397b47a33311a3bd17681a0b4c05cc024607ae42402d1dc2eb733ddc954373fa

Sharing

Copy URL Twitter E-mail

General

Target

397b47a33311a3bd17681a0b4c05cc024607ae42402d1dc2eb733ddc954373fa
Size

14.1MB
MD5

8946d432eec06370355561c9d02b33f8
SHA1

9df490c267f9a1fb3ef58719bd499af1431de8b0
SHA256

397b47a33311a3bd17681a0b4c05cc024607ae42402d1dc2eb733ddc954373fa
SHA512

28ed2ecf69aa435f81123ac752355f8da2cc37f53931993e4f49a96aa9758fbc52060426397753e5820fbded978738a38b4cc7f09f5ea55d4a0bdd973b2ed4bf
SSDEEP

98304:gdFqjAQCKCbCwFYLdaBBBHG46GUat6esDGXdndvJAUNG5ff7Ow3/GNgbRG78Md6T:G4jNCKapFYhResKtHi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
397b47a33311a3bd17681a0b4c05cc024607ae42402d1dc2eb733ddc954373fa

Files

397b47a33311a3bd17681a0b4c05cc024607ae42402d1dc2eb733ddc954373fa
.exe windows x64

1effaccd529dd4c47511055c5669d9bf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

gdiplus

GdipAddPathLine2
GdipAddPathLine2I
GdipAddPathLineI
GdipAddPathPolygonI
GdipAlloc
GdipCloneBrush
GdipClosePathFigure
GdipCreateFromHDC
GdipCreatePath
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipDeleteGraphics
GdipDeletePath
GdipDeletePen
GdipDrawArcI
GdipDrawLineI
GdipDrawPath
GdipFillPath
GdipFillPieI
GdipFree
GdipGetPenWidth
GdipScaleWorldTransform
GdipSetPenColor
GdipSetPenDashArray
GdipSetPenDashStyle
GdipSetPenEndCap
GdipSetPenLineJoin
GdipSetPenStartCap
GdipSetPenWidth
GdipSetSmoothingMode
GdipSetSolidFillColor
GdiplusShutdown
GdiplusStartup

kernel32

CreateSemaphoreW
DeleteCriticalSection
GetTickCount
IsDBCSLeadByteEx
RaiseException
ReleaseSemaphore
RtlAddFunctionTable
RtlUnwindEx
RtlVirtualUnwind
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
__C_specific_handler
AcquireSRWLockExclusive
AcquireSRWLockShared
AddVectoredExceptionHandler
CancelIo
CloseHandle
CompareStringOrdinal
CopyFileExW
CreateDirectoryW
CreateEventW
CreateFileMappingA
CreateFileW
CreateHardLinkW
CreateMutexA
CreateNamedPipeW
CreateProcessW
CreateSymbolicLinkW
CreateThread
CreateToolhelp32Snapshot
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileW
FindNextFileW
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCommandLineW
GetComputerNameA
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentDirectoryA
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileType
GetFinalPathNameByHandleW
GetFullPathNameW
GetLastError
GetLocaleInfoA
GetLogicalDrives
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetProcessId
GetStartupInfoA
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
HeapAlloc
HeapFree
HeapReAlloc
InitOnceBeginInitialize
InitOnceComplete
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LocalFree
MapViewOfFile
Module32FirstW
Module32NextW
MoveFileExW
MulDiv
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleW
ReadFile
ReadFileEx
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
RemoveDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
SetConsoleMode
SetConsoleTextAttribute
SetCurrentDirectoryA
SetCurrentDirectoryW
SetEnvironmentVariableW
SetEvent
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
SetFileTime
SetHandleInformation
SetLastError
SetThreadErrorMode
SetThreadStackGuarantee
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
SleepEx
SwitchToThread
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
UnmapViewOfFile
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFileEx
lstrlenW

msvcrt

___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_close
_close
_errno
_fmode
_fpreset
_ftime
_gmtime64
_initterm
_lock
_lseeki64
_onexit
_open
_read
_stat64
_strdup
_time64
_unlock
_vsnprintf
_waccess
_wchdir
_wchmod
_wexecvp
_wfopen
_wgetcwd
_wgetenv
_wmkdir
_wopen
_wputenv
_wrename
_write
_wrmdir
_wstat
_wsystem
_wunlink
abort
acos
acosf
atan2
atan2f
atof
calloc
cosf
exit
fclose
feof
ferror
fflush
fgets
fmod
fmodf
fopen
fprintf
fputc
fputs
fread
free
frexp
fscanf
fseek
ftell
fwrite
getc
getenv
localeconv
malloc
modf
printf
putchar
raise
rand
realloc
remove
rewind
setlocale
signal
sinf
sqrtf
strerror
tan
tanf
ungetc
vfprintf

ntdll

NtReadFile
NtWriteFile
_setjmp
_stricmp
_strnicmp
atoi
atol
bsearch
cos
floor
isalnum
isalpha
islower
isprint
isspace
isupper
isxdigit
log
longjmp
mbstowcs
memchr
memcmp
memcpy
memmove
memset
pow
qsort
sin
sprintf
sqrt
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strlen
strncmp
strncpy
strrchr
strstr
strtol
strtoul
tolower
toupper
wcscpy
wcslen
wcsncpy
wcstombs
NtCreateFile
RtlNtStatusToDosError

advapi32

OpenProcessToken
SystemFunction036

bcrypt

BCryptGenRandom

comctl32

_TrackMouseEvent

comdlg32

CommDlgExtendedError
GetOpenFileNameW
GetSaveFileNameW
PrintDlgA

gdi32

AddFontResourceExA
Arc
BitBlt
CloseEnhMetaFile
CombineRgn
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreateEnhMetaFileA
CreateFontW
CreatePalette
CreatePen
CreatePolygonRgn
CreateRectRgn
CreateSolidBrush
DPtoLP
DeleteDC
DeleteEnhMetaFile
DeleteObject
EndDoc
EndPage
EnumFontFamiliesW
EqualRgn
ExtCreatePen
ExtCreateRegion
GdiFlush
GetCharacterPlacementW
GetDCOrgEx
GetDIBits
GetDeviceCaps
GetEnhMetaFileHeader
GetGlyphOutlineW
GetObjectA
GetRegionData
GetRgnBox
GetStockObject
GetTextExtentPoint32W
GetTextMetricsA
GetWindowOrgEx
GetWorldTransform
LPtoDP
LineTo
ModifyWorldTransform
MoveToEx
OffsetRgn
Pie
PlayEnhMetaFile
PolyPolygon
Polygon
Polyline
RealizePalette
RectInRegion
RemoveFontResourceExA
RestoreDC
SaveDC
SelectClipRgn
SelectObject
SelectPalette
SetBkMode
SetDIBitsToDevice
SetGraphicsMode
SetMapMode
SetPixel
SetStretchBltMode
SetTextAlign
SetTextColor
SetViewportExtEx
SetWindowExtEx
SetWindowOrgEx
SetWorldTransform
StartDocA
StartPage
StretchBlt
StretchDIBits
TextOutW
UpdateColors

ole32

CoCreateGuid
DoDragDrop
OleInitialize
RegisterDragDrop
ReleaseStgMedium
RevokeDragDrop

oleaut32

GetErrorInfo
SetErrorInfo
SysAllocStringLen
SysFreeString
SysStringLen

shell32

DragQueryFileW
SHBrowseForFolderW
SHGetFolderPathW
SHGetMalloc
SHGetPathFromIDListA
SHGetPathFromIDListW
ShellExecuteA

user32

AdjustWindowRectEx
BringWindowToTop
CallWindowProcA
ChangeClipboardChain
ClientToScreen
CloseClipboard
CopyIcon
CreateIconIndirect
CreateWindowExA
CreateWindowExW
DefWindowProcW
DestroyIcon
DestroyWindow
DispatchMessageW
EmptyClipboard
FillRect
GetAsyncKeyState
GetClientRect
GetClipboardData
GetClipboardOwner
GetCursorPos
GetDC
GetForegroundWindow
GetKeyState
GetKeyboardLayout
GetKeyboardState
GetParent
GetSysColor
GetSystemMetrics
GetUpdateRgn
GetWindow
GetWindowLongA
GetWindowLongPtrA
GetWindowLongPtrW
GetWindowPlacement
GetWindowRect
InvalidateRect
IsClipboardFormatAvailable
IsIconic
IsWindow
LoadCursorA
LoadIconA
MapWindowPoints
MessageBeep
MessageBoxA
MsgWaitForMultipleObjects
OpenClipboard
OpenIcon
PeekMessageA
PeekMessageW
PostMessageA
PostThreadMessageA
RegisterClassExW
RegisterWindowMessageW
ReleaseCapture
ReleaseDC
SendMessageA
SendMessageW
SetActiveWindow
SetCapture
SetClipboardData
SetClipboardViewer
SetCursor
SetFocus
SetForegroundWindow
SetLayeredWindowAttributes
SetRect
SetWindowLongA
SetWindowLongPtrA
SetWindowPos
SetWindowRgn
SetWindowTextW
ShowWindow
SystemParametersInfoA
TranslateMessage
ValidateRgn
WindowFromPoint

userenv

GetUserProfileDirectoryW

ws2_32

WSACleanup
WSADuplicateSocketW
WSAGetLastError
WSARecv
WSASend
WSASocketW
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getpeername
getsockname
getsockopt
ioctlsocket
listen
recv
recvfrom
select
send
sendto
setsockopt
shutdown

Sections

.text
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 479KB - Virtual size: 478KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 265KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 310KB - Virtual size: 309KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/4
Size: 1024B - Virtual size: 656B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 553KB - Virtual size: 553KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/35
Size: 512B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/51
Size: 969KB - Virtual size: 969KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/63
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/77
Size: 384KB - Virtual size: 384KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/89
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/102
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/113
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/124
Size: 528KB - Virtual size: 527KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1effaccd529dd4c47511055c5669d9bf

Headers

DLL Characteristics

File Characteristics

Imports

gdiplus

kernel32

msvcrt

ntdll

advapi32

bcrypt

comctl32

comdlg32

gdi32

ole32

oleaut32

shell32

user32

userenv

ws2_32

Sections

.text Size: 4.1MB - Virtual size: 4.1MB

.data Size: 47KB - Virtual size: 46KB

.rdata Size: 479KB - Virtual size: 478KB

.pdata Size: 265KB - Virtual size: 264KB

.xdata Size: 310KB - Virtual size: 309KB

.bss Size: - Virtual size: 5KB

.idata Size: 20KB - Virtual size: 19KB

.CRT Size: 512B - Virtual size: 120B

.tls Size: 512B - Virtual size: 16B

/4 Size: 1024B - Virtual size: 656B

/19 Size: 553KB - Virtual size: 553KB

/35 Size: 512B - Virtual size: 180B

/51 Size: 969KB - Virtual size: 969KB

/63 Size: 7KB - Virtual size: 6KB

/77 Size: 384KB - Virtual size: 384KB

/89 Size: 2KB - Virtual size: 1KB

/102 Size: 1.3MB - Virtual size: 1.3MB

/113 Size: 9KB - Virtual size: 8KB

/124 Size: 528KB - Virtual size: 527KB

.text
Size: 4.1MB - Virtual size: 4.1MB

.data
Size: 47KB - Virtual size: 46KB

.rdata
Size: 479KB - Virtual size: 478KB

.pdata
Size: 265KB - Virtual size: 264KB

.xdata
Size: 310KB - Virtual size: 309KB

.bss
Size: - Virtual size: 5KB

.idata
Size: 20KB - Virtual size: 19KB

.CRT
Size: 512B - Virtual size: 120B

.tls
Size: 512B - Virtual size: 16B

/4
Size: 1024B - Virtual size: 656B

/19
Size: 553KB - Virtual size: 553KB

/35
Size: 512B - Virtual size: 180B

/51
Size: 969KB - Virtual size: 969KB

/63
Size: 7KB - Virtual size: 6KB

/77
Size: 384KB - Virtual size: 384KB

/89
Size: 2KB - Virtual size: 1KB

/102
Size: 1.3MB - Virtual size: 1.3MB

/113
Size: 9KB - Virtual size: 8KB

/124
Size: 528KB - Virtual size: 527KB