6dcdfe8ff8745253c0c6a099b73b06ad3491c850ce95c15c797c210ea1c251ef

Sharing

Copy URL Twitter E-mail

General

Target

6dcdfe8ff8745253c0c6a099b73b06ad3491c850ce95c15c797c210ea1c251ef
Size

1.0MB
MD5

fa02f572297c12b9598a271b144a65ad
SHA1

8d76d8027a7cbb55bf5fe53d2adca584d4955b12
SHA256

6dcdfe8ff8745253c0c6a099b73b06ad3491c850ce95c15c797c210ea1c251ef
SHA512

d5c66c3860465b2603550de70b8856d5b54ebe23442a1e4c603215f3774ef1801c8879aafb0a6e95c60982a0b040a7d649244f59f8a6d8692fb721b3ac006255
SSDEEP

24576:pb5PbNWcO19tOvQ4HrdMKo50218QBUMKpKWDU:pdelOvjdMKc3KdDU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6dcdfe8ff8745253c0c6a099b73b06ad3491c850ce95c15c797c210ea1c251ef

Files

6dcdfe8ff8745253c0c6a099b73b06ad3491c850ce95c15c797c210ea1c251ef
.exe windows x86

780ec4999f2d04454a217613ec8683ef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
WriteFile
DuplicateHandle
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
GetLocalTime
InitializeCriticalSectionAndSpinCount
InterlockedIncrement
InterlockedDecrement
SetEndOfFile
GetFullPathNameW
SetEnvironmentVariableA
GetTimeZoneInformation
WriteConsoleW
LCMapStringW
CompareStringW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
ReleaseSemaphore
VirtualProtect
VirtualFree
VirtualAlloc
GetVersionExW
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
OutputDebugStringW
GetStringTypeW
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
FindFirstFileExW
SetStdHandle
FlushFileBuffers
ReadConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
CreateEventW
GetProcessHeap
SystemTimeToFileTime
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetConsoleMode
GetConsoleCP
GetCurrentThread
GetCPInfo
GetOEMCP
IsValidCodePage
HeapSize
AreFileApisANSI
GetModuleHandleExW
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
WaitForSingleObjectEx
CreateTimerQueue
RtlUnwind
RaiseException
FileTimeToSystemTime
GetFileInformationByHandle
FileTimeToLocalFileTime
SetFilePointerEx
IsProcessorFeaturePresent
IsDebuggerPresent
HeapReAlloc
SetFilePointer
DosDateTimeToFileTime
GetFileSize
CreateFileW
GetModuleHandleW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetACP
ExitProcess
LockResource
SizeofResource
FreeResource
LoadResource
FindResourceW
ExpandEnvironmentStringsA
WaitForMultipleObjects
GetFileType
GetStdHandle
ReadFile
PeekNamedPipe
GetProcAddress
LoadLibraryW
FreeLibrary
GetTickCount
VerifyVersionInfoW
SleepEx
VerSetConditionMask
SetLastError
FormatMessageA
MultiByteToWideChar
WideCharToMultiByte
FindClose
DeleteFileW
FindNextFileW
FindFirstFileW
GetModuleFileNameW
CreateDirectoryA
GetLastError
CreateMutexA
CloseHandle
CreateProcessA
EnterCriticalSection
DeleteCriticalSection
HeapFree
GetCommandLineW
HeapAlloc
LoadLibraryExW
ExitThread
CreateThread
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
Sleep
GetCurrentThreadId
SetEvent
CreateSemaphoreW
WaitForSingleObject
InitializeCriticalSection
QueryPerformanceCounter
LeaveCriticalSection

user32

GetWindowLongW
SetWindowLongW
SetWindowPos
MessageBoxW
OffsetRect
UnionRect
wvsprintfW
SetCursor
LoadCursorW
GetKeyState
DestroyWindow
ReleaseDC
GetDC
SetTimer
KillTimer
GetActiveWindow
GetWindow
GetParent
SetFocus
BeginPaint
EndPaint
IsRectEmpty
SetWindowRgn
IsWindow
IsWindowVisible
IntersectRect
MapWindowPoints
CreateWindowExW
GetCursorPos
PtInRect
GetFocus
InvalidateRect
ScreenToClient
ReleaseCapture
CharNextW
DefWindowProcW
IsZoomed
EnableWindow
RegisterClassW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
SetPropW
GetPropW
GetWindowRect
GetUpdateRect
GetClientRect
FillRect
SetRect
CharPrevW
CreateCaret
ShowCaret
HideCaret
GetCaretPos
SetCaretPos
ClientToScreen
GetSysColor
GetCaretBlinkTime
SetWindowTextW
GetWindowTextLengthW
GetWindowTextW
InvalidateRgn
CreateAcceleratorTableW
GetGUIThreadInfo
MoveWindow
MonitorFromWindow
SetCapture
GetMonitorInfoW
DispatchMessageW
TranslateMessage
PeekMessageW
PostMessageW
SendMessageW
PostQuitMessage
wsprintfW
MsgWaitForMultipleObjectsEx
GetMessageW
MsgWaitForMultipleObjects
ShowWindow
PostThreadMessageW
IsIconic
FindWindowW

gdi32

ExtSelectClipRgn
DeleteObject
GetObjectW
GetStockObject
CreatePatternBrush
GetDeviceCaps
GdiFlush
TextOutW
GetTextExtentPoint32W
GetCharABCWidthsW
SetBkColor
SetTextColor
SetBkMode
GetObjectA
CreateSolidBrush
SetStretchBltMode
StretchBlt
CreateDIBSection
CombineRgn
CreateRoundRectRgn
CreateRectRgnIndirect
GetClipBox
SelectClipRgn
GetTextMetricsW
SetWindowOrgEx
Rectangle
RestoreDC
BitBlt
SaveDC
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
CreatePen
CreateFontIndirectW

advapi32

CryptDestroyHash
CryptAcquireContextW
CryptHashData
CryptGetHashParam
CryptCreateHash
CryptReleaseContext

shell32

ShellExecuteW
SHGetFolderPathA

ole32

CoUninitialize
CoCreateGuid
OleLockRunning
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
CreateStreamOnHGlobal
CoInitialize

oleaut32

VariantInit
SysAllocString
SysFreeString
VariantClear

gdiplus

GdipLoadImageFromStream
GdipImageSelectActiveFrame
GdipGetImageHeight
GdipGetImageWidth
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipDrawImage
GdipGraphicsClear
GdipDrawImageRectI
GdipGetFamily
GdipDeleteFontFamily
GdipSetPixelOffsetMode
GdipSetInterpolationMode
GdipSetCompositingQuality
GdipSetSmoothingMode
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromScan0
GdipCreateLineBrushI
GdipCreateStringFormat
GdipSetTextRenderingHint
GdipDrawString
GdipMeasureString
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipCloneStringFormat
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawPath
GdipAddPathArcI
GdipAddPathLineI
GdipDeletePath
GdipCreatePath
GdipDrawRectangleI
GdipSetPenMode
GdipDrawLineI
GdipSetPenDashStyle
GdipDeletePen
GdipCreatePen1
GdipFillRectangleI
GdipCloneBrush
GdipAlloc
GdipFree
GdipDeleteBrush
GdipCreateSolidFill
GdipDeleteGraphics
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup

shlwapi

PathFileExistsA

ws2_32

gethostname
getaddrinfo
freeaddrinfo
ioctlsocket
listen
accept
recvfrom
sendto
send
select
__WSAFDIsSet
getpeername
WSAIoctl
connect
WSAGetLastError
htons
ntohs
getsockname
setsockopt
recv
bind
socket
WSASetLastError
closesocket
getsockopt
WSAStartup
WSACleanup

wldap32

ord167
ord147
ord27
ord301
ord46
ord142
ord133
ord145
ord14
ord216
ord79
ord26
ord41
ord127
ord118
ord208

comctl32

ord17
_TrackMouseEvent

imm32

ImmReleaseContext
ImmSetCompositionFontW
ImmGetContext
ImmSetCompositionWindow

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape

Sections

.text
Size: 769KB - Virtual size: 768KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 143KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

780ec4999f2d04454a217613ec8683ef

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

shlwapi

ws2_32

wldap32

comctl32

imm32

Exports

Exports

Sections

.text Size: 769KB - Virtual size: 768KB

.rdata Size: 143KB - Virtual size: 143KB

.data Size: 15KB - Virtual size: 24KB

.rsrc Size: 85KB - Virtual size: 84KB

.reloc Size: 41KB - Virtual size: 40KB

.text
Size: 769KB - Virtual size: 768KB

.rdata
Size: 143KB - Virtual size: 143KB

.data
Size: 15KB - Virtual size: 24KB

.rsrc
Size: 85KB - Virtual size: 84KB

.reloc
Size: 41KB - Virtual size: 40KB