aad05eee8a7c5363aa1abefc43d72c5e4e4e9721d3fc33c81f30ce1b3da81fc8

Sharing

Copy URL Twitter E-mail

General

Target

aad05eee8a7c5363aa1abefc43d72c5e4e4e9721d3fc33c81f30ce1b3da81fc8
Size

5.2MB
MD5

1649e00c568cf07a252e020f863f0bf5
SHA1

1522cbba4796470cc19f783d37323d8f189833ad
SHA256

aad05eee8a7c5363aa1abefc43d72c5e4e4e9721d3fc33c81f30ce1b3da81fc8
SHA512

e3bf68c4d92ca20ef85278a75792c7fff1fb2ec34accd56bfe3fc9ff849e1fb7d6a02a2eda77a530111d6bd04ae032f306df5ecc22fc784bb06e9edaa1eac362
SSDEEP

98304:4/vO2Qud0VvB18s4S0ZZAiDstk1FRvsGBN56:4uyOYs4ScZAiNFRsE36

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aad05eee8a7c5363aa1abefc43d72c5e4e4e9721d3fc33c81f30ce1b3da81fc8

Files

aad05eee8a7c5363aa1abefc43d72c5e4e4e9721d3fc33c81f30ce1b3da81fc8
.exe windows x86

24f89fec3be9f5196ef61552bbb85d6c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesW
GetFileAttributesExW
GetFileSizeEx
GetFileTime
SetFileAttributesW
GetCommandLineW
RtlUnwind
ExitProcess
GetModuleHandleExW
AreFileApisANSI
ExitThread
IsDebuggerPresent
IsProcessorFeaturePresent
HeapQueryInformation
GetStdHandle
GetFileType
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetTickCount
IsValidCodePage
GetOEMCP
GetCPInfo
GetTimeZoneInformation
OutputDebugStringW
GetDateFormatW
GetTimeFormatW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetStringTypeW
SetStdHandle
WriteConsoleW
ReadConsoleW
SetEnvironmentVariableA
GetSystemDefaultLangID
GetTempFileNameW
CreateFileA
MapViewOfFile
UnmapViewOfFile
GetDriveTypeW
GetLogicalDrives
GetSystemDefaultLCID
GetSystemPowerStatus
GetCurrentProcess
GetTempPathW
CreateFileMappingW
QueryDosDeviceW
GetSystemInfo
GetTempPathA
GetLocalTime
FileTimeToLocalFileTime
FindVolumeClose
GetLogicalDriveStringsW
SetVolumeMountPointW
GetDriveTypeA
GetVolumeInformationA
DeleteVolumeMountPointW
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
DefineDosDeviceW
SetVolumeLabelW
DeviceIoControl
GetDiskFreeSpaceExA
GetDiskFreeSpaceExW
FindFirstVolumeW
GetVolumeNameForVolumeMountPointW
FindResourceA
MoveFileExW
OpenProcess
Process32FirstW
GetProcessId
Process32NextW
CreateToolhelp32Snapshot
OpenFile
SystemTimeToTzSpecificLocalTime
CreateDirectoryW
GetFileAttributesA
FindFirstFileA
RemoveDirectoryW
FindNextFileW
lstrcpynW
lstrlenW
lstrcatW
PeekNamedPipe
GetExitCodeProcess
CreatePipe
CreateProcessW
TryEnterCriticalSection
InterlockedCompareExchange
InterlockedExchange
InterlockedDecrement
WaitForMultipleObjects
GetExitCodeThread
CopyFileExW
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
GetFullPathNameA
GetFileInformationByHandle
FindFirstFileExW
SystemTimeToFileTime
SetErrorMode
FileTimeToSystemTime
lstrcmpiW
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetVolumeInformationW
GetFullPathNameW
GetFileSize
FlushFileBuffers
FindFirstFileW
FindClose
CreateFileW
DeleteFileW
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
GetCurrentDirectoryW
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
CopyFileW
FormatMessageW
MulDiv
LocalFree
GlobalSize
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
CreateEventW
SetEvent
GlobalFree
GlobalUnlock
GlobalFindAtomW
GlobalAddAtomW
LoadLibraryA
FreeResource
GetSystemDirectoryW
LeaveCriticalSection
EnterCriticalSection
EncodePointer
FindResourceW
lstrcmpW
lstrcmpA
GlobalDeleteAtom
GlobalLock
GlobalAlloc
SizeofResource
LockResource
LoadResource
LoadLibraryExW
FreeLibrary
GetVersionExW
GetCurrentThreadId
GetCurrentThread
LoadLibraryW
GetProcAddress
GetModuleHandleA
GetModuleFileNameW
SetLastError
OutputDebugStringA
GetACP
WideCharToMultiByte
MultiByteToWideChar
CreateMutexW
HeapCompact
FlushViewOfFile
WaitForSingleObjectEx
UnlockFileEx
FormatMessageA
HeapCreate
HeapValidate
LockFileEx
GetDiskFreeSpaceW
CreateFileMappingA
GetDiskFreeSpaceA
GetVersionExA
GetSystemTime
DeleteFileA
SetDllDirectoryW
GetThreadTimes
InitializeSListHead
Sleep
GetModuleHandleW
DeleteCriticalSection
DecodePointer
HeapSize
GetLastError
RaiseException
HeapDestroy
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapFree
HeapAlloc
HeapReAlloc
GetCurrentProcessId
WaitForSingleObject
CreateThread
CloseHandle
GetSystemDirectoryA

user32

OffsetRect
UnregisterClassW
EqualRect
CopyRect
GetSysColor
MapWindowPoints
ScreenToClient
AdjustWindowRectEx
GetWindowRect
GetClientRect
GetWindowTextW
RemovePropW
GetPropW
RedrawWindow
ValidateRect
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
UpdateWindow
GetMenuItemCount
GetMenuItemID
GetSubMenu
SetMenu
GetMenu
GetCapture
GetKeyState
GetFocus
SetFocus
GetDlgCtrlID
GetDlgItem
IsWindowVisible
WinHelpW
MonitorFromWindow
GetMonitorInfoW
CreateDialogIndirectParamW
EndDialog
GetNextDlgTabItem
GetActiveWindow
IsWindowEnabled
GetDesktopWindow
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadBitmapW
GetMessageW
TranslateMessage
GetCursorPos
ReleaseDC
LoadIconW
MessageBoxW
SendMessageW
ShowWindow
SetPropW
GetParent
EnableWindow
SetCursor
GetWindowThreadProcessId
PostMessageW
SetTimer
KillTimer
SetRect
PtInRect
GetWindowLongW
CreateDesktopW
CloseDesktop
SetWindowLongW
IntersectRect
UnionRect
SetClipboardData
UpdateLayeredWindow
GetCaretPos
SetWindowRgn
IsZoomed
SetCaretPos
HideCaret
CreateCaret
DestroyCaret
GetWindowRgn
RegisterClassExW
GetClassNameA
SendMessageA
wsprintfW
CloseClipboard
GetClassLongW
GetClassNameW
GetTopWindow
GetLastActivePopup
GetWindow
SetWindowsHookExW
MoveWindow
OpenClipboard
SetWindowTextW
IsDialogMessageW
SetCapture
ReleaseCapture
ClientToScreen
WindowFromPoint
LoadCursorW
SystemParametersInfoW
RealChildWindowFromPoint
InvalidateRect
DrawTextW
DrawTextExW
GrayStringW
TabbedTextOutW
GetDC
CallNextHookEx
EmptyClipboard
GetClipboardData
GetWindowDC
GetAsyncKeyState
EnumWindows
ExitWindowsEx
BeginPaint
EndPaint
GetSystemMetrics
DestroyMenu
SendDlgItemMessageA
PostQuitMessage
UnhookWindowsHookEx
RegisterWindowMessageW
DispatchMessageW
PeekMessageW
GetMessagePos
GetMessageTime
DefWindowProcW
CallWindowProcW
RegisterClassW
GetSysColorBrush
IsIconic
DestroyIcon
CharUpperW
GetClassInfoW
GetWindowPlacement
SetWindowPos
DestroyWindow
IsWindow
GetClassInfoExW
CreateWindowExW

shell32

SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteExW
DragAcceptFiles
ord165
ord155
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation
SHGetSpecialFolderPathA
ord716
SHGetDesktopFolder
ShellExecuteW
DragQueryFileW
SHGetFileInfoW

shlwapi

PathStripToRootW
PathFileExistsW
PathIsRootW
PathIsDirectoryW
PathCanonicalizeW
PathIsRootA
PathFileExistsA
PathIsUNCW
PathRemoveFileSpecW
PathFindFileNameW
PathFindExtensionW

gdiplus

GdipAddPathLineI
GdipSetStringFormatLineAlign
GdipAddPathArcI
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeleteFont
GdipCreateFont
GdipCreatePath
GdipSetTextRenderingHint
GdipDrawString
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDrawLineI
GdipSetPenDashStyle
GdipGetImageHeight
GdipGetImageWidth
GdipAddPathEllipseI
GdipAddPathRectangleI
GdipSetClipPath
GdipResetClip
GdipImageGetFrameDimensionsCount
GdipDeletePath
GdipImageSelectActiveFrame
GdipDrawPath
GdipDeletePen
GdipCreatePen1
GdipFillPath
GdipResetPath
GdipDeleteBrush
GdipCreateSolidFill
GdipSetSmoothingMode
GdipLoadImageFromStream
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromFile
GdipCloneImage
GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup
GdipDrawImageRectRect
GdipDeleteGraphics
GdipCreateFromHDC
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipClosePathFigure
GdipSetStringFormatAlign
GdipDisposeImage

oleacc

CreateStdAccessibleObject
LresultFromObject

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

imagehlp

MakeSureDirectoryPathExists

winmm

timeSetEvent
timeKillEvent
timeGetDevCaps

gdi32

SetBkMode
EnumFontFamiliesExW
MoveToEx
TextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetMapMode
OffsetViewportOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetTextExtentPoint32W
CreateCompatibleBitmap
CreateFontW
GetDIBits
CreateDIBSection
CreatePolygonRgn
FillRgn
CreateRoundRectRgn
PtInRegion
SetPixel
GetBitmapBits
SetBitmapBits
SelectObject
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
GetStockObject
GetClipBox
Escape
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePen
CreateCompatibleDC
BitBlt
DeleteObject
GetDeviceCaps
GetObjectW
SetTextColor
ExtTextOutW
CreateBitmap
SetBkColor

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

GetSidIdentifierAuthority
LsaFreeMemory
RegQueryInfoKeyW
ControlService
UnlockServiceDatabase
ChangeServiceConfigW
QueryServiceStatus
StartServiceW
LockServiceDatabase
OpenServiceW
OpenSCManagerW
CloseServiceHandle
AdjustTokenPrivileges
LookupPrivilegeValueW
LookupAccountNameW
GetSidSubAuthorityCount
GetUserNameW
GetSidSubAuthority
OpenProcessToken
LsaRetrievePrivateData
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
LsaNtStatusToWinError
ImpersonateLoggedOnUser
RevertToSelf
RegQueryValueExA
RegOpenKeyExA
LsaOpenPolicy
LsaClose

ole32

CoTaskMemFree
CoInitializeEx
CoInitialize
CoCreateInstance
CoCreateGuid
CoUninitialize
CreateStreamOnHGlobal
OleSetContainedObject
CoSetProxyBlanket
CoInitializeSecurity

oleaut32

VarDateFromStr
VariantTimeToSystemTime
VariantChangeType
VariantClear
VariantInit
SysAllocString
SysFreeString

msimg32

AlphaBlend

comctl32

_TrackMouseEvent

imm32

ImmGetContext
ImmDestroyContext
ImmSetCompositionWindow
ImmReleaseContext
ImmAssociateContext

ws2_32

ioctlsocket
connect
WSAStartup
inet_addr
select
htons
shutdown
setsockopt
closesocket
gethostbyname
send
WSACleanup
recv
socket
WSAGetLastError

iphlpapi

GetAdaptersInfo

wininet

InternetCrackUrlA
InternetCanonicalizeUrlA

wlanapi

WlanOpenHandle
WlanGetProfileList
WlanFreeMemory
WlanEnumInterfaces
WlanGetProfile
WlanCloseHandle

rpcrt4

UuidFromStringW
RpcStringFreeW
UuidToStringW

setupapi

SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW

crypt32

CryptUnprotectData
CryptStringToBinaryW

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 549KB - Virtual size: 548KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 194KB - Virtual size: 238KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 540KB - Virtual size: 539KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 220KB - Virtual size: 219KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 27.6MB - Virtual size: 27.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

24f89fec3be9f5196ef61552bbb85d6c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

shlwapi

gdiplus

oleacc

version

imagehlp

winmm

gdi32

winspool.drv

comdlg32

advapi32

ole32

oleaut32

msimg32

comctl32

imm32

ws2_32

iphlpapi

wininet

wlanapi

rpcrt4

setupapi

crypt32

Sections

.text Size: 3.3MB - Virtual size: 3.3MB

.rdata Size: 549KB - Virtual size: 548KB

.data Size: 194KB - Virtual size: 238KB

.vmp0 Size: 540KB - Virtual size: 539KB

.reloc Size: 220KB - Virtual size: 219KB

.rsrc Size: 27.6MB - Virtual size: 27.6MB

.text
Size: 3.3MB - Virtual size: 3.3MB

.rdata
Size: 549KB - Virtual size: 548KB

.data
Size: 194KB - Virtual size: 238KB

.vmp0
Size: 540KB - Virtual size: 539KB

.reloc
Size: 220KB - Virtual size: 219KB

.rsrc
Size: 27.6MB - Virtual size: 27.6MB