c13a22eb7f50cc8e254523a3b0694e7fa138eabefd493c3597f9da0223ecfc52

Sharing

Copy URL

Twitter E-mail

General

Target

c13a22eb7f50cc8e254523a3b0694e7fa138eabefd493c3597f9da0223ecfc52
Size

2.6MB
MD5

0ba3f24a13b7fdd846655aaff7da5448
SHA1

1ee8546e7d2b07207fce49499fb39eaa7c4e27cc
SHA256

c13a22eb7f50cc8e254523a3b0694e7fa138eabefd493c3597f9da0223ecfc52
SHA512

5a6ca02b6f8f9fce954d3ff98c9a6a83322c434b09850315e4b8a500a30a358db7577e6347d38b7e315ee2e1e125f30cf4da7bb587424bd95ac703a68ee9cc5d
SSDEEP

49152:q9e9ys4ORM+43x3DltGnm225r1o+ckiF8LCL6hp/Jf:q9KRKFH2Grk8LCL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c13a22eb7f50cc8e254523a3b0694e7fa138eabefd493c3597f9da0223ecfc52

Files

c13a22eb7f50cc8e254523a3b0694e7fa138eabefd493c3597f9da0223ecfc52
.exe windows x86

e263d6a17b793718551d665c4a05dd12

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareStringW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
lstrcmpW
GetLocalTime
GetFileSizeEx
GetFileSize
lstrlenA
FindNextFileW
FindClose
GetCurrentThread
GetOverlappedResult
CreateNamedPipeW
SetNamedPipeHandleState
DisconnectNamedPipe
ConnectNamedPipe
WriteFile
ReadFile
ReleaseMutex
MulDiv
WinExec
LoadLibraryA
WriteProcessMemory
VirtualFreeEx
VirtualAllocEx
GetTickCount
OpenProcess
CreateRemoteThread
SetLastError
MoveFileExW
WaitForMultipleObjects
Sleep
CreateEventW
ResetEvent
SetEvent
SetFileAttributesW
IsBadReadPtr
lstrcmpiW
SetProcessDEPPolicy
LoadLibraryExW
VirtualProtect
GetSystemDirectoryW
GetStartupInfoW
CreateProcessW
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
SetStdHandle
ReadConsoleW
CreateProcessA
GetExitCodeProcess
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetStdHandle
GetCurrentThreadId
GetCurrentProcessId
CreateMutexW
WaitForSingleObject
InitializeCriticalSectionEx
SetUnhandledExceptionFilter
RaiseException
DecodePointer
DeleteFileW
SetFilePointer
GetCommandLineW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
CloseHandle
CreateFileW
WideCharToMultiByte
lstrlenW
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCurrentProcess
GetLastError
MultiByteToWideChar
FindResourceW
SizeofResource
LockResource
LoadResource
FreeLibrary
FindResourceExW
DeleteCriticalSection
LeaveCriticalSection
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileType
VirtualQuery
GetSystemInfo
GetModuleHandleExW
ExitThread
GetFileAttributesExW
RtlUnwind
OpenFileMappingW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
ReleaseSemaphore
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
FlushFileBuffers
GetVersionExW
GetSystemWindowsDirectoryW
InterlockedCompareExchange
CreateFileA
EnterCriticalSection
InitializeCriticalSection
lstrcmpiA
lstrcmpA
DeviceIoControl
TerminateProcess
UnhandledExceptionFilter
GetTempFileNameW
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
GetVersion
ResumeThread
SetEndOfFile
FreeResource
ExitProcess
GetACP
LocalFree
GetTempPathW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
InterlockedDecrement
InterlockedIncrement
InterlockedExchangeAdd
lstrcpynW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
LoadLibraryExA
VirtualFree
VirtualAlloc
GetStringTypeW
FormatMessageW
DuplicateHandle
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
TryEnterCriticalSection
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
QueryPerformanceCounter
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent

user32

CopyRect
TranslateMessage
DispatchMessageW
PeekMessageW
SendMessageW
GetCursorPos
DefWindowProcW
DestroyWindow
CharNextW
FindWindowW
GetMessageW
EnumDisplayMonitors
GetMonitorInfoW
SendMessageTimeoutW
IsWindow
SetWindowPos
PostMessageW
PtInRect
CallWindowProcW
GetClassNameW
EnumWindows
GetParent
FillRect
GetWindowTextW
SetWindowTextW
RemovePropW
GetPropW
SetPropW
LoadStringW
GetClientRect
UpdateWindow
DestroyIcon
LoadIconW
DrawTextW
GetActiveWindow
MonitorFromWindow
wvsprintfW
InflateRect
UnionRect
OffsetRect
GetDC
ReleaseDC
MonitorFromPoint
IsChild
UpdateLayeredWindow
IsZoomed
GetFocus
GetKeyState
SetCapture
ReleaseCapture
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
CreateCaret
GetCaretBlinkTime
SetCaretPos
MapWindowPoints
IntersectRect
IsRectEmpty
GetWindow
RegisterClassW
EnableWindow
LoadImageW
IsIconic
SetWindowRgn
MessageBoxW
DrawIconEx
CharPrevW
SetRect
GetIconInfo
HideCaret
ShowCaret
GetSysColor
SetLayeredWindowAttributes
RedrawWindow
GetWindowTextLengthW
CreateAcceleratorTableW
InvalidateRgn
IsWindowEnabled
GetWindowDC
SetRectEmpty
LockWorkStation
LoadCursorW
GetWindowThreadProcessId
FindWindowExW
EqualRect
ScreenToClient
ClientToScreen
SetCursor
GetWindowRect
SetForegroundWindow
SetActiveWindow
KillTimer
SetTimer
SetFocus
IsWindowVisible
MoveWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
PostQuitMessage
UnregisterHotKey
RegisterHotKey
TrackMouseEvent
RegisterWindowMessageW
SystemParametersInfoW
wsprintfW
SetWindowLongW
GetWindowLongW
ShowWindow

gdi32

CreateRectRgnIndirect
GetCharABCWidthsW
GetClipBox
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
SetDIBColorTable
TextOutW
ExtTextOutW
GetDIBits
SetDIBitsToDevice
CombineRgn
CreateRoundRectRgn
SetWindowOrgEx
GetTextMetricsW
SaveDC
RestoreDC
Rectangle
CreatePen
CreateFontIndirectW
CreateCompatibleBitmap
BitBlt
GetDeviceCaps
CreateDCW
DeleteDC
GetTextExtentPoint32W
SelectObject
CreateCompatibleDC
CreateSolidBrush
DeleteObject
CreateDIBSection
GetObjectW
GetStockObject

comdlg32

ChooseColorW

advapi32

RegOpenKeyExW
RegCreateKeyW
RegNotifyChangeKeyValue
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
OpenProcessToken
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegGetValueW
RegCloseKey
RegEnumKeyExA
RegQueryValueExA
RegOpenKeyExA

shell32

SHFileOperationW
ShellExecuteW
ord75
ShellExecuteExW
SHGetSpecialFolderPathW
SHGetFolderPathW
Shell_NotifyIconW
ord165

ole32

CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoCreateGuid
CreateStreamOnHGlobal
OleLockRunning
CLSIDFromProgID
CLSIDFromString
CoInitialize
OleInitialize
CoUninitialize

oleaut32

SafeArrayCreate
SafeArrayPutElement
VariantInit
SysAllocString
SysFreeString
VarUI4FromStr
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocStringLen
SysStringLen
VariantClear
VarBstrCmp

shlwapi

StrTrimA
StrCmpNIW
StrStrIA
StrStrIW
PathFindFileNameW
SHSetValueA
StrCpyW
StrCmpIW
SHGetValueW
PathIsDirectoryW
PathCombineW
PathRemoveFileSpecW
PathFileExistsW
PathAppendW
wnsprintfW
SHGetValueA
PathFindExtensionW
SHAutoComplete

comctl32

ImageList_DrawEx
InitCommonControlsEx
_TrackMouseEvent
ord17

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

gdiplus

GdipDisposeImage
GdipLoadImageFromStreamICM
GdipDrawImagePointsI
GdipFillPath
GdipGraphicsClear
GdipCloneBitmapAreaI
GdipCreateBitmapFromStream
GdipCreateTexture
GdipClosePathFigure
GdipSaveImageToFile
GdipCloneImage
GdipGetImageHeight
GdipImageGetFrameDimensionsList
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusShutdown
GdipCreateBitmapFromHBITMAP
GdipCreateHBITMAPFromBitmap
GdipDrawImageRectRectI
GdipFree
GdipAlloc
GdiplusStartup
GdipGetImageWidth
GdipImageGetFrameDimensionsCount
GdipDrawImageRectI
GdipSetInterpolationMode
GdipGetImagePixelFormat
GdipGetImageGraphicsContext
GdipImageGetFrameCount
GdipCreateBitmapFromFile
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipCreatePath
GdipDeletePath
GdipAddPathLineI
GdipAddPathArcI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipSetPenDashStyle
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawLineI
GdipDrawRectangleI
GdipDrawPath
GdipFillEllipseI
GdipAddPathArc
GdipDrawEllipseI
GdipLoadImageFromFile
GdipImageSelectActiveFrame

sensapi

IsNetworkAlive

wininet

InternetCrackUrlW
DeleteUrlCacheEntryW
InternetGetConnectedState

iphlpapi

GetAdaptersInfo

crypt32

CertGetNameStringW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

msimg32

AlphaBlend
GradientFill

urlmon

URLDownloadToFileW
URLDownloadToCacheFileW

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 313KB - Virtual size: 313KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 781KB - Virtual size: 781KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e263d6a17b793718551d665c4a05dd12

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

version

gdiplus

sensapi

wininet

iphlpapi

crypt32

wintrust

msimg32

urlmon

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 313KB - Virtual size: 313KB

.data Size: 30KB - Virtual size: 54KB

.rsrc Size: 781KB - Virtual size: 781KB

.reloc Size: 88KB - Virtual size: 88KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 313KB - Virtual size: 313KB

.data
Size: 30KB - Virtual size: 54KB

.rsrc
Size: 781KB - Virtual size: 781KB

.reloc
Size: 88KB - Virtual size: 88KB