313e9ce71134d85fbe9909b8cb14dfd9225e1256ab098cabc5a3ceb81bb9495e

Sharing

Copy URL Twitter E-mail

General

Target

313e9ce71134d85fbe9909b8cb14dfd9225e1256ab098cabc5a3ceb81bb9495e
Size

2.7MB
MD5

4b5dac206f46ed2c79d80888170be06f
SHA1

8a85156e7b3b824bf4d9531cac516456d6585b6e
SHA256

313e9ce71134d85fbe9909b8cb14dfd9225e1256ab098cabc5a3ceb81bb9495e
SHA512

18b8fa9dd93c3583ce7dc31c3b7c77730a2af49e97812de345e1f76fc30d729da0ff12b136589fe16af36cb4857e45838af42e47e2018fb563df07e5df3d03ca
SSDEEP

49152:cWUePgPrD2jYvPJfnd6JeIKJWM2N4Fwu8M8kFNeQ4NM4Thrqp/tWnmbRpXDfyf2P:eePgPrD2jYvPRnd6JGo4KuykFNkNMnNt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
313e9ce71134d85fbe9909b8cb14dfd9225e1256ab098cabc5a3ceb81bb9495e

Files

313e9ce71134d85fbe9909b8cb14dfd9225e1256ab098cabc5a3ceb81bb9495e
.exe windows x86

96e174fe8b84c2669521d889cb848ef3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
TerminateThread
LocalFree
GetModuleHandleA
LocalAlloc
GlobalUnlock
GetStartupInfoW
GetTimeZoneInformation
GetModuleFileNameW
ReadFile
GetVersionExW
LoadLibraryW
GlobalAlloc
WriteFile
OutputDebugStringW
WaitForSingleObject
GlobalLock
CreateDirectoryW
InterlockedDecrement
SetFilePointer
GetFileSize
GetWindowsDirectoryW
GetProcAddress
TerminateProcess
GetCurrentProcess
MultiByteToWideChar
ResumeThread
GetLastError
CreateSemaphoreA
LocalFileTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetSystemTimeAsFileTime
GetFileSizeEx
CreateFileW
lstrcpyW
GetModuleHandleW
QueryFullProcessImageNameW
OpenProcess
CloseHandle
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetEnvironmentVariableW
CreateProcessW
GetFileAttributesExW
GetPrivateProfileIntW
FindNextFileW
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
SetEndOfFile
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
GetLocalTime
Sleep
RemoveDirectoryW
WideCharToMultiByte
FindClose
FindFirstFileW
WritePrivateProfileStringW
CopyFileW
LockResource
SizeofResource
FreeResource
LoadResource
FindResourceW
DeleteFileW
GetFileAttributesW
GetTickCount
GetCurrentDirectoryA
GetFullPathNameA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoA
SetHandleCount
SetStdHandle
GetConsoleCP
LCMapStringA
VirtualAlloc
VirtualFree
HeapCreate
LCMapStringW
GetModuleFileNameA
IsValidCodePage
GetOEMCP
GetCPInfo
HeapSize
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetConsoleMode
SetConsoleMode
ReadConsoleInputA
CreateFileA
InterlockedExchange
GetFileInformationByHandle
SetConsoleCtrlHandler
ExitProcess
GetDriveTypeA
HeapReAlloc
RtlUnwind
RaiseException
CreateThread
ExitThread
HeapAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FlushConsoleInputBuffer
FindFirstFileA
GlobalMemoryStatus
GetCurrentProcessId
QueryPerformanceCounter
LoadLibraryA
GetSystemDirectoryA
VerSetConditionMask
VerifyVersionInfoA
ExpandEnvironmentStringsA
FreeLibrary
WaitForMultipleObjects
PeekNamedPipe
SleepEx
GetStdHandle
GetFileType
GetVersion
FormatMessageA
SetLastError
InterlockedIncrement
SetFileTime
SystemTimeToFileTime
MulDiv
GetPrivateProfileStringW
LeaveCriticalSection
EnterCriticalSection
GlobalMemoryStatusEx
GetSystemInfo
GetComputerNameW
DeleteCriticalSection
InitializeCriticalSection
HeapFree
GetProcessHeap
GetCurrentDirectoryW
GetACP

user32

GetMonitorInfoW
IsWindow
MonitorFromWindow
wsprintfW
SetWindowRgn
GetWindowRect
IsIconic
TrackPopupMenu
AppendMenuW
CreatePopupMenu
GetCursorPos
BringWindowToTop
SetForegroundWindow
DestroyIcon
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW
GetWindowTextW
SetWindowTextW
GetWindowTextLengthW
MoveWindow
GetGUIThreadInfo
CreateAcceleratorTableW
InvalidateRgn
SetRect
CharPrevW
DrawTextW
FillRect
GetCaretBlinkTime
GetSysColor
ClientToScreen
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
LoadIconW
RegisterWindowMessageW
SetWindowPos
FindWindowW
ShowWindow
GetClientRect
ScreenToClient
CreateCaret
SetCursor
wvsprintfW
OffsetRect
CharNextW
ReleaseCapture
SetCapture
InvalidateRect
UnionRect
SetWindowLongW
GetWindowLongW
PostMessageW
DefWindowProcW
CreateWindowExW
PostQuitMessage
DispatchMessageW
TranslateMessage
SetFocus
GetMessageW
EnableWindow
GetWindow
GetParent
SendMessageW
LoadImageW
GetSystemMetrics
RegisterClassW
LoadCursorW
RegisterClassExW
GetClassInfoExW
CallWindowProcW
GetPropW
SetPropW
ReleaseDC
DestroyWindow
GetDC
KillTimer
SetTimer
GetKeyState
GetFocus
MapWindowPoints
PtInRect
IntersectRect
IsWindowVisible
GetUpdateRect
IsRectEmpty
EndPaint
BeginPaint
GetActiveWindow

gdi32

SetWindowOrgEx
CreatePen
SelectObject
SaveDC
BitBlt
RestoreDC
DeleteDC
GetStockObject
Rectangle
CreatePatternBrush
GdiFlush
GetObjectW
DeleteObject
CreateRoundRectRgn
CreateCompatibleBitmap
CreateCompatibleDC
GetTextMetricsW
GetObjectA
GetDeviceCaps
SelectClipRgn
CombineRgn
CreateRectRgnIndirect
GetClipBox
CreateDIBSection
StretchBlt
SetStretchBltMode
CreateSolidBrush
LineTo
MoveToEx
CreatePenIndirect
RoundRect
SetTextColor
SetBkMode
TextOutW
GetTextExtentPoint32W
GetCharABCWidthsW
SetBkColor
ExtSelectClipRgn
CreateFontIndirectW

advapi32

ReportEventA
DeregisterEventSource
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteValueA
RegisterEventSourceA

shell32

Shell_NotifyIconW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
ShellExecuteW
SHGetKnownFolderPath

ole32

CoInitialize
OleInitialize
CoUninitialize
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
OleLockRunning
CreateStreamOnHGlobal
OleUninitialize
CoTaskMemFree

oleaut32

VariantInit
SysFreeString
VariantClear
SysAllocString

iphlpapi

GetAdaptersAddresses

crypt32

CryptMsgGetParam
CertCloseStore
CertFindCertificateInStore
CryptMsgClose
CryptQueryObject
CertFreeCertificateContext
CertGetNameStringW

shlwapi

PathIsDirectoryW

gdiplus

GdipCloneImage
GdipSetInterpolationMode
GdipDisposeImage
GdipAlloc
GdipDrawImageRectI
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipCreateBitmapFromScan0
GdipFree
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageRect
GdipDrawLine
GdipFillRectangleI
GdipCreatePen2
GdipSetSolidFillColor
GdipSetPenStartCap
GdipSetPenEndCap
GdiplusStartup
GdiplusShutdown
GdipDeletePath
GdipDeleteRegion
GdipDeleteBrush
GdipFillRegion
GdipSetPathGradientFocusScales
GdipSetPathGradientCenterColor
GdipCombineRegionRegion
GdipCreateRegionPath
GdipCreateRegionRect
GdipAddPathLineI
GdipAddPathArcI
GdipCreatePath
GdipSetPageUnit
GdipCreateFromHDC
GdipCloneBrush
GdipCreatePathGradientFromPath
GdipSetPathGradientSurroundColorsWithCount
GdipGetPathGradientPointCount
GdipDeleteFont
GdipDeleteStringFormat
GdipDeleteFontFamily
GdipDrawImage
GdipGraphicsClear
GdipDrawString
GdipSetPixelOffsetMode
GdipSetCompositingQuality
GdipSetSmoothingMode
GdipCreateLineBrushI
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipCreateStringFormat
GdipSetTextRenderingHint
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipGetFamily
GdipCreateSolidFill
GdipDrawImageI
GdipDeletePen

ws2_32

bind
getservbyname
gethostbyname
WSACleanup
WSAStartup
gethostname
WSASetLastError
__WSAFDIsSet
WSAGetLastError
select
recv
send
WSAIoctl
setsockopt
getsockname
ntohs
htons
getsockopt
getpeername
closesocket
socket
connect
freeaddrinfo
getaddrinfo
sendto
recvfrom
accept
listen
ioctlsocket
shutdown
htonl

wldap32

ord22
ord211
ord143
ord60
ord50
ord26
ord30
ord200
ord32
ord35
ord79
ord33
ord301
ord27
ord41
ord46

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

comctl32

_TrackMouseEvent
ord17

imm32

ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext
ImmSetCompositionFontW

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 444KB - Virtual size: 443KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 45KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 17B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 189KB - Virtual size: 189KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

96e174fe8b84c2669521d889cb848ef3

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

iphlpapi

crypt32

shlwapi

gdiplus

ws2_32

wldap32

version

comctl32

imm32

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 444KB - Virtual size: 443KB

.data Size: 45KB - Virtual size: 62KB

.tls Size: 512B - Virtual size: 17B

.rsrc Size: 189KB - Virtual size: 189KB

.reloc Size: 103KB - Virtual size: 102KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 444KB - Virtual size: 443KB

.data
Size: 45KB - Virtual size: 62KB

.tls
Size: 512B - Virtual size: 17B

.rsrc
Size: 189KB - Virtual size: 189KB

.reloc
Size: 103KB - Virtual size: 102KB