c251c73b50b723742c11c32ff03d0bd3d8ae2e0cb17545b59f81f2e11cbbdae4

Sharing

Copy URL Twitter E-mail

General

Target

c251c73b50b723742c11c32ff03d0bd3d8ae2e0cb17545b59f81f2e11cbbdae4
Size

1.5MB
MD5

6b87ca9fcd643fefdebc38d11cdc18dc
SHA1

5c63197895a136d7f1b40619c209367b18228c9c
SHA256

c251c73b50b723742c11c32ff03d0bd3d8ae2e0cb17545b59f81f2e11cbbdae4
SHA512

c588e71c70bb89c7ebb2c8bcaa9c1c5110d8990a66e84be7e0f3d2cc67af127fec8045dcd4d1cee19e2ef88722623a2429fcc107bef45b2e82b2df8cd7b94dea
SSDEEP

49152:KBrY2fc7XyDjhZ0j5Jl34KZbGiJyXoog1:ArncjyDNajHZbGi9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c251c73b50b723742c11c32ff03d0bd3d8ae2e0cb17545b59f81f2e11cbbdae4

Files

c251c73b50b723742c11c32ff03d0bd3d8ae2e0cb17545b59f81f2e11cbbdae4
.exe windows x86

91988c477478d60065d1365bb7a1b24c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipFree
GdipCreatePen1
GdipCreateSolidFill
GdipAlloc
GdipCreateHICONFromBitmap
GdipDeleteBrush
GdipCloneBrush
GdipFillPath
GdipDrawPath
GdipAddPathArcI
GdipAddPathLineI
GdipDeletePath
GdipCreatePath
GdipGetClip
GdipSetClipRegion
GdipFillEllipseI
GdipDrawEllipseI
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFileICM
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipDrawImageRectRectI
GdipDrawImageRectI
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipSetPenDashStyle
GdipGetLogFontW
GdipDeleteRegion
GdipCreateRegion
GdipRestoreGraphics
GdipSaveGraphics
GdipSetClipRectI
GdipSetWorldTransform
GdipTranslateMatrix
GdipDeleteMatrix
GdipCreateMatrix
GdipCreateLineBrushFromRectI
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipDrawString
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCreateStringFormat
GdipBitmapGetPixel
GdipGetImageHeight
GdipMeasureString
GdipFillRectangleI
GdipDrawRectangleI
GdipDrawLineI
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHWND
GdipCreateFromHDC
GdipDeletePen

wininet

InternetSetOptionW
InternetConnectW
HttpOpenRequestW
InternetOpenW
HttpSendRequestW
InternetReadFile
HttpQueryInfoW
InternetQueryOptionW
InternetCrackUrlW
InternetCloseHandle

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

kernel32

VirtualAlloc
UnregisterWaitEx
InitializeSListHead
SetFilePointerEx
GetFileType
MoveFileExW
ReadConsoleW
FlushFileBuffers
GetStdHandle
GetTimeZoneInformation
GetOEMCP
GetACP
IsValidCodePage
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
WaitForSingleObjectEx
SetEvent
CreateTimerQueue
LoadLibraryExW
ExitThread
CreateThread
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
GetCommandLineW
GetModuleHandleExW
ExitProcess
IsProcessorFeaturePresent
ReadFile
SystemTimeToTzSpecificLocalTime
FindClose
FindNextFileW
FindFirstFileExW
AreFileApisANSI
GetCPInfo
EncodePointer
GetStringTypeW
SystemTimeToFileTime
GetFileAttributesExW
CreateFileW
SetFileTime
VirtualFree
DeleteFileW
GetLastError
FormatMessageW
Sleep
CreateDirectoryA
GetCurrentProcessId
GetModuleFileNameA
GetSystemTimeAsFileTime
GetVersionExW
GetProcAddress
GetModuleHandleW
GetSystemInfo
GetTickCount
lstrlenW
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSectionAndSpinCount
RaiseException
HeapSize
DecodePointer
DeleteCriticalSection
WideCharToMultiByte
GetCurrentThreadId
CreateSemaphoreW
WaitForSingleObject
ReleaseSemaphore
FileTimeToSystemTime
GetShortPathNameW
CopyFileW
GetModuleFileNameW
TerminateProcess
GetExitCodeProcess
OpenProcess
MultiByteToWideChar
GetFileAttributesW
CreateDirectoryW
FindResourceW
LoadResource
FreeResource
SizeofResource
LockResource
GetFileSize
WriteFile
LoadLibraryW
FreeLibrary
GlobalMemoryStatusEx
VirtualProtect
GetProcessId
GetTempPathW
SetCurrentDirectoryW
lstrcmpW
OutputDebugStringW
RemoveDirectoryW
GetEnvironmentVariableW
GlobalMemoryStatus
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GlobalSize
InterlockedDecrement
lstrlenA
LoadLibraryA
GetLongPathNameW
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
DuplicateHandle
GetCurrentProcess
GetCurrentThread
GetExitCodeThread
SetStdHandle
WriteConsoleW
SetEndOfFile
SetEnvironmentVariableA
SetFilePointer
GetCurrentDirectoryW
DosDateTimeToFileTime
LocalFree
CloseHandle
SetFileAttributesW

user32

CopyRect
UnionRect
IntersectRect
OffsetRect
GetKeyState
PeekMessageW
GetWindowTextW
GetIconInfo
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetDC
SetWindowTextW
SetWindowLongW
IsWindow
TranslateAcceleratorW
IsChild
DestroyWindow
ShowWindow
DefWindowProcW
FillRect
EndPaint
BeginPaint
CreateWindowExW
SetFocus
LoadCursorW
LoadAcceleratorsW
SendMessageW
EnumWindows
DispatchMessageW
TranslateMessage
GetMessageW
GetParent
GetWindowThreadProcessId
MessageBoxW
ShowWindowAsync
SetActiveWindow
GetClassNameW
GetFocus
InvalidateRect
ReleaseDC
GetWindowDC
ScreenToClient
PostQuitMessage
IsWindowVisible
TrackPopupMenu
SetForegroundWindow
GetCursorPos
GetSubMenu
LoadMenuW
MoveWindow
LoadIconW
IsZoomed
IsIconic
DestroyMenu
KillTimer
SetTimer
PostMessageW
wsprintfW
SetWindowPos
MapWindowPoints
MonitorFromWindow
GetMonitorInfoW
GetDesktopWindow
GetWindow
GetClientRect
GetWindowRect
RegisterClassW
GetWindowLongW

gdi32

GetStockObject
CreateSolidBrush
GetObjectW
BitBlt
SelectObject
SetViewportOrgEx
CreateCompatibleBitmap
CreateFontIndirectW
DeleteDC
GetDIBits
CreateCompatibleDC
DeleteObject

advapi32

RegOpenKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW

shell32

Shell_NotifyIconW
SHGetSpecialFolderPathW
SHFileOperationW
ShellExecuteExW
SHChangeNotify

ole32

CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
OleRun
CoInitialize

oleaut32

VariantClear
VariantCopy
VariantInit
SysFreeString
GetErrorInfo
SysAllocString

shlwapi

StrCpyNW
StrCmpW
PathIsDirectoryA
wnsprintfW
StrCmpNW
StrCmpIW
StrCpyW
StrChrW

ws2_32

WSAGetLastError
socket
inet_addr
htons
connect
send
inet_ntoa
getsockname
gethostbyname
closesocket
WSACleanup
WSAStartup

Sections

.text
Size: 876KB - Virtual size: 875KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 204KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 423KB - Virtual size: 422KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

91988c477478d60065d1365bb7a1b24c

Headers

DLL Characteristics

File Characteristics

Imports

gdiplus

wininet

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

Sections

.text Size: 876KB - Virtual size: 875KB

.rdata Size: 204KB - Virtual size: 204KB

.data Size: 24KB - Virtual size: 48KB

.rsrc Size: 423KB - Virtual size: 422KB

.reloc Size: 48KB - Virtual size: 48KB

.text
Size: 876KB - Virtual size: 875KB

.rdata
Size: 204KB - Virtual size: 204KB

.data
Size: 24KB - Virtual size: 48KB

.rsrc
Size: 423KB - Virtual size: 422KB

.reloc
Size: 48KB - Virtual size: 48KB