81773c929ffc19b536fda3e2f4e1f7efdaf6f73853ac8336c6f62f859ca0b816

Sharing

Copy URL Twitter E-mail

General

Target

81773c929ffc19b536fda3e2f4e1f7efdaf6f73853ac8336c6f62f859ca0b816
Size

11.3MB
MD5

56d90c648f01bd42da09b1236b65bffb
SHA1

c44f119e991cbe8eb8ca01c897018e91fb054343
SHA256

81773c929ffc19b536fda3e2f4e1f7efdaf6f73853ac8336c6f62f859ca0b816
SHA512

57f3632aee6904c054997f533becccd3cbb022ff78d9a2613429554a307fd2c09b8866bb2a0feff7315747287bf15b6029f5a717391b3e1a8a33cf113fe14381
SSDEEP

196608:+cQHL9/5ideEUuebh9CELLQZe3wcSac0/1tVvtK4m+tnU/9yU:1QhAdeE7EKdxg1tV1KT/0U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
81773c929ffc19b536fda3e2f4e1f7efdaf6f73853ac8336c6f62f859ca0b816

Files

81773c929ffc19b536fda3e2f4e1f7efdaf6f73853ac8336c6f62f859ca0b816
.exe windows x86

cc2d20e3a2e2d6ea9213c43ebb0a5e7a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32NextW
InitializeCriticalSection
GetExitCodeThread
SetEvent
CreateEventW
FreeResource
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
ResumeThread
ResetEvent
MulDiv
GetCurrentProcessId
DeviceIoControl
CreateFileA
lstrcmpA
lstrcmpiA
MoveFileExW
GetFileAttributesW
CreateProcessW
GetModuleHandleW
lstrlenA
Sleep
WaitForSingleObject
RaiseException
GetExitCodeProcess
GetCurrentProcess
LocalFree
InterlockedDecrement
InterlockedIncrement
GetProcAddress
FreeLibrary
FileTimeToSystemTime
CompareFileTime
SetFilePointer
SetEndOfFile
GetFileSize
GetFileInformationByHandle
FindCloseChangeNotification
FindFirstChangeNotificationW
WriteConsoleW
FindNextFileW
FlushFileBuffers
SetStdHandle
OutputDebugStringA
SetConsoleCtrlHandler
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
Process32FirstW
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
ReadConsoleW
GetConsoleMode
HeapReAlloc
HeapSize
GetStringTypeW
GetCurrentThread
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetACP
GetModuleFileNameA
FreeLibraryAndExitThread
ExitThread
GetModuleHandleExW
InterlockedFlushSList
RtlUnwind
TlsGetValue
ReleaseMutex
OpenThread
HeapWalk
HeapUnlock
HeapLock
SetFilePointerEx
LocalFileTimeToFileTime
QueryPerformanceCounter
GetStartupInfoW
WaitForSingleObjectEx
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
IsDebuggerPresent
TlsFree
TlsAlloc
SetWaitableTimer
CreateWaitableTimerW
CancelWaitableTimer
CreateToolhelp32Snapshot
WritePrivateProfileStringW
GetPrivateProfileStringW
GetFileSizeEx
OutputDebugStringW
CreateMutexW
lstrcmpiW
GetTickCount
SystemTimeToFileTime
GetLocalTime
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetCurrentThreadId
DecodePointer
lstrcpyW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetDiskFreeSpaceExW
FindResourceW
SizeofResource
LoadResource
LockResource
GetVersionExW
GetOEMCP
GetVolumeInformationW
FindFirstFileW
GetLogicalDriveStringsW
FindClose
MoveFileW
SearchPathW
DeleteFileW
SetFileAttributesW
CreateFileW
GetFullPathNameW
RemoveDirectoryW
CreateDirectoryW
GetCurrentDirectoryW
GetWindowsDirectoryW
GetTempFileNameW
GetTempPathW
GetSystemDirectoryW
lstrlenW
CloseHandle
SetFileTime
GetShortPathNameW
GetModuleFileNameW
LoadLibraryExW
LoadLibraryW
WideCharToMultiByte
MultiByteToWideChar
ReadFile
WriteFile
GetStdHandle
GetConsoleCP
TlsSetValue
IsBadWritePtr
IsBadReadPtr
CreateThread
ExpandEnvironmentStringsW
GetLastError
GetSystemTime
LocalAlloc
GetSystemInfo
GetProcessTimes
GetSystemTimeAsFileTime
DuplicateHandle
HeapFree
GetProcessHeap
DebugBreak
CopyFileW
OpenProcess
TerminateProcess
WaitForMultipleObjects
SetProcessWorkingSetSize
ExitProcess
VirtualQuery
GetFileTime
HeapAlloc
SetErrorMode
FileTimeToLocalFileTime

user32

IsClipboardFormatAvailable
OpenClipboard
MonitorFromPoint
wvsprintfW
UnhookWindowsHookEx
CallNextHookEx
DrawEdge
PostThreadMessageW
AttachThreadInput
PostQuitMessage
CallWindowProcW
GetClipboardData
GetClassInfoExW
CreateWindowExW
SetWindowPos
IsWindowVisible
IsIconic
GetDlgItem
GetDlgCtrlID
GetCapture
SetCapture
ReleaseCapture
SetTimer
KillTimer
EnableWindow
IsWindowEnabled
GetSystemMetrics
GetMenu
DrawTextW
UpdateWindow
CloseClipboard
EmptyClipboard
SetClipboardData
FindWindowExW
SendMessageTimeoutW
SubtractRect
MapVirtualKeyW
CharToOemW
GetKeyNameTextW
SetWindowsHookExW
FindWindowW
SetWindowLongW
MessageBoxW
GetActiveWindow
SetDlgItemTextW
DialogBoxParamW
CreateDialogParamW
RegisterClassExW
CharNextW
LoadStringW
UnregisterClassW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
SendMessageW
PostMessageW
DefWindowProcW
IsWindow
DestroyWindow
GetMonitorInfoW
GetForegroundWindow
GetWindowDC
UpdateLayeredWindow
EndDialog
CopyRect
SetRect
GetUpdateRect
ReleaseDC
SetForegroundWindow
MonitorFromWindow
SystemParametersInfoW
IsDialogMessageW
LoadImageW
LoadCursorW
GetWindow
GetWindowThreadProcessId
GetParent
GetDesktopWindow
GetWindowLongW
PtInRect
OffsetRect
InflateRect
FillRect
DrawFocusRect
GetSysColor
MapWindowPoints
ClientToScreen
SetCursor
AdjustWindowRectEx
GetWindowRect
GetClientRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
RedrawWindow
InvalidateRect
SetWindowRgn
EndPaint
BeginPaint
GetDC
ShowWindow

gdi32

OffsetViewportOrgEx
GetBitmapBits
CreatePatternBrush
CreateFontW
CreateDIBPatternBrushPt
GetDeviceCaps
PatBlt
CreateDCW
SetViewportOrgEx
GetObjectW
CreateDIBSection
SetTextColor
SetBkMode
SelectObject
GetStockObject
GetCurrentObject
DeleteDC
CreateSolidBrush
CreateRectRgnIndirect
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
CombineRgn
BitBlt
DeleteObject

advapi32

SetNamedSecurityInfoW
CopySid
RegEnumKeyW
RegSetKeySecurity
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegOpenKeyExA
RegEnumKeyExA
RegQueryValueExA
RegQueryValueExW
RegCreateKeyW
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegGetKeySecurity
GetNamedSecurityInfoW
SetEntriesInAclW
EqualSid
GetAce
LookupAccountNameW
SetSecurityInfo
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
GetSecurityInfo

shell32

SHGetPathFromIDListW
SHChangeNotify
SHGetSpecialFolderLocation
SHGetMalloc
SHFileOperationW
ShellExecuteW
CommandLineToArgvW
SHGetSpecialFolderPathW
ord165
SHLoadNonloadedIconOverlayIdentifiers
SHAppBarMessage
SHFreeNameMappings
SHGetFileInfoW
SHBrowseForFolderW

ole32

CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemRealloc
CoTaskMemFree
CLSIDFromProgID
CreateStreamOnHGlobal
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
OleInitialize
CoCreateGuid
CoTaskMemAlloc
OleUninitialize

oleaut32

VariantCopy
VariantClear
SysFreeString
SysAllocString
VarUI4FromStr
OleLoadPicture
VariantInit
SysAllocStringByteLen

shlwapi

PathCombineW
SHGetValueW
StrStrIW
PathIsPrefixW
PathRemoveFileSpecW
PathAddBackslashW
PathIsRootW
PathRemoveBackslashW
SHDeleteKeyW
SHSetValueW
ord176
StrCmpW
PathIsSameRootW
PathGetDriveNumberW
PathFindExtensionW
PathSkipRootW
PathStripPathW
StrToIntExW
SHGetValueA
PathFileExistsW
SHSetValueA
PathIsURLW
PathIsDirectoryW
PathMatchSpecW

comctl32

ImageList_Remove
ImageList_Duplicate
ImageList_Add
ImageList_Create
_TrackMouseEvent
ImageList_GetIconSize
ImageList_Draw
ImageList_Destroy
InitCommonControlsEx

msimg32

AlphaBlend

gdiplus

GdipAlloc
GdipFree
GdiplusShutdown
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromScan0
GdipDisposeImage
GdipCloneImage

setupapi

SetupIterateCabinetW

urlmon

URLDownloadToFileW
ObtainUserAgentString

wintrust

WTHelperProvDataFromStateData
CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust

crypt32

CertGetNameStringW

netapi32

Netbios

wininet

InternetOpenW
FtpGetFileSize
HttpQueryInfoW
HttpSendRequestExW
HttpOpenRequestW
InternetSetOptionA
InternetConnectW
InternetSetStatusCallbackW
InternetReadFile
InternetReadFileExA
FtpOpenFileW
HttpEndRequestW
InternetWriteFile
FtpCommandW
InternetGetLastResponseInfoW
InternetSetOptionW
InternetQueryOptionW
InternetCrackUrlW
CreateUrlCacheEntryW
GetUrlCacheEntryInfoW
CommitUrlCacheEntryW
InternetCloseHandle
InternetOpenUrlW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

psapi

EnumProcessModules
GetModuleFileNameExW
GetModuleBaseNameW
GetProcessMemoryInfo
EnumProcesses

comdlg32

GetSaveFileNameW
GetOpenFileNameW

Sections

.text
Size: 593KB - Virtual size: 593KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 82.1MB - Virtual size: 82.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cc2d20e3a2e2d6ea9213c43ebb0a5e7a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

setupapi

urlmon

wintrust

crypt32

netapi32

wininet

version

psapi

comdlg32

Sections

.text Size: 593KB - Virtual size: 593KB

.rdata Size: 123KB - Virtual size: 122KB

.data Size: 17KB - Virtual size: 37KB

.rsrc Size: 82.1MB - Virtual size: 82.1MB

.reloc Size: 27KB - Virtual size: 26KB

.text
Size: 593KB - Virtual size: 593KB

.rdata
Size: 123KB - Virtual size: 122KB

.data
Size: 17KB - Virtual size: 37KB

.rsrc
Size: 82.1MB - Virtual size: 82.1MB

.reloc
Size: 27KB - Virtual size: 26KB