49a1118f98f5196a799b188b26b341d24b71a9c40c46b72685090af0254b9b28

Sharing

Copy URL

Twitter E-mail

General

Target

49a1118f98f5196a799b188b26b341d24b71a9c40c46b72685090af0254b9b28
Size

3.8MB
MD5

cbeca28641378c675457e38db3538f3c
SHA1

d62a45ec991440b04d7753cc0fb9e86635e2d323
SHA256

49a1118f98f5196a799b188b26b341d24b71a9c40c46b72685090af0254b9b28
SHA512

38a5d7c7216669d79f045381e6d526b6bae46c33f8a3cb46101bc627236131459d77b4021addad889887e7d8553b09414f02c6776fe34c7a6577483373643ecc
SSDEEP

98304:GmhCP6iL6YbmkRcKkAUArR7FVqwzlOfVH5WD:GbzbLfUYRRVAtZU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49a1118f98f5196a799b188b26b341d24b71a9c40c46b72685090af0254b9b28

Files

49a1118f98f5196a799b188b26b341d24b71a9c40c46b72685090af0254b9b28
.exe windows x86

ed7fed570c4f1b0dd3cd1f6afb5b0498

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateMutexW
CreateProcessW
GetStartupInfoW
GetCommandLineW
GetDriveTypeW
GetSystemDirectoryW
GetTempPathW
GetWindowsDirectoryW
GetDiskFreeSpaceExW
SetFileAttributesW
DeleteFileW
CopyFileW
MoveFileW
MoveFileExW
WaitNamedPipeW
IsBadReadPtr
IsBadCodePtr
GetTickCount
FileTimeToSystemTime
GetTimeZoneInformation
TzSpecificLocalTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetSystemInfo
SetLocalTime
GetLocalTime
GetSystemTime
DeviceIoControl
FlushFileBuffers
GetLogicalDrives
Sleep
EnterCriticalSection
SetLastError
GetCurrentThreadId
CreateThread
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
SetProcessWorkingSetSize
VirtualProtect
LocalFree
GlobalMemoryStatusEx
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
FreeResource
InterlockedDecrement
InterlockedIncrement
EndUpdateResourceW
UpdateResourceW
BeginUpdateResourceW
BeginUpdateResourceA
LoadLibraryExW
LoadLibraryExA
FreeLibrary
Module32NextW
Module32FirstW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetVersionExW
LoadLibraryW
lstrlenW
lstrlenA
WaitForSingleObject
WriteProcessMemory
CreateRemoteThread
OpenProcess
VirtualFreeEx
VirtualAllocEx
FindNextFileW
FindFirstFileW
GetFileAttributesW
CreateFileW
CreateDirectoryW
DosDateTimeToFileTime
FileTimeToDosDateTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
CloseHandle
SetFileTime
GetFileTime
FindClose
ReadFile
WriteFile
GetFileSizeEx
GetFileSize
WideCharToMultiByte
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
GetLastError
DecodePointer
GetFullPathNameW
lstrcpyW
FindResourceW
GetModuleHandleW
GetModuleFileNameW
SizeofResource
LoadResource
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSection
RaiseException
GetCurrentProcess
GetProcessHeap
HeapSize
HeapFree
SetEndOfFile
GetCurrentDirectoryW
SetCurrentDirectoryW
WriteConsoleW
SetStdHandle
OutputDebugStringA
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
SetConsoleCtrlHandler
HeapQueryInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleCP
SetFilePointerEx
ReadConsoleW
GetConsoleMode
LockResource
GetFileType
GetACP
GetStdHandle
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
GetFullPathNameA
InterlockedFlushSList
RtlUnwind
CreateFileA
SetFilePointer
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
GetUserDefaultUILanguage
lstrcmpW
IsBadStringPtrW
MulDiv
SetEvent
TerminateThread
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
HeapReAlloc
HeapAlloc
HeapDestroy
GetProcAddress
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
FormatMessageW
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
GetThreadTimes
GetCurrentThread
QueryPerformanceFrequency
QueryPerformanceCounter
VirtualQuery
FindResourceExW
lstrcmpiW

gdi32

ExtSelectClipRgn
SelectClipRgn
RoundRect
Rectangle
LineTo
GetTextExtentPoint32W
GetClipBox
GetCharABCWidthsW
CreateRectRgnIndirect
CreateRectRgn
CreatePen
CombineRgn
SetStretchBltMode
SetBkColor
GetBitmapBits
CreateCompatibleBitmap
CreatePatternBrush
CreateSolidBrush
PtInRegion
OffsetRgn
SetWindowOrgEx
SaveDC
RestoreDC
CreateRoundRectRgn
DeleteObject
GetTextMetricsW
SetDIBColorTable
SelectObject
CreateDIBSection
CreateCompatibleDC
CreateDCW
StretchBlt
GdiFlush
TextOutW
SetBitmapBits
MoveToEx
GetObjectW
GetObjectA
SetTextColor
SetBkMode
SelectPalette
RealizePalette
GetStockObject
GetDIBits
GetDeviceCaps
DeleteDC
CreateFontIndirectW
BitBlt

comdlg32

GetSaveFileNameW
ChooseFontW
ChooseColorW
GetOpenFileNameW

advapi32

FreeSid
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
SetTokenInformation
AllocateAndInitializeSid
GetLengthSid
GetUserNameW
CreateProcessAsUserW
DuplicateTokenEx
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyExW
RegFlushKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
ChangeServiceConfigW
ChangeServiceConfig2W
CloseServiceHandle
CreateServiceW
OpenSCManagerW
OpenServiceW
StartServiceW
SetEntriesInAclW
SetNamedSecurityInfoW
ConvertStringSidToSidW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA

shell32

ShellExecuteExW
CommandLineToArgvW
SHFileOperationW
SHCreateDirectoryExW
SHGetFolderPathW
ShellExecuteW

ole32

CreateILockBytesOnHGlobal
ReleaseStgMedium
OleDuplicateData
OleSetContainedObject
OleCreateStaticFromData
StgCreateDocfileOnILockBytes
StgCreateDocfile
OleUninitialize
OleInitialize
CoInitialize
CoUninitialize
CoSetProxyBlanket
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
OleRun
CreateStreamOnHGlobal
OleLockRunning

oleaut32

SysFreeString
VariantCopy
VariantChangeType
CreateErrorInfo
VarUdateFromDate
VariantInit
VariantTimeToSystemTime
SetErrorInfo
GetErrorInfo
SystemTimeToVariantTime
SysAllocStringByteLen
SysStringByteLen
SysAllocString
VariantClear

shlwapi

PathFindFileNameW
PathFindExtensionW
PathAppendW
PathFileExistsW

gdiplus

GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateHBITMAPFromBitmap
GdipGetFontSize
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipSaveImageToStream
GdipSaveImageToFile
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipSetPenWidth
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipGetPathWorldBounds
GdipAddPathString
GdipDeletePath
GdipTranslateWorldTransform
GdipFree
GdipAlloc
GdipDrawString
GdipMeasureString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipSetStringFormatHotkeyPrefix
GdipRotateWorldTransform
GdipDrawLineI
GdipDrawLinesI
GdipFillRectangleI
GdipFillEllipseI
GdipDrawImageRectI
GdipDrawImageRectRectI
GdipDrawPath
GdipDrawRectangleI
GdipSetImageAttributesColorKeys
GdipSetPenDashStyle
GdipAddPathArcI
GdipAddPathLineI
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipDeleteFontFamily
GdipCreateFontFromDC
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdiplusShutdown
GdiplusStartup
GdipSaveGraphics
GdipDrawImageI
GdipGraphicsClear
GdipSetImageAttributesWrapMode
GdipSetImageAttributesColorMatrix
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipGetFamily
GdipCreatePath
GdipGetFontStyle
GdipCreateBitmapFromHBITMAP
GdipGetImagePalette
GdipGetImagePaletteSize
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipReleaseDC

imm32

ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
ImmSetCandidateWindow

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

urlmon

URLDownloadToFileW

wininet

InternetCloseHandle
InternetOpenW
InternetSetOptionW
HttpOpenRequestA
InternetConnectW
InternetQueryOptionW
InternetOpenUrlW
InternetReadFile
HttpOpenRequestW
HttpSendRequestA
HttpSendRequestExW
HttpEndRequestW
HttpQueryInfoW
InternetWriteFile
InternetConnectA
HttpAddRequestHeadersA

iphlpapi

GetAdaptersInfo

winmm

sndPlaySoundW
mciSendStringW

powrprof

SetSuspendState

sensapi

IsNetworkAlive

dbghelp

MiniDumpWriteDump

ws2_32

sendto
htonl
htons
inet_addr
ntohl
recvfrom
setsockopt
socket
WSAStartup
WSACleanup

comctl32

_TrackMouseEvent
ord17

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 660KB - Virtual size: 660KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 61KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7.8MB - Virtual size: 7.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ed7fed570c4f1b0dd3cd1f6afb5b0498

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

imm32

version

urlmon

wininet

iphlpapi

winmm

powrprof

sensapi

dbghelp

ws2_32

comctl32

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 660KB - Virtual size: 660KB

.data Size: 61KB - Virtual size: 102KB

.tls Size: 512B - Virtual size: 13B

.gfids Size: 2KB - Virtual size: 2KB

.rsrc Size: 7.8MB - Virtual size: 7.8MB

.reloc Size: 160KB - Virtual size: 160KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 660KB - Virtual size: 660KB

.data
Size: 61KB - Virtual size: 102KB

.tls
Size: 512B - Virtual size: 13B

.gfids
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 7.8MB - Virtual size: 7.8MB

.reloc
Size: 160KB - Virtual size: 160KB