4894ce3f44de3a75f9d6bfcdc3f1b303cda6ca031f813f4e9d97265eea706350

Sharing

Copy URL Twitter E-mail

General

Target

4894ce3f44de3a75f9d6bfcdc3f1b303cda6ca031f813f4e9d97265eea706350
Size

4.0MB
MD5

c72bfe4726c9d450783449d4691cc5e2
SHA1

d62b4979c07c85f635ad997d72ca0baa0999f574
SHA256

4894ce3f44de3a75f9d6bfcdc3f1b303cda6ca031f813f4e9d97265eea706350
SHA512

e80b66d7f63802d8e602b873aaa1619698c939272f57030cc9ad7a280474003c2aebdafe2838113f4de701da33588284d364577bccc77721580ea403ed70dfea
SSDEEP

49152:aU7h1xo13zJs2lpPRPa52bhqvQGPmYcGHd5hsb4e2rmlZ7BCHv2tATiTZbf/3fah:9N1xKVsYK52wmYc2n4Ces0T+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4894ce3f44de3a75f9d6bfcdc3f1b303cda6ca031f813f4e9d97265eea706350

Files

4894ce3f44de3a75f9d6bfcdc3f1b303cda6ca031f813f4e9d97265eea706350
.exe windows x86

795fb0c169ef1e1db1053e69ece2c809

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

HttpQueryInfoA

crypt32

CryptGetMessageCertificates
CertCreateCertificateContext
CertFindCertificateInStore
CertVerifySubjectCertificateContext
CertFreeCertificateContext
CryptVerifyMessageSignature
CertCloseStore

urlmon

CopyStgMedium

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

winmm

waveInGetNumDevs
waveOutGetDevCapsA
waveOutGetNumDevs
waveOutOpen
waveInStart
waveInAddBuffer
waveInGetDevCapsA
waveInOpen
timeSetEvent
timeKillEvent
waveOutGetPosition
timeBeginPeriod
timeGetTime
waveInStop
waveInReset
waveInUnprepareHeader
waveInClose
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
waveOutClose
waveOutReset
timeGetDevCaps
waveInPrepareHeader
timeEndPeriod

oleaut32

SysFreeString

kernel32

GlobalAlloc
FreeLibrary
GetSystemDefaultLangID
MoveFileA
DeleteFileA
GetFileAttributesA
GetSystemInfo
GetUserDefaultLangID
ExitThread
GlobalFree
WriteFile
SetFilePointer
CreateFileA
ReadFile
GetFileSize
LockResource
LoadResource
FindResourceExA
FindResourceExW
GetFileAttributesW
SetUnhandledExceptionFilter
GetTempPathA
FindClose
FindNextFileA
FindFirstFileA
InterlockedIncrement
InterlockedDecrement
GetTimeZoneInformation
GetSystemTime
SystemTimeToFileTime
CreateDirectoryA
GetModuleFileNameA
CreateMutexA
CreateFileW
GlobalSize
GetTempFileNameA
GetFullPathNameA
GetSystemDirectoryA
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
GetFileAttributesExA
SetCurrentDirectoryA
RemoveDirectoryA
SetFilePointerEx
GetFileSizeEx
UnmapViewOfFile
ReleaseMutex
MapViewOfFile
CreateFileMappingA
ResetEvent
TerminateThread
lstrcpyA
lstrlenA
IsDBCSLeadByteEx
GetModuleHandleA
GetCommandLineW
DeleteFileW
SetEndOfFile
SetFileAttributesA
CopyFileA
GetStartupInfoA
GetCommandLineA
GetProcessHeap
HeapFree
VirtualAlloc
VirtualFree
VirtualProtect
UnhandledExceptionFilter
GetStdHandle
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapCreate
GetCurrentProcessId
GlobalLock
GlobalUnlock
WideCharToMultiByte
GetCurrentProcess
GetProcessTimes
CreateWaitableTimerA
CreateThread
SetWaitableTimer
WaitForSingleObject
SetThreadPriority
QueryPerformanceFrequency
QueryPerformanceCounter
CreateProcessA
LCMapStringW
LCMapStringA
GetTickCount
GetCurrentThreadId
GetLocaleInfoA
FlushInstructionCache
SetErrorMode
GetLastError
GetVersionExA
LoadLibraryA
GetProcAddress
GetCurrentThread
SetThreadAffinityMask
IsDBCSLeadByte
GetACP
GetCPInfo
VirtualQuery
MultiByteToWideChar
CreateEventA
CreateSemaphoreA
CloseHandle
SetEvent
WaitForMultipleObjects
ReleaseSemaphore
InterlockedExchange
InterlockedCompareExchange
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
HeapAlloc
VirtualProtectEx
HeapReAlloc
TerminateProcess
IsDebuggerPresent
GetOEMCP
IsValidCodePage
RtlUnwind
HeapSize
ExitProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
RaiseException
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
GetCurrentDirectoryA

user32

TranslateAcceleratorA
GetMessageA
LoadAcceleratorsA
EnableWindow
SetDlgItemTextW
SetDlgItemTextA
GetWindowTextA
ShowWindow
UpdateWindow
UnregisterClassA
RemoveMenu
InsertMenuW
InsertMenuA
SetMenu
MoveWindow
LoadStringW
EnumDisplaySettingsA
GetWindow
IsClipboardFormatAvailable
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetWindowLongA
GetWindowThreadProcessId
IsWindow
CreateWindowExA
SetCapture
ReleaseCapture
GetMenuItemID
DeleteMenu
InsertMenuItemA
TrackPopupMenu
DefWindowProcA
GetCapture
WindowFromPoint
GetFocus
DestroyWindow
GetMenu
LoadCursorA
SetCursor
GetCursorPos
TranslateMessage
KillTimer
SetTimer
LoadMenuA
GetSubMenu
DestroyMenu
BeginPaint
GetWindowTextLengthA
EnableMenuItem
CheckMenuItem
InvalidateRect
MapVirtualKeyA
GetKeyState
GetForegroundWindow
WaitForInputIdle
MessageBoxA
DialogBoxParamW
DialogBoxParamA
GetClientRect
LoadStringA
RedrawWindow
DialogBoxIndirectParamW
DialogBoxIndirectParamA
PostMessageA
EndDialog
SetWindowLongA
GetWindowRect
GetDesktopWindow
SetWindowPos
LoadIconA
GetDlgItem
SendMessageA
SetWindowTextA
SetFocus
GetMenuItemCount
GetMenuItemInfoA
GetSystemMetrics
SystemParametersInfoA
InsertMenuItemW
GetClipboardFormatNameA
RegisterClipboardFormatA
DdeInitializeA
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DispatchMessageA
RegisterClassA
GetMenuStringW
GetMenuStringA
PostQuitMessage
GetWindowTextLengthW
ScreenToClient
GetDlgItemTextW
DdeDisconnect
DdeFreeStringHandle
DdeUninitialize
SendInput
GetKeyboardLayout
FillRect
GetDC
ReleaseDC
ClientToScreen
GetMonitorInfoA
OffsetRect
SetRect
MonitorFromWindow
GetDoubleClickTime
EndPaint
GetDlgItemTextA
GetParent

gdi32

GetPixel
GetObjectA
CreateDIBSection
DeleteObject
GetDIBits
CreateCompatibleBitmap
GetDeviceCaps
BitBlt
SelectObject
RealizePalette
SelectPalette
ExtTextOutA
SetBkColor
CreateSolidBrush
StretchBlt
SetStretchBltMode
GetStretchBltMode
GetICMProfileA
CreateDCA
GetStockObject
CreateFontIndirectA
GetTextMetricsA
EnumFontFamiliesA
LineTo
DeleteDC
IntersectClipRect
SelectClipRgn
ExtTextOutW
SetTextColor
GetClipRgn
CreateRectRgn
GetTextAlign
GetBkMode
GetTextColor
GetBkColor
CreateFontIndirectW
SetWorldTransform
SetGraphicsMode
GetWorldTransform
SetTextCharacterExtra
CreatePen
DPtoLP
GetTextExtentPoint32W
GetCurrentObject
GetTextExtentPoint32A
CreatePalette
GetSystemPaletteEntries
GetClipBox
LPtoDP
StartDocA
EndDoc
StrokePath
ExtCreatePen
FillPath
StretchDIBits
CreateCompatibleDC
GdiFlush
RestoreDC
SaveDC
SelectClipPath
PolyBezierTo
SetTextAlign
MoveToEx
SetPolyFillMode
EndPath
BeginPath
EndPage
GetFontData
SetBkMode
EnumFontFamiliesExW
StartPage

comdlg32

CommDlgExtendedError
GetOpenFileNameA
PrintDlgA
GetOpenFileNameW
GetSaveFileNameW
GetSaveFileNameA

advapi32

RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA

shell32

DragQueryFileA
DragAcceptFiles
SHBrowseForFolderA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHAppBarMessage
DragQueryFileW

ole32

CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
CoInitialize
CreateBindCtx
ReleaseStgMedium
CoUninitialize
OleUninitialize
OleIsCurrentClipboard
OleGetClipboard
OleSetClipboard
OleInitialize
OleFlushClipboard

mscms

DeleteColorTransform
CloseColorProfile
OpenColorProfileA
TranslateBitmapBits
CreateColorTransformW

ws2_32

WSACloseEvent
ntohl
WSACreateEvent
ioctlsocket
select
gethostname
WSAAddressToStringA
sendto
recvfrom
WSAEventSelect
connect
setsockopt
WSASetLastError
getservbyport
gethostbyaddr
htons
getservbyname
htonl
inet_ntoa
gethostbyname
inet_addr
getsockname
ntohs
bind
send
recv
WSAStartup
WSASocketA
socket
WSAAsyncSelect
WSAIoctl
WSAGetLastError
closesocket
WSACleanup
WSAEnumNetworkEvents

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 499KB - Virtual size: 498KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 105KB - Virtual size: 960KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 358KB - Virtual size: 357KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

795fb0c169ef1e1db1053e69ece2c809

Headers

DLL Characteristics

File Characteristics

Imports

wininet

crypt32

urlmon

version

winmm

oleaut32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

mscms

ws2_32

Sections

.text Size: 3.0MB - Virtual size: 3.0MB

.rdata Size: 499KB - Virtual size: 498KB

.data Size: 105KB - Virtual size: 960KB

.rodata Size: 1KB - Virtual size: 1KB

.rsrc Size: 358KB - Virtual size: 357KB

.reloc Size: 95KB - Virtual size: 95KB

.text
Size: 3.0MB - Virtual size: 3.0MB

.rdata
Size: 499KB - Virtual size: 498KB

.data
Size: 105KB - Virtual size: 960KB

.rodata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 358KB - Virtual size: 357KB

.reloc
Size: 95KB - Virtual size: 95KB