e41c887b898ae82671c805ee7f1c6736309774e338a6883265b015e250633c3d

Sharing

Copy URL Twitter E-mail

General

Target

e41c887b898ae82671c805ee7f1c6736309774e338a6883265b015e250633c3d
Size

5.3MB
MD5

b9350d9d645f2848058f869ffefa930f
SHA1

ca4bc0914f3b857960e8b7d7a3785f33972fdb77
SHA256

e41c887b898ae82671c805ee7f1c6736309774e338a6883265b015e250633c3d
SHA512

089337bcef3f1c5809dcab7a7c9a5247731a6e702065187ef03ff5bd962142f85b13a9265c725bf2df5b0aa07571e9d5409362302008ffe385cdd8691d7ba10a
SSDEEP

98304:4VXeB7Yi15ngeMpTO6oT9PRSpwREqcw+JCQwJRpC9fiEV3SfnlnMca:4VXWYW5nyNO6cRnVwEfpOiEVCfnlnMf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e41c887b898ae82671c805ee7f1c6736309774e338a6883265b015e250633c3d

Files

e41c887b898ae82671c805ee7f1c6736309774e338a6883265b015e250633c3d
.exe windows x86

cbaefac3c3a85a39680e479eee00730a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitThread
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
GlobalAlloc
DeleteFileW
GetTempPathW
FindResourceW
WriteFile
SizeofResource
LoadResource
LockResource
ExpandEnvironmentStringsW
PeekNamedPipe
WaitForMultipleObjects
GetSystemDirectoryA
SleepEx
lstrlenA
CreateFileMappingW
UnmapViewOfFile
FreeLibraryAndExitThread
GetFileSizeEx
GetFileInformationByHandle
InterlockedCompareExchange
SetCurrentDirectoryW
MulDiv
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetModuleHandleW
GetLastError
GetCurrentProcessId
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
WideCharToMultiByte
OutputDebugStringA
InterlockedDecrement
InterlockedIncrement
CreateFileW
WritePrivateProfileStringW
GetCurrentDirectoryW
GlobalLock
GlobalUnlock
MapViewOfFile
MultiByteToWideChar
GetModuleFileNameW
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetPrivateProfileStringW
GlobalFree
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
DecodePointer
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
GetSystemInfo
FormatMessageW
FindClose
CreateDirectoryW
FindFirstFileW
FindNextFileW
MoveFileExW
FileTimeToSystemTime
ReleaseMutex
CreateMutexW
GetTickCount
AreFileApisANSI
FlushInstructionCache
HeapCreate
InitializeCriticalSection
FreeResource
SetLastError
GetFullPathNameW
GetLocalTime
GetVersionExA
GetSystemTime
LoadLibraryA
GetModuleHandleA
EncodePointer
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetACP
GetFileType
GetStringTypeW
CompareStringW
LCMapStringW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
OutputDebugStringW
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
FlushFileBuffers
WriteConsoleW
SetEndOfFile
ReadFile
GetFileSize
CreateThread
QueryDosDeviceW
GetWindowsDirectoryW
GetLogicalDriveStringsW
lstrlenW
lstrcmpiW
CloseHandle
OpenProcess
FreeLibrary
GetVersionExW
LoadLibraryW
Sleep
EnterCriticalSection
GetProcAddress

user32

ReleaseCapture
UpdateWindow
BeginPaint
EndPaint
InvalidateRect
GetCursorPos
ScreenToClient
GetClassNameW
DestroyIcon
LoadBitmapW
CreateIconFromResource
LoadImageW
CharNextW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
ClientToScreen
SetRect
EnableMenuItem
GetSysColor
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetSystemMetrics
IsWindowVisible
DrawTextW
SystemParametersInfoA
CharLowerBuffW
MapVirtualKeyA
UpdateLayeredWindow
IsMenu
IsWindowEnabled
CreatePopupMenu
DestroyMenu
GetMenuItemCount
AppendMenuW
SetCapture
GetMenuInfo
SetMenuInfo
GetMenuItemInfoW
SetMenuContextHelpId
GetFocus
SetFocus
PtInRect
EqualRect
IsRectEmpty
UnionRect
CopyRect
SetCursor
KillTimer
SetTimer
DestroyWindow
DestroyCursor
LoadCursorW
IntersectRect
LoadStringW
GetKeyState
UnregisterClassW
GetIconInfo
DrawIconEx
OffsetRect
ReleaseDC
GetDC
SendMessageW
ShowWindow
SetWindowPos
SetWindowTextW
IsWindow
SetForegroundWindow
FindWindowW
InflateRect
GetCapture
IsZoomed
IsIconic
SetLayeredWindowAttributes
AnimateWindow
PostQuitMessage
PostMessageW
TrackMouseEvent
GetMonitorInfoW
MonitorFromWindow
GetWindow
GetParent
SetWindowLongW
MapWindowPoints
GetWindowRect
SystemParametersInfoW
GetClientRect
GetActiveWindow
CreateWindowExW
GetDlgItem
RegisterClassExW
CallWindowProcW
DefWindowProcW
TrackPopupMenu
GetWindowLongW

advapi32

RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
ImpersonateLoggedOnUser
RevertToSelf
DuplicateTokenEx
CreateProcessAsUserW
LookupAccountSidW
SetSecurityDescriptorDacl
OpenProcessToken
GetTokenInformation
SetTokenInformation
InitializeSecurityDescriptor

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW
ShellExecuteW
SHGetPathFromIDListW
SHBrowseForFolderW
SHChangeNotify

ole32

CoCreateInstance
OleInitialize
OleUninitialize
CreateStreamOnHGlobal
OleLockRunning
CLSIDFromString
CLSIDFromProgID
CreateBindCtx
CoCreateGuid

shlwapi

SHDeleteKeyW
SHDeleteValueW
SHGetValueW
SHSetValueW
StrToIntExW
PathFileExistsW

psapi

EnumProcessModules
GetModuleFileNameExW
EnumProcesses
GetProcessImageFileNameW

crypt32

CryptMsgGetParam
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CryptMsgClose

gdiplus

GdipFree
GdipAlloc
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipGetImageEncoders
GdipGetImageHeight
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageGetFrameDimensionsCount
GdipGetImageEncodersSize
GdipDrawImageRectI
GdipGraphicsClear
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipSaveImageToFile
GdipBitmapUnlockBits
GdipDrawImageI
GdipDeleteGraphics

imm32

ImmAssociateContext
ImmGetContext
ImmDestroyContext
ImmCreateContext
ImmReleaseContext

gdi32

GetStockObject
Rectangle
GetObjectW
CreateDIBSection
SetBkMode
GetCurrentObject
StretchBlt
GetViewportOrgEx
SetViewportOrgEx
EnumFontFamiliesExW
GetCharABCWidthsW
GetFontData
DeleteDC
DeleteObject
ExtCreateRegion
IntersectClipRect
SelectClipRgn
SelectObject
SetGraphicsMode
SetWorldTransform
CreateSolidBrush
CreateFontIndirectW
GetDeviceCaps
CreateBitmap
EnumFontsW
BitBlt
CreateCompatibleDC
GdiFlush
GetTextFaceW
ExtTextOutW
GetTextMetricsW
SetTextAlign
SetTextColor
RemoveFontMemResourceEx
AddFontMemResourceEx
GetTextExtentPointI
GetGlyphIndicesW
GetFontUnicodeRanges
GetOutlineTextMetricsW
GetGlyphOutlineW

oleaut32

SysAllocString
SysFreeString

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

ws2_32

getsockname
getsockopt
htons
ntohs
setsockopt
WSASetLastError
htonl
inet_addr
inet_ntoa
gethostbyaddr
gethostbyname
getservbyport
getservbyname
__WSAFDIsSet
select
recvfrom
sendto
accept
listen
getpeername
gethostname
WSAStartup
WSACleanup
ioctlsocket
recv
send
WSAGetLastError
closesocket
socket
bind
connect

usp10

ScriptShape
ScriptItemize
ScriptFreeCache

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 476KB - Virtual size: 476KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 59KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 376B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13.2MB - Virtual size: 13.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cbaefac3c3a85a39680e479eee00730a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

psapi

crypt32

gdiplus

imm32

gdi32

oleaut32

userenv

ws2_32

usp10

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 476KB - Virtual size: 476KB

.data Size: 59KB - Virtual size: 160KB

.gfids Size: 512B - Virtual size: 376B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 13.2MB - Virtual size: 13.2MB

.reloc Size: 123KB - Virtual size: 122KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 476KB - Virtual size: 476KB

.data
Size: 59KB - Virtual size: 160KB

.gfids
Size: 512B - Virtual size: 376B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 13.2MB - Virtual size: 13.2MB

.reloc
Size: 123KB - Virtual size: 122KB