6ab9224ed12dc3a17ec8cdb38f14f95d3372418f4c5cb9896787c5d2e25a1da7

Sharing

Copy URL Twitter E-mail

General

Target

6ab9224ed12dc3a17ec8cdb38f14f95d3372418f4c5cb9896787c5d2e25a1da7
Size

2.3MB
MD5

414dc19b8f99642b3ba5b7f1c87f498c
SHA1

d7caae5e4b21d4ceabf6a263f0c065eef8903ace
SHA256

6ab9224ed12dc3a17ec8cdb38f14f95d3372418f4c5cb9896787c5d2e25a1da7
SHA512

9b3751cc985c21e399059082cec6f54a1b7913c5a5d4251d3bc2b71a7b52a9fd85aec98e57458c098710fb579b5f1f4c781c528dbfc06cbac6fe73650fbb514c
SSDEEP

49152:o8U38GqlqQ7wSfxOl7/iwchauhcd5ptuFTE8grt:j77wKhw8Vhe5pQhX4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6ab9224ed12dc3a17ec8cdb38f14f95d3372418f4c5cb9896787c5d2e25a1da7

Files

6ab9224ed12dc3a17ec8cdb38f14f95d3372418f4c5cb9896787c5d2e25a1da7
.exe windows x86

aef67ae9bb97509fbf4712afaa49a95a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetCurrentThreadId
SetErrorMode
lstrcmpiW
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleW
MultiByteToWideChar
WideCharToMultiByte
GetShortPathNameW
LoadLibraryW
DeleteFileW
InterlockedIncrement
FindResourceExW
FindResourceW
SizeofResource
LoadResource
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetLastError
RaiseException
CopyFileW
MoveFileW
lstrcmpW
GetCommandLineW
GetTickCount
SetLastError
lstrcpynW
OpenProcess
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
WaitForSingleObject
WriteFile
MoveFileExW
FindNextFileW
FindFirstFileW
GetFileAttributesW
SetFileAttributesW
CreateFileW
GetFullPathNameW
RemoveDirectoryW
GetTempFileNameW
lstrlenW
CloseHandle
FindClose
GetSystemWindowsDirectoryW
GetProcessHeap
HeapSize
WriteConsoleW
ReadConsoleW
SetStdHandle
FreeLibrary
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
GetFileType
FreeLibraryAndExitThread
ExitThread
RtlUnwind
CreateFileA
lstrcmpiA
lstrcmpA
DeviceIoControl
DosDateTimeToFileTime
LocalFileTimeToFileTime
CreateDirectoryW
GetSystemDirectoryW
OutputDebugStringA
GetModuleHandleExW
GetModuleHandleExA
TlsFree
SetEnvironmentVariableA
InterlockedDecrement
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
LockResource
SetFilePointer
TlsSetValue
TlsGetValue
TlsAlloc
DuplicateHandle
SetFileTime
SetFilePointerEx
FlushFileBuffers
GetStdHandle
WaitForMultipleObjects
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetStringTypeW
Sleep
GetNativeSystemInfo
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
LocalFree
LCMapStringEx
QueryPerformanceFrequency
GetCPInfo
ReleaseMutex
FormatMessageW
CreateMutexW
GetPrivateProfileIntW
WritePrivateProfileStringW
GetVersionExW
GetFileSizeEx
ReadFile
GetACP
FreeResource
ExitProcess
GlobalAlloc
GlobalLock
GlobalUnlock
GetFileSize
MulDiv
IsBadReadPtr
GlobalFree
SetEvent
ResetEvent
CreateEventW
GetVersion
InterlockedExchange
InterlockedCompareExchange
ResumeThread
GetLocalTime
SetEndOfFile
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
GetTempPathW
CreateThread
GetCurrentThread
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
DecodePointer

user32

MapWindowPoints
PtInRect
LoadIconW
SystemParametersInfoW
CallWindowProcW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
SetTimer
GetWindowLongW
SetWindowLongW
LoadCursorW
GetDC
ReleaseDC
GetIconInfo
MoveWindow
SetWindowPos
GetCursorPos
GetWindowRect
GetClientRect
SetForegroundWindow
ScreenToClient
SwitchToThisWindow
wvsprintfW
SetCursor
InflateRect
OffsetRect
GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
IsChild
UpdateLayeredWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
UpdateWindow
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
IsRectEmpty
GetParent
GetClassNameW
GetWindow
RegisterClassW
EnableWindow
GetMenu
SetPropW
GetPropW
AdjustWindowRectEx
CopyRect
IntersectRect
IsIconic
SetWindowRgn
MonitorFromWindow
GetMonitorInfoW
FindWindowExW
CharPrevW
DrawTextW
SetRect
DrawIconEx
CreateCaret
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
GetSysColor
RemovePropW
GetWindowDC
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
CreateAcceleratorTableW
InvalidateRgn
FillRect
PeekMessageW
WaitMessage
CallMsgFilterW
GetQueueStatus
MsgWaitForMultipleObjectsEx
SetFocus
IsZoomed
IsWindowVisible
ShowWindow
IsWindow
PostQuitMessage
RegisterWindowMessageW
MessageBoxW
LoadImageW
DestroyIcon
PostMessageW
KillTimer
CharNextW
DestroyWindow
DefWindowProcW
UnregisterClassW
wsprintfW

gdi32

SaveDC
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontIndirectW
CreatePen
DeleteDC
GetStockObject
GetTextExtentPoint32W
Rectangle
RestoreDC
SetDIBitsToDevice
SelectObject
GetTextMetricsW
GetObjectW
CreateDCW
GetDeviceCaps
SetWindowOrgEx
CreateRoundRectRgn
CombineRgn
CreateRectRgnIndirect
GetCharABCWidthsW
GetClipBox
LineTo
RoundRect
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
ExtTextOutW
GetDIBits
DeleteObject
SetTextColor
CreateDIBSection
MoveToEx
TextOutW
CreateSolidBrush

advapi32

RegOpenKeyExW
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegCreateKeyW
RegQueryValueExW
GetTokenInformation

shell32

SHChangeNotify
SHCreateDirectoryExW
ShellExecuteW
Shell_NotifyIconW
ord165
SHFileOperationW
ShellExecuteExW
SHGetSpecialFolderPathW

ole32

OleLockRunning
CLSIDFromProgID
CoCreateGuid
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoInitialize
CoUninitialize
CLSIDFromString
CoCreateInstance

oleaut32

SafeArrayPutElement
VariantInit
SysFreeString
VarUI4FromStr
VariantClear
SysAllocString
SysAllocStringLen
SafeArrayCreate

shlwapi

StrStrIW
StrStrIA
StrCmpNIW
PathFileExistsW
PathIsDirectoryW
PathRemoveFileSpecW
SHDeleteKeyW
PathCombineW
PathFindFileNameW
SHGetValueW
SHSetValueW
AssocQueryStringW
StrCpyW
StrTrimA
StrCmpIW
SHSetValueA
SHGetValueA
PathAppendW

comctl32

_TrackMouseEvent
InitCommonControlsEx
ord17

gdiplus

GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipGraphicsClear
GdipDrawImageRectI
GdipCreatePath
GdipDeletePath
GdipClosePathFigure
GdipAddPathArcI
GdipCreateTexture
GdipSaveImageToFile
GdipGetImageGraphicsContext
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipCreateHBITMAPFromBitmap
GdipCloneBitmapAreaI
GdipImageGetFrameCount
GdipBitmapUnlockBits
GdiplusStartup
GdiplusShutdown
GdipAlloc
GdipFree
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipLoadImageFromStream
GdipSetInterpolationMode
GdipFillPath
GdipDrawImagePointsI
GdipDrawImageRectRectI
GdipGetImageEncodersSize
GdipGetImageEncoders
ord1
GdipCreatePen1
GdipDeletePen
GdipDrawPath
GdipDrawEllipseI
GdipLoadImageFromStreamICM
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipGetImageWidth
GdipFillEllipseI
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipCloneImage
GdipBitmapLockBits

psapi

EnumProcesses
EnumProcessModules
GetModuleFileNameExW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

wininet

InternetGetConnectedState
InternetSetCookieW
InternetGetCookieExW
InternetCrackUrlW

iphlpapi

GetAdaptersInfo

crypt32

CertGetNameStringW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

msimg32

GradientFill
AlphaBlend

urlmon

URLDownloadToFileW
URLDownloadToCacheFileW

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 265KB - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aef67ae9bb97509fbf4712afaa49a95a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

psapi

version

wininet

iphlpapi

crypt32

wintrust

winmm

msimg32

urlmon

imm32

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 265KB - Virtual size: 265KB

.data Size: 24KB - Virtual size: 37KB

.rsrc Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 64KB - Virtual size: 63KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 265KB - Virtual size: 265KB

.data
Size: 24KB - Virtual size: 37KB

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 64KB - Virtual size: 63KB