7100135d3b1b4b4942df6b8492a6353cfbd994718d0e8f050974bbe7e2d95f8d

Sharing

Copy URL Twitter E-mail

General

Target

7100135d3b1b4b4942df6b8492a6353cfbd994718d0e8f050974bbe7e2d95f8d
Size

2.6MB
MD5

c32e8a2648023f1ed896b4ccba0900d2
SHA1

99e0494989416ed964abe667beb6797894ee6126
SHA256

7100135d3b1b4b4942df6b8492a6353cfbd994718d0e8f050974bbe7e2d95f8d
SHA512

bc9912a09a3e3cf69391c98b5dece309f0bd8849763a012c7910be4abcf7ecea9e6d1ca0989afab3865062680850a58759880c4af9d16c586cceb45622aa789e
SSDEEP

49152:d6haTFmZW6MF7UwvFdqrZ3siy+zckNF8LCLz7VWO:d6rWnJE3jyA8LCL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7100135d3b1b4b4942df6b8492a6353cfbd994718d0e8f050974bbe7e2d95f8d

Files

7100135d3b1b4b4942df6b8492a6353cfbd994718d0e8f050974bbe7e2d95f8d
.exe windows x86

e263d6a17b793718551d665c4a05dd12

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareStringW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
lstrcmpW
GetLocalTime
GetFileSizeEx
GetFileSize
lstrlenA
FindNextFileW
FindClose
GetCurrentThread
GetOverlappedResult
CreateNamedPipeW
SetNamedPipeHandleState
DisconnectNamedPipe
ConnectNamedPipe
WriteFile
ReadFile
ReleaseMutex
MulDiv
WinExec
LoadLibraryA
WriteProcessMemory
VirtualFreeEx
VirtualAllocEx
GetTickCount
OpenProcess
CreateRemoteThread
SetLastError
MoveFileExW
WaitForMultipleObjects
Sleep
CreateEventW
ResetEvent
SetEvent
SetFileAttributesW
IsBadReadPtr
lstrcmpiW
SetProcessDEPPolicy
LoadLibraryExW
VirtualProtect
GetSystemDirectoryW
GetStartupInfoW
CreateProcessW
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
SetStdHandle
ReadConsoleW
CreateProcessA
GetExitCodeProcess
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetStdHandle
GetCurrentThreadId
GetCurrentProcessId
CreateMutexW
WaitForSingleObject
InitializeCriticalSectionEx
SetUnhandledExceptionFilter
RaiseException
DecodePointer
DeleteFileW
SetFilePointer
GetCommandLineW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
CloseHandle
CreateFileW
WideCharToMultiByte
lstrlenW
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCurrentProcess
GetLastError
MultiByteToWideChar
FindResourceW
SizeofResource
LockResource
LoadResource
FreeLibrary
FindResourceExW
DeleteCriticalSection
LeaveCriticalSection
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileType
VirtualQuery
GetSystemInfo
GetModuleHandleExW
ExitThread
GetFileAttributesExW
RtlUnwind
OpenFileMappingW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
ReleaseSemaphore
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
FlushFileBuffers
GetVersionExW
GetSystemWindowsDirectoryW
InterlockedCompareExchange
CreateFileA
EnterCriticalSection
InitializeCriticalSection
lstrcmpiA
lstrcmpA
DeviceIoControl
TerminateProcess
UnhandledExceptionFilter
GetTempFileNameW
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
GetVersion
ResumeThread
SetEndOfFile
FreeResource
ExitProcess
GetACP
LocalFree
GetTempPathW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
InterlockedDecrement
InterlockedIncrement
InterlockedExchangeAdd
lstrcpynW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
LoadLibraryExA
VirtualFree
VirtualAlloc
GetStringTypeW
FormatMessageW
DuplicateHandle
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
TryEnterCriticalSection
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
QueryPerformanceCounter
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent

user32

CopyRect
TranslateMessage
DispatchMessageW
PeekMessageW
SendMessageW
GetCursorPos
DefWindowProcW
DestroyWindow
CharNextW
FindWindowW
GetMessageW
EnumDisplayMonitors
GetMonitorInfoW
SendMessageTimeoutW
IsWindow
SetWindowPos
PostMessageW
PtInRect
CallWindowProcW
GetClassNameW
EnumWindows
GetParent
FillRect
GetWindowTextW
SetWindowTextW
RemovePropW
GetPropW
SetPropW
LoadStringW
GetClientRect
UpdateWindow
DestroyIcon
LoadIconW
DrawTextW
GetActiveWindow
MonitorFromWindow
wvsprintfW
InflateRect
UnionRect
OffsetRect
GetDC
ReleaseDC
MonitorFromPoint
IsChild
UpdateLayeredWindow
IsZoomed
GetFocus
GetKeyState
SetCapture
ReleaseCapture
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
CreateCaret
GetCaretBlinkTime
SetCaretPos
MapWindowPoints
IntersectRect
IsRectEmpty
GetWindow
RegisterClassW
EnableWindow
LoadImageW
IsIconic
SetWindowRgn
MessageBoxW
DrawIconEx
CharPrevW
SetRect
GetIconInfo
HideCaret
ShowCaret
GetSysColor
SetLayeredWindowAttributes
RedrawWindow
GetWindowTextLengthW
CreateAcceleratorTableW
InvalidateRgn
IsWindowEnabled
GetWindowDC
SetRectEmpty
LockWorkStation
LoadCursorW
GetWindowThreadProcessId
FindWindowExW
EqualRect
ScreenToClient
ClientToScreen
SetCursor
GetWindowRect
SetForegroundWindow
SetActiveWindow
KillTimer
SetTimer
SetFocus
IsWindowVisible
MoveWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
PostQuitMessage
UnregisterHotKey
RegisterHotKey
TrackMouseEvent
RegisterWindowMessageW
SystemParametersInfoW
wsprintfW
SetWindowLongW
GetWindowLongW
ShowWindow

gdi32

CreateRectRgnIndirect
GetCharABCWidthsW
GetClipBox
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
SetDIBColorTable
TextOutW
ExtTextOutW
GetDIBits
SetDIBitsToDevice
CombineRgn
CreateRoundRectRgn
SetWindowOrgEx
GetTextMetricsW
SaveDC
RestoreDC
Rectangle
CreatePen
CreateFontIndirectW
CreateCompatibleBitmap
BitBlt
GetDeviceCaps
CreateDCW
DeleteDC
GetTextExtentPoint32W
SelectObject
CreateCompatibleDC
CreateSolidBrush
DeleteObject
CreateDIBSection
GetObjectW
GetStockObject

comdlg32

ChooseColorW

advapi32

RegOpenKeyExW
RegCreateKeyW
RegNotifyChangeKeyValue
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
OpenProcessToken
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegGetValueW
RegCloseKey
RegEnumKeyExA
RegQueryValueExA
RegOpenKeyExA

shell32

SHFileOperationW
ShellExecuteW
ord75
ShellExecuteExW
SHGetSpecialFolderPathW
SHGetFolderPathW
Shell_NotifyIconW
ord165

ole32

CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoCreateGuid
CreateStreamOnHGlobal
OleLockRunning
CLSIDFromProgID
CLSIDFromString
CoInitialize
OleInitialize
CoUninitialize

oleaut32

SafeArrayCreate
SafeArrayPutElement
VariantInit
SysAllocString
SysFreeString
VarUI4FromStr
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocStringLen
SysStringLen
VariantClear
VarBstrCmp

shlwapi

StrTrimA
StrCmpNIW
StrStrIA
StrStrIW
PathFindFileNameW
SHSetValueA
StrCpyW
StrCmpIW
SHGetValueW
PathIsDirectoryW
PathCombineW
PathRemoveFileSpecW
PathFileExistsW
PathAppendW
wnsprintfW
SHGetValueA
PathFindExtensionW
SHAutoComplete

comctl32

ImageList_DrawEx
InitCommonControlsEx
_TrackMouseEvent
ord17

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

gdiplus

GdipDisposeImage
GdipLoadImageFromStreamICM
GdipDrawImagePointsI
GdipFillPath
GdipGraphicsClear
GdipCloneBitmapAreaI
GdipCreateBitmapFromStream
GdipCreateTexture
GdipClosePathFigure
GdipSaveImageToFile
GdipCloneImage
GdipGetImageHeight
GdipImageGetFrameDimensionsList
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusShutdown
GdipCreateBitmapFromHBITMAP
GdipCreateHBITMAPFromBitmap
GdipDrawImageRectRectI
GdipFree
GdipAlloc
GdiplusStartup
GdipGetImageWidth
GdipImageGetFrameDimensionsCount
GdipDrawImageRectI
GdipSetInterpolationMode
GdipGetImagePixelFormat
GdipGetImageGraphicsContext
GdipImageGetFrameCount
GdipCreateBitmapFromFile
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipCreatePath
GdipDeletePath
GdipAddPathLineI
GdipAddPathArcI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipSetPenDashStyle
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawLineI
GdipDrawRectangleI
GdipDrawPath
GdipFillEllipseI
GdipAddPathArc
GdipDrawEllipseI
GdipLoadImageFromFile
GdipImageSelectActiveFrame

sensapi

IsNetworkAlive

wininet

InternetCrackUrlW
DeleteUrlCacheEntryW
InternetGetConnectedState

iphlpapi

GetAdaptersInfo

crypt32

CertGetNameStringW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

msimg32

AlphaBlend
GradientFill

urlmon

URLDownloadToFileW
URLDownloadToCacheFileW

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 313KB - Virtual size: 312KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 781KB - Virtual size: 781KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e263d6a17b793718551d665c4a05dd12

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

version

gdiplus

sensapi

wininet

iphlpapi

crypt32

wintrust

msimg32

urlmon

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 313KB - Virtual size: 312KB

.data Size: 30KB - Virtual size: 54KB

.rsrc Size: 781KB - Virtual size: 781KB

.reloc Size: 88KB - Virtual size: 88KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 313KB - Virtual size: 312KB

.data
Size: 30KB - Virtual size: 54KB

.rsrc
Size: 781KB - Virtual size: 781KB

.reloc
Size: 88KB - Virtual size: 88KB