9479d8fcea06be77ab4090fe7622a1945edbfa5b4d6a05d28cf78242f0bc50bf

Sharing

Copy URL Twitter E-mail

General

Target

9479d8fcea06be77ab4090fe7622a1945edbfa5b4d6a05d28cf78242f0bc50bf
Size

5.1MB
MD5

5f3c6e6820e4d0297a98b5adbe72aac3
SHA1

35bca081e6d0841b9ed49229639c48fee94e6dd3
SHA256

9479d8fcea06be77ab4090fe7622a1945edbfa5b4d6a05d28cf78242f0bc50bf
SHA512

492bdd8b70fb2eda146fdf09245351ca14caeb9246d8b6546fcc44a724e384e556b833a30ec81bc951a491dfca59ec6b691b25e369b2736de181abdb2d0e8d0b
SSDEEP

98304:BRmzfuCSiNK16AIjuGFqICiElvzPRdHgUR2DK1x3w:BRFRilCGFqliElLqKw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9479d8fcea06be77ab4090fe7622a1945edbfa5b4d6a05d28cf78242f0bc50bf

Files

9479d8fcea06be77ab4090fe7622a1945edbfa5b4d6a05d28cf78242f0bc50bf
.dll windows x86

dddf48f25fb0bdfe3577bf4f9cb58169

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

InternetCheckConnectionW

basicsqlite

?ExecSQL@RCSQLiteConnection@RC@@QAE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAVRCSQLiteRecordSet@2@@Z
??0RCSQLiteRecordSet@RC@@QAE@XZ
??1RCSQLiteRecordSet@RC@@QAE@XZ
?MoveFirst@RCSQLiteRecordSet@RC@@QAE_NXZ
?NextRow@RCSQLiteRecordSet@RC@@QAE_NXZ
?GetFieldNum@RCSQLiteRecordSet@RC@@QBEHXZ
?GetIntegerField@RCSQLiteRecordSet@RC@@QBE_JH_J@Z
?GetStringField@RCSQLiteRecordSet@RC@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@HABV34@@Z
??0RCSQLiteConnection@RC@@QAE@XZ
??1RCSQLiteConnection@RC@@QAE@XZ
?LoadDB@RCSQLiteConnection@RC@@QAE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?DisconnectDB@RCSQLiteConnection@RC@@QAE_NXZ

kernel32

GetCurrentProcess
GetVersionExW
GetModuleHandleW
GlobalMemoryStatusEx
lstrlenW
InterlockedExchangeAdd
SetLastError
InterlockedExchange
SetEvent
WaitForMultipleObjects
GetFileSize
DeleteFileW
SetEndOfFile
SetFilePointer
ReadFile
GetCurrentProcessId
ReleaseMutex
WaitForSingleObject
CreateMutexW
GetModuleHandleExW
VirtualQuery
GetLogicalDriveStringsW
GetEnvironmentVariableW
QueryDosDeviceW
CreateFileW
WriteFile
GetTickCount
ExpandEnvironmentStringsW
LoadLibraryW
GetProcAddress
FreeLibrary
CreateFileMappingW
UnmapViewOfFile
OpenThread
SetThreadContext
GetThreadContext
CreateToolhelp32Snapshot
SuspendThread
Thread32First
Thread32Next
GetFileInformationByHandle
CreateSemaphoreW
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetModuleFileNameA
ExitProcess
LocalFree
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
ReleaseSemaphore
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
FlushFileBuffers
FormatMessageA
LockFileEx
UnlockFile
HeapCompact
HeapReAlloc
DeleteFileA
GetVersionExA
CreateFileA
FlushViewOfFile
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnlockFileEx
GetFullPathNameA
LockFile
InterlockedCompareExchange
AreFileApisANSI
GetFileType
GetStdHandle
IsBadStringPtrW
IsBadReadPtr
IsBadWritePtr
LoadLibraryExA
VirtualFree
VirtualAlloc
InterlockedPushEntrySList
InterlockedPopEntrySList
OutputDebugStringW
HeapDestroy
HeapCreate
OutputDebugStringA
VirtualProtect
CreateThread
DisableThreadLibraryCalls
GetModuleHandleA
MapViewOfFileEx
MapViewOfFile
CloseHandle
Sleep
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
GetCurrentThreadId
RaiseException
DecodePointer
ExitThread
GetFileAttributesW
GetModuleFileNameW
FlushInstructionCache
GlobalUnlock
GlobalLock
FreeResource
CreateWaitableTimerW
SetWaitableTimer
MulDiv
SizeofResource
GetACP
MultiByteToWideChar
WideCharToMultiByte
FindFirstFileW
GetLongPathNameW
GetFileAttributesExW
CreateProcessW
GetExitCodeProcess
SetFileTime
GetFileTime
LockResource
GetSystemInfo
LoadResource
FindResourceW
lstrcmpiW
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
LoadLibraryExW
OpenProcess
GetDiskFreeSpaceW
FindNextFileW
FindClose
FileTimeToSystemTime
SystemTimeToFileTime
GetSystemTime
ResumeThread
CreateEventW
ResetEvent
HeapFree
GlobalAlloc
GlobalFree
HeapAlloc
GetProcessHeap
SwitchToThread
CreateDirectoryW
GetFullPathNameW
RemoveDirectoryW
GetTempPathW
SetFileAttributesW
GetCurrentDirectoryW
GetWindowsDirectoryW
MoveFileExW
GetTempFileNameW
MoveFileW
LoadLibraryA
DeviceIoControl
lstrcatW
lstrcpyW
GetFileSizeEx
QueryPerformanceFrequency
QueryPerformanceCounter
OpenFileMappingW
FormatMessageW
EncodePointer
DuplicateHandle
WaitForSingleObjectEx
GetCurrentThread
GetExitCodeThread
GetStringTypeW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
GetLocalTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
InterlockedDecrement
CreateFileMappingA
LocalAlloc
lstrcmpW
InterlockedIncrement

user32

CallWindowProcW
IsWindowVisible
UnregisterClassW
SetWindowLongW
LoadIconW
CopyRect
SendMessageW
DefWindowProcW
PostThreadMessageW
PeekMessageW
DispatchMessageW
SystemParametersInfoW
TranslateMessage
GetMessageW
GetDesktopWindow
SetWindowPos
MoveWindow
ShowWindow
DestroyWindow
EnableMenuItem
GetForegroundWindow
GetWindowLongW
GetWindowThreadProcessId
WaitMessage
GetCapture
MonitorFromRect
MapVirtualKeyExW
GetKeyboardLayout
GetKeyNameTextW
GetPropW
GetMenuItemInfoW
InflateRect
GetMenuItemCount
DeleteMenu
RemovePropW
CreatePopupMenu
SetMenuItemInfoW
GetMenuStringW
SetPropW
InsertMenuW
AppendMenuW
LoadMenuW
TrackPopupMenu
GetSubMenu
GetMenuDefaultItem
DestroyIcon
IsMenu
SetMenuDefaultItem
DestroyMenu
GetAsyncKeyState
GetFocus
LoadStringW
DestroyAcceleratorTable
CreateAcceleratorTableW
EnumThreadWindows
PostQuitMessage
RegisterWindowMessageW
GetAncestor
EmptyClipboard
SetClipboardData
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
GetSysColor
GetKeyboardState
GetCaretBlinkTime
ToAscii
GetIconInfo
GetWindowTextW
EnableWindow
ReleaseDC
SetForegroundWindow
GetParent
GetDlgItem
GetClientRect
GetClassNameW
MapWindowPoints
GetMonitorInfoW
IsWindow
WindowFromPoint
SetWindowTextW
MonitorFromWindow
GetDC
GetWindowRect
GetWindow
MonitorFromPoint
GetWindowTextLengthW
GetSystemMetrics
EndPaint
BeginPaint
IsIconic
GetDCEx
InvalidateRect
UpdateWindow
KillTimer
IsZoomed
GetWindowDC
SetCapture
SetParent
GetUpdateRect
SetFocus
IsWindowEnabled
ValidateRect
IsChild
ClientToScreen
RedrawWindow
SetTimer
OpenClipboard
InvalidateRgn
ScreenToClient
CreateWindowExW
SetWindowRgn
MessageBoxW
PostMessageW
ShowWindowAsync
AdjustWindowRectEx
GetClassInfoExW
LoadCursorW
IsRectEmpty
RegisterClassExW
ReleaseCapture
TrackMouseEvent
GetKeyState
GetCursorPos
SetCursor
IntersectRect
OffsetRect
EnumChildWindows
EqualRect
PtInRect
CharNextW
UnionRect
AttachThreadInput
SetRectEmpty
SetRect
UpdateLayeredWindow
FillRect
MsgWaitForMultipleObjects
GetClassLongW
SetCaretPos
LoadImageW
LoadBitmapW
DrawTextW
DrawIconEx

gdi32

GetDIBits
CreateDCW
ExtTextOutW
MoveToEx
SelectClipRgn
SetMapMode
GetMapMode
CreateRoundRectRgn
PtInRegion
GetClipBox
EnumFontsW
GetObjectW
SetTextAlign
SetBkColor
CreateSolidBrush
GetTextMetricsW
GetTextExtentPointW
SetGraphicsMode
SetWorldTransform
CreateRectRgnIndirect
CreatePolygonRgn
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
SetViewportOrgEx
DeleteObject
GetRgnBox
GetStockObject
GetDeviceCaps
SetBkMode
CreatePen
AddFontMemResourceEx
GetFontUnicodeRanges
DeleteDC
CreateFontIndirectW
GetOutlineTextMetricsW
CreateRectRgn
LineTo
CreateDIBSection
SetTextColor
EnumFontFamiliesExW
GetTextFaceW
GdiFlush
GetFontData
GetTextExtentPointI
GetGlyphIndicesW
GetCharABCWidthsW
GetGlyphOutlineW
RemoveFontMemResourceEx
ExtCreatePen

advapi32

RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyW
RegQueryInfoKeyW

shell32

SHGetSpecialFolderPathW
DragFinish
DragQueryFileW
SHChangeNotify
SHGetFolderPathW
ShellExecuteW
Shell_NotifyIconW

ole32

OleLockRunning
RegisterDragDrop
RevokeDragDrop
CoCreateGuid
StringFromGUID2
CoGetClassObject
CreateStreamOnHGlobal
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromString
OleInitialize
OleUninitialize
CoCreateInstance
CLSIDFromProgID

oleaut32

LoadRegTypeLi
VariantInit
LoadTypeLi
OleCreateFontIndirect
SysStringLen
SysAllocStringLen
VarUI4FromStr
SysAllocString
VariantClear
SysFreeString
DispCallFunc

shlwapi

PathFindFileNameW
ord12
StrToIntA
AssocQueryStringW
PathAppendW
StrDupW

comctl32

ord17
_TrackMouseEvent
InitCommonControlsEx

msimg32

AlphaBlend

urlmon

CoInternetCreateZoneManager
CoInternetCreateSecurityManager

gdiplus

GdipDeleteRegion
GdipMeasureString
GdipCloneBrush
GdipRestoreGraphics
GdipRotateWorldTransform
GdipStringFormatGetGenericTypographic
GdipGetCellAscent
GdipSetTextRenderingHint
GdipCloneStringFormat
GdipGetMatrixElements
GdipGetTextureTransform
GdipCreateTexture
GdipBeginContainer2
GdipFillEllipse
GdipCreateFromHDC
GdipGetClipBoundsI
GdipSetImageAttributesWrapMode
GdipDrawString
GdipDrawPath
GdipSetClipRegion
GdipCreateImageAttributes
GdipDrawArcI
GdipGetSmoothingMode
GdipClosePathFigure
GdipSetClipRectI
GdipScaleWorldTransform
GdipSetPixelOffsetMode
GdipDrawRectangle
GdipDrawLine
GdipSetPenDashStyle
GdipGraphicsClear
GdipMultiplyWorldTransform
GdipGetPathWorldBounds
GdipFillPath
GdipTransformRegion
GdipGetFamilyName
GdipGetImageGraphicsContext
GdipSetStringFormatFlags
GdipGetImagePixelFormat
GdipCloneBitmapAreaI
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipCloneImage
GdipBitmapUnlockBits
GdipGetPropertyItem
GdipCreateBitmapFromStream
GdipAlloc
GdipDisposeImage
GdipDeleteFont
GdipImageSelectActiveFrame
GdipBitmapLockBits
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetImageWidth
GdipGetPropertyItemSize
GdiplusStartup
GdiplusShutdown
GdipGetFontSize
GdipTranslateWorldTransform
GdipFillRectangleI
GdipSetStringFormatTrimming
GdipGetFontStyle
GdipCreateSolidFill
GdipCloneBitmapArea
GdipGetCellDescent
GdipSetInterpolationMode
GdipSetLinePresetBlend
GdipCreateFont
GdipSetStringFormatLineAlign
GdipCreatePath
GdipEndContainer
ord1
GdipDeleteGraphics
GdipCloneRegion
GdipDeleteStringFormat
GdipSetSmoothingMode
GdipCreateMatrix
GdipGetStringFormatAlign
GdipDeletePath
GdipDisposeImageAttributes
GdipDeletePen
GdipCreateMatrix2
GdipDeleteBrush
GdipGetLineSpacing
GdipSetLineWrapMode
GdipCreateLineBrushI
GdipDrawImageRectRect
GdipSaveGraphics
GdipCreateFontFamilyFromName
GdipGetEmHeight
GdipGetStringFormatLineAlign
GdipAddPathString
GdipGetTextRenderingHint
GdipGetFamily
GdipSetCompositingQuality
GdipSetImageAttributesColorMatrix
GdipGetLineTransform
GdipDeleteFontFamily
GdipGetInterpolationMode
GdipCreateRegionPath
GdipAddPathLineI
GdipAddPathBezierI
GdipCombineRegionPath
GdipAddPathEllipseI
GdipAddPathArcI
GdipAddPathRectangleI
GdipCombineRegionRegion
GdipGetBrushType
GdipSetLineTransform
GdipSetTextureTransform
GdipCreatePen1
GdipSetStringFormatAlign
GdipDrawImageRectRectI
GdipFree
GdipSetCompositingMode
GdipLoadImageFromFile
GdipCreateBitmapFromResource
GdipSetImageAttributesColorKeys
GdipCreateBitmapFromHBITMAP
GdipCreateHBITMAPFromBitmap
GdipDeleteMatrix

crypt32

CertCloseStore
CryptQueryObject
CertFreeCertificateContext
CryptMsgClose
CertFindCertificateInStore
CertGetNameStringW
CryptMsgGetParam

imm32

ImmAssociateContextEx
ImmGetCompositionStringW
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmNotifyIME

usp10

ScriptShape
ScriptFreeCache
ScriptItemize

winmm

timeGetTime

psapi

GetMappedFileNameW

Exports

Exports

?__autoclassinit2@RCSQLiteConnection@RC@@QAEXI@Z
?__autoclassinit2@RCSQLiteRecordSet@RC@@QAEXI@Z
GetCurrentNotifyAssocEventCount
GetSwitchStatus
Initialize
IsAllowedPopup
IsHitDatabaseItem
NotifyAssocEventWithResult
NotifyAssocEventWithoutResult
ParseFileAssocCloudSettings
TryToCleanDoneAssocEvents
Uninitialize

Sections

.text
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 783KB - Virtual size: 783KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 59KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 245KB - Virtual size: 245KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 179KB - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dddf48f25fb0bdfe3577bf4f9cb58169

Headers

DLL Characteristics

File Characteristics

Imports

version

wininet

basicsqlite

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

urlmon

gdiplus

crypt32

imm32

usp10

winmm

psapi

Exports

Exports

Sections

.text Size: 3.9MB - Virtual size: 3.9MB

.rdata Size: 783KB - Virtual size: 783KB

.data Size: 59KB - Virtual size: 84KB

_RDATA Size: 2KB - Virtual size: 2KB

.rsrc Size: 245KB - Virtual size: 245KB

.reloc Size: 179KB - Virtual size: 179KB

.text
Size: 3.9MB - Virtual size: 3.9MB

.rdata
Size: 783KB - Virtual size: 783KB

.data
Size: 59KB - Virtual size: 84KB

_RDATA
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 245KB - Virtual size: 245KB

.reloc
Size: 179KB - Virtual size: 179KB