50ae0b5bc6d53589d1f8824a17dd1b7c02188a96bc7087fa202528820d0bf348

Sharing

Copy URL Twitter E-mail

General

Target

50ae0b5bc6d53589d1f8824a17dd1b7c02188a96bc7087fa202528820d0bf348
Size

4.8MB
MD5

a227b2d48102bd4c006bc31c07b355d5
SHA1

461f5d3eab1083e4a94ba777cee7dde56dd82eab
SHA256

50ae0b5bc6d53589d1f8824a17dd1b7c02188a96bc7087fa202528820d0bf348
SHA512

dbe2fa19f3d0838d3524e52fa77dd39c0667db2a4501f113c36acbdf5d982caa901d024e58a39c1c4ee7ffe43d6102e0f9fae0873a6ed65b9ab0768eb5c4bd71
SSDEEP

49152:cVO1lRfl31FeePMjy7GSepAx+eZEG+bAQ1Xgvs3oPztEe18FuCiMG7JKg0coSe2o:xhlPeeTlvs3oKe18M9JKxYGNKT4WXg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
50ae0b5bc6d53589d1f8824a17dd1b7c02188a96bc7087fa202528820d0bf348

Files

50ae0b5bc6d53589d1f8824a17dd1b7c02188a96bc7087fa202528820d0bf348
.exe windows x86

5712db4912004710a0f9abbb937ba8b2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetVolumeInformationW
GetFullPathNameW
GetFileAttributesExW
GetFileSizeEx
GetFileTime
GetStartupInfoW
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
ExitThread
GetDriveTypeA
GetTimeFormatA
GetDateFormatA
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
ExitProcess
HeapReAlloc
HeapSize
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
DebugBreak
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
GetConsoleMode
GetTimeZoneInformation
SetFilePointer
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetProcessHeap
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
TlsFree
LocalReAlloc
SetEnvironmentVariableW
SetConsoleMode
ReadConsoleInputA
GetFileInformationByHandle
GetFileAttributesExA
CreateSemaphoreA
GetWindowsDirectoryA
OpenEventA
WaitNamedPipeA
SetNamedPipeHandleState
AreFileApisANSI
OutputDebugStringA
GetDiskFreeSpaceA
CreateFileMappingW
GetDiskFreeSpaceW
LockFileEx
GetTempPathW
HeapValidate
UnlockFileEx
OutputDebugStringW
InterlockedCompareExchange
HeapCompact
FlushConsoleInputBuffer
GlobalMemoryStatus
GetVersion
ExpandEnvironmentStringsA
PeekNamedPipe
FormatMessageA
SleepEx
TlsSetValue
TlsAlloc
GlobalHandle
GetCurrentDirectoryA
GlobalReAlloc
TlsGetValue
LocalAlloc
GlobalFlags
GetThreadLocale
RaiseException
GetModuleHandleA
InterlockedDecrement
GlobalFindAtomW
CompareStringW
GetVersionExA
FormatMessageW
LocalFree
MulDiv
FreeResource
GlobalAddAtomW
SuspendThread
ResumeThread
SetThreadPriority
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
CopyFileW
MapViewOfFile
UnmapViewOfFile
ReleaseMutex
CreateMutexA
CreateFileMappingA
OpenFileMappingA
CreateDirectoryW
MoveFileExA
WritePrivateProfileStringW
CopyFileA
InterlockedIncrement
GetTempPathA
SetLastError
lstrlenW
InterlockedExchange
GetFileSize
GetVersionExW
FindFirstFileW
DeleteFileW
FindNextFileW
SystemTimeToFileTime
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetSystemDirectoryA
GetSystemTime
MoveFileA
FreeLibrary
LoadLibraryA
lstrcmpW
GetPrivateProfileIntA
GetCurrentProcessId
GetModuleFileNameW
SetEvent
ResetEvent
CreateThread
CreateEventW
GetPrivateProfileStringA
GetTickCount
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetLogicalDriveStringsA
QueryDosDeviceA
OpenProcess
CreateFileW
WriteFile
CreateDirectoryA
GetCurrentThreadId
GetQueuedCompletionStatus
GetLastError
PostQueuedCompletionStatus
WaitForSingleObject
WaitForMultipleObjects
GetExitCodeThread
TerminateThread
CreateIoCompletionPort
Sleep
DeleteFileA
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
GetFileAttributesW
DeleteCriticalSection
InitializeCriticalSection
GetFullPathNameA
lstrcatA
FindNextFileA
lstrcpyA
lstrlenA
CreateFileA
ReadFile
GetFileAttributesA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToSystemTime
WritePrivateProfileStringA
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
OpenMutexW
CreateMutexW
CloseHandle
SetErrorMode
GetModuleHandleW
GetModuleFileNameA
GetCurrentProcess
TerminateProcess
LoadLibraryW
GetConsoleCP
GetProcAddress

user32

UnregisterClassW
CharUpperW
GetSysColorBrush
ReleaseCapture
SetCapture
EndPaint
BeginPaint
GetWindowDC
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
MoveWindow
SetWindowTextW
IsDialogMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetClassLongW
GetClassNameW
SetFocus
GetWindowTextLengthW
GetForegroundWindow
GetTopWindow
UnhookWindowsHookEx
IsRectEmpty
MapWindowPoints
SetMenu
MessageBoxA
MessageBoxW
SetForegroundWindow
ShowWindow
UpdateWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
ScreenToClient
EqualRect
GetDlgCtrlID
DefWindowProcW
PtInRect
GetMenu
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindow
RegisterClipboardFormatW
GetNextDlgGroupItem
MessageBeep
GetMenuItemID
SetWindowContextHelpId
SetRect
CopyAcceleratorTableW
InvalidateRgn
CharNextW
MapDialogRect
GetMessageTime
IsIconic
IsWindowVisible
EnumWindows
GetPropW
EnableWindow
SendMessageW
SetLastErrorEx
wsprintfW
SetPropW
DeleteMenu
AppendMenuW
GetSubMenu
GetSystemMenu
GetClientRect
SetTimer
GetSystemMetrics
DrawIcon
KillTimer
RemovePropW
GetMessagePos
LoadMenuW
PostMessageW
InvalidateRect
IsWindow
LoadIconW
GetDlgItem
SetWindowPos
SetDlgItemTextW
TrackPopupMenu
CreatePopupMenu
GetCursorPos
DestroyMenu
DestroyCursor
DestroyIcon
SetCursor
TrackPopupMenuEx
FillRect
PostThreadMessageW
GetMenuItemCount
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
EndDialog
GetWindowThreadProcessId
GetLastActivePopup
IsWindowEnabled
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
ModifyMenuW
GetMenuState
CheckMenuItem
PostQuitMessage
GetWindowTextW
RegisterWindowMessageW
CallWindowProcW
SetWindowLongW
SystemParametersInfoW
LoadCursorW
EnableMenuItem
GetKeyState
GetWindowLongW
WindowFromPoint
GetParent
GetNextDlgTabItem
GetActiveWindow
ClientToScreen
GetWindowRect
DrawFocusRect
DrawStateW
FrameRect
GetSysColor
ReleaseDC
GetDC
CreateIconIndirect
GetIconInfo
LoadImageW
CopyRect
InflateRect
OffsetRect
GetProcessWindowStation
GetUserObjectInformationW
SendMessageA
FindWindowA

gdi32

GetMapMode
DPtoLP
GetRgnBox
GetBkColor
GetTextColor
CreateSolidBrush
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
TextOutW
RectVisible
PtVisible
CreatePen
MoveToEx
LineTo
SetMapMode
SetBkMode
RestoreDC
DeleteObject
GetStockObject
DeleteDC
SetTextColor
BitBlt
SetBkColor
SelectObject
CreateCompatibleDC
CreateBitmap
CreateCompatibleBitmap
SetPixel
GetPixel
GetObjectW
CreateDIBSection
SetDIBColorTable
SetStretchBltMode
StretchBlt
CreateFontIndirectW
GetDeviceCaps
GetClipBox
CreateRectRgnIndirect
GetWindowExtEx
GetViewportExtEx
SaveDC
ExtTextOutW

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegOpenKeyExW
RegEnumValueA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegQueryValueW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
CryptDecrypt
CryptEncrypt
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptSetKeyParam
CryptDestroyKey
CryptDestroyHash
CryptReleaseContext
RegCreateKeyExW
RegSetValueExW
RegCloseKey

shell32

ShellExecuteW
Shell_NotifyIconW
ShellExecuteExW
ShellExecuteA

comctl32

_TrackMouseEvent

shlwapi

PathFindExtensionW
PathIsUNCW
PathStripToRootW
PathFindFileNameW

oledlg

OleUIBusyW

ole32

CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
OleIsCurrentClipboard
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoDisconnectObject
CLSIDFromString
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
OleFlushClipboard
CoRegisterMessageFilter
CLSIDFromProgID

oleaut32

SysAllocString
SafeArrayUnaccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
VariantClear
SysStringLen
SysAllocStringLen
VariantChangeType
VariantInit
VariantCopy
DispCallFunc
LoadRegTypeLi
SafeArrayGetElemsize
SafeArrayCreate
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
LoadTypeLi
OleCreateFontIndirect
SysFreeString

version

GetFileVersionInfoA
VerQueryValueA
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA

ws2_32

getaddrinfo
freeaddrinfo
getsockopt
WSAIoctl
ioctlsocket
WSASetLastError
gethostbyaddr
getsockname
ntohs
recvfrom
sendto
accept
WSARecv
WSASend
WSAAccept
getpeername
inet_addr
WSAStartup
gethostname
gethostbyname
WSACleanup
send
shutdown
WSAGetLastError
htonl
inet_ntoa
htons
connect
select
__WSAFDIsSet
WSASocketW
bind
listen
setsockopt
closesocket
recv
socket
ntohl

wldap32

ord32
ord22
ord211
ord143
ord60
ord50
ord26
ord30
ord33
ord35
ord79
ord200
ord301
ord27
ord41
ord46

iphlpapi

GetAdaptersAddresses
GetAdaptersInfo

gdiplus

GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdiplusStartup
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipAlloc
GdipCloneImage
GdipDisposeImage
GdiplusShutdown
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipSaveImageToFile
GdipDeleteGraphics
GdipFree
GdipGetImageGraphicsContext

psapi

EnumProcessModules
EnumProcesses
GetProcessImageFileNameA
GetModuleBaseNameA
GetModuleFileNameExW

wsock32

getservbyname

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 620KB - Virtual size: 619KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.0MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 307KB - Virtual size: 306KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5712db4912004710a0f9abbb937ba8b2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

version

ws2_32

wldap32

iphlpapi

gdiplus

psapi

wsock32

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.rdata Size: 620KB - Virtual size: 619KB

.data Size: 1.0MB - Virtual size: 1.1MB

.rsrc Size: 307KB - Virtual size: 306KB

.text
Size: 2.9MB - Virtual size: 2.9MB

.rdata
Size: 620KB - Virtual size: 619KB

.data
Size: 1.0MB - Virtual size: 1.1MB

.rsrc
Size: 307KB - Virtual size: 306KB