ee99f56b7e37bad6de2338e6b46f2927b9df4152f643dd00100989b07522add7

Sharing

Copy URL Twitter E-mail

General

Target

ee99f56b7e37bad6de2338e6b46f2927b9df4152f643dd00100989b07522add7
Size

3.5MB
MD5

01065e91d1fd73982436f4219ba1a739
SHA1

202b77222e6672415ff7556061a23494c865b993
SHA256

ee99f56b7e37bad6de2338e6b46f2927b9df4152f643dd00100989b07522add7
SHA512

110ae41bdb1e84fc1b86b6dddf343d205bcc32b358615a0f9aac07327c72f6b20f68d9d69044d2bc22a43a495dbafa3db1a7fe781733379836cf1543b6bb8bec
SSDEEP

49152:KoSrMhxCDZvAj3NransbxIKtgQiQVp+e5MG5t3tr63XRv0XuJdQnLCLMm7a6X:KoSrMoihKgPlnrQXTQnLCLM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ee99f56b7e37bad6de2338e6b46f2927b9df4152f643dd00100989b07522add7

Files

ee99f56b7e37bad6de2338e6b46f2927b9df4152f643dd00100989b07522add7
.exe windows x86

d984e99d68874d963de78a1a5fd48b58

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32NextW
CompareStringW
SetFilePointer
HeapAlloc
OpenFileMappingW
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FindResourceExW
FreeLibrary
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
GetLastError
GetCurrentProcess
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryW
lstrcpynW
lstrlenW
WideCharToMultiByte
CreateFileW
CloseHandle
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetCommandLineW
DeleteFileW
DecodePointer
RaiseException
SetUnhandledExceptionFilter
InitializeCriticalSectionEx
WaitForSingleObject
CreateMutexW
GetCurrentProcessId
GetCurrentThreadId
CreateProcessW
GetStartupInfoW
GetSystemDirectoryW
VirtualProtect
LoadLibraryExW
SetProcessDEPPolicy
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
SetStdHandle
ReadConsoleW
CreateProcessA
GetExitCodeProcess
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetStdHandle
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileType
VirtualQuery
GetModuleHandleExW
ExitThread
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
Process32FirstW
CreateToolhelp32Snapshot
lstrcmpW
GetLocalTime
GetFileSizeEx
GetFileAttributesW
GetFileSize
lstrlenA
LocalFree
ExpandEnvironmentStringsW
FindNextFileW
FindClose
GetOverlappedResult
CreateNamedPipeW
SetNamedPipeHandleState
DisconnectNamedPipe
ConnectNamedPipe
WriteFile
ReadFile
ReleaseMutex
MulDiv
WinExec
LoadLibraryA
WriteProcessMemory
VirtualFreeEx
VirtualAllocEx
GetTickCount
GetThreadIOPendingFlag
OpenProcess
ResumeThread
GetCurrentThread
CreateRemoteThread
CreateWaitableTimerW
CancelWaitableTimer
SetWaitableTimer
QueryPerformanceFrequency
QueryPerformanceCounter
ReleaseSemaphore
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
AreFileApisANSI
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
UnlockFileEx
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
FlushViewOfFile
GetVersionExA
DeleteFileA
GetSystemInfo
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
FormatMessageA
FlushFileBuffers
GetVersionExW
GetSystemWindowsDirectoryW
InterlockedCompareExchange
CreateFileA
lstrcmpiA
lstrcmpA
DeviceIoControl
SetLastError
DuplicateHandle
TerminateProcess
UnhandledExceptionFilter
GetTempPathW
GetTempFileNameW
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
GetVersion
SystemTimeToFileTime
GetSystemTime
SetEndOfFile
FreeResource
ExitProcess
GetACP
InterlockedDecrement
InterlockedIncrement
MoveFileExW
WaitForMultipleObjects
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
InterlockedExchangeAdd
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
Sleep
CreateEventW
ResetEvent
SetEvent
SetFileAttributesW
IsBadReadPtr
lstrcmpiW
GetStringTypeW
FormatMessageW
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
TryEnterCriticalSection
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
InitializeSListHead
HeapDestroy

user32

SendMessageTimeoutW
GetMessageW
EnumDisplayMonitors
CopyRect
SendMessageW
DispatchMessageW
IsWindow
SetWindowPos
PostMessageW
GetCursorPos
PeekMessageW
GetMonitorInfoW
PtInRect
FindWindowW
TranslateMessage
DefWindowProcW
GetClassNameW
EnumWindows
GetWindowTextW
SetWindowTextW
RemovePropW
GetPropW
SetPropW
LoadStringW
UpdateWindow
MapVirtualKeyW
GetKeyNameTextW
DestroyIcon
LoadIconW
GetActiveWindow
GetParent
OffsetRect
FrameRect
FillRect
GetCaretPos
SetCaretPos
GetClientRect
InvalidateRect
EndPaint
BeginPaint
GetWindowDC
DrawTextW
GetFocus
MonitorFromWindow
SetRectEmpty
LockWorkStation
LoadCursorW
wvsprintfW
InflateRect
UnionRect
GetDC
ReleaseDC
MonitorFromPoint
IsChild
UpdateLayeredWindow
IsZoomed
GetKeyState
SetCapture
ReleaseCapture
GetUpdateRect
CreateCaret
GetCaretBlinkTime
MapWindowPoints
IntersectRect
IsRectEmpty
GetWindow
RegisterClassW
EnableWindow
LoadImageW
IsIconic
SetWindowRgn
MessageBoxW
DrawIconEx
CharPrevW
SetRect
GetIconInfo
HideCaret
ShowCaret
GetSysColor
SetLayeredWindowAttributes
RedrawWindow
GetWindowTextLengthW
CreateAcceleratorTableW
InvalidateRgn
IsWindowEnabled
GetWindowThreadProcessId
FindWindowExW
EqualRect
ScreenToClient
ClientToScreen
SetCursor
GetWindowRect
SetForegroundWindow
SetActiveWindow
KillTimer
SetTimer
MsgWaitForMultipleObjectsEx
SetFocus
IsWindowVisible
MoveWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
PostQuitMessage
UnregisterHotKey
RegisterHotKey
TrackMouseEvent
RegisterWindowMessageW
SystemParametersInfoW
wsprintfW
SetWindowLongW
GetWindowLongW
ShowWindow
CallWindowProcW
CharNextW
DestroyWindow

gdi32

DeleteObject
GetStockObject
DeleteDC
StretchBlt
GetDeviceCaps
BitBlt
CreateCompatibleBitmap
CreateFontIndirectW
CreatePen
Rectangle
RestoreDC
SaveDC
GetTextMetricsW
SetWindowOrgEx
CreateRoundRectRgn
CombineRgn
CreateRectRgnIndirect
GetCharABCWidthsW
GetClipBox
SelectClipRgn
ExtSelectClipRgn
CreateSolidBrush
SetStretchBltMode
SetDIBColorTable
TextOutW
GetDIBits
SetDIBitsToDevice
SelectObject
GetObjectW
CreateDIBSection
CreateCompatibleDC
GetTextExtentPoint32W
CreateDCW
ExtTextOutW
SetTextColor
SetBkMode
SetBkColor

comdlg32

ChooseColorW

advapi32

RegCloseKey
RegGetValueW
InitializeSecurityDescriptor
GetTokenInformation
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCreateKeyW
RegNotifyChangeKeyValue
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegQueryInfoKeyW
OpenProcessToken
SetSecurityDescriptorDacl

shell32

SHGetFileInfoW
SHBindToParent
SHGetFolderLocation
ord155
SHFileOperationW
ShellExecuteW
ord75
ShellExecuteExW
SHGetSpecialFolderPathW
SHGetFolderPathW
Shell_NotifyIconW
ord165

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoInitialize
OleInitialize
CoUninitialize
CoCreateGuid
CreateStreamOnHGlobal
OleLockRunning
CLSIDFromProgID
CLSIDFromString

oleaut32

VariantInit
VarBstrCmp
SafeArrayPutElement
SafeArrayCreate
VariantClear
SysStringLen
SysAllocStringLen
SysAllocString
SysFreeString
VarUI4FromStr
SystemTimeToVariantTime
VariantTimeToSystemTime

shlwapi

StrRetToBufW
StrCpyW
PathFindExtensionW
SHGetValueW
PathIsDirectoryW
PathCombineW
PathRemoveFileSpecW
PathFileExistsW
PathAppendW
wnsprintfW
PathFindFileNameW
StrStrIW
SHAutoComplete
SHGetValueA
SHSetValueA
StrCmpNIW
StrTrimA
StrStrIA
PathAddBackslashW
StrCmpIW

comctl32

ord17
_TrackMouseEvent
ImageList_DrawEx
InitCommonControlsEx

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

gdiplus

GdipSetPenMode
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdiplusStartup
GdipAlloc
GdipFree
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusShutdown
GdipCreateBitmapFromHBITMAP
GdipCreateHBITMAPFromBitmap
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipLoadImageFromStreamICM
GdipDrawImagePointsI
GdipCreatePath
GdipDeletePath
GdipAddPathLineI
GdipAddPathArcI
GdipCloneBrush
GdipFillPath
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipDeleteBrush
GdipSetPenDashStyle
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawLineI
GdipDrawRectangleI
GdipDrawPath
GdipFillEllipseI
GdipAddPathArc
GdipDrawEllipseI
GdipLoadImageFromFile
GdipGetImageGraphicsContext
GdipGetImagePixelFormat
GdipSetInterpolationMode
GdipDrawImageRectI
GdipDrawImageRectRectI
GdipClosePathFigure
GdipCreateTexture
GdipCreateBitmapFromStream
GdipCloneBitmapAreaI
GdipGraphicsClear

imm32

ImmAssociateContext

sensapi

IsNetworkAlive

wininet

InternetGetConnectedState
InternetCrackUrlW
DeleteUrlCacheEntryW

iphlpapi

GetAdaptersInfo

crypt32

CertGetNameStringW

msimg32

AlphaBlend
GradientFill

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 379KB - Virtual size: 378KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 781KB - Virtual size: 781KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d984e99d68874d963de78a1a5fd48b58

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

version

gdiplus

imm32

sensapi

wininet

iphlpapi

crypt32

msimg32

urlmon

wintrust

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 379KB - Virtual size: 378KB

.data Size: 50KB - Virtual size: 76KB

.rsrc Size: 781KB - Virtual size: 781KB

.reloc Size: 110KB - Virtual size: 109KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 379KB - Virtual size: 378KB

.data
Size: 50KB - Virtual size: 76KB

.rsrc
Size: 781KB - Virtual size: 781KB

.reloc
Size: 110KB - Virtual size: 109KB