c170f1db831dd58611163af039f50fc840876c8ca30dd3a5edbbda3cd2706bf6

Sharing

Copy URL Twitter E-mail

General

Target

c170f1db831dd58611163af039f50fc840876c8ca30dd3a5edbbda3cd2706bf6
Size

1.6MB
MD5

2ff8beaf8a71d0b7afff6bc8e6fb855f
SHA1

d535724d00f7c080dc02b8f9c8a90b58d7a2275b
SHA256

c170f1db831dd58611163af039f50fc840876c8ca30dd3a5edbbda3cd2706bf6
SHA512

d53268a2f2a6353e929bd78312d0ca69dd32ff93569aceb08ddb0a3c3aebe2de8635003149e1618f4f8887345af409cf77c05716bda96f769850aa42cdb5fa31
SSDEEP

49152:qon6oWC1pHYo4aBuKpWbVw5v+2CVHhaLYWimn1Ii/7gThuqI:PSCgKpWbVw5v+MQuq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c170f1db831dd58611163af039f50fc840876c8ca30dd3a5edbbda3cd2706bf6

Files

c170f1db831dd58611163af039f50fc840876c8ca30dd3a5edbbda3cd2706bf6
.exe windows x86

8572091e4f72fd6e7342e88034da1484

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

sqlite3

sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_text
sqlite3_changes
sqlite3_close
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_count
sqlite3_column_name
sqlite3_column_text
sqlite3_column_type
sqlite3_errmsg
sqlite3_exec
sqlite3_finalize
sqlite3_free_table
sqlite3_get_table
sqlite3_key
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_open
sqlite3_prepare
sqlite3_rekey
sqlite3_step

mxqfconv

_ConvCcm2Pgn@8
_ConvChe2Pgn@8
_ConvChn2Pgn@8
_ConvInit@4
_ConvMxq2Pgn@8
_ConvXqf2Pgn@8

ecco

_EccoIndex@4
_EccoInitOpenVar@4
_EccoOpening@4
_EccoVariation@4

cchess

_CchessBoard2Fen@4
_CchessChin2File@8
_CchessFen2Board@8
_CchessFile2Chin@8
_CchessFile2Move@8
_CchessGenMoves@8
_CchessInit@4
_CchessMove2File@8
_CchessPromotion@4
_CchessSetIrrev@4
_CchessTryMove@12
_CchessUndoMove@4

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW

comctl32

InitCommonControlsEx
SetWindowSubclass

comdlg32

GetOpenFileNameW
GetSaveFileNameW

gdi32

AddFontMemResourceEx
BeginPath
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
CreateDIBSection
CreateFontIndirectW
CreateHatchBrush
CreatePen
CreateRoundRectRgn
CreateSolidBrush
DeleteDC
DeleteObject
Ellipse
EndPath
ExcludeClipRect
GdiAlphaBlend
GetCurrentObject
GetDeviceCaps
GetObjectW
GetPixel
GetStockObject
GetTextColor
GetTextExtentPoint32A
GetTextExtentPoint32W
LineTo
MoveToEx
Polyline
Rectangle
RoundRect
SelectObject
SetBkColor
SetBkMode
SetStretchBltMode
SetTextColor
StretchBlt
StrokePath
TextOutW

gdiplus

GdipAddPathArc
GdipAddPathBezier
GdipAddPathLine
GdipAddPathString
GdipBitmapGetPixel
GdipBitmapSetPixel
GdipClosePathFigure
GdipCreateAdjustableArrowCap
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromStream
GdipCreateFontFamilyFromName
GdipCreateFromHDC
GdipCreateHBITMAPFromBitmap
GdipCreateHICONFromBitmap
GdipCreateLineBrush
GdipCreatePath
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipDeleteCustomLineCap
GdipDeleteFontFamily
GdipDeleteGraphics
GdipDeletePath
GdipDeletePen
GdipDisposeImage
GdipDrawEllipse
GdipDrawImageRect
GdipDrawImageRectRect
GdipDrawLine
GdipDrawPath
GdipDrawPolygon
GdipDrawRectangle
GdipFillEllipse
GdipFillPath
GdipFillPolygon
GdipFillRectangle
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipGetImageHeight
GdipGetImageWidth
GdipGetMatrixElements
GdipGetPathGradientPointCount
GdipGetPenFillType
GdipLoadImageFromFile
GdipSaveImageToFile
GdipSetImageAttributesRemapTable
GdipSetPenCustomEndCap
GdipSetPenCustomStartCap
GdipSetSmoothingMode
GdipWindingModeOutline
GdiplusShutdown
GdiplusStartup

kernel32

CloseHandle
CompareStringW
CreateDirectoryW
CreateFileW
CreatePipe
CreateProcessW
CreateWaitableTimerA
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileW
FindNextFileW
FindResourceW
FreeLibrary
GetCommandLineW
GetConsoleCP
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatW
GetExitCodeThread
GetFileAttributesW
GetFileSize
GetFileSizeEx
GetLargestConsoleWindowSize
GetLastError
GetLocaleInfoA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetPrivateProfileStringA
GetPrivateProfileStringW
GetProcAddress
GetProcessHeap
GetProcessTimes
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetVersionExW
GlobalAlloc
GlobalFree
GlobalLock
GlobalSize
GlobalUnlock
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LoadResource
LocalFree
LockResource
MoveFileW
MulDiv
MultiByteToWideChar
PeekConsoleInputA
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleInputA
ReadFile
SetConsoleCtrlHandler
SetConsoleMode
SetConsoleWindowInfo
SetCurrentDirectoryW
SetUnhandledExceptionFilter
SetWaitableTimer
SizeofResource
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteConsoleInputA
WriteFile
WritePrivateProfileStringA
WritePrivateProfileStringW
lstrcmpiW

msvcrt

__getmainargs
__initenv
__lconv_init
__p__acmdln
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_beginthreadex
_cexit
_controlfp
_errno
_fmode
_fpreset
_i64toa
_i64tow
_initterm
_iob
_itoa
_itow
_onexit
_snprintf
_snwprintf
_strdup
_strnicmp
_ui64toa
_ui64tow
_ultoa
_ultow
_wtoi64
abort
atoi
calloc
exit
fprintf
fputs
free
fwrite
isalpha
islower
isspace
isupper
localtime
iswctype
localeconv
log10
malloc
mbstowcs
memset
memcmp
memcpy
memmove
modf
pow
qsort
rand
realloc
setlocale
signal
sprintf
srand
strcat
strchr
strcpy
strlen
strncmp
strtol
strtoul
time
tolower
toupper
towupper
vfprintf
wcscmp
wcscspn
wcslen
wcsncmp
wcsstr
wcstod
wcstombs
wcstoul

ole32

CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoGetClassObject
CoGetObject
CoInitialize
CoTaskMemFree
CoUninitialize
CreateStreamOnHGlobal

oleaut32

SafeArrayAccessData
SafeArrayUnaccessData
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
SystemTimeToVariantTime
VarBstrFromDec
VarCat
VariantClear
VariantCopy

shell32

CommandLineToArgvW
DragQueryFileW
ExtractAssociatedIconW
ExtractIconW
SHFileOperationW
SHGetPathFromIDListW
ShellExecuteA
ShellExecuteW

shlwapi

PathRemoveBackslashW

user32

AdjustWindowRectEx
AppendMenuW
BeginDeferWindowPos
BeginPaint
CallNextHookEx
CallWindowProcW
CloseClipboard
CopyAcceleratorTableW
CreateAcceleratorTableW
CreateIconIndirect
CreatePopupMenu
CreateWindowExW
DefWindowProcW
DeferWindowPos
DeleteMenu
DestroyAcceleratorTable
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageW
DrawIconEx
DrawMenuBar
DrawTextW
EmptyClipboard
EnableWindow
EndDeferWindowPos
EndPaint
EnumThreadWindows
FillRect
FindWindowExW
FindWindowW
FlashWindowEx
GetActiveWindow
GetAncestor
GetAsyncKeyState
GetClassLongW
GetClassNameA
GetClassNameW
GetClientRect
GetClipboardData
GetCursorPos
GetDC
GetDesktopWindow
GetDlgCtrlID
GetDlgItem
GetFocus
GetForegroundWindow
GetIconInfo
GetKeyState
GetMenu
GetMessageW
GetParent
GetPropW
GetScrollInfo
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMetrics
GetWindow
GetWindowDC
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextLengthW
GetWindowThreadProcessId
IntersectRect
InvalidateRect
IsClipboardFormatAvailable
IsDialogMessageW
IsIconic
IsWindow
IsWindowEnabled
IsWindowVisible
IsZoomed
KillTimer
LoadCursorW
LoadIconA
LoadImageA
LoadImageW
LoadStringW
MapVirtualKeyA
MapWindowPoints
MessageBoxW
ModifyMenuW
MsgWaitForMultipleObjects
OpenClipboard
OpenIcon
PeekMessageW
PostMessageW
PostQuitMessage
PtInRect
RegisterClassExW
ReleaseCapture
ReleaseDC
RemovePropW
ScreenToClient
SendMessageA
SendMessageTimeoutW
SendMessageW
SetCapture
SetClassLongW
SetClipboardData
SetCursor
SetFocus
SetForegroundWindow
SetLayeredWindowAttributes
SetMenuItemBitmaps
SetMenuItemInfoW
SetParent
SetPropW
SetRect
SetScrollInfo
SetTimer
SetWinEventHook
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowRgn
SetWindowsHookExW
ShowWindow
SystemParametersInfoW
TrackMouseEvent
TrackPopupMenu
TranslateAcceleratorW
TranslateMDISysAccel
TranslateMessage
UnhookWinEvent
UnhookWindowsHookEx
UnregisterClassW
UpdateLayeredWindow
UpdateWindow
VkKeyScanA
WindowFromPoint

uxtheme

SetWindowTheme

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

HttpOpenRequestA
HttpSendRequestA
InternetCloseHandle
InternetConnectA
InternetOpenA
InternetReadFile

winmm

PlaySoundW

ws2_32

WSAStartup
closesocket
connect
gethostbyname
htons
inet_addr
recv
send
socket

Exports

Exports

BACKCSERVICE@20
CLOSECSERVICE@4
OPENCOLORDIALOG@8
OPENCSERVICE@16

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 108KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 163B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 301KB - Virtual size: 301KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8572091e4f72fd6e7342e88034da1484

Headers

File Characteristics

Imports

sqlite3

mxqfconv

ecco

cchess

advapi32

comctl32

comdlg32

gdi32

gdiplus

kernel32

msvcrt

ole32

oleaut32

shell32

shlwapi

user32

uxtheme

version

wininet

winmm

ws2_32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.data Size: 53KB - Virtual size: 52KB

.rdata Size: 38KB - Virtual size: 37KB

.bss Size: - Virtual size: 108KB

.edata Size: 512B - Virtual size: 163B

.idata Size: 15KB - Virtual size: 15KB

.CRT Size: 512B - Virtual size: 52B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 301KB - Virtual size: 301KB

.reloc Size: 34KB - Virtual size: 34KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 53KB - Virtual size: 52KB

.rdata
Size: 38KB - Virtual size: 37KB

.bss
Size: - Virtual size: 108KB

.edata
Size: 512B - Virtual size: 163B

.idata
Size: 15KB - Virtual size: 15KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 301KB - Virtual size: 301KB

.reloc
Size: 34KB - Virtual size: 34KB