9aff852c530d46e1e930f1e33336dc71942ae7fa0fa00036783a3c8115485030

Sharing

Copy URL

Twitter E-mail

General

Target

9aff852c530d46e1e930f1e33336dc71942ae7fa0fa00036783a3c8115485030
Size

7.1MB
MD5

a9003e398a16a6335551de81063184ca
SHA1

dbedca64a30da8494b141dfad4ec760b954840c6
SHA256

9aff852c530d46e1e930f1e33336dc71942ae7fa0fa00036783a3c8115485030
SHA512

c6efd6803245f6b4ee45905b61d8ff1bdcafee70127db9462692608967e697b99a7e5e371779ddc4b56039328a9ef469c865c9f78b3755872ad291e54151d526
SSDEEP

49152:/YYlYGlTR9SjlveqflOZXVuF2KJqC9q01qPKGrc5jIBRqT1teLteB9jWIjWHNb1H:9lY4Gmtuzn311Zqq7eLwrBY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9aff852c530d46e1e930f1e33336dc71942ae7fa0fa00036783a3c8115485030

Files

9aff852c530d46e1e930f1e33336dc71942ae7fa0fa00036783a3c8115485030
.exe windows x86

12f512a15db6a216036a9b018da152a9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

hid

HidD_GetAttributes
HidD_GetHidGuid
HidD_GetPreparsedData
HidP_GetCaps

setupapi

CM_Locate_DevNode_ExW
CM_Get_Sibling_Ex
CM_Get_DevNode_Registry_Property_ExW
CM_Get_Child_Ex
CM_Disconnect_Machine
CM_Connect_MachineW
SetupDiGetClassImageIndex
SetupDiGetClassImageList
CM_Setup_DevNode
CM_Query_And_Remove_SubTreeW
CM_Enable_DevNode
CM_Disable_DevNode
SetupDiGetDeviceRegistryPropertyW
CM_Get_Device_Interface_List_SizeW
CM_Get_Device_Interface_ListW
CM_Get_Device_IDW
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
CM_Get_Sibling
CM_Get_Parent
CM_Get_DevNode_Registry_PropertyW
CM_Get_Child
CM_Reenumerate_DevNode
CM_Locate_DevNodeW

rpcrt4

UuidFromStringW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW

imagehlp

ImageGetCertificateData
ImageEnumerateCertificates

crypt32

CertFindCertificateInStore
CertCloseStore
CertOpenStore
CertGetNameStringW

wintrust

WinVerifyTrust

kernel32

QueryPerformanceCounter
VirtualQuery
GetStartupInfoW
WaitForSingleObjectEx
RaiseException
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetUserDefaultLCID
ReplaceFileW
GetDiskFreeSpaceW
FindResourceExW
LocalUnlock
LocalLock
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GetCurrentDirectoryW
GetPrivateProfileIntW
SystemTimeToTzSpecificLocalTime
SetFileTime
SetFileAttributesW
LocalFileTimeToFileTime
GetFileTime
GetFileSizeEx
GetFileAttributesExW
GetFileAttributesW
FileTimeToLocalFileTime
VirtualProtect
GetProfileIntW
SystemTimeToFileTime
FileTimeToSystemTime
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
GetAtomNameW
SetErrorMode
GetThreadLocale
GetStringTypeExW
MoveFileW
GetCurrentProcess
GetHandleInformation
DuplicateHandle
UnlockFile
SetEndOfFile
LockFile
GetVolumeInformationW
GetShortPathNameW
GetFullPathNameW
FlushFileBuffers
CompareStringW
GlobalGetAtomNameW
GlobalFindAtomW
GlobalAddAtomW
LoadLibraryA
FreeResource
GetSystemDirectoryW
EncodePointer
CompareStringA
lstrcmpW
lstrcmpA
GlobalDeleteAtom
LoadLibraryExW
GetVersionExW
GetCurrentThread
GetCurrentThreadId
ResumeThread
SuspendThread
GetThreadPriority
SetThreadPriority
CopyFileW
MulDiv
GlobalLock
GlobalUnlock
GlobalSize
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringA
GetACP
GetExitCodeThread
TerminateThread
WaitForMultipleObjects
CreateEventW
WaitForSingleObject
ResetEvent
SetEvent
GetOverlappedResult
WriteFile
QueryFullProcessImageNameW
InitializeSListHead
GetNativeSystemInfo
GetTempPathW
GetTempFileNameW
GetCommandLineW
FormatMessageW
LoadLibraryW
FreeLibrary
GetPrivateProfileStringW
GetModuleFileNameW
GetFileSize
FindNextFileW
FindFirstFileW
FindClose
GetComputerNameW
lstrlenW
GetProcAddress
GetModuleHandleW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
lstrcmpiW
OpenProcess
CreateProcessW
GetExitCodeProcess
TerminateProcess
GetCurrentProcessId
CreatePipe
GetStdHandle
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
DecodePointer
GetConsoleWindow
WideCharToMultiByte
GetSystemPowerStatus
WritePrivateProfileStringW
WinExec
Sleep
GlobalFree
GlobalAlloc
DeviceIoControl
DeleteFileW
SetCurrentDirectoryW
SetFilePointer
ReadFile
MultiByteToWideChar
CreateDirectoryW
LocalFree
LocalAlloc
FindResourceW
SizeofResource
LockResource
LoadResource
SetLastError
GetLastError
CloseHandle
CreateFileW
InterlockedFlushSList
GetModuleHandleExW
QueryPerformanceFrequency
GetConsoleCP
ExitProcess
CreateThread
ExitThread
FreeLibraryAndExitThread
HeapValidate
GetSystemInfo
SetStdHandle
GetFileType
GetCommandLineA
HeapQueryInformation
VirtualAlloc
WriteConsoleW
SetConsoleCtrlHandler
GetDateFormatW
GetTimeFormatW
LCMapStringW
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
GetConsoleMode
SetConsoleMode
GetNumberOfConsoleInputEvents
ReadConsoleInputW
PeekConsoleInputA
ReadConsoleW
GetConsoleOutputCP
SetFilePointerEx
GetStringTypeW
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
InterlockedPushEntrySList
RtlUnwind
OutputDebugStringW
GetSystemTimeAsFileTime
GetProductInfo

user32

SetWindowPos
DestroyWindow
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
CallNextHookEx
SetWindowsHookExW
GetCursorPos
GetKeyState
NotifyWinEvent
ArrangeIconicWindows
DlgDirSelectComboBoxExW
DlgDirListComboBoxW
DlgDirSelectExW
DlgDirListW
LoadIconW
GetWindow
GetTopWindow
FindWindowExW
SetParent
GetDesktopWindow
ChildWindowFromPointEx
ChildWindowFromPoint
WindowFromPoint
MapWindowPoints
ScreenToClient
ClientToScreen
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
CreateCaret
GetWindowContextHelpId
SetWindowContextHelpId
GetWindowRect
GetClientRect
EnableScrollBar
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
LockWindowUpdate
RedrawWindow
ValidateRgn
InvalidateRgn
ValidateRect
InvalidateRect
GetWindowRgn
SetWindowRgn
GetUpdateRgn
GetUpdateRect
EndPaint
BeginPaint
ReleaseDC
GetWindowDC
GetDCEx
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
DragDetect
GetSystemMenu
DrawMenuBar
HiliteMenuItem
SetCapture
GrayStringW
GetActiveWindow
GetWindowPlacement
CopyRect
GetClipboardViewer
SetClipboardViewer
GetClipboardOwner
OpenClipboard
GetNextDlgTabItem
GetNextDlgGroupItem
IsZoomed
BringWindowToTop
IsIconic
IsWindowVisible
CloseWindow
OpenIcon
ShowOwnedPopups
FlashWindow
IsChild
PostThreadMessageW
SendNotifyMessageW
DrawAnimatedRects
DrawCaption
GetLastActivePopup
GetWindowThreadProcessId
GetWindowLongW
IsWindowEnabled
EnableWindow
MapDialogRect
TabbedTextOutW
PostMessageW
SendMessageW
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringW
IsMenu
UnregisterClassA
GetParent
OffsetRect
SetRectEmpty
SendDlgItemMessageA
PeekMessageA
FindWindowW
UpdateWindow
CreateWindowExW
RegisterClassExW
RegisterDeviceNotificationW
GetMessageW
SendInput
EqualRect
SetWindowLongW
GetClassLongW
GetClassNameW
UnhookWindowsHookEx
UnregisterClassW
SetRect
SystemParametersInfoW
LoadCursorW
PtInRect
GetSysColor
GetDC
GetSystemMetrics
GetFocus
IsWindow
PostQuitMessage
RegisterSuspendResumeNotification
MessageBoxW
ShowWindow
wsprintfW
QueryDisplayConfig
GetDisplayConfigBufferSizes
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
GetDlgItem
GetDlgCtrlID
SetFocus
GetMenu
SetMenu
TrackPopupMenu
TrackPopupMenuEx
ScrollWindow
SetPropW
GetPropW
RemovePropW
GetWindowTextW
GetWindowTextLengthW
GetOpenClipboardWindow
SetScrollInfo
GetScrollInfo
WinHelpW
MonitorFromWindow
GetMonitorInfoW
DrawEdge
DrawFrameControl
LoadMenuW
LoadMenuIndirectW
CreateMenu
CreatePopupMenu
CheckMenuItem
EnableMenuItem
ModifyMenuW
DeleteMenu
SetMenuItemBitmaps
InsertMenuItemW
GetMenuItemInfoW
SetMenuItemInfoW
GetMenuDefaultItem
SetMenuDefaultItem
AdjustWindowRectEx
DrawIcon
DrawTextW
DrawStateW
TranslateMessage
DispatchMessageW
GetTabbedTextExtentW
WindowFromDC
ExcludeUpdateRgn
ScrollDC
ChangeClipboardChain
SetMenuContextHelpId
GetMenuContextHelpId
GetSysColorBrush
DrawFocusRect
FillRect
FrameRect
InvertRect
CheckMenuRadioItem
LoadBitmapW
GetMenuCheckMarkDimensions
MoveWindow
SetDlgItemInt
GetDlgItemInt
SetDlgItemTextW
CheckDlgButton
CheckRadioButton
IsDlgButtonChecked
SendDlgItemMessageW
ScrollWindowEx
SetWindowTextW
IsDialogMessageW
GetKeyNameTextW
MapVirtualKeyW
CharUpperW
CreateDialogIndirectParamW
EndDialog
DrawTextExW
UnionRect
GetDialogBaseUnits
IsRectEmpty
MessageBeep
IsClipboardFormatAvailable
RealChildWindowFromPoint
CopyImage
GetClipboardFormatNameW
GetClipboardFormatNameA
ReuseDDElParam
UnpackDDElParam
GetMenuBarInfo
LoadImageW
DestroyIcon
IntersectRect
DestroyMenu
TranslateAcceleratorW
LoadAcceleratorsW
GetAsyncKeyState
InflateRect
SetCursor
GetCapture
ReleaseCapture
PeekMessageW
SetTimer
KillTimer
GetDlgItemTextW

gdi32

GetClipRgn
GetCurrentPositionEx
GetObjectType
IntersectClipRect
LineTo
OffsetClipRgn
PlayMetaFile
RestoreDC
SaveDC
GetClipBox
ExtSelectClipRgn
SelectObject
SelectPalette
SetBkMode
SetMapperFlags
SetGraphicsMode
SetMapMode
SetLayout
GetLayout
ExcludeClipRect
DeleteObject
CreateSolidBrush
CreateRectRgn
SelectClipRgn
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextCharacterExtra
SetTextAlign
SetTextJustification
PlayMetaFileRecord
EnumMetaFile
SetWorldTransform
ModifyWorldTransform
SetColorAdjustment
ArcTo
PolyDraw
SelectClipPath
SetArcDirection
ExtCreatePen
MoveToEx
PolyBezierTo
PolylineTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
AnimatePalette
Arc
BitBlt
Chord
CombineRgn
CreateBitmap
CreateBitmapIndirect
CreateBrushIndirect
CreateCompatibleBitmap
CreateDiscardableBitmap
CreateCompatibleDC
CreateEllipticRgn
CreateEllipticRgnIndirect
CreateFontIndirectW
CreateFontW
CreateICW
CreatePalette
CreatePenIndirect
CreatePolyPolygonRgn
CreateRectRgnIndirect
CreateRoundRectRgn
DrawEscape
Ellipse
EnumObjects
EqualRgn
Escape
ExtEscape
ExtCreateRegion
ExtFloodFill
FillRgn
FloodFill
FrameRgn
GetROP2
GetAspectRatioFilterEx
GetBkColor
GetBkMode
GetBitmapBits
GetBitmapDimensionEx
GetBoundsRect
GetBrushOrgEx
CreatePen
GetCharWidthFloatW
GetCharABCWidthsW
GetCharABCWidthsFloatW
GetCurrentObject
GetFontData
GetGlyphOutlineW
GetGraphicsMode
GetMapMode
GetNearestColor
GetNearestPaletteIndex
GetOutlineTextMetricsW
GetPaletteEntries
GetPixel
GetPolyFillMode
GetRegionData
GetRgnBox
GetStretchBltMode
GetTextCharacterExtra
GetTextAlign
GetTextColor
GetTextExtentPoint32W
GetFontLanguageInfo
GetCharacterPlacementW
GetViewportExtEx
GetViewportOrgEx
GetWindowExtEx
GetWindowOrgEx
InvertRgn
MaskBlt
PlgBlt
OffsetRgn
PatBlt
Pie
PaintRgn
PolyPolygon
PtInRegion
PtVisible
RectInRegion
RectVisible
Rectangle
ResetDCW
RealizePalette
RoundRect
ResizePalette
SetBitmapBits
SetBoundsRect
SetPaletteEntries
SetPixel
SetPixelV
StretchBlt
SetRectRgn
UpdateColors
PlayEnhMetaFile
GdiComment
GetTextMetricsW
AngleArc
PolyPolyline
GetWorldTransform
GetColorAdjustment
CreateHalftonePalette
StartDocW
EndDoc
StartPage
EndPage
AbortDoc
SetAbortProc
AbortPath
BeginPath
CloseFigure
EndPath
FillPath
FlattenPath
GetPath
PathToRegion
SetMiterLimit
StrokeAndFillPath
StrokePath
WidenPath
GetMiterLimit
GetArcDirection
TextOutW
CreatePolygonRgn
DPtoLP
LPtoDP
Polygon
Polyline
PolyBezier
SetBitmapDimensionEx
SetBrushOrgEx
GetTextFaceW
GetKerningPairsW
UnrealizeObject
StretchDIBits
CreateDIBSection
EnumFontFamiliesExW
CreateHatchBrush
CreateDIBPatternBrushPt
GetObjectW
SetTextColor
SetBkColor
ExtTextOutW
CreateEnhMetaFileW
CloseEnhMetaFile
CreatePatternBrush
CreateMetaFileW
CloseMetaFile
GetDeviceCaps
CreateDCW
CopyMetaFileW
DeleteDC
GetStockObject
GetCharWidthW

winspool.drv

DocumentPropertiesW
ClosePrinter
GetJobW
OpenPrinterW

advapi32

RegEnumValueW
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyW
RegQueryValueW
GetFileSecurityW
SetFileSecurityW
RegDeleteKeyExW
RegCreateKeyW
RegSetValueExW
RegEnumKeyExW
RegDeleteValueW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueW

shell32

DragAcceptFiles
SHGetFileInfoW
DragQueryFileW
DragFinish
SHAddToRecentDocs
ExtractIconW
ShellExecuteW
SHGetSpecialFolderPathW

shlwapi

PathFileExistsW
PathFindExtensionW
PathIsUNCW
PathStripToRootW
PathFindFileNameW
PathRemoveExtensionW
PathRemoveFileSpecW
PathIsDirectoryW

uxtheme

DrawThemeParentBackground
DrawThemeText
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
DrawThemeBackground
CloseThemeData
OpenThemeData

ole32

WriteFmtUserTypeStg
CreateBindCtx
CoTreatAsClass
WriteClassStg
ReadClassStg
CoTaskMemFree
CoTaskMemAlloc
StringFromCLSID
CoInitialize
OleDuplicateData
CoUninitialize
StringFromGUID2
CoCreateGuid
SetConvertStg
OleRegGetUserType
CoDisconnectObject
CLSIDFromString
CoInitializeEx
CLSIDFromProgID
OleRun
PropVariantCopy
CoRegisterClassObject
CoRevokeClassObject
CreateStreamOnHGlobal
ReadFmtUserTypeStg
CoCreateInstance
ReleaseStgMedium

oleaut32

VarBstrFromDate
VarBstrFromCy
VarCyFromStr
VarDateFromStr
VariantCopy
SafeArrayPtrOfIndex
SafeArrayCopy
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayRedim
SafeArrayDestroy
SafeArrayDestroyData
VarDecFromStr
SafeArrayCreate
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
SysReAllocStringLen
RegisterTypeLi
LoadRegTypeLi
LoadTypeLi
SafeArrayGetElemsize
SafeArrayGetDim
VariantChangeType
VariantClear
VariantInit
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysFreeString
SysAllocStringLen
VarBstrFromDec
SafeArrayDestroyDescriptor

winusb

WinUsb_Initialize
WinUsb_Free
WinUsb_GetPowerPolicy
WinUsb_GetDescriptor
WinUsb_SetPowerPolicy

iphlpapi

GetIpAddrTable
GetAdaptersInfo

ws2_32

inet_ntoa

powrprof

DevicePowerClose
PowerReadDCValueIndex
PowerReadACValueIndex
DevicePowerOpen
PowerGetActiveScheme
PowerWriteACValueIndex
DevicePowerEnumDevices
PowerWriteDCValueIndex

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

gdiplus

GdiplusShutdown

Sections

.textbss
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 553KB - Virtual size: 553KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 355KB - Virtual size: 355KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

12f512a15db6a216036a9b018da152a9

Headers

DLL Characteristics

File Characteristics

Imports

hid

setupapi

rpcrt4

version

imagehlp

crypt32

wintrust

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

winusb

iphlpapi

ws2_32

powrprof

oleacc

gdiplus

Sections

.textbss Size: - Virtual size: 1.5MB

.text Size: 3.1MB - Virtual size: 3.1MB

.rdata Size: 553KB - Virtual size: 553KB

.data Size: 15KB - Virtual size: 58KB

.idata Size: 26KB - Virtual size: 26KB

.msvcjmc Size: 2KB - Virtual size: 2KB

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 270B

.rsrc Size: 355KB - Virtual size: 355KB

.reloc Size: 152KB - Virtual size: 151KB

.textbss
Size: - Virtual size: 1.5MB

.text
Size: 3.1MB - Virtual size: 3.1MB

.rdata
Size: 553KB - Virtual size: 553KB

.data
Size: 15KB - Virtual size: 58KB

.idata
Size: 26KB - Virtual size: 26KB

.msvcjmc
Size: 2KB - Virtual size: 2KB

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 270B

.rsrc
Size: 355KB - Virtual size: 355KB

.reloc
Size: 152KB - Virtual size: 151KB