5c8704ac1377a47be23eca1991ab2e7b50c92876ae8b240830ec978b019b2bd6

Sharing

Copy URL

Twitter E-mail

General

Target

5c8704ac1377a47be23eca1991ab2e7b50c92876ae8b240830ec978b019b2bd6
Size

1.7MB
MD5

12e151a61684152f7166fb385310bf94
SHA1

3432bb096d7727d2ba218cde4f6a7f5c148c5049
SHA256

5c8704ac1377a47be23eca1991ab2e7b50c92876ae8b240830ec978b019b2bd6
SHA512

a51decf23a77019970d313dbb48473601537f522c85afff3d6882d7e3ea64773ed774b62a5b069388f099076121ebfdb8dcd83162909a794726572b2c4131fae
SSDEEP

49152:Tv6D/4E3wPL9n3fTjeqOLO0IL+MFLgYNg:Tvc4E3wPxnvfeqDrtFdNg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5c8704ac1377a47be23eca1991ab2e7b50c92876ae8b240830ec978b019b2bd6

Files

5c8704ac1377a47be23eca1991ab2e7b50c92876ae8b240830ec978b019b2bd6
.exe windows x86

ae1994c345e226f5556c18a868cbffca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateThread
GetExitCodeThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateEventW
LoadLibraryExW
GetModuleFileNameW
WritePrivateProfileStringW
GetProcAddress
LocalAlloc
LocalFree
VirtualAlloc
VirtualFree
OpenProcess
GetCurrentProcessId
GetLastError
lstrlenW
GetModuleHandleW
QueryDosDeviceW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
DecodePointer
InterlockedIncrement
InterlockedDecrement
FreeLibrary
RaiseException
InitializeCriticalSectionAndSpinCount
LoadResource
SizeofResource
lstrcmpiW
LoadLibraryW
SetThreadPriority
ReleaseSemaphore
CreateEventA
GetDiskFreeSpaceExW
GetTempPathW
WriteFile
LockResource
MultiByteToWideChar
CreateThread
WideCharToMultiByte
ReadFile
GetLogicalDriveStringsW
FindResourceW
GetFileSize
SetEndOfFile
GetFullPathNameW
DeleteFileW
CreateFileW
RemoveDirectoryW
GetSystemDirectoryW
GetPrivateProfileStringW
CloseHandle
DeviceIoControl
Sleep
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
FlushFileBuffers
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
SetFilePointerEx
FreeLibraryAndExitThread
ExitThread
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
WriteConsoleW
GetModuleHandleExW
RtlUnwind
ExpandEnvironmentStringsW
PeekNamedPipe
GetStdHandle
GetFileType
WaitForMultipleObjects
GetSystemDirectoryA
LoadLibraryA
SleepEx
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
ResetEvent
UnhandledExceptionFilter
IsProcessorFeaturePresent
FindClose
CreateDirectoryW
FindFirstFileW
FindNextFileW
MoveFileExW
CopyFileW
GetWindowsDirectoryW
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
GetVolumeInformationW
GetTickCount
GetCurrentProcess
GetCurrentThreadId
GetSystemInfo
FormatMessageW
GetVersionExW
GetLongPathNameW
lstrcpyW
FileTimeToSystemTime
GlobalAlloc
GlobalFree
TerminateProcess
GetExitCodeProcess
CreateProcessW
ReleaseMutex
CreateMutexW
GetFileAttributesW
AreFileApisANSI
SetUnhandledExceptionFilter
SetErrorMode
GetLocalTime
GetCommandLineW
OutputDebugStringA
SetPriorityClass
GetACP
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
SetFilePointer
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
FreeResource
ExitProcess
MulDiv
VerSetConditionMask
VerifyVersionInfoW
lstrcpynW
QueryPerformanceCounter
EncodePointer
SetLastError
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
FindFirstFileA
FindNextFileA
ExpandEnvironmentStringsA
OutputDebugStringW
CreateFileA
CreateSemaphoreA

user32

SetWindowLongW
GetWindowLongW
InvalidateRect
SetTimer
SetForegroundWindow
PostQuitMessage
MessageBoxA
MapVirtualKeyExW
GetKeyNameTextW
IsWindow
IsRectEmpty
SetRectEmpty
SetWindowPos
CharNextW
ShowWindow
PostMessageW
FindWindowW
wsprintfW
LoadStringW
GetKeyState
SetCursor
InflateRect
UnionRect
OffsetRect
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
CreateWindowExW
DestroyWindow
IsWindowVisible
IsIconic
IsZoomed
SetFocus
GetActiveWindow
GetFocus
SetCapture
ReleaseCapture
KillTimer
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
GetClientRect
GetWindowRect
GetCursorPos
ScreenToClient
MapWindowPoints
GetSysColor
IntersectRect
PtInRect
GetParent
GetWindow
LoadImageW
MonitorFromWindow
GetMonitorInfoW
CharPrevW
DrawTextW
FillRect
SetRect
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
UpdateWindow
SetWindowRgn
MessageBoxW
UpdateLayeredWindow
MoveWindow
GetWindowRgn
CreatePopupMenu
DestroyMenu
EnableMenuItem
AppendMenuW
TrackPopupMenu
CreateCaret
GetCaretBlinkTime
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
IsWindowEnabled
EqualRect
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
wsprintfA
DrawTextA
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
GetKeyboardLayout

advapi32

CreateServiceW
CloseServiceHandle
OpenSCManagerW
RegFlushKey
DeleteService
StartServiceW
OpenServiceW
DuplicateTokenEx
RevertToSelf
ImpersonateLoggedOnUser
OpenProcessToken
GetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupAccountSidW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyW
RegEnumKeyW
RegCloseKey
RegQueryValueExA

shell32

SHGetFolderPathW
DragQueryFileW
ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderPathW

ole32

OleDuplicateData
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
OleLockRunning
ReleaseStgMedium
DoDragDrop
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoInitialize
CoUninitialize

oleaut32

VarUI4FromStr
SysAllocString
VariantClear
VariantInit
SysFreeString

iphlpapi

GetAdaptersInfo

comctl32

_TrackMouseEvent
InitCommonControlsEx
ord17

gdiplus

GdipAddPathLine
GdipDeletePath
GdipCreatePath
GdiplusShutdown
GdiplusStartup
GdipDrawImageRectI
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
ord1
GdipCloneImage
GdipDeleteBrush
GdipAlloc
GdipCreateSolidFill
GdipCreatePen1
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipSetStringFormatTrimming
GdipDisposeImage
GdipDeletePen
GdipSetPenMode
GdipLoadImageFromStream
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipDrawRectangleI
GdipDrawPath
GdipFillRectangleI
GdipFillPath
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipFree

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow

psapi

EnumProcessModules
GetModuleFileNameExW
GetProcessImageFileNameW

crypt32

CryptMsgClose
CryptQueryObject
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptMsgGetParam

shlwapi

PathFileExistsW

urlmon

URLDownloadToFileW

ws2_32

sendto
recvfrom
select
__WSAFDIsSet
getservbyname
getservbyport
gethostbyaddr
inet_ntoa
inet_addr
htonl
WSASetLastError
listen
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
socket
closesocket
WSAGetLastError
send
recv
WSACleanup
WSAStartup
gethostname
ioctlsocket
gethostbyname
accept
setsockopt

gdi32

GetObjectA
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBitmap
CreateFontIndirectW
CreatePen
DeleteDC
DeleteObject
GetDeviceCaps
GetStockObject
AddFontMemResourceEx
RemoveFontMemResourceEx
Rectangle
RestoreDC
SaveDC
SelectObject
CloseEnhMetaFile
CreateEnhMetaFileW
GetEnhMetaFileHeader
PlayEnhMetaFile
GetTextMetricsW
GetObjectW
SetWindowOrgEx
CombineRgn
CreateBitmap
CreatePenIndirect
CreateRectRgnIndirect
CreateRoundRectRgn
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
RectVisible
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
StretchDIBits
SetStretchBltMode
SetTextColor
SetBitmapBits
GetBitmapBits
GetTextExtentPointA
CreateDIBSection
MoveToEx
TextOutW
GdiFlush
CreateRectRgn
CreatePatternBrush
PtInRegion
BitBlt

Exports

Exports

AddInjectPreventDll
AddProtectFile
AddProtectProcess
AddProtectReg
AddTrustProcess
ClearInjectPreventDll
ClearProtectFile
ClearProtectProcess
ClearProtectReg
ClearTrustProcess
DeleteInjectPreventDll
DeleteProtectFile
DeleteProtectProcess
DeleteProtectReg
DeleteTrustProcess
GetAndShowProtectFileOperate
GetInjectPreventDllList
GetProcessInformation
GetProtectFileList
GetProtectProcessList
GetProtectRegList
GetTrustProcessList
SHDeleteFile
SHDeleteSelfProtectService
SHGetDumpPath
SHRegDeleteKey
SHRegDeleteValueKey
SHRegSetValueKey
SHStartSelfProtectService
SHTerminateProcessById
StartCreateProcessCallBack
StartLoadImageCallBack
StartMiniFilter
StartObjectCallBack
StartRegCallBack
StopCreateProcessCallBack
StopLoadImageCallBack
StopMiniFilter
StopObjectCallBack
StopRegCallBack

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 222KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.7MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ae1994c345e226f5556c18a868cbffca

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

iphlpapi

comctl32

gdiplus

imm32

psapi

crypt32

shlwapi

urlmon

ws2_32

gdi32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 222KB - Virtual size: 222KB

.data Size: 10KB - Virtual size: 28KB

.rsrc Size: 5.7MB - Virtual size: 5.7MB

.reloc Size: 59KB - Virtual size: 59KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 222KB - Virtual size: 222KB

.data
Size: 10KB - Virtual size: 28KB

.rsrc
Size: 5.7MB - Virtual size: 5.7MB

.reloc
Size: 59KB - Virtual size: 59KB