4bfb79ff2747cf68bde41593ca082752bced3ba3431fa680d046516045b42c2e

Sharing

Copy URL Twitter E-mail

General

Target

4bfb79ff2747cf68bde41593ca082752bced3ba3431fa680d046516045b42c2e
Size

420KB
MD5

7dd856d165448681c6729296c9a102ac
SHA1

349c0cb9a867a2698caf265d631213f896462e97
SHA256

4bfb79ff2747cf68bde41593ca082752bced3ba3431fa680d046516045b42c2e
SHA512

520844eada19ece418845cce069d5c483123a0d095afd818378d14a26c9f3d37646bfabbab27031c08213499fc912dca6c07f59c6a2c628a0094bd92ff3c3436
SSDEEP

6144:ul073J3gpJ1K4t1O9rdDWK4t0+eoJAbB3T+cbJp:z3Jwp/KMqJk0+5cCIJp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4bfb79ff2747cf68bde41593ca082752bced3ba3431fa680d046516045b42c2e

Files

4bfb79ff2747cf68bde41593ca082752bced3ba3431fa680d046516045b42c2e
.exe windows x64

d1884757532ce7b0014241f40262c929

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceEvent
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW

kernel32

GetTickCount
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW
GetVersionExA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
OutputDebugStringA
CreateMutexW
lstrlenA
MultiByteToWideChar
ReleaseMutex
GetVersionExW
GetSystemDefaultUILanguage
Sleep
CloseHandle
WriteFile
lstrlenW
CreateFileW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
EnterCriticalSection
LeaveCriticalSection
RegisterApplicationRestart
HeapSetInformation
DeleteFileW
GetTempPathW
FreeLibrary
WideCharToMultiByte
GetProcAddress
LoadLibraryW
ExpandEnvironmentStringsW
RaiseException
GlobalDeleteAtom
GlobalAddAtomW
GetLastError
GetCurrentThreadId
SetLastError

gdi32

CreateCompatibleBitmap
CreatePen
CreateRectRgnIndirect
CreateRectRgn
CombineRgn
GetStockObject
Rectangle
SelectObject
GetDeviceCaps
DeleteObject
SetTextColor
SetBkMode
GetLayout
GetClipRgn
SelectClipRgn
GetObjectW
CreatePolygonRgn
OffsetRgn
FillRgn
PatBlt
CreateCompatibleDC
DeleteDC
CreateDIBSection
BitBlt
SetLayout
CreateSolidBrush

user32

MapWindowPoints
GetMonitorInfoW
CopyRect
UnregisterClassA
DeferWindowPos
BeginDeferWindowPos
SetCursor
GetIconInfo
GetWindowTextW
CallWindowProcW
DrawIconEx
OffsetRect
GetWindowRgnBox
UnregisterHotKey
GetWindowLongW
GetForegroundWindow
DestroyMenu
CheckMenuRadioItem
GetSystemMetrics
IsWindowVisible
ShowWindow
ReleaseDC
LoadCursorW
RegisterClassW
GetWindowLongPtrW
SetWindowLongPtrW
BeginPaint
LoadMenuW
SetCapture
ReleaseCapture
UnionRect
InvalidateRect
GetPropW
SetPropW
IntersectRect
EnumDisplayMonitors
IsIconic
PtInRect
GetWindow
LogicalToPhysicalPoint
SetRect
CloseClipboard
OpenClipboard
EmptyClipboard
SetClipboardData
GetClassNameW
GetParent
LoadAcceleratorsW
GetWindowRect
TranslateAcceleratorW
LoadStringW
CreateWindowExW
AdjustWindowRect
RegisterHotKey
DestroyWindow
MonitorFromWindow
EndDeferWindowPos
LoadIconW
GetSubMenu
LoadImageW
SetClassLongPtrW
SetWindowTextW
IsZoomed
DialogBoxParamW
CheckDlgButton
IsDlgButtonChecked
GetClientRect
DrawFocusRect
DrawTextW
GetProcessDefaultLayout
TrackPopupMenuEx
SetScrollInfo
GetScrollInfo
SetFocus
DefWindowProcW
PostMessageW
GetMessageW
TranslateMessage
DispatchMessageW
EndPaint
AdjustWindowRectEx
InflateRect
FillRect
SendMessageW
EndDialog
GetDlgItem
GetDC
SetForegroundWindow
OpenIcon
FindWindowW
MessageBoxW
GetSysColor
SetWindowPos
GetWindowDC
GetDesktopWindow
PostQuitMessage
SystemParametersInfoW

msvcrt

__CxxFrameHandler3
??3@YAXPEAX@Z
??_V@YAXPEAX@Z
free
_vsnwprintf
??_U@YAPEAX_K@Z
??2@YAPEAX_K@Z
_wcsicmp
memcpy_s
wcscspn
wcsspn
memmove_s
malloc
_resetstkoflw
strstr
_vscwprintf
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UEAA@XZ
_errno
realloc
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_cexit
_ismbblead
_exit
_XcptFilter
__getmainargs
memset
__C_specific_handler
vswprintf_s
_CxxThrowException

ntdll

WinSqmIncrementDWORD
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EtwTraceMessage
WinSqmIsOptedIn

gdiplus

GdipSaveImageToStream
GdipMeasureString
GdipSetStringFormatFlags
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipCreateStringFormat
GdipCreateFontFromLogfontW
GdipDeleteStringFormat
GdipDeleteFont
GdipDrawString
GdipFillRectangle
GdipCreateLineBrushFromRect
GdipGetImageEncodersSize
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipFillEllipseI
GdipSetSmoothingMode
GdiplusStartup
GdiplusShutdown
GdipDeleteGraphics
GdipFillRectangleI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreateFromHDC
GdipFree
GdipAlloc
GdipGetImageEncoders

comctl32

ImageList_Create
ImageList_Add
ord380
ImageList_Destroy
ord345
InitCommonControlsEx

shlwapi

UrlCreateFromPathW
PathFindExtensionW
StrStrA
PathIsURLW
StrChrW
ord487
PathFindFileNameW
ord158
SHRegGetUSValueW
PathRemoveExtensionW

shell32

ShellAboutW
ord75
SHCreateItemInKnownFolder

ole32

CoTaskMemFree
StringFromCLSID
CoInitialize
CoCreateInstance
CreateStreamOnHGlobal
CoCreateGuid
CoUninitialize

oleaut32

SafeArrayGetElement
SafeArrayGetUBound
VarBstrCat
SysAllocStringLen
SysStringLen
SysAllocString
VariantClear
VariantInit
SysFreeString
SafeArrayPutElement

uxtheme

GetThemeSysFont
GetThemeSysColor

oleacc

AccessibleObjectFromWindow

slc

SLGetWindowsInformationDWORD

msdrm

DRMIsWindowProtected

Sections

.text
Size: 165KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 245KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d1884757532ce7b0014241f40262c929

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

gdiplus

comctl32

shlwapi

shell32

ole32

oleaut32

uxtheme

oleacc

slc

msdrm

Sections

.text Size: 165KB - Virtual size: 165KB

.data Size: 1024B - Virtual size: 11KB

.pdata Size: 5KB - Virtual size: 4KB

.rsrc Size: 245KB - Virtual size: 248KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 165KB - Virtual size: 165KB

.data
Size: 1024B - Virtual size: 11KB

.pdata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 245KB - Virtual size: 248KB

.reloc
Size: 1KB - Virtual size: 1KB