9f8f80db5de9f0288bd958bf77190bc7d7c1b192a4a62cfd0c6f7025b72e8074

Sharing

Copy URL Twitter E-mail

General

Target

9f8f80db5de9f0288bd958bf77190bc7d7c1b192a4a62cfd0c6f7025b72e8074
Size

4.1MB
MD5

6afb486fa4b2e2c0e4b8e08c5b436667
SHA1

82850dc8c02042bbdf3245eddd03bd738f755c07
SHA256

9f8f80db5de9f0288bd958bf77190bc7d7c1b192a4a62cfd0c6f7025b72e8074
SHA512

19b9bae97cafdd671f042376d1ef5200d6018974c6a7b969b6cf01d54e47d3c2b2ba6cc6d2e9deb8cfff03710af264405a45802abe5490ce1c39c391775affba
SSDEEP

49152:5tKMxo8EZuaQF+2+z/y/OkO275C2AjcIc2a0spVqL9WWrmlwEVQ9mSsc9Fac4w48:JfvbAva4V/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9f8f80db5de9f0288bd958bf77190bc7d7c1b192a4a62cfd0c6f7025b72e8074

Files

9f8f80db5de9f0288bd958bf77190bc7d7c1b192a4a62cfd0c6f7025b72e8074
.exe windows x64

56cbbe2b358f1a2028288b93349bd22f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

comctl32

ord17
ImageList_Create
ImageList_Destroy
ord410
ImageList_Add
ord412
ord413

winmm

timeEndPeriod
timeBeginPeriod

shlwapi

SHDeleteKeyW
ord12
SHAutoComplete
StrCmpLogicalW

uxtheme

OpenThemeData
IsThemePartDefined
DrawThemeBackground
GetThemePartSize
CloseThemeData
EnableThemeDialogTexture
SetWindowTheme

kernel32

FindResourceExW
FindResourceW
LoadLibraryW
SetErrorMode
CreateMutexW
TryEnterCriticalSection
SetThreadPriority
GetSystemPowerStatus
VerifyVersionInfoW
VerSetConditionMask
GlobalFree
SystemTimeToFileTime
LocalFileTimeToFileTime
ResumeThread
GetLocaleInfoW
GetNumberFormatW
DecodePointer
GlobalSize
FormatMessageW
WaitForMultipleObjects
MultiByteToWideChar
WideCharToMultiByte
ReadFile
WriteFile
DuplicateHandle
GetCurrentProcess
EnterCriticalSection
GetThreadId
GetThreadPriority
GetSystemTimeAsFileTime
FileTimeToSystemTime
GetFileSizeEx
DosDateTimeToFileTime
SizeofResource
SetEndOfFile
GetFileTime
FlushFileBuffers
CreateFileW
GetDiskFreeSpaceExW
FindFirstFileW
DeleteFileW
FileTimeToLocalFileTime
SetFilePointer
SetFileTime
GetVolumePathNameW
OutputDebugStringW
NormalizeString
InitOnceBeginInitialize
LoadResource
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
LoadLibraryExA
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RemoveDirectoryW
GetFileAttributesW
MoveFileExW
GetFileAttributesExW
FindNextFileW
FindClose
GetCurrentThread
ReadDirectoryChangesW
GetOverlappedResult
GetFileInformationByHandle
CancelIo
CreateEventW
GetExitCodeThread
GetCurrentProcessId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
CopyFileW
Sleep
FreeLibrary
IsDebuggerPresent
SetDllDirectoryW
SetEvent
ResetEvent
CloseHandle
WaitForSingleObject
GetModuleHandleW
LeaveCriticalSection
GetSystemInfo
VirtualProtect
VirtualQuery
GetTickCount64
DeleteCriticalSection
InitializeCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GlobalUnlock
GlobalLock
GlobalAlloc
GetCommandLineW
LoadLibraryExW
lstrlenW
GetNativeSystemInfo
GetVersionExW
PowerCreateRequest
PowerClearRequest
PowerSetRequest
InitOnceComplete
LockResource
GetProcAddress
GetTickCount
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
MulDiv
InitializeCriticalSectionEx
GetLastError
RaiseException
GetCurrentThreadId
SetLastError

user32

MsgWaitForMultipleObjects
PeekMessageW
IsDialogMessageW
GetMenu
AdjustWindowRectEx
MapVirtualKeyW
SetDlgItemTextW
GetSystemMetrics
UnregisterHotKey
CharUpperW
GetComboBoxInfo
EnumThreadWindows
GetWindowPlacement
IsIconic
AdjustWindowRect
DrawEdge
SetClipboardData
CloseClipboard
OpenClipboard
FillRect
GetWindowTextLengthW
GetWindowTextW
NotifyWinEvent
RedrawWindow
IsRectEmpty
DrawTextW
TrackMouseEvent
InflateRect
FrameRect
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
GetNextDlgTabItem
InvalidateRgn
SystemParametersInfoW
ScrollWindowEx
SetScrollPos
UpdateWindow
SetScrollInfo
GetWindowThreadProcessId
SetGestureConfig
CloseGestureInfoHandle
GetGestureInfo
GetScrollInfo
MapDialogRect
IsZoomed
SetMenuItemInfoW
GetMenuItemInfoW
GetDC
RegisterHotKey
PostQuitMessage
GetDlgCtrlID
TrackPopupMenuEx
SetMenuDefaultItem
MapWindowPoints
EnumChildWindows
SetActiveWindow
MessageBeep
DialogBoxParamW
EndDialog
MessageBoxW
DestroyMenu
GetMonitorInfoW
MonitorFromPoint
CreatePopupMenu
TrackPopupMenu
AppendMenuW
GetMessagePos
GetKeyState
GetParent
DrawFrameControl
ReleaseDC
GetWindowDC
CallWindowProcW
GetClassNameW
GetClassInfoExW
RegisterClassExW
SetTimer
LoadCursorW
TranslateMessage
SetCursor
SetCapture
EnumWindows
AllowSetForegroundWindow
wsprintfW
RegisterClipboardFormatW
LoadIconW
MonitorFromWindow
GetWindow
DrawTextExW
GetFocus
SetForegroundWindow
IsChild
DispatchMessageW
RegisterClassW
RegisterWindowMessageW
DeregisterShellHookWindow
RegisterShellHookWindow
GetMessageW
MoveWindow
TranslateAcceleratorW
LoadAcceleratorsW
DestroyAcceleratorTable
IsWindowVisible
EmptyClipboard
DeferWindowPos
BeginDeferWindowPos
EndDeferWindowPos
CharLowerW
MonitorFromRect
CopyRect
OffsetRect
GetDesktopWindow
LoadImageW
KillTimer
SetFocus
GetCursorPos
DefWindowProcW
PtInRect
IntersectRect
ScreenToClient
CreateWindowExW
CheckMenuRadioItem
GetSysColor
WindowFromPoint
IsClipboardFormatAvailable
IsCharAlphaW
PostMessageW
SetWindowLongW
IsWindowEnabled
InvalidateRect
EndPaint
BeginPaint
SetLayeredWindowAttributes
SetWindowPos
GetWindowRect
ClientToScreen
GetClientRect
GetWindowLongW
GetActiveWindow
SendDlgItemMessageW
SetWindowLongPtrW
CreateDialogParamW
UnregisterClassW
DestroyWindow
SetWindowTextW
EnableWindow
ShowWindow
SendMessageW
GetDlgItem
GetClipboardData
SetRectEmpty
GetWindowLongPtrW

gdi32

DeleteDC
DeleteObject
GetObjectW
CreateFontIndirectW
SetTextColor
OffsetRgn
CreatePen
GetCurrentObject
GetBkColor
GetTextColor
GetTextExtentPoint32W
CreateRectRgn
CreateRectRgnIndirect
SetBkMode
SetBkColor
LineTo
SetDCPenColor
CombineRgn
BitBlt
SetViewportOrgEx
FillRgn
FrameRgn
CreatePolygonRgn
IntersectClipRect
SetWindowOrgEx
OffsetWindowOrgEx
RestoreDC
SaveDC
LPtoDP
GetTextMetricsW
GetDeviceCaps
ExtTextOutW
CreateCompatibleBitmap
SetDCBrushColor
CreateCompatibleDC
SelectObject
GetStockObject
MoveToEx

advapi32

RegQueryValueExW
CryptGetHashParam
CryptVerifySignatureW
CryptHashData
CryptCreateHash
CryptDestroyKey
CryptDestroyHash
RegSetValueExW
RegCloseKey
RegOpenKeyW
CryptReleaseContext
CryptImportKey
RegCreateKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegOpenKeyExW
CryptAcquireContextW

shell32

ShellExecuteExW
SHOpenFolderAndSelectItems
ord74
SHGetDesktopFolder
SHCreateItemFromIDList
ord680
DragFinish
ShellExecuteW
SHGetFolderPathW
DragAcceptFiles

ole32

CoCreateInstance
RevokeDragDrop
RegisterDragDrop
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
CoCreateGuid
ReleaseStgMedium
CoTaskMemAlloc
CLSIDFromString
PropVariantClear
CoTaskMemFree
OleGetClipboard
OleSetClipboard
DoDragDrop

oleaut32

VariantClear
SysAllocString
VariantInit

zlib1

crc32
inflateInit2_
inflate
inflateEnd

sqlite3

sqlite3_bind_double
sqlite3_bind_int64
sqlite3_column_double
sqlite3_bind_blob
sqlite3_column_blob
sqlite3_column_text
sqlite3_column_int64
sqlite3_reset
sqlite3_column_bytes
sqlite3_bind_null
sqlite3_column_type
sqlite3_column_count
sqlite3_column_name
sqlite3_open_v2
sqlite3_errmsg
sqlite3_close
sqlite3_busy_timeout
sqlite3_exec
sqlite3_last_insert_rowid
sqlite3_prepare_v2
sqlite3_clear_bindings
sqlite3_changes
sqlite3_finalize
sqlite3_bind_text
sqlite3_column_int
sqlite3_bind_int
sqlite3_step

shared

uDragQueryFileCount
uSetWindowTextEx
stricmp_utf8_max
stricmp_utf8_ex
uCharLower
?scale@audio_math@@YAXPEBN_KPEANN@Z
uGetCurrentDirectory
uGetCommandLine
LoadSystemLibrary
uGetModuleHandle
uSetCurrentDirectory
uPrintCrashInfo_SetDumpPath
uPrintCrashInfo_StartLogging
uPrintCrashInfo_Init
uGetEnvironmentVariable
uEvalKnownFolder
uGetKeyNameText
uRemovePanicHandler
uAddPanicHandler
uSearchPath
uFixPathCaps
uCreateDirectory
uGetFileAttributes
uCreateFile
uAddStringLower
uAddStringUpper
uBrowseForFolder
uBrowseForFolderEx
uGetOpenFileName
uGetOpenFileNameMulti
uSendDlgItemMessageText
uFixAmpersandChars_v2
uAppendMenu
ModalDialog_Switch
uSetClipboardString
?uPrintCrashInfo_Suppress@@YAXXZ
uPrintCrashInfo_SetComponentList
uMessageBox
uLoadLibrary
GetInfiniteWaitEvent
?convert_to_int32@audio_math@@YAXPEBN_KPEAHN@Z
?convert_to_int16@audio_math@@YAXPEBN_KPEAFN@Z
uGetTempFileName
uGetTempPath
stricmp_utf8
uGetModuleFileName
stricmp_utf8_partial
ModalDialog_PokeExisting
ModalDialog_CanCreateNew
uFindFirstFile
PokeWindow
LoadResourceEx
uFileExists
uShellExecute
uStringCompare
??1uCallStackTracker@@QEAA@XZ
??0uCallStackTracker@@QEAA@PEBD@Z
uGetDlgItemText
uSetDlgItemText
FindOwningPopup
uGetWindowText
uExceptFilterProc
uSetWindowText
uPrintCrashInfo_OnEvent
uBugCheck
uGetClipboardString
?popup_dialog@t_font_description@@QEAA_NPEAUHWND__@@@Z
uCharUpper
uPrintCrashInfo_AddEnvironmentInfo
?g_from_system@t_font_description@@SA?AU1@H@Z
?create@t_font_description@@QEBAPEAUHFONT__@@XZ
?calculate_peak@audio_math@@YANPEBN_K@Z
uReplaceCharAdd
uDragQueryFile
uFormatSystemErrorMessage
uSendMessageText

msvcp140

?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
_Cnd_do_broadcast_at_thread_exit
_Cnd_wait
_Thrd_detach
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Cnd_broadcast
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
_Mtx_lock
?uncaught_exceptions@std@@YAHXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_join
_Thrd_id
_Thrd_hardware_concurrency
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
_Cnd_init_in_situ
_Cnd_destroy_in_situ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z

msimg32

GradientFill

oleacc

LresultFromObject
AccessibleObjectFromWindow

crypt32

CertVerifyRevocation
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertVerifyTimeValidity
CertFreeCertificateChain
CertFreeCertificateContext
CertCloseStore

winhttp

WinHttpCloseHandle
WinHttpOpen
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser

gdiplus

GdiplusShutdown
GdipDrawLineI
GdipDeletePen
GdipCreatePen1
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToFile
GdipLoadImageFromStream
GdipGraphicsClear
GdipGetImageGraphicsContext
GdipDrawImageRect
GdipSetSmoothingMode
GdipSetCompositingMode
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipGetImageRawFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageType
GdiplusStartup
GdipCreateBitmapFromStream
GdipCloneImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipSetCompositingQuality
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipAlloc
GdipFree

secur32

FreeCredentialsHandle
QueryContextAttributesW
DecryptMessage
EncryptMessage
InitializeSecurityContextW
AcquireCredentialsHandleW
FreeContextBuffer
AcceptSecurityContext
DeleteSecurityContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException
__current_exception_context
__current_exception
memcmp
memset
memmove
memcpy
wcsstr
strrchr
_set_purecall_handler
memchr
wcschr
strchr
strstr
__C_specific_handler
_purecall
__std_exception_destroy
__std_terminate
__std_exception_copy

api-ms-win-crt-heap-l1-1-0

_aligned_malloc
free
malloc
_expand
_aligned_realloc
realloc
_aligned_free
_recalloc
_set_new_mode
_callnewh

api-ms-win-crt-runtime-l1-1-0

_controlfp_s
_register_thread_local_exe_atexit_callback
_c_exit
_exit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_invalid_parameter_noinfo_noreturn
signal
_set_abort_behavior
_seh_filter_exe
terminate
_cexit
_crt_atexit
_set_invalid_parameter_handler
_register_onexit_function
_errno
_invalid_parameter_noinfo
_initialize_onexit_table
abort
_beginthreadex

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__stdio_common_vsprintf
__p__commode
__stdio_common_vsprintf_s
__stdio_common_vswprintf_s

api-ms-win-crt-math-l1-1-0

lround
lroundf
exp
_dclass
llround
log
tan
pow
log10
_fpclass
floor
sin
__setusermatherr

api-ms-win-crt-string-l1-1-0

_strdup
wcscmp
strcmp
isalpha
strcat_s
wcsncmp
wcslen
wcsnlen
wmemcpy_s
strncmp
wcstok_s
wcsncpy_s
wcscpy_s
strlen
strcpy_s

api-ms-win-crt-convert-l1-1-0

atoi
_wtoi
_atoi64
atoll

api-ms-win-crt-utility-l1-1-0

_byteswap_ulong
rand
_byteswap_ushort
srand

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 620KB - Virtual size: 620KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 163KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.movehcs
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

56cbbe2b358f1a2028288b93349bd22f

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

winmm

shlwapi

uxtheme

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

zlib1

sqlite3

shared

msvcp140

msimg32

oleacc

crypt32

winhttp

gdiplus

secur32

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 3.0MB - Virtual size: 3.0MB

.rdata Size: 620KB - Virtual size: 620KB

.data Size: 108KB - Virtual size: 137KB

.pdata Size: 163KB - Virtual size: 162KB

_RDATA Size: 136KB - Virtual size: 136KB

.rsrc Size: 122KB - Virtual size: 121KB

.reloc Size: 40KB - Virtual size: 39KB

.movehcs Size: 6KB - Virtual size: 8KB

.text
Size: 3.0MB - Virtual size: 3.0MB

.rdata
Size: 620KB - Virtual size: 620KB

.data
Size: 108KB - Virtual size: 137KB

.pdata
Size: 163KB - Virtual size: 162KB

_RDATA
Size: 136KB - Virtual size: 136KB

.rsrc
Size: 122KB - Virtual size: 121KB

.reloc
Size: 40KB - Virtual size: 39KB

.movehcs
Size: 6KB - Virtual size: 8KB