b6645b411528025bc824b6981d484153aaa3f1dd2c5820c4ba1bd1f37c3db7c6

Sharing

Copy URL Twitter E-mail

General

Target

b6645b411528025bc824b6981d484153aaa3f1dd2c5820c4ba1bd1f37c3db7c6
Size

2.4MB
MD5

320372185229513adf09ae09bfb98db9
SHA1

71cd5bf00f23aa922858197086fb82748b611f2f
SHA256

b6645b411528025bc824b6981d484153aaa3f1dd2c5820c4ba1bd1f37c3db7c6
SHA512

77b7b3eb5fa9b5213357faaeea8dc29ce32c742ca7104491e9773ba91a0caf01f81b061efe795d40266fcf218f4a006bf951fc52a19274627cbd54da710f1507
SSDEEP

49152:G5lfSv7xGQDpJjR4PPtzFI+YlmpPwxiNhtIdjy902iKdWC:G5VSv1bh4PPthI+YlmpPwMNhtIQ902

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b6645b411528025bc824b6981d484153aaa3f1dd2c5820c4ba1bd1f37c3db7c6

Files

b6645b411528025bc824b6981d484153aaa3f1dd2c5820c4ba1bd1f37c3db7c6
.exe windows x86

c9a3b79fde777ae4787f54db8d748717

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

libtlog

ord1
ord3

kernel32

InitializeSListHead
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsValidCodePage
FindNextFileW
FindFirstFileExW
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
GetStringTypeW
CreateDirectoryW
MoveFileExW
LCMapStringW
CompareStringW
GetTimeFormatW
GetStartupInfoW
ResetEvent
CreateProcessW
GetExitCodeProcess
GetStdHandle
ExitProcess
QueryPerformanceFrequency
HeapQueryInformation
GetFileType
SetStdHandle
VirtualQuery
VirtualAlloc
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
SetConsoleCtrlHandler
RtlUnwind
OutputDebugStringW
GetSystemTimeAsFileTime
IsDebuggerPresent
CreateEventW
GetDateFormatW
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
GetTempFileNameA
GetProfileIntA
SearchPathA
GetWindowsDirectoryA
FindResourceExW
GetTempPathA
SetErrorMode
GetVolumeInformationA
lstrcmpiA
WaitForSingleObjectEx
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetFullPathNameA
GetFileSize
FlushFileBuffers
DeleteFileA
GetACP
GetCPInfo
GetOEMCP
VirtualProtect
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GlobalFlags
VerifyVersionInfoA
lstrcpyA
VerSetConditionMask
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
GetThreadLocale
InitializeCriticalSectionAndSpinCount
GetPrivateProfileIntA
GetVersionExA
GetCurrentThread
ResumeThread
SetThreadPriority
lstrcmpA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileTime
GetFileSizeEx
GetFileAttributesExA
GetFileAttributesA
FileTimeToLocalFileTime
CompareStringA
GlobalGetAtomNameA
GlobalFindAtomA
GlobalAddAtomA
FindResourceA
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
FreeLibrary
GetSystemDirectoryW
EncodePointer
LoadLibraryW
LoadLibraryA
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
OutputDebugStringA
SetLastError
MulDiv
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
LocalFree
FormatMessageA
MultiByteToWideChar
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
HeapFree
GetTickCount
SetUnhandledExceptionFilter
GetCurrentProcess
GetCurrentProcessId
CreateFileA
GetCurrentThreadId
QueryPerformanceCounter
CreateMutexA
ReleaseMutex
OpenMutexA
GetSystemInfo
WritePrivateProfileStringA
CreateIoCompletionPort
GetPrivateProfileStringA
GetCurrentDirectoryA
CancelIo
WaitForMultipleObjects
PostQueuedCompletionStatus
CreateEventA
Sleep
SetEvent
CloseHandle
CreateProcessA
FindClose
WriteConsoleW
FindNextFileA
FindFirstFileA
CopyFileA
CreateDirectoryA
GetLastError
GetTickCount64
GetQueuedCompletionStatus
WaitForSingleObject
CreateThread
GetModuleFileNameA
FindResourceW
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockShared
DeleteFileW
CreateFileW
GetFileAttributesExW

user32

LoadCursorA
GetSysColorBrush
SetCursor
ShowOwnedPopups
SystemParametersInfoA
InflateRect
GetMenuItemInfoA
DestroyMenu
TranslateMessage
OffsetRect
SetRectEmpty
GetCursorPos
ClientToScreen
GetWindowDC
TabbedTextOutA
GrayStringA
DrawTextExA
DrawTextA
GetWindowThreadProcessId
GetDesktopWindow
GetActiveWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamA
SetMenuItemInfoA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
IsDialogMessageA
SetWindowTextA
IsWindowEnabled
SendDlgItemMessageA
CheckDlgButton
SetDlgItemTextA
GetDlgItemInt
SetDlgItemInt
MoveWindow
ShowWindow
GetMonitorInfoA
MonitorFromWindow
WinHelpA
GetScrollInfo
SetScrollInfo
LoadIconA
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
GetWindow
GetLastActivePopup
GetTopWindow
GetParent
GetClassLongA
SetWindowLongA
GetWindowLongA
PtInRect
EqualRect
GetSysColor
MapWindowPoints
ScreenToClient
MessageBoxA
AdjustWindowRectEx
GetWindowRect
GetWindowTextLengthA
GetWindowTextA
RemovePropA
GetPropA
SetPropA
ShowScrollBar
GetScrollRange
EnableScrollBar
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
ValidateRect
EndPaint
BeginPaint
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
UnionRect
MonitorFromPoint
DestroyIcon
LoadImageW
WaitMessage
CharNextA
CopyAcceleratorTableA
InvalidateRgn
TrackPopupMenu
SetMenu
LoadCursorW
GetCapture
GetKeyState
GetFocus
SetFocus
GetDlgCtrlID
GetDlgItem
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
DestroyWindow
SetRect
SetWindowContextHelpId
LoadImageA
DrawEdge
DrawFrameControl
DrawFocusRect
DrawIconEx
GetKeyboardLayout
GetKeyboardState
ToAsciiEx
LoadAcceleratorsW
CreateAcceleratorTableA
DestroyAcceleratorTable
EnumDisplayMonitors
IsChild
IsMenu
CreateWindowExA
IntersectRect
RealChildWindowFromPoint
CopyImage
GetAsyncKeyState
MapDialogRect
TrackMouseEvent
IsZoomed
SetCursorPos
SetParent
BringWindowToTop
LockWindowUpdate
SetClassLongA
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetWindowRgn
GetComboBoxInfo
EnableWindow
SendMessageA
GetClientRect
DestroyCursor
PostMessageA
IsWindow
LoadIconW
GetSystemMenu
AppendMenuA
IsIconic
GetSystemMetrics
DrawIcon
PostQuitMessage
IsWindowVisible
PostThreadMessageA
GetMessageA
UnregisterClassA
GetMenuStringA
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuA
RemoveMenu
DrawStateA
UpdateWindow
InvalidateRect
FillRect
GetClassNameA
LoadBitmapW
GetKeyNameTextA
MapVirtualKeyA
GetDC
ReleaseDC
CopyRect
RegisterWindowMessageA
DispatchMessageA
PeekMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
CreateMenu
CallWindowProcA
RegisterClassA
GetClassInfoA
GetClassInfoExA
SubtractRect
GetUpdateRect
IsClipboardFormatAvailable
SetLayeredWindowAttributes
CharUpperA
SetCapture
ReleaseCapture
SetTimer
KillTimer
LoadMenuW
DeleteMenu
SetWindowRgn
MessageBeep
WindowFromPoint
NotifyWinEvent
CreatePopupMenu
GetMenuDefaultItem
SetMenuDefaultItem
IsRectEmpty
GetMenu
UpdateLayeredWindow
TranslateMDISysAccel
DefMDIChildProcA
DefFrameProcA
DrawMenuBar
MapVirtualKeyExA
IsCharLowerA
GetDoubleClickTime
InvertRect
HideCaret
GetIconInfo
GetNextDlgGroupItem
FrameRect
CopyIcon
ReuseDDElParam
UnpackDDElParam
InsertMenuItemA
LoadMenuA
TranslateAcceleratorA
LoadAcceleratorsA
ModifyMenuA
CharUpperBuffA
RegisterClipboardFormatA
SetScrollRange

gdi32

CreatePen
CreatePatternBrush
CreateRectRgn
Escape
GetClipBox
GetObjectType
GetPixel
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectObject
SelectPalette
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
MoveToEx
TextOutA
ExtTextOutA
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateFontIndirectA
CreateHatchBrush
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesA
GetTextCharsetInfo
GetTextMetricsA
CombineRgn
GetMapMode
SetRectRgn
DPtoLP
CreateRoundRectRgn
CreateDIBSection
GetBkColor
GetTextColor
GetRgnBox
CreateEllipticRgn
Ellipse
Polygon
Polyline
EnumFontFamiliesExA
RealizePalette
SetPixel
StretchBlt
SetDIBColorTable
OffsetRgn
Rectangle
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
LPtoDP
RoundRect
ExtFloodFill
SetPaletteEntries
FillRgn
FrameRgn
GetBoundsRect
GetWindowOrgEx
GetViewportOrgEx
SetPixelV
GetTextFaceA
CreateCompatibleDC
BitBlt
CreateBitmap
SetTextColor
SetBkColor
PatBlt
CreateRectRgnIndirect
GetObjectA
GetStockObject
DeleteObject
CreateSolidBrush
GetDeviceCaps
CreateDCA
CopyMetaFileA
PtInRegion
DeleteDC
GetTextExtentPoint32A
ExcludeClipRect
CreatePolygonRgn

msimg32

TransparentBlt
AlphaBlend

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

advapi32

RegEnumKeyA
RegOpenKeyExA
RegEnumKeyExA
RegEnumValueA
RegQueryValueA
RegCloseKey
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegQueryValueExA

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetFileInfoA
SHGetDesktopFolder
DragQueryFileA
DragFinish
SHBrowseForFolderA
SHAppBarMessage
ShellExecuteA

comctl32

InitCommonControlsEx
ImageList_ReplaceIcon

shlwapi

PathFindFileNameA
PathRemoveFileSpecW
PathIsUNCA
PathStripToRootA
StrFormatKBSizeA
PathFindExtensionA

uxtheme

IsAppThemed
DrawThemeParentBackground
DrawThemeText
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetThemePartSize
IsThemeBackgroundPartiallyTransparent
GetWindowTheme
GetThemeSysColor
GetCurrentThemeName

ole32

CoCreateGuid
CoRegisterMessageFilter
CoRevokeClassObject
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CreateStreamOnHGlobal
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
CLSIDFromProgID
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoDisconnectObject
CLSIDFromString
CoInitializeEx
CoInitialize
CoCreateInstance
CoUninitialize
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2

oleaut32

VariantClear
VariantInit
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
VariantCopy
DispCallFunc
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantChangeType
SysAllocString
LoadRegTypeLi
SafeArrayGetElemsize
SafeArrayAccessData
SafeArrayUnaccessData
VarBstrFromDate
SafeArrayDestroy
OleCreateFontIndirect
LoadTypeLi
SafeArrayCreate

oledlg

ord8

gdiplus

GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDrawImageI
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipDrawImageRectI

ws2_32

ioctlsocket
WSAStartup
connect
sendto
select
recvfrom
getsockopt
socket
shutdown
send
gethostbyname
gethostname
WSASend
WSARecv
WSAIoctl
listen
bind
ntohs
htons
htonl
WSASocketA
WSAGetLastError
setsockopt
inet_ntoa
closesocket

libeay32

ord197
ord188
ord1804

ssleay32

ord12
ord110
ord235
ord183
ord8
ord24
ord5
ord74
ord96
ord78
ord108
ord48
ord58
ord43
ord30
ord75
ord87

dbghelp

MiniDumpWriteDump

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundA

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 369KB - Virtual size: 369KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c9a3b79fde777ae4787f54db8d748717

Headers

DLL Characteristics

File Characteristics

Imports

libtlog

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

ws2_32

libeay32

ssleay32

dbghelp

oleacc

imm32

winmm

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 369KB - Virtual size: 369KB

.data Size: 23KB - Virtual size: 40KB

.rsrc Size: 132KB - Virtual size: 131KB

.reloc Size: 151KB - Virtual size: 150KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 369KB - Virtual size: 369KB

.data
Size: 23KB - Virtual size: 40KB

.rsrc
Size: 132KB - Virtual size: 131KB

.reloc
Size: 151KB - Virtual size: 150KB