tmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tmp
Size

4.7MB
MD5

23ba2984dbf9039d62300a59106519b2
SHA1

1ac4f1b00e0908edef98b24f03e8e12396444611
SHA256

53653db3196156d7a124b132c36b9149ddf0ecd5e0b2f31bedafb8927b028fc1
SHA512

bb1d4b4884a0a979923388a03e6a11fc4511bf92fd74c0f0fb8008ba1cefbba4545554b063fc8fd368c1d2d86bd9c926ac95858fa372c50b245df15f245c042b
SSDEEP

98304:GDHZC4mTh4lw9vzSywti+JGv2BZSPyJD6ZXKwi1jDQXO0qgaaDAAnyuDb:Ww9zSFbBZSPyF6VKrgpnywb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp

Files

tmp
.exe windows x86

b9e72aae02e349415cb1df08d832fff1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OutputDebugStringW
RaiseException
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetFileTime
VirtualQuery
lstrcatW
GlobalMemoryStatusEx
CreateProcessW
InterlockedIncrement
InterlockedDecrement
MulDiv
InterlockedCompareExchange
InterlockedExchange
GetLocaleInfoA
GetCommandLineW
FreeConsole
GetStdHandle
GetConsoleScreenBufferInfo
ReadConsoleOutputCharacterA
SetConsoleCursorPosition
FillConsoleOutputCharacterW
WriteConsoleW
WriteConsoleA
SetErrorMode
GlobalAlloc
GlobalFree
GlobalLock
GlobalSize
GlobalUnlock
HeapSize
DebugBreak
ExitProcess
ReleaseMutex
TlsSetValue
lstrlenW
ResumeThread
TlsGetValue
TlsAlloc
TlsFree
GetModuleHandleA
GetEnvironmentVariableW
IsValidCodePage
GetCPInfo
SetCurrentDirectoryW
GetFileType
FileTimeToSystemTime
FindFirstFileW
FindClose
GetLocaleInfoW
GetUserDefaultLCID
GetACP
IsValidLocale
ExpandEnvironmentStringsW
PeekNamedPipe
CreateThread
FindNextFileW
IsBadReadPtr
IsBadStringPtrA
RemoveDirectoryW
DeleteFileW
DeviceIoControl
GetFullPathNameW
GetFileAttributesExW
MoveFileExW
CreateDirectoryW
AreFileApisANSI
FormatMessageA
OpenEventA
ResetEvent
SetWaitableTimer
CreateWaitableTimerA
UnhandledExceptionFilter
GetCommandLineA
GetStartupInfoA
HeapReAlloc
GetTimeFormatA
GetDateFormatA
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeW
CompareStringA
ExitThread
GetTimeZoneInformation
GetDriveTypeA
GetFullPathNameA
SetStdHandle
GetConsoleCP
GetConsoleMode
GetModuleFileNameA
HeapCreate
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetOEMCP
SetConsoleCtrlHandler
EnumSystemLocalesA
GetStringTypeA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetEnvironmentVariableA
SetEnvironmentVariableW
GetCurrentDirectoryA
CreateFileA
GetConsoleOutputCP
GetVersion
GetVersionExA
FlushConsoleInputBuffer
CreateMutexA
GetStringTypeExA
GetVolumeInformationW
GetDiskFreeSpaceExW
GetDriveTypeW
SetUnhandledExceptionFilter
lstrcpyW
IsDebuggerPresent
TerminateProcess
GetFileInformationByHandle
GetFileSize
SetEndOfFile
SetFilePointer
FlushFileBuffers
WriteFile
ReadFile
CreateFileW
GetDiskFreeSpaceW
SetThreadPriority
GetCurrentThread
QueryPerformanceCounter
QueryPerformanceFrequency
GetLocalTime
SystemTimeToFileTime
GetCurrentProcessId
VirtualFree
VirtualAlloc
GetWindowsDirectoryW
GetTempFileNameW
GetTempPathW
GetLongPathNameW
GetModuleFileNameW
GlobalMemoryStatus
GetSystemInfo
FreeLibrary
GetSystemDefaultLangID
FormatMessageW
GetShortPathNameW
SetLastError
GetFileAttributesW
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceW
MultiByteToWideChar
WideCharToMultiByte
GetVersionExW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WaitForMultipleObjects
CreateEventW
LocalFree
LocalAlloc
LoadLibraryW
Sleep
GetSystemTimeAsFileTime
GetSystemTime
CompareStringW
CreateSemaphoreA
GetCurrentProcess
DuplicateHandle
CopyFileW
MoveFileW
GetProcAddress
GetModuleHandleW
SetFileAttributesW
ReleaseSemaphore
HeapAlloc
HeapFree
GetProcessHeap
ReadConsoleInputA
SetConsoleMode
FindFirstFileA
GetLastError
CreateMutexW
GetUserDefaultLangID
GetCurrentThreadId
WaitForSingleObject
GetTickCount
CloseHandle
SetEvent
CreateEventA

user32

GetClipboardFormatNameW
GetClassNameW
ValidateRect
GetDoubleClickTime
GetWindowDC
BeginPaint
EndPaint
DestroyAcceleratorTable
CreateAcceleratorTableW
TranslateAcceleratorW
UnionRect
GetMessagePos
MapWindowPoints
ValidateRgn
FindWindowExW
IsClipboardFormatAvailable
ChangeDisplaySettingsW
EnumDisplaySettingsW
ShowCursor
GetDialogBaseUnits
MessageBeep
KillTimer
DdeInitializeW
DdeUninitialize
DdeNameService
DdeConnect
DdeDisconnect
DdeClientTransaction
DdeGetData
DdeFreeDataHandle
DdePostAdvise
DdeCreateDataHandle
DdeCreateStringHandleW
DdeQueryStringW
DdeFreeStringHandle
DdeGetLastError
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxA
LoadStringA
RegisterHotKey
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
GetActiveWindow
GetAsyncKeyState
VkKeyScanW
GetMenuItemInfoW
GetMenuItemCount
SystemParametersInfoW
GetMessageTime
EndDeferWindowPos
BeginDeferWindowPos
FillRect
GetUpdateRgn
InflateRect
IsWindowVisible
IsWindowEnabled
IsDialogMessageW
GetKeyState
CallWindowProcW
TrackPopupMenu
PeekMessageW
DeferWindowPos
ClientToScreen
ScreenToClient
UpdateWindow
SetParent
GetParent
WindowFromPoint
IsWindow
ScrollWindow
EnableScrollBar
SetScrollInfo
GetScrollInfo
SetCursorPos
PtInRect
GetCursorPos
GetCapture
ReleaseCapture
SetCapture
GetFocus
SetFocus
RegisterClassW
UnregisterClassW
FlashWindow
GetMenu
AdjustWindowRectEx
GetClientRect
SetWindowRgn
DrawMenuBar
EnableMenuItem
GetSystemMenu
GetSystemMetrics
GetDesktopWindow
GetWindowPlacement
IsIconic
IsZoomed
BringWindowToTop
SetWindowTextW
MoveWindow
CreateDialogIndirectParamW
SetCursor
InvalidateRect
SetWindowPos
GetWindowRect
GetWindow
RegisterWindowMessageW
GetSysColor
SendMessageW
RedrawWindow
ReleaseDC
GetDC
ShowWindow
SetActiveWindow
wsprintfW
wvsprintfW
SetForegroundWindow
DefWindowProcW
GetWindowLongW
DestroyWindow
SetWindowLongW
CreateWindowExW
RegisterClassExW
PostThreadMessageW
DispatchMessageW
TranslateMessage
GetMessageW
SetTimer
PostMessageW
GetWindowTextW
LoadImageW
DrawIconEx
MsgWaitForMultipleObjects
MessageBoxW
ChildWindowFromPoint
DrawFrameControl
GetSysColorBrush
DrawStateW
DrawEdge
SetRect
CheckMenuItem
CheckMenuRadioItem
GetSubMenu
AppendMenuW
CreateMenu
GetMenuState
ModifyMenuW
RemoveMenu
InsertMenuW
InsertMenuItemW
DestroyMenu
CreatePopupMenu
SetMenuItemInfoW
LoadCursorW
DestroyCursor
HideCaret
keybd_event
GetWindowTextLengthW
SetMenu
OffsetRect
DrawFocusRect
DrawTextW
CopyRect
CreateIconIndirect
GetIconInfo
LoadIconW
LoadBitmapW
DestroyIcon
GetDlgItem
CreateDialogParamW
PostQuitMessage
UnregisterHotKey
EnableWindow

comctl32

ImageList_SetBkColor
ImageList_Draw
ord17
ord16
ImageList_BeginDrag
ImageList_SetDragCursorImage
ImageList_EndDrag
ImageList_DragMove
ImageList_DragEnter
ImageList_DragLeave
ImageList_Replace
ImageList_ReplaceIcon
ImageList_Add
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
ImageList_Remove

rpcrt4

RpcStringFreeW
UuidToStringW

wsock32

ioctlsocket
recvfrom
gethostbyname
htons
closesocket
socket
ntohs
inet_addr
bind
htonl
inet_ntoa
accept
WSASetLastError
WSACleanup
WSAStartup
sendto
listen
shutdown
getsockname
getpeername
gethostname
connect
WSAAsyncGetHostByName
send
recv
WSACancelAsyncRequest
WSAGetLastError
setsockopt
WSAAsyncSelect

ws2_32

WSAEventSelect

gdi32

SetTextColor
DeleteObject
CreateFontIndirectW
GetOutlineTextMetricsW
CreateRectRgn
RealizePalette
SelectPalette
ExcludeClipRect
GetTextMetricsW
GetTextExtentPoint32W
SelectObject
GdiFlush
OffsetRgn
ExtCreateRegion
GetDeviceCaps
EnumFontFamiliesExW
CloseEnhMetaFile
SetBkColor
SetBkMode
GetObjectW
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
BitBlt
CreatePen
CreateSolidBrush
CombineRgn
RectInRegion
CreateRectRgnIndirect
SetTextAlign
SelectClipRgn
SetStretchBltMode
GetClipBox
ExtSelectClipRgn
SetMapMode
GetBkColor
ExtFloodFill
GetPixel
Pie
Arc
SetPixel
SetPolyFillMode
Polygon
PolyPolygon
Polyline
Rectangle
RoundRect
Ellipse
PolyBezier
GetStockObject
MaskBlt
ExtTextOutW
SetBrushOrgEx
SetROP2
GetCharABCWidthsW
GetTextExtentExPointW
SetViewportExtEx
SetWindowExtEx
SetViewportOrgEx
SetWindowOrgEx
StretchBlt
StretchDIBits
MoveToEx
LineTo
SaveDC
RestoreDC
GetRgnBox
EqualRgn
PtInRegion
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
CreatePatternBrush
CreateHatchBrush
ExtCreatePen
CreateICW
CreateDIBSection
GetDIBits
GetDIBColorTable
CreateDIBitmap
SetAbortProc
StartDocW
EndDoc
StartPage
EndPage
CreateDCW
GetEnhMetaFileW
DeleteEnhMetaFile
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateEnhMetaFileW
GetRegionData

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

comdlg32

GetOpenFileNameW
GetSaveFileNameW
PageSetupDlgW
PrintDlgW
ChooseFontW
CommDlgExtendedError
ChooseColorW

advapi32

RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegQueryValueExW
RegSetValueExW
RegEnumValueW
RegEnumKeyW
DeregisterEventSource
OpenProcessToken
AdjustTokenPrivileges
GetUserNameW
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
RegCreateKeyW
RegOpenKeyExW
ReportEventA
RegisterEventSourceA

shell32

SHGetSpecialFolderLocation
SHBrowseForFolderW
SHGetMalloc
ExtractIconW
ExtractIconExW
DragFinish
DragQueryPoint
DragQueryFileW
DragAcceptFiles
SHGetSpecialFolderPathW
ord155
ord16
SHBindToParent
SHGetPathFromIDListW
ShellExecuteExW

ole32

OleGetClipboard
OleFlushClipboard
OleSetClipboard
OleIsCurrentClipboard
CoLockObjectExternal
ReleaseStgMedium
CoTaskMemAlloc
RevokeDragDrop
OleUninitialize
CoGetMalloc
OleInitialize
OleLockRunning
OleSetContainedObject
OleRun
CoUninitialize
CoInitialize
CoCreateInstance
RegisterDragDrop

oleaut32

VariantInit
SafeArrayPutElement
SafeArrayCreate
VariantClear
SysFreeString
VarDecFromR8
VarR8FromDec
VariantChangeType
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayGetElement
SysAllocString
SysStringLen
SafeArrayDestroy

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 114KB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b9e72aae02e349415cb1df08d832fff1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

comctl32

rpcrt4

wsock32

ws2_32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 114KB - Virtual size: 1.6MB

.tls Size: 512B - Virtual size: 13B

.rsrc Size: 167KB - Virtual size: 166KB

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 114KB - Virtual size: 1.6MB

.tls
Size: 512B - Virtual size: 13B

.rsrc
Size: 167KB - Virtual size: 166KB