8e6b4662823fa6f99bb38b1de00c86a0fbf161125d4aafc7e10a31d0a34cd400

Sharing

Copy URL Twitter E-mail

General

Target

8e6b4662823fa6f99bb38b1de00c86a0fbf161125d4aafc7e10a31d0a34cd400
Size

5.4MB
MD5

26678807dee432b1c38a754b2e5149ed
SHA1

9af148f7eef5d108ba29b34dfb2e5f11c0dba37a
SHA256

8e6b4662823fa6f99bb38b1de00c86a0fbf161125d4aafc7e10a31d0a34cd400
SHA512

cb7b43b59fe7c04447f18f796fd987bd354bc0b6fd7b277b3296f28c2084697c541d144483d8315a1050af06f6508e44e23611885b3db1356b175053a1c50b8a
SSDEEP

98304:wCJpVEUBDsweS3wPtTbUJJzhOaQ6M3Ukk0bii1:wSVswUbAJzhBQ6IUP0b3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e6b4662823fa6f99bb38b1de00c86a0fbf161125d4aafc7e10a31d0a34cd400

Files

8e6b4662823fa6f99bb38b1de00c86a0fbf161125d4aafc7e10a31d0a34cd400
.exe windows x86

2baf1a3ff2801c3303a6996babd3b0d6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetLastError
GetTempPathW
CreateDirectoryW
RemoveDirectoryW
SetFileAttributesW
FindClose
GetLogicalDriveStringsW
GetModuleHandleA
FindFirstFileW
FindNextFileW
LocalFileTimeToFileTime
MoveFileExW
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
GetCurrentDirectoryW
FileTimeToLocalFileTime
ResetEvent
ReleaseSemaphore
CreateSemaphoreW
QueryPerformanceCounter
GetVersionExW
lstrlenA
SystemTimeToFileTime
GetSystemTime
VerifyVersionInfoA
GetSystemDirectoryA
LoadLibraryExW
SleepEx
GetFileInformationByHandle
MultiByteToWideChar
GetProcessHeap
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
GetSystemInfo
SetFileTime
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
HeapFree
GetNativeSystemInfo
CreateFileA
GetFileAttributesExW
GetEnvironmentVariableW
GetCurrentProcess
GetLogicalDrives
SetCurrentDirectoryW
GetModuleFileNameW
SetFilePointerEx
FormatMessageA
LocalFree
FormatMessageW
WideCharToMultiByte
OutputDebugStringW
GetModuleHandleW
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
FindVolumeClose
FindFirstVolumeW
QueryDosDeviceW
DeleteFileW
GetDriveTypeW
GetDiskFreeSpaceExW
VirtualAlloc
VirtualFree
GlobalUnlock
GlobalLock
GlobalAlloc
TerminateThread
GetExitCodeThread
GetLastError
FlushFileBuffers
SetEndOfFile
SetFilePointer
DeviceIoControl
GetVolumeInformationW
WaitForSingleObject
CreateThread
SetEvent
CreateEventW
WaitForMultipleObjects
GetPrivateProfileStringW
WritePrivateProfileStringW
GetTickCount
FreeLibrary
GetFileSize
Sleep
GetFileAttributesW
CreateFileW
OutputDebugStringA
WriteFile
CreateProcessW
CloseHandle
CreatePipe
GetStdHandle
ReadFile
MulDiv
VerifyVersionInfoW
VerSetConditionMask
GetProcAddress
LoadLibraryW
OpenProcess
InterlockedIncrement
GetCurrentProcessId
DeleteCriticalSection
GetSystemDirectoryW
GetCurrentThreadId
InitializeCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
SetStdHandle
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleCP
GetACP
SetConsoleCtrlHandler
ExitProcess
SetEnvironmentVariableA
ExitThread
PeekNamedPipe
WriteConsoleW
SystemTimeToTzSpecificLocalTime
RtlUnwind
UnregisterWaitEx
QueryDepthSList
LeaveCriticalSection
InterlockedDecrement
ExpandEnvironmentStringsA
EnterCriticalSection
TryEnterCriticalSection
DuplicateHandle
WaitForSingleObjectEx
GetCurrentThread
EncodePointer
IsProcessorFeaturePresent
QueueUserWorkItem
QueryPerformanceFrequency
GetStringTypeW
FindFirstFileExW
CopyFileW
AreFileApisANSI
GetCPInfo
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetFileType
GetModuleHandleExW
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
TerminateProcess
LoadLibraryA
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
GetFullPathNameW
GetLongPathNameW
lstrcpyW
WTSGetActiveConsoleSessionId
ReleaseMutex
CreateMutexW
GlobalFree
LocalAlloc
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FileTimeToSystemTime
SetPriorityClass
FlushInstructionCache
HeapCreate
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceW
GetLocalTime
GetVersionExA
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
VirtualProtect
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList

user32

GetWindowLongW
SetWindowLongW
TranslateMessage
DispatchMessageW
PeekMessageW
GetClassNameW
LoadCursorW
DestroyCursor
SetTimer
KillTimer
SetCursor
SetRect
CopyRect
IntersectRect
UnionRect
EqualRect
PtInRect
CallWindowProcW
GetDlgItem
GetActiveWindow
GetClientRect
GetWindowRect
MapWindowPoints
GetParent
GetWindow
MonitorFromWindow
GetMonitorInfoW
SetFocus
GetFocus
EnableWindow
IsWindowEnabled
SetActiveWindow
GetDesktopWindow
SetForegroundWindow
AnimateWindow
SetLayeredWindowAttributes
IsIconic
IsZoomed
GetCapture
SetCapture
ReleaseCapture
UpdateWindow
BeginPaint
EndPaint
InvalidateRect
GetCursorPos
CreateCaret
GetCaretBlinkTime
HideCaret
SetCaretPos
ScreenToClient
DestroyIcon
CharNextW
LoadBitmapW
CreateIconFromResource
LoadImageW
GetMessageW
EnableMenuItem
GetSysColor
IsWindowVisible
SystemParametersInfoA
CharLowerBuffW
MapVirtualKeyA
UpdateLayeredWindow
IsMenu
CreatePopupMenu
DestroyMenu
GetMenuItemCount
AppendMenuW
TrackPopupMenu
GetMenuInfo
SetMenuInfo
GetMenuItemInfoW
SetMenuContextHelpId
MsgWaitForMultipleObjects
DestroyWindow
DefWindowProcW
LoadIconW
wsprintfW
PostQuitMessage
ClientToScreen
IsWindow
ShowWindow
GetForegroundWindow
SetWindowPos
SetWindowTextW
OffsetRect
IsRectEmpty
InflateRect
UnregisterClassW
GetSystemMetrics
CharUpperW
CharPrevExA
LoadStringW
GetKeyState
GetIconInfo
DrawIconEx
InvertRect
FillRect
DrawTextW
GetUserObjectInformationW
GetProcessWindowStation
CreateWindowExW
SendMessageW
GetCursor
RegisterClassExW
PostMessageW
MonitorFromPoint
GetDC
MessageBoxW
ReleaseDC
TrackMouseEvent

gdi32

SetROP2
SetTextColor
GetWorldTransform
SetWorldTransform
CreateDIBSection
ExtCreatePen
GetObjectW
SetRectRgn
SetViewportOrgEx
EnumFontsW
CreateBitmap
StretchBlt
GetCurrentObject
GetViewportOrgEx
SetGraphicsMode
SetBkMode
SelectObject
ExtSelectClipRgn
SaveDC
RoundRect
RestoreDC
Rectangle
RectInRegion
PtInRegion
Pie
OffsetRgn
IntersectClipRect
GetTextExtentPoint32W
GetTextColor
GetStockObject
GetRgnBox
GetClipRgn
GetClipBox
ExcludeClipRect
Ellipse
DeleteObject
GetDeviceCaps
DeleteDC
CreateSolidBrush
CreateRoundRectRgn
CreateRectRgnIndirect
CreateRectRgn
CreatePatternBrush
CreatePen
CreateFontIndirectW
CreateEllipticRgnIndirect
CreateCompatibleDC
CreateCompatibleBitmap
CombineRgn
BitBlt
Arc
Polyline

advapi32

OpenProcessToken
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
RevertToSelf
RegEnumKeyW
DuplicateTokenEx
LookupAccountSidW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExW
RegOpenKeyExW
DeregisterEventSource
RegCloseKey
RegOpenKeyW
RegSetValueExW
RegCreateKeyExW
GetTokenInformation
ImpersonateLoggedOnUser

shell32

ShellExecuteW
ShellExecuteExW
SHGetFolderPathW
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA

ole32

OleInitialize
OleUninitialize
CreateStreamOnHGlobal
CoCreateInstance
CoInitialize
CoUninitialize
OleLockRunning
CLSIDFromString
CLSIDFromProgID
CreateBindCtx

oleaut32

SysFreeString
SysAllocStringLen
VariantClear
SysAllocString
VariantCopy

shlwapi

PathFileExistsW
PathAddBackslashW
StrToIntExW

wininet

InternetReadFile
InternetSetOptionW
InternetCloseHandle
HttpQueryInfoW
InternetOpenUrlW
InternetOpenW
InternetQueryOptionW

ws2_32

setsockopt
getsockopt
connect
closesocket
getsockname
bind
ntohs
socket
accept
WSASetLastError
send
recv
freeaddrinfo
getaddrinfo
WSAGetLastError
WSACleanup
__WSAFDIsSet
getpeername
htons
WSAIoctl
recvfrom
sendto
gethostname
WSAStartup
ioctlsocket
select
listen

gdiplus

GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectI
GdipGraphicsClear
GdipSaveImageToFile
GdiplusStartup
GdiplusShutdown
GdipGetImageHeight
GdipGetPropertyItemSize
GdipDrawImageI
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipGetImageWidth
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipBitmapLockBits
GdipImageSelectActiveFrame
GdipFree
GdipDisposeImage
GdipAlloc
GdipCreateBitmapFromStream
GdipGetPropertyItem
GdipBitmapUnlockBits
GdipCloneImage
GdipImageGetFrameDimensionsCount

setupapi

SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiEnumDeviceInterfaces

wtsapi32

WTSQueryUserToken

imm32

ImmReleaseContext
ImmGetContext
ImmAssociateContext

msimg32

GradientFill
AlphaBlend

wldap32

ord50
ord22
ord41
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord143
ord46
ord211
ord60

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 837KB - Virtual size: 836KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 71KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 173KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2baf1a3ff2801c3303a6996babd3b0d6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

ws2_32

gdiplus

setupapi

wtsapi32

imm32

msimg32

wldap32

version

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.rdata Size: 837KB - Virtual size: 836KB

.data Size: 71KB - Virtual size: 184KB

.gfids Size: 4KB - Virtual size: 4KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.reloc Size: 173KB - Virtual size: 173KB

.text
Size: 2.9MB - Virtual size: 2.9MB

.rdata
Size: 837KB - Virtual size: 836KB

.data
Size: 71KB - Virtual size: 184KB

.gfids
Size: 4KB - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

.reloc
Size: 173KB - Virtual size: 173KB