
SetEnvironmentVariableA
GetFileSizeEx
InterlockedCompareExchange
IsDebuggerPresent
UnhandledExceptionFilter
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
GetOEMCP
GetCPInfo
GlobalFlags
GetVolumeInformationA
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetStringTypeExA
GetThreadLocale
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GlobalAddAtomA
SuspendThread
SetThreadPriority
InterlockedDecrement
GetModuleFileNameW
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
CompareStringA
InterlockedExchange
lstrcmpA
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
InterlockedIncrement
CreateThread
ResetEvent
GlobalAlloc
ResumeThread
GlobalFree
MulDiv
GlobalUnlock
GlobalLock
CreateEventA
GetVersion
SetEvent
HeapFree
GetProcessHeap
HeapAlloc
SetFilePointer
TerminateThread
GetExitCodeThread
SystemTimeToFileTime
CreateToolhelp32Snapshot
Process32Next
Process32First
GetComputerNameA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetFileSize
FileTimeToSystemTime
FileTimeToLocalFileTime
SetCurrentDirectoryA
SetFileAttributesA
RemoveDirectoryA
GetCurrentDirectoryA
SetLastError
FindClose
FindNextFileA
FindFirstFileA
ReadFile
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetFileTime
CreateDirectoryA
GetFileAttributesA
GetFullPathNameA
FormatMessageA
WriteFile
FreeResource
LocalFree
LocalAlloc
GetVersionExA
CopyFileA
GetLocalTime
GetTickCount
LoadLibraryA
WaitForSingleObject
GetExitCodeProcess
GetSystemDirectoryA
TerminateProcess
OpenProcess
CloseHandle
CreateProcessA
WinExec
LeaveCriticalSection
EnterCriticalSection
Sleep
GetModuleHandleW
InitializeCriticalSection
SetUnhandledExceptionFilter
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateFileA
DeleteFileA
LockResource
GetTempPathA
ReleaseMutex
CreateMutexA
DeleteCriticalSection
GetModuleFileNameA
LoadLibraryExA
FindResourceA
LoadResource
GetLastError
SizeofResource
RaiseException
lstrlenW
WideCharToMultiByte
IsDBCSLeadByte
MultiByteToWideChar
lstrcmpiA
GetModuleHandleA
GetProcAddress
lstrlenA
GetConsoleMode
FreeLibrary

user32

DrawTextA
TabbedTextOutA
SetWindowTextA
SendDlgItemMessageA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetWindowTextLengthA
GetForegroundWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
GetClassInfoExA
AdjustWindowRectEx
ScreenToClient
GetDlgCtrlID
CallWindowProcA
PtInRect
GetMenu
GetWindowPlacement
GetLastActivePopup
SetWindowsHookExA
CallNextHookEx
GetMessageA
ValidateRect
GetMenuCheckMarkDimensions
DrawTextExA
UnhookWindowsHookEx
MessageBeep
IsChild
GetTopWindow
GetNextDlgGroupItem
CreateDialogIndirectParamA
GetDlgItem
EndDialog
PostMessageA
RegisterWindowMessageA
SetWindowContextHelpId
MapDialogRect
RegisterClipboardFormatA
PostQuitMessage
GetMenuState
GetMenuItemCount
ReleaseCapture
SetFocus
GetDesktopWindow
GetFocus
SetCapture
InvalidateRgn
EqualRect
IsWindowEnabled
IntersectRect
IsRectEmpty
CopyAcceleratorTableA
UpdateWindow
DrawStateA
DrawFocusRect
OffsetRect
InflateRect
FrameRect
TrackPopupMenuEx
WindowFromPoint
ClientToScreen
SetCursor
GetParent
GetNextDlgTabItem
DestroyCursor
EndPaint
GrayStringA
GetWindowDC
CharUpperA
GetSysColorBrush
PostThreadMessageA
UnregisterClassA
BeginPaint
MoveWindow
RegisterClassA
EnableMenuItem
CharNextW
LoadIconA
CheckMenuItem
FindWindowA
SendMessageA
GetClientRect
GetWindowRect
SetActiveWindow
IsIconic
GetSystemMetrics
DrawIcon
GetActiveWindow
MessageBoxA
SetWindowPos
SetForegroundWindow
LoadMenuA
GetSubMenu
IsWindowVisible
ModifyMenuA
SetMenuItemInfoA
CharNextA
LoadBitmapA
SetMenuItemBitmaps
SetMenuDefaultItem
GetCursorPos
EnableWindow
GetAsyncKeyState
GetKeyState
PeekMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
EnumWindows
GetWindowLongA
GetWindowThreadProcessId
GetClassInfoA
LoadCursorA
SetWindowLongA
CopyRect
GetSysColor
FillRect
InvalidateRect
ReleaseDC
GetDC
SetRect
ShowWindow
DrawAnimatedRects
SetParent
SystemParametersInfoA
EnumChildWindows
GetClassNameA
DefWindowProcA
GetMenuItemID
TrackPopupMenu
DestroyMenu
IsWindow
LoadStringA
KillTimer
DestroyIcon
LoadImageA
DestroyWindow
CreateWindowExA
RegisterClassExA
GetWindowTextA
GetWindow

gdi32

GetMapMode
GetTextColor
GetBkColor
CreatePen
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
GetWindowExtEx
GetViewportExtEx
MoveToEx
LineTo
SetMapMode
SetBkMode
RestoreDC
SaveDC
GetClipBox
GetRgnBox
CreateRectRgnIndirect
GetObjectA
SetTextColor
SetBkColor
CreateBitmap
CreateFontIndirectA
GetStockObject
CreateCompatibleBitmap
GetDeviceCaps
SelectObject
DeleteDC
DeleteObject
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
CreateCompatibleDC
CreateSolidBrush
BitBlt

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegOpenKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
RegCloseKey
RegDeleteKeyA
RegCreateKeyExA
RegDeleteValueA
RegQueryValueExA
CryptAcquireContextA
CryptGetUserKey
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
CryptGetKeyParam
CryptGenRandom
CryptReleaseContext
RegSetValueExA

shell32

SHGetSpecialFolderPathA
ShellExecuteA
SHGetFolderPathA
SHFileOperationA
Shell_NotifyIconA
SHAppBarMessage
ShellExecuteExA

comctl32

_TrackMouseEvent
InitCommonControlsEx

shlwapi

PathFindFileNameA
UrlUnescapeA
PathStripToRootA
PathIsUNCA
PathFindExtensionA

oledlg

ord8

ole32

OleInitialize
CLSIDFromString
OleRun
CLSIDFromProgID
CoCreateInstance
OleUninitialize
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CoGetClassObject
CoInitialize
CreateStreamOnHGlobal
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoFreeUnusedLibraries
StringFromGUID2
CoUninitialize
StgOpenStorageOnILockBytes

oleaut32

RegisterTypeLi
SysStringLen
SysFreeString
SysAllocString
LoadTypeLi
UnRegisterTypeLi
VariantClear
VariantInit
SysAllocStringLen
SysAllocStringByteLen
SysStringByteLen
VariantCopy
OleLoadPicture
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayDestroy
VariantChangeType
OleCreateFontIndirect
VarUI4FromStr

dbghelp

MiniDumpWriteDump

psapi

EnumProcesses
GetModuleFileNameExA
EnumProcessModules

crypt32

CertGetCertificateContextProperty
CertCloseStore
CertEnumCertificatesInStore
CertOpenStore
CertFreeCertificateContext
CertCreateCertificateContext
CertFindCertificateInStore
CertAddCertificateContextToStore

wininet

InternetQueryDataAvailable
InternetSetFilePointer
InternetGetLastResponseInfoA
InternetQueryOptionA
InternetSetStatusCallback
HttpQueryInfoA
InternetCrackUrlA
InternetCloseHandle
InternetOpenA
InternetCanonicalizeUrlA
InternetOpenUrlA
InternetGetConnectedState
HttpSendRequestA
InternetReadFile
FindFirstUrlCacheEntryA
DeleteUrlCacheEntry
FindNextUrlCacheEntryA
InternetWriteFile

rpcrt4

UuidFromStringA

ws2_32

recvfrom
sendto
WSAGetLastError
socket
closesocket
inet_ntoa
WSACleanup
gethostbyname
WSAStartup
select

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Sections

.text
Size: 566KB - Virtual size: 565KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 45KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33.7MB - Virtual size: 33.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 141KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f63582cf43a36fb647dcaf5d3e3fead6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

dbghelp

psapi

crypt32

wininet

rpcrt4

ws2_32

version

Sections

.text Size: 566KB - Virtual size: 565KB

.rdata Size: 110KB - Virtual size: 109KB

.data Size: 45KB - Virtual size: 93KB

.rsrc Size: 33.7MB - Virtual size: 33.7MB

.reloc Size: 141KB - Virtual size: 141KB

.text
Size: 566KB - Virtual size: 565KB

.rdata
Size: 110KB - Virtual size: 109KB

.data
Size: 45KB - Virtual size: 93KB

.rsrc
Size: 33.7MB - Virtual size: 33.7MB

.reloc
Size: 141KB - Virtual size: 141KB