b20ca6fdc3e4dd620be566bf59703529989957e3f11756d5fd560c607860ed37

Sharing

Copy URL

Twitter E-mail

General

Target

b20ca6fdc3e4dd620be566bf59703529989957e3f11756d5fd560c607860ed37
Size

2.5MB
MD5

05298d4f036e456e4352d39d15c7e0db
SHA1

642b089e4490f34433f73078f8672bf3c39d2453
SHA256

b20ca6fdc3e4dd620be566bf59703529989957e3f11756d5fd560c607860ed37
SHA512

358893a3e700bcbefddf44085dafb2d80d011fa5c0e807db38b9b74f25e4dcd8fde93396443f0f57c107ebffbd2462be07961b27e61895630101f16178a9585a
SSDEEP

49152:8HUPoG58u0CwDkLw1o363eT4DgUynsR1iRIv8J2TVXTieUIn:80PoG5KQLw1wC5syiRITJRn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b20ca6fdc3e4dd620be566bf59703529989957e3f11756d5fd560c607860ed37

Files

b20ca6fdc3e4dd620be566bf59703529989957e3f11756d5fd560c607860ed37
.exe windows x86

ae931f7553a798a6ead6d634d40b886c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

gdiplus

GdipSaveGraphics
GdipRestoreGraphics
GdipBeginContainer2
GdipEndContainer
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipGetFamilyName
GdipGetEmHeight
GdipGetCellAscent
GdipGetCellDescent
GdipGetLineSpacing
GdipCreateFont
GdipDeleteFont
GdipGetFamily
GdipGetFontStyle
GdipGetFontSize
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipGetStringFormatAlign
GdipSetStringFormatLineAlign
GdipGetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipAddPathLineI
GdipAddPathArcI
GdipAddPathBezierI
GdipAddPathRectangleI
GdipAddPathEllipseI
GdipCreateRegionPath
GdipCombineRegionPath
GdipCombineRegionRegion
GdipGetBrushType
GdipSetTextureTransform
GdipSetLineTransform
GdipDrawLine
GdipRotateWorldTransform
GdipScaleWorldTransform
GdipTranslateWorldTransform
GdipMultiplyWorldTransform
GdipGetInterpolationMode
GdipSetInterpolationMode
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipSetPixelOffsetMode
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipSetCompositingQuality
GdipGetClipBoundsI
GdipCreateFromHDC
GdipSetClipRectI
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipCloneBitmapArea
GdipGetImageGraphicsContext
GdipSetPenDashStyle
GdipDeletePen
GdipCreatePen1
GdipGetLineTransform
GdipSetLineWrapMode
GdipSetLinePresetBlend
GdipCreateLineBrushI
GdipCreateSolidFill
GdipGetTextureTransform
GdipCreateTexture
GdipDeleteBrush
GdipCloneBrush
GdipTransformRegion
GdipDeleteRegion
GdipCloneRegion
GdipGetMatrixElements
GdipDeleteMatrix
GdipCreateMatrix2
GdipCreateMatrix
GdipGetPathWorldBounds
GdipAddPathString
GdipClosePathFigure
GdipDeletePath
GdipCreatePath
GdipCloneBitmapAreaI
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipGetImagePixelFormat
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc
GdipDeleteGraphics
GdipSetClipRegion
GdiplusStartup
GdipDrawImageRectRectI
GdipDrawImageRectRect
GdipFillPath
GdipFillEllipse
GdipFillRectangleI
GdipGraphicsClear
GdipDrawPath
GdipSetCompositingMode
GdipCreateHBITMAPFromBitmap
GdipDrawRectangle
GdipSetImageAttributesWrapMode
GdipDrawArcI
ord1

kernel32

EnterCriticalSection
ReadFile
SetEvent
ResetEvent
CreateEventW
InterlockedExchangeAdd
GetFullPathNameW
GetTempFileNameW
MoveFileExW
CreateDirectoryW
GetTempPathW
MoveFileW
GetWindowsDirectoryW
DeleteFileW
SetFileAttributesW
FindNextFileW
HeapAlloc
HeapFree
GetProcessHeap
GlobalAlloc
GlobalFree
GetCurrentThreadId
QueryDosDeviceW
GetLogicalDriveStringsW
GetVolumeInformationW
FlushInstructionCache
MulDiv
lstrcmpW
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
CreateWaitableTimerW
SetWaitableTimer
FreeResource
GlobalLock
GlobalUnlock
QueryPerformanceCounter
QueryPerformanceFrequency
UnmapViewOfFile
CreateFileMappingW
MapViewOfFileEx
VirtualProtect
GetModuleHandleExW
DisableThreadLibraryCalls
CreateThread
TlsAlloc
TlsGetValue
TlsSetValue
GetModuleHandleA
HeapCreate
HeapDestroy
GetLocalTime
GetCurrentThread
GetComputerNameW
DeviceIoControl
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
LeaveCriticalSection
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
WaitForSingleObjectEx
CreateTimerQueue
VirtualQuery
SuspendThread
OpenThread
Thread32Next
Thread32First
InterlockedCompareExchange
SetThreadContext
GetThreadContext
VirtualFree
VirtualAlloc
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
DuplicateHandle
SetEnvironmentVariableA
OutputDebugStringW
WriteConsoleW
SetStdHandle
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeZoneInformation
HeapReAlloc
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetFilePointerEx
GetFileType
GetStdHandle
CreateSemaphoreW
GetStartupInfoW
TlsFree
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapSize
ExitProcess
RtlUnwind
GetSystemTimeAsFileTime
ExitThread
GetCommandLineW
IsProcessorFeaturePresent
IsDebuggerPresent
EncodePointer
InitializeCriticalSection
WriteFile
SetFileTime
CreateTimerQueueTimer
SetEndOfFile
lstrcpyW
lstrcmpiW
GetFileAttributesExW
GetLongPathNameW
CreateFileW
SetFilePointer
GetFileSize
ResumeThread
LoadLibraryW
LoadLibraryExW
FreeLibrary
MultiByteToWideChar
GetACP
WideCharToMultiByte
ExpandEnvironmentStringsW
lstrcatW
FindClose
GetFileAttributesW
FindFirstFileW
LocalFree
LocalAlloc
GetTickCount
WaitForSingleObject
CreateProcessW
LockResource
GetModuleFileNameW
SizeofResource
LoadResource
FindResourceW
ReleaseMutex
SetErrorMode
CreateMutexW
GetVersion
OutputDebugStringA
GetDiskFreeSpaceW
WritePrivateProfileStringW
lstrlenW
Sleep
GetPrivateProfileStringW
DeleteCriticalSection
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetVersionExW
GetModuleHandleW
GetCurrentProcess
GetCurrentProcessId
CloseHandle
CreateToolhelp32Snapshot
Process32NextW
WaitForMultipleObjects
Process32FirstW
TerminateProcess
OpenProcess
SetLastError
GetLastError
ReleaseSemaphore
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
GetLogicalProcessorInformation

user32

SetParent
AdjustWindowRectEx
InvalidateRgn
ValidateRect
SetWindowRgn
EndPaint
BeginPaint
GetAsyncKeyState
AttachThreadInput
UnionRect
PtInRect
SetRectEmpty
UpdateLayeredWindow
FillRect
SetRect
MoveWindow
IsWindow
PostMessageW
EndDialog
SetWindowLongW
UnregisterClassW
DefWindowProcW
CallWindowProcW
SetWindowTextW
EnableWindow
SendMessageW
IsWindowVisible
MessageBoxW
CreateWindowExW
GetAncestor
LoadStringW
EnumThreadWindows
DestroyAcceleratorTable
CreateAcceleratorTableW
GetFocus
PostQuitMessage
RegisterWindowMessageW
GetSysColor
IsClipboardFormatAvailable
EmptyClipboard
GetClipboardData
GetActiveWindow
ShowWindow
GetWindowLongW
LoadIconW
SetClipboardData
CloseClipboard
GetIconInfo
DrawIconEx
RemovePropW
SetPropW
SetCaretPos
MsgWaitForMultipleObjects
LoadBitmapW
LoadImageW
GetKeyboardState
GetForegroundWindow
GetSystemMetrics
GetCaretBlinkTime
GetPropW
SetFocus
DispatchMessageW
PeekMessageW
TranslateMessage
OpenClipboard
ToAscii
GetMessageW
GetWindowThreadProcessId
FindWindowExW
SendDlgItemMessageW
GetDlgItem
GetWindowTextW
CloseDesktop
IsWindowEnabled
EnumDesktopWindows
CreateDesktopW
CharNextW
GetWindow
CopyRect
GetMonitorInfoW
MapWindowPoints
SetWindowPos
GetDesktopWindow
MonitorFromWindow
ReleaseDC
GetClassNameW
SystemParametersInfoW
GetDC
GetClientRect
GetParent
SetForegroundWindow
GetWindowRect
GetWindowTextLengthW
IsIconic
IsZoomed
GetDCEx
GetWindowDC
InvalidateRect
RedrawWindow
SetCursor
GetCursorPos
ClientToScreen
IntersectRect
OffsetRect
IsRectEmpty
EqualRect
EnumChildWindows
LoadCursorW
DialogBoxParamW
DestroyWindow
TrackMouseEvent
GetKeyState
SetCapture
ReleaseCapture
ScreenToClient
SetTimer
KillTimer
GetClassLongW
RegisterClassExW
GetClassInfoExW
IsChild
ShowWindowAsync

gdi32

ExtTextOutW
GetDIBits
CreateDCW
GetClipBox
PtInRegion
CreateRoundRectRgn
EnumFontsW
SetBkColor
CreatePolygonRgn
CreateRectRgnIndirect
SetWorldTransform
SetGraphicsMode
SetViewportOrgEx
SelectObject
GetRgnBox
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
GetDeviceCaps
SetTextColor
CreateFontIndirectW
DeleteObject
GetObjectW
GetStockObject
CreateSolidBrush
CreateDIBSection
DeleteDC

advapi32

CheckTokenMembership
GetUserNameW
LookupAccountSidW
OpenThreadToken
FreeSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHChangeNotify
SHGetSpecialFolderPathW
DragQueryFileW
DragFinish
SHGetFileInfoW
SHFileOperationW
SHCreateDirectoryExW

ole32

OleLockRunning
StringFromGUID2
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
CreateStreamOnHGlobal
CoTaskMemRealloc
CoTaskMemAlloc
CoInitializeEx
CoCreateInstance
CoTaskMemFree
CoInitialize
OleInitialize
OleUninitialize
CoUninitialize

oleaut32

DispCallFunc
OleCreateFontIndirect
SysFreeString
LoadRegTypeLi
LoadTypeLi
VariantClear
VariantInit
SysStringLen
SysAllocStringLen
VarUI4FromStr
SysAllocString

wininet

InternetCrackUrlW
InternetConnectW
InternetWriteFile
HttpQueryInfoW
HttpOpenRequestW
HttpEndRequestW
InternetCloseHandle
HttpSendRequestExW
InternetReadFile

shlwapi

ord12
PathFindFileNameW
PathAppendW
StrDupW
StrToIntA
PathFileExistsW

comctl32

_TrackMouseEvent
InitCommonControlsEx

msimg32

AlphaBlend

urlmon

CoInternetCreateZoneManager
CoInternetCreateSecurityManager

imm32

ImmGetContext
ImmAssociateContextEx
ImmGetCompositionStringW
ImmNotifyIME
ImmSetCompositionWindow
ImmReleaseContext

winmm

timeGetTime

psapi

GetMappedFileNameW

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 299KB - Virtual size: 298KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 61.2MB - Virtual size: 180.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ae931f7553a798a6ead6d634d40b886c

Headers

DLL Characteristics

File Characteristics

Imports

version

gdiplus

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wininet

shlwapi

comctl32

msimg32

urlmon

imm32

winmm

psapi

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 299KB - Virtual size: 298KB

.data Size: 24KB - Virtual size: 48KB

.rsrc Size: 61.2MB - Virtual size: 180.2MB

.reloc Size: 69KB - Virtual size: 68KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 299KB - Virtual size: 298KB

.data
Size: 24KB - Virtual size: 48KB

.rsrc
Size: 61.2MB - Virtual size: 180.2MB

.reloc
Size: 69KB - Virtual size: 68KB