71b94abc75736231fbfd859345c5a5c8ab4fa4bab73449b028b2ec885be74445

Sharing

Copy URL Twitter E-mail

General

Target

71b94abc75736231fbfd859345c5a5c8ab4fa4bab73449b028b2ec885be74445
Size

5.1MB
MD5

1800591d2f4b93d4d34d28222606a32e
SHA1

1db2f3a6aee5b7639870ce172b7bd80a4b9a388f
SHA256

71b94abc75736231fbfd859345c5a5c8ab4fa4bab73449b028b2ec885be74445
SHA512

85a52c2a05520c58be35c67bb8c4d05555654ffa9c2b17b070342364f47ea2688c499f234a13eab2821ae07e420a5d9e3501f834c9f3e6d96b988fd947926012
SSDEEP

98304:B5GQvprFRp8dAYIP+UKBM2h7heQ8+B+XwKm7kZNuDe2uEhWY9zsv:B5fhEy+UoM2jhB+XjTufMY9zU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
71b94abc75736231fbfd859345c5a5c8ab4fa4bab73449b028b2ec885be74445

Files

71b94abc75736231fbfd859345c5a5c8ab4fa4bab73449b028b2ec885be74445
.exe windows x86

861126bc6525aecfb486847c41c6298b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wldap32

ord143
ord50
ord26
ord30
ord200
ord32
ord217
ord79
ord33
ord301
ord27
ord41
ord46
ord211
ord22
ord35
ord60

kernel32

FileTimeToLocalFileTime
GetFileAttributesExW
SetFileTime
GetCurrentDirectoryW
RtlUnwind
RaiseException
ExitThread
SetConsoleCtrlHandler
UnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
HeapReAlloc
HeapSize
ExitProcess
GetStdHandle
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
HeapCreate
VirtualFree
VirtualAlloc
SetHandleCount
GetFileType
GetStartupInfoA
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
QueryPerformanceCounter
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
GetSystemDirectoryA
QueryPerformanceFrequency
VerifyVersionInfoA
CompareFileTime
GetEnvironmentVariableA
PeekNamedPipe
MoveFileExA
GetConsoleScreenBufferInfo
FlushFileBuffers
SetFilePointer
ReadFile
GlobalFlags
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
LoadLibraryA
lstrcmpW
GetVersionExA
SystemTimeToFileTime
FileTimeToSystemTime
lstrlenA
lstrcmpA
CompareStringW
ResumeThread
SetThreadPriority
GetCurrentDirectoryA
GetFullPathNameA
DeleteFileA
SetConsoleMode
ReadConsoleInputA
GetFileInformationByHandle
GetFileAttributesA
FindFirstFileA
GetDriveTypeA
TryEnterCriticalSection
CreateMutexW
GetDiskFreeSpaceExW
RemoveDirectoryW
CreateHardLinkW
MoveFileExW
GetComputerNameA
GetLogicalDriveStringsW
ExpandEnvironmentStringsW
GetLongPathNameW
DosDateTimeToFileTime
GetLocalTime
FormatMessageA
OpenEventA
CreateWaitableTimerA
ResetEvent
GetSystemTime
GlobalMemoryStatus
GetVersion
FlushConsoleInputBuffer
SetConsoleTextAttribute
CreatePipe
GetExitCodeThread
GetConsoleWindow
GetExitCodeProcess
GetFileSize
FormatMessageW
MulDiv
lstrlenW
LockResource
GlobalFree
LocalReAlloc
GlobalAlloc
GlobalHandle
GlobalUnlock
GlobalReAlloc
GetLocaleInfoW
CompareStringA
DuplicateHandle
SetEndOfFile
CreateEventA
EnterCriticalSection
LeaveCriticalSection
InterlockedExchange
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
FreeResource
SizeofResource
LoadResource
FindResourceW
TlsFree
CloseHandle
GetLastError
CreateMutexA
PostQueuedCompletionStatus
WaitForSingleObject
TlsAlloc
InterlockedExchangeAdd
SetEvent
SetFileAttributesW
GetFileAttributesW
FindClose
CopyFileW
DeleteFileW
FindNextFileW
FindFirstFileW
lstrcpyW
GetModuleHandleW
Sleep
HeapFree
GetProcessHeap
TerminateProcess
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GlobalLock
LocalFree
LocalAlloc
MoveFileW
GetModuleHandleA
ReleaseMutex
LoadLibraryW
FreeLibrary
CreateProcessW
CreateFileA
DeviceIoControl
GetEnvironmentVariableW
InitializeCriticalSection
GetTempPathW
CreateDirectoryW
GetPrivateProfileIntW
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameA
OpenMutexA
WaitForMultipleObjectsEx
WaitForSingleObjectEx
CreateWaitableTimerW
SetLastError
GetQueuedCompletionStatus
WaitForMultipleObjects
TerminateThread
QueueUserAPC
SetWaitableTimer
TlsSetValue
TlsGetValue
InterlockedCompareExchange
VerSetConditionMask
VerifyVersionInfoW
CreateIoCompletionPort
SleepEx
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetSystemTimeAsFileTime
ReleaseSemaphore
CreateSemaphoreA
SetUnhandledExceptionFilter
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
CreateThread
GetProcAddress
GetSystemInfo
GetProcessTimes
CreateEventW
GetTickCount
CreateFileW
WriteFile
OutputDebugStringA
GetSystemDirectoryW
HeapAlloc

user32

MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW
GetSubMenu
SetCursor
InvalidateRect
EndPaint
BeginPaint
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
FillRect
ClientToScreen
ShowWindow
SetWindowTextW
ReleaseCapture
SetRect
GetMenuItemCount
GetMenuItemID
GetMenuState
ValidateRect
PeekMessageW
GetKeyState
DispatchMessageW
TranslateMessage
CallNextHookEx
SetWindowsHookExW
GetSysColorBrush
wsprintfW
MoveWindow
SystemParametersInfoW
SetWindowLongW
RegisterWindowMessageW
WinHelpW
GetCapture
GetClassNameW
SetPropW
GetPropW
RemovePropW
IsWindow
SetFocus
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
GetClientRect
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
ScreenToClient
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
CopyRect
IsRectEmpty
UnionRect
GetMessageW
GetWindowLongW
AppendMenuW
CreatePopupMenu
LoadIconW
DestroyMenu
MessageBoxW
TrackPopupMenu
SetForegroundWindow
GetCursorPos
PostMessageW
SendMessageW
KillTimer
SetTimer
UpdateWindow
PostQuitMessage
UnhookWindowsHookEx
EnableWindow
IsWindowEnabled
GetLastActivePopup
GetParent
GetWindowThreadProcessId
FindWindowW
CreateAcceleratorTableW
InvalidateRgn
GetCaretPos
HideCaret
ShowCaret
CharPrevW
GetWindowRgn
CharNextW
UpdateLayeredWindow
GetSysColor
GetUpdateRect
GetCaretBlinkTime
SetCaretPos
CreateCaret
SetWindowRgn
MonitorFromPoint
PtInRect
GetMenu
SetWindowPos
IsZoomed
RegisterClassExW
SetCapture
GetClassLongW
MonitorFromWindow
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetWindowTextLengthW
GetWindowTextW
LoadCursorW
GetSystemMetrics
GetDC
ReleaseDC
GetMonitorInfoW

gdi32

ExtTextOutW
BitBlt
CreateFontIndirectW
DeleteObject
GetObjectW
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
GetDeviceCaps
GetStockObject
CreateSolidBrush
GetTextExtentPoint32W
CreateRectRgnIndirect
CombineRgn
GetTextMetricsW
SaveDC
RestoreDC
SelectClipRgn
CreateRectRgn
PtVisible
RectVisible
TextOutW
Escape
SetBkMode
SetStretchBltMode
SetMapMode
CreateCompatibleBitmap
GetObjectA
CreateRoundRectRgn
CreateDIBSection
PtInRegion
StretchBlt
GetCharABCWidthsW
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
CreateCompatibleDC
ExtSelectClipRgn
CreatePen
DeleteDC

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

CryptSetHashParam
OpenSCManagerW
CryptDecrypt
ReportEventW
RegisterEventSourceW
CryptGenRandom
CryptCreateHash
CryptSignHashA
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextA
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersA
RegisterEventSourceA
OpenServiceW
ReportEventA
DeregisterEventSource
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueW
RegQueryValueExW
RegCloseKey
StartServiceW
DeleteService
CreateServiceW
CloseServiceHandle

shell32

SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
Shell_NotifyIconW

ole32

CLSIDFromString
OleLockRunning
CLSIDFromProgID
CoTaskMemFree
CoInitialize
CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal

oleaut32

VariantClear
VariantChangeType
VariantInit
SysFreeString
SysAllocString

iphlpapi

GetExtendedTcpTable
GetAdaptersInfo

crypt32

CertOpenStore
CertGetCertificateContextProperty
CertOpenSystemStoreA
CertFindCertificateInStore
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertCloseStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext

shlwapi

wnsprintfW

ws2_32

recvfrom
getnameinfo
inet_addr
gethostbyname
gethostname
WSACreateEvent
WSAEventSelect
WSACloseEvent
WSAEnumNetworkEvents
sendto
socket
getpeername
recv
send
__WSAFDIsSet
WSAIoctl
getsockname
getsockopt
connect
accept
getaddrinfo
listen
freeaddrinfo
WSARecv
select
shutdown
ntohs
closesocket
ioctlsocket
WSASocketW
WSASend
setsockopt
bind
WSAGetLastError
htons
htonl
ntohl
WSASetLastError
WSACleanup
WSAStartup
getservbyname

mswsock

AcceptEx
GetAcceptExSockaddrs

gdiplus

GdipDrawRectangleI
GdipLoadImageFromStream
GdipImageSelectActiveFrame
GdipDrawImageRectI
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipGetImageHeight
GdipCreateFromHDC
GdipDeleteGraphics
GdipCreateFontFromDC
GdipDeleteFont
GdipCreateSolidFill
GdipDeleteBrush
GdipFree
GdipAlloc
GdipCloneStringFormat
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipSetStringFormatTrimming
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipMeasureString
GdipDrawString
GdipFillRectangleI
GdipCreatePen1
GdipDeletePen
GdipSetPenDashStyle
GdipDrawLineI
GdipSetPenMode
GdipCreateFontFromLogfontA
GdipCreatePath
GdipDeletePath
GdipAddPathLineI
GdipAddPathArcI
GdipDrawPath
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipGetImageWidth

dbghelp

MiniDumpWriteDump

oleacc

CreateStdAccessibleObject
LresultFromObject

comctl32

ord17
_TrackMouseEvent

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 774KB - Virtual size: 773KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 97KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 614KB - Virtual size: 613KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 214KB - Virtual size: 214KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

861126bc6525aecfb486847c41c6298b

Headers

DLL Characteristics

File Characteristics

Imports

wldap32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

iphlpapi

crypt32

shlwapi

ws2_32

mswsock

gdiplus

dbghelp

oleacc

comctl32

imm32

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.rdata Size: 774KB - Virtual size: 773KB

.data Size: 97KB - Virtual size: 136KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 614KB - Virtual size: 613KB

.reloc Size: 214KB - Virtual size: 214KB

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 774KB - Virtual size: 773KB

.data
Size: 97KB - Virtual size: 136KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 614KB - Virtual size: 613KB

.reloc
Size: 214KB - Virtual size: 214KB