0fe27d930e83ac0809e36fded11a44f490f7d0173e84d2aed993236b131b8b98

Sharing

Copy URL Twitter E-mail

General

Target

0fe27d930e83ac0809e36fded11a44f490f7d0173e84d2aed993236b131b8b98
Size

2.8MB
MD5

7fa304022833436d150aebffe4520c75
SHA1

36fed0da8d3578269017cf3b748780a3b88efda9
SHA256

0fe27d930e83ac0809e36fded11a44f490f7d0173e84d2aed993236b131b8b98
SHA512

b56d97465fc412723addc9992262cd419e3f2597385f12b285790d7bef824b2315c3007aa48f506530c9322d19fb8173a13cac9446a366044490c909d5a4b4cb
SSDEEP

49152:YxAQz6r6q3Xrz4I+Rim4hG7JQafo2Q7ORfsVe5XYFdGYvatojBRGjefgbUX7zFV:U6r60z4IYim4yQag2Q7Oi9Cto5gbGRV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0fe27d930e83ac0809e36fded11a44f490f7d0173e84d2aed993236b131b8b98

Files

0fe27d930e83ac0809e36fded11a44f490f7d0173e84d2aed993236b131b8b98
.exe windows x64

bd49c6896b84072f87bee1d897eb8f75

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GlobalFindAtomA
GlobalGetAtomNameA
MulDiv
GetModuleFileNameW
LocalFree
FormatMessageA
GlobalFlags
LocalAlloc
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
InitializeCriticalSection
TlsAlloc
GlobalReAlloc
GlobalHandle
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
GetThreadLocale
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetCurrentProcess
FindClose
lstrcmpW
GetVolumeInformationA
GetFullPathNameA
GetCPInfo
GetOEMCP
FileTimeToSystemTime
SetErrorMode
GetTickCount
FileTimeToLocalFileTime
GetFileTime
HeapReAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapAlloc
GetCommandLineA
GetProcessHeap
GetStartupInfoA
RtlLookupFunctionEntry
RtlUnwindEx
ExitProcess
RaiseException
RtlPcToFileHeader
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
Sleep
HeapSetInformation
HeapCreate
GetStdHandle
GetACP
IsValidCodePage
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
GetVersionExA
GetCurrentProcessId
SetLastError
LoadLibraryA
GlobalAddAtomA
GlobalUnlock
WritePrivateProfileStringA
FreeResource
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
GetModuleFileNameA
GetLocaleInfoA
LoadLibraryExA
GlobalLock
lstrcmpA
FreeLibrary
GetModuleHandleA
GetProcAddress
WriteFile
GetFileAttributesA
SetFilePointer
MultiByteToWideChar
GetLastError
CompareStringW
GetVersion
WideCharToMultiByte
lstrlenA
CompareStringA
SizeofResource
LockResource
LoadResource
FindResourceA
GlobalFree
ReadFile
CloseHandle
GlobalAlloc
GetFileSize
FindFirstFileA
CreateFileA

user32

DrawTextA
DrawTextExA
GrayStringA
ClientToScreen
GetWindowDC
BeginPaint
EndPaint
GetSysColorBrush
LoadCursorA
SetCapture
ReleaseCapture
CharNextA
CopyAcceleratorTableA
IsRectEmpty
SetRect
InvalidateRect
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
DestroyMenu
UnregisterClassA
RegisterClipboardFormatA
PostThreadMessageA
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
GetClassLongA
GetClassNameA
GetClassLongPtrA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextA
GetForegroundWindow
GetTopWindow
GetWindowLongPtrA
SetWindowLongPtrA
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
TabbedTextOutA
GetMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
ScreenToClient
EqualRect
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowThreadProcessId
GetLastActivePopup
MessageBoxA
SetCursor
ReleaseDC
GetDC
CopyRect
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetWindowLongA
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
GetWindow
SetWindowContextHelpId
MapDialogRect
SetWindowPos
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
IsIconic
SetTimer
LoadIconA
KillTimer
SendMessageA
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
GetParent
ModifyMenuA
ShowWindow
MoveWindow
SetWindowTextA
GetSystemMetrics
GetClientRect
DrawIcon
GetWindowRect
EnableWindow
CharUpperA
IsDialogMessageA
SetDlgItemTextA
SetForegroundWindow
PostQuitMessage
PostMessageA
CheckMenuItem
EnableMenuItem
GetMenuState
UpdateWindow

gdi32

GetStockObject
GetDeviceCaps
GetBkColor
GetTextColor
CreateRectRgnIndirect
GetClipBox
SetTextColor
DeleteDC
GetObjectA
SaveDC
RestoreDC
SetMapMode
SetBkColor
ExtSelectClipRgn
DeleteObject
GetViewportExtEx
GetWindowExtEx
PtVisible
GetRgnBox
GetMapMode
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
CreateFontA
CreateBitmap
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
SetViewportOrgEx

comdlg32

GetOpenFileNameA
GetFileTitleA

okapi64

ord40
ord1
ord29
ord9
ord66
ord3
ord62
ord64

comctl32

InitCommonControlsEx

shlwapi

PathFindExtensionA
PathStripToRootA
PathFindFileNameA
PathIsUNCA

oledlg

ord8

oleacc

LresultFromObject
CreateStdAccessibleObject

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

ole32

OleUninitialize
StgOpenStorageOnILockBytes
CoGetClassObject
CoTaskMemAlloc
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries

oleaut32

VariantClear
SysAllocStringLen
VariantInit
VariantChangeType
SysStringLen
SysAllocStringByteLen
OleCreateFontIndirect
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayDestroy
SysAllocString
VariantCopy
SysFreeString

Sections

.text
Size: 288KB - Virtual size: 288KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bd49c6896b84072f87bee1d897eb8f75

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

okapi64

comctl32

shlwapi

oledlg

oleacc

winspool.drv

advapi32

ole32

oleaut32

Sections

.text Size: 288KB - Virtual size: 288KB

.rdata Size: 104KB - Virtual size: 103KB

.data Size: 13KB - Virtual size: 36KB

.pdata Size: 21KB - Virtual size: 21KB

.rsrc Size: 2.4MB - Virtual size: 2.4MB

.text
Size: 288KB - Virtual size: 288KB

.rdata
Size: 104KB - Virtual size: 103KB

.data
Size: 13KB - Virtual size: 36KB

.pdata
Size: 21KB - Virtual size: 21KB

.rsrc
Size: 2.4MB - Virtual size: 2.4MB