d069000f1d3e51c80549544cbb7c3fa6d46c75e291194987e6cb4196a82b2b6e

Sharing

Copy URL Twitter E-mail

General

Target

d069000f1d3e51c80549544cbb7c3fa6d46c75e291194987e6cb4196a82b2b6e
Size

1.9MB
MD5

bdcea1f63d66955c466efb08767aa0a8
SHA1

257e9b9769813f19c8a8c6745c641078670a400e
SHA256

d069000f1d3e51c80549544cbb7c3fa6d46c75e291194987e6cb4196a82b2b6e
SHA512

84dd18213348eb5c950ab1eb0c357a997554f66014fbab7f6a3234be50d592b386ee0d886caf3f32878104d04dd83466c6538cc7851a697166117ddc1175c730
SSDEEP

49152:5Wj21bNKpoajltPUZ5JdsIE4UsrMUCF+dTKL:8jQgpoYtM9dsISCy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d069000f1d3e51c80549544cbb7c3fa6d46c75e291194987e6cb4196a82b2b6e

Files

d069000f1d3e51c80549544cbb7c3fa6d46c75e291194987e6cb4196a82b2b6e
.exe windows x86

30512ba45ee132dd86006925c9ed10d2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

InitCommonControlsEx
ord8
ImageList_Destroy
ImageList_Create
ImageList_ReplaceIcon
ImageList_AddMasked
ord412
ord410
CreateStatusWindowW
ord413

shlwapi

StrCmpLogicalW
UrlUnescapeW
StrFormatByteSizeW
StrRetToBufW
StrStrW
StrCatBuffW
PathFindExtensionW
PathUnquoteSpacesW
PathIsUNCW
StrTrimW
SHAutoComplete
StrStrIW
PathRemoveFileSpecW
PathFindFileNameW
PathQuoteSpacesW
PathCombineW
PathRenameExtensionW
PathIsDirectoryW
StrRChrW
PathRemoveExtensionW
PathCompactPathExW
PathStripToRootW
PathGetDriveNumberW
PathCommonPrefixW
PathCanonicalizeW
PathIsRootW
PathUnExpandEnvStringsW
PathIsPrefixW
PathRelativePathToW
StrDupW
StrStrIA
StrDupA
UrlEscapeW
StrTrimA
PathMatchSpecW
PathIsRelativeW
PathAppendW
StrChrW

imm32

ImmEscapeW
ImmGetCompositionStringW
ImmSetCompositionWindow
ImmSetCompositionFontW
ImmReleaseContext
ImmSetCompositionStringW
ImmNotifyIME
ImmGetContext
ImmSetCandidateWindow

uxtheme

GetThemeSysFont
IsAppThemed
CloseThemeData
OpenThemeData
SetWindowTheme

kernel32

LoadLibraryExW
Sleep
GlobalSize
GlobalAlloc
GlobalLock
LCMapStringW
WideCharToMultiByte
GetTickCount
GlobalUnlock
HeapFree
lstrlenW
GetLocaleInfoW
lstrcatW
GetLocalTime
GetTimeFormatW
GetDateFormatW
WritePrivateProfileStringW
lstrcpynW
GetPrivateProfileIntW
GetModuleFileNameW
GetFileAttributesW
GetVersionExW
FormatMessageW
GlobalFree
CreateThread
HeapAlloc
GetCurrentDirectoryW
LocalFree
SetEvent
CompareStringW
ReadFile
GetFileSizeEx
IsDBCSLeadByteEx
GetFullPathNameW
WriteFile
SetEndOfFile
LocalAlloc
CreateFileW
GetACP
HeapSize
GetPrivateProfileStringW
GetTimeZoneInformation
GetLastError
GlobalMemoryStatusEx
GetOEMCP
QueryPerformanceCounter
SizeofResource
InterlockedExchange
GetCurrentProcess
ExpandEnvironmentStringsW
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
FreeResource
GetFileInformationByHandle
LockResource
HeapReAlloc
ResetEvent
LoadResource
FindResourceW
GetWindowsDirectoryW
WritePrivateProfileSectionW
GetCommandLineW
GetLongPathNameW
SetErrorMode
FindFirstChangeNotificationW
GetVersion
SetFileAttributesW
GetFileAttributesExW
FindCloseChangeNotification
DeleteFileW
FindNextChangeNotification
SetCurrentDirectoryW
GetCurrentProcessId
GetProcessHeap
CreateProcessW
GetSystemTimeAsFileTime
GetSystemTime
CreateEventW
QueueUserWorkItem
SetThreadPriority
GetNativeSystemInfo
CloseHandle
WaitForSingleObject
CreateWaitableTimerW
SetWaitableTimer
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentThreadId
MulDiv
FreeLibrary
GetModuleHandleW
GetProcAddress
QueryPerformanceFrequency
MultiByteToWideChar
InterlockedCompareExchange
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
DeleteCriticalSection
IsValidCodePage
GetCurrentThread
InitializeSListHead
TerminateProcess
RtlUnwind
RaiseException
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
GetStdHandle
GetStringTypeW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
lstrcpyW
DecodePointer

user32

GetMenu
FindWindowExW
GetWindow
GetMenuState
GetSystemMenu
DeferWindowPos
DrawAnimatedRects
IsIconic
RegisterWindowMessageW
EnableMenuItem
PostQuitMessage
IsZoomed
CheckMenuItem
TrackPopupMenuEx
FindWindowW
TranslateAcceleratorW
IntersectRect
EnumWindows
SetMenu
GetForegroundWindow
SetMenuDefaultItem
CountClipboardFormats
SetWindowPlacement
ChangeClipboardChain
DestroyIcon
IsDialogMessageW
OffsetRect
IsWindow
GetSubMenu
LoadAcceleratorsW
GetWindowPlacement
ShowOwnedPopups
SetClipboardViewer
EqualRect
IsWindowVisible
CheckMenuRadioItem
MapVirtualKeyW
ShowWindowAsync
LoadMenuW
GetMessageW
GetMessagePos
GetMenuItemInfoW
SetActiveWindow
SetCaretPos
OpenClipboard
SetTimer
GetKeyboardLayoutNameW
GetDlgCtrlID
CloseClipboard
EmptyClipboard
IsChild
CreateCaret
ValidateRect
TrackMouseEvent
DispatchMessageW
GetMessageTime
SetFocus
GetClipboardData
DestroyCaret
SetClipboardData
IsClipboardFormatAvailable
GetCaretBlinkTime
ShowCaret
KillTimer
PtInRect
GetWindowLongW
DefWindowProcW
AdjustWindowRectEx
MonitorFromPoint
GetWindowRect
DestroyWindow
InflateRect
GetDC
SetWindowPos
CopyImage
MonitorFromRect
MonitorFromWindow
FillRect
CreateWindowExW
GetIconInfo
SendMessageW
GetSystemMetrics
UnregisterClassW
RegisterClassExW
DestroyCursor
TrackPopupMenu
ShowWindow
DrawTextA
GetMonitorInfoW
CreateIconIndirect
ClientToScreen
MapWindowPoints
GetDoubleClickTime
FrameRect
GetSysColor
DestroyMenu
LoadCursorW
SetCapture
SetCursor
SetWindowLongW
GetClientRect
DrawTextW
SystemParametersInfoW
GetParent
ReleaseCapture
InvalidateRect
ReleaseDC
GetCursorPos
BeginPaint
EndPaint
RedrawWindow
PeekMessageW
DialogBoxIndirectParamW
SetLayeredWindowAttributes
GetMenuStringW
TranslateMessage
GetClassNameW
InsertMenuW
SetRect
CreateDialogIndirectParamW
SetForegroundWindow
GetNextDlgTabItem
IsCharLowerW
CharUpperW
CharLowerW
GetFocus
GetCapture
GetComboBoxInfo
ChildWindowFromPoint
IsCharUpperW
GetWindowTextW
GetWindowTextLengthW
CheckRadioButton
GetPropW
MessageBoxExW
EndDialog
RemovePropW
SetWindowTextW
MessageBeep
GetActiveWindow
BeginDeferWindowPos
wvsprintfW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
IsWindowEnabled
IsDlgButtonChecked
IsCharAlphaNumericW
SetPropW
LoadIconW
EndDeferWindowPos
GetDlgItemInt
CheckDlgButton
GetSysColorBrush
SetDlgItemInt
LoadImageW
EnableWindow
LoadStringW
SendDlgItemMessageW
wsprintfW
GetDlgItem
UpdateWindow
MsgWaitForMultipleObjects
SetScrollInfo
RegisterClipboardFormatW
GetKeyState
GetUpdateRgn
PostMessageW
HideCaret
ScreenToClient
NotifyWinEvent
GetKeyboardLayout
GetScrollInfo
SetCursorPos

gdi32

DeleteDC
CreatePatternBrush
GetTextMetricsW
GetDeviceCaps
GetTextExtentExPointA
Polyline
GetStockObject
StretchBlt
GdiAlphaBlend
GetTextExtentExPointW
MoveToEx
GetTextExtentPoint32A
CreateDIBSection
SelectObject
ExtTextOutA
GetTextExtentPoint32W
CreateCompatibleBitmap
BitBlt
CombineRgn
CreateBitmap
CreateRectRgn
CreateRectRgnIndirect
EndPage
DPtoLP
StartDocW
CreateFontW
EndDoc
StartPage
TranslateCharsetInfo
SetMapMode
EnumFontFamiliesExW
SetTextColor
SetBkMode
LineTo
CreatePen
ExtCreatePen
GetObjectW
SaveDC
SetBkColor
Ellipse
RestoreDC
DeleteObject
CreateSolidBrush
CreateFontIndirectW
SetTextAlign
RoundRect
ExtTextOutW
Polygon
CreateCompatibleDC
IntersectClipRect

comdlg32

ChooseFontW
GetSaveFileNameW
GetOpenFileNameW
PageSetupDlgW
PrintDlgW
ChooseColorW

advapi32

RegDeleteKeyW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
IsTextUnicode
GetTokenInformation
RegQueryValueExW
OpenProcessToken
RegSetValueExW
RegDeleteValueW

shell32

SHGetPathFromIDListW
SHGetDataFromIDListW
SHGetDesktopFolder
ord180
SHAppBarMessage
SHOpenFolderAndSelectItems
ShellExecuteExW
ord190
DragQueryFileW
Shell_NotifyIconW
SHCreateDirectoryExW
DragAcceptFiles
DragFinish
SHAddToRecentDocs
ShellExecuteW
SHBrowseForFolderW
SHGetFileInfoW
SHGetFolderPathW

ole32

OleUninitialize
CoCreateGuid
OleInitialize
CoTaskMemFree
RevokeDragDrop
RegisterDragDrop
DoDragDrop
ReleaseStgMedium
CLSIDFromProgID
CoCreateInstance
CoTaskMemAlloc

oleaut32

SysAllocStringLen
SysFreeString

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 625KB - Virtual size: 624KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

30512ba45ee132dd86006925c9ed10d2

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

shlwapi

imm32

uxtheme

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 625KB - Virtual size: 624KB

.data Size: 44KB - Virtual size: 128KB

.rsrc Size: 106KB - Virtual size: 106KB

.reloc Size: 50KB - Virtual size: 49KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 625KB - Virtual size: 624KB

.data
Size: 44KB - Virtual size: 128KB

.rsrc
Size: 106KB - Virtual size: 106KB

.reloc
Size: 50KB - Virtual size: 49KB