fb5f083eafa5ac8690e3336ea450857d175eeabb2c389daba3b13473e7368bd9

Sharing

Copy URL Twitter E-mail

General

Target

fb5f083eafa5ac8690e3336ea450857d175eeabb2c389daba3b13473e7368bd9
Size

1.8MB
MD5

27ea786dd3583a6251aafc1e13551a5a
SHA1

36cb40a6a5239d4119391492ca2dc34e21157c5d
SHA256

fb5f083eafa5ac8690e3336ea450857d175eeabb2c389daba3b13473e7368bd9
SHA512

2b595fca6b72fe1a45c94cb84c6965a722aa146f3059576ac6eaf478c6beb04f4b77c4b1adda5d6db8bf533fb2a36c23cb1c0b7081ded1a655d0b7d0c944de74
SSDEEP

24576:rHTFHCo/7csz+GNcSI1b/PBXzLncGTA6RmMdZ55msvXK1ne:rHTcopzl+SI1b3BD7cGT155ra1e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb5f083eafa5ac8690e3336ea450857d175eeabb2c389daba3b13473e7368bd9

Files

fb5f083eafa5ac8690e3336ea450857d175eeabb2c389daba3b13473e7368bd9
.exe windows x64

51850e20d6136d553d0dd71e95283961

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

crypt32

CertFreeCertificateChainEngine
CertFreeCertificateChain
CertFindExtension
CryptDecodeObjectEx
CertGetCertificateChain
CertEnumCertificatesInStore
PFXImportCertStore
CertFindCertificateInStore
CertCloseStore
CryptQueryObject
CertCreateCertificateChainEngine
CertOpenStore
CryptStringToBinaryW
CertAddCertificateContextToStore
CertFreeCertificateContext

kernel32

GetProcAddress
VirtualAlloc
LoadLibraryA
GetSystemInfo
FindFirstFileW
FindResourceExW
FindResourceW
LoadResource
WideCharToMultiByte
Sleep
SizeofResource
CreateEventA
MultiByteToWideChar
lstrlenW
CreateDirectoryA
GetLastError
FindClose
LockResource
GetModuleFileNameA
SetFilePointer
SystemTimeToFileTime
CreateDirectoryW
SetFileTime
WriteFile
GetFileAttributesW
ReadFile
CreateFileW
GetCurrentDirectoryW
CloseHandle
LocalFileTimeToFileTime
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
GetSystemDirectoryW
LoadLibraryW
OpenEventA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
DeleteFileA
GetModuleHandleW
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentProcessId
SetEnvironmentVariableA
GetDriveTypeA
CreateFileA
GetConsoleOutputCP
WriteConsoleA
LCMapStringW
LCMapStringA
HeapQueryInformation
HeapReAlloc
GetTimeZoneInformation
GetCurrentDirectoryA
GetProcessHeap
HeapAlloc
HeapFree
SetStdHandle
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
HeapDestroy
HeapCreate
HeapSetInformation
FlsFree
FlsAlloc
FlsSetValue
FlsGetValue
DecodePointer
EncodePointer
GetStartupInfoA
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
OutputDebugStringW
WriteConsoleW
OutputDebugStringA
DebugBreak
RtlPcToFileHeader
RaiseException
RtlUnwindEx
IsBadReadPtr
HeapValidate
HeapSize
GetDateFormatA
GetTimeFormatA
ExitThread
CreateThread
GetDriveTypeW
GetFileInformationByHandle
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
ExitProcess
GetStartupInfoW
FileTimeToSystemTime
GetTickCount
GetVolumeInformationW
DeleteFileW
MoveFileW
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetCurrentProcess
DuplicateHandle
lstrlenA
GetAtomNameW
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
LocalFree
SetErrorMode
GlobalFlags
MulDiv
GetDiskFreeSpaceW
GetFullPathNameW
GetTempFileNameW
GetFileTime
CompareStringW
GetVersionExW
GlobalGetAtomNameW
GlobalFindAtomW
GetVersionExA
SetEvent
GlobalAddAtomW
WritePrivateProfileStringW
FreeResource
GlobalFree
CompareStringA
GlobalAlloc
GlobalDeleteAtom
lstrcmpA
GetCurrentThread
GetCurrentThreadId
GetLocaleInfoW
ConvertDefaultLocale
EnumResourceLanguagesW
GetModuleFileNameW
GlobalLock
lstrcmpW
GlobalUnlock
GetFileSizeEx
SleepEx
GetModuleHandleA
VerSetConditionMask
VerifyVersionInfoW
WaitForSingleObject
MoveFileExW
GetEnvironmentVariableA
SetLastError
FormatMessageW
GetStdHandle
GetFileType
WaitForMultipleObjects
PeekNamedPipe

user32

SystemParametersInfoW
CharUpperW
CopyAcceleratorTableW
RemoveMenu
ModifyMenuW
InsertMenuItemW
InsertMenuW
GetMenuItemInfoW
GetMenuStringW
GetMenuState
GetMenuItemID
EnableMenuItem
CheckMenuItem
AppendMenuW
DeleteMenu
IsMenu
CreatePopupMenu
CreateMenu
GrayStringW
DrawTextExW
DrawTextW
DrawIcon
GetSysColorBrush
SetRectEmpty
FillRect
DestroyCursor
GetMenuItemCount
GetSubMenu
UnpackDDElParam
ReuseDDElParam
LoadMenuW
DestroyMenu
ReleaseCapture
TranslateAcceleratorW
LoadAcceleratorsW
RegisterWindowMessageW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
SendDlgItemMessageA
GetSysColor
AdjustWindowRectEx
EqualRect
DeferWindowPos
BeginDeferWindowPos
CopyRect
EndDeferWindowPos
ScrollWindow
GetScrollInfo
SetScrollInfo
WinHelpW
TrackPopupMenu
GetClassLongW
GetClassLongPtrW
GetClassNameW
GetWindowLongPtrW
SetPropW
UnhookWindowsHookEx
GetPropW
CallWindowProcW
SetWindowLongPtrW
RemovePropW
DefWindowProcW
SetMenu
GetMenu
GetMessageTime
GetMessagePos
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetSystemMetrics
SetCursor
GetKeyState
CallNextHookEx
PeekMessageW
GetCursorPos
SetWindowsHookExW
GetMessageW
TranslateMessage
DispatchMessageW
GetMenuCheckMarkDimensions
LoadBitmapW
SetMenuItemBitmaps
TabbedTextOutW
EndDialog
CreateDialogIndirectParamW
DestroyWindow
LoadIconW
LoadCursorW
PostThreadMessageW
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
GetForegroundWindow
SetForegroundWindow
WindowFromPoint
SetParent
IsChild
GetTopWindow
ShowScrollBar
GetNextDlgTabItem
wsprintfW
PostQuitMessage
RegisterClipboardFormatW
SendMessageW
GetWindowThreadProcessId
GetDesktopWindow
SetCapture
GetCapture
SetActiveWindow
GetActiveWindow
KillTimer
SetTimer
LockWindowUpdate
GetDCEx
ShowOwnedPopups
IsWindowVisible
ValidateRect
InvalidateRect
UpdateWindow
ReleaseDC
GetClipboardFormatNameA
GetClipboardFormatNameW
PtInRect
GetWindowDC
GetDC
IsRectEmpty
GetTabbedTextExtentA
UnregisterClassW
OffsetRect
EnableWindow
IsWindowEnabled
InflateRect
SetRect
GetLastActivePopup
GetParent
GetWindowLongW
MessageBoxW
GetWindow
SetWindowPos
IsWindow
GetDlgItem
SendDlgItemMessageW
SetDlgItemTextW
IsDialogMessageW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetDlgCtrlID
SetWindowLongW
ShowWindow
SetFocus
GetFocus
PostMessageW
GetSystemMenu
IsIconic
IsZoomed
SetWindowRgn
BringWindowToTop
GetWindowRect
GetClientRect
MapWindowPoints
ClientToScreen
ScreenToClient
BeginPaint
EndPaint

gdi32

CreateDCW
GetObjectW
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
ExtTextOutW
MoveToEx
LineTo
SetTextAlign
GetCurrentPositionEx
CreateRectRgn
GetDeviceCaps
CreatePen
CreateSolidBrush
CreatePatternBrush
CreateFontIndirectW
CreateRectRgnIndirect
CreateEllipticRgn
SetRectRgn
CombineRgn
GetNearestColor
DeleteDC
GetBkColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextColor
GetViewportOrgEx
GetViewportExtEx
GetWindowOrgEx
GetWindowExtEx
DPtoLP
LPtoDP
PtVisible
RectVisible
Ellipse
Rectangle
PatBlt
BitBlt
GetPixel
TextOutW
GetTextExtentPoint32W
GetTextAlign
GetTextFaceW
GetTextMetricsW
Escape
StartDocW
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
GetTextExtentPointW
GetTextExtentPoint32A
GetStockObject
StretchDIBits
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
DeleteObject
GetCharWidthW
CreateFontW
GetObjectType
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
SelectClipRgn
ExcludeClipRect
IntersectClipRect

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
GetJobW
ClosePrinter

advapi32

RegEnumKeyW
RevertToSelf
SetThreadToken
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptDestroyKey
CryptEncrypt
CryptImportKey
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
GetFileSecurityW
SetFileSecurityW
RegOpenKeyW
OpenThreadToken
RegQueryValueW
RegDeleteKeyW
RegSetValueExW

shell32

DragFinish
DragQueryFileW

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameW
PathIsUNCW
PathStripToRootW
PathRemoveFileSpecW
PathFindExtensionW

ole32

StringFromCLSID
CoCreateInstance
CoInitializeEx
CoUninitialize
OleTranslateAccelerator
IsAccelerator
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
CoTaskMemFree

oleaut32

SysAllocStringLen
VariantClear
VariantChangeType
VariantInit

ws2_32

ioctlsocket
gethostname
getpeername
__WSAFDIsSet
select
connect
recv
WSAIoctl
setsockopt
getaddrinfo
freeaddrinfo
htonl
socket
listen
getsockname
accept
recvfrom
bind
sendto
htons
WSASetLastError
ntohs
WSACloseEvent
WSAEventSelect
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
WSAResetEvent
getsockopt
WSACreateEvent
WSAStartup
WSACleanup
WSAGetLastError
send
closesocket

wldap32

ord117
ord14
ord219
ord145
ord208
ord26
ord133
ord147
ord127
ord142
ord79
ord167
ord301
ord27
ord41
ord46
ord216
ord73

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 355KB - Virtual size: 355KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

51850e20d6136d553d0dd71e95283961

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

ws2_32

wldap32

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 355KB - Virtual size: 355KB

.data Size: 17KB - Virtual size: 44KB

.pdata Size: 71KB - Virtual size: 71KB

.rsrc Size: 19KB - Virtual size: 18KB

.reloc Size: 27KB - Virtual size: 27KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 355KB - Virtual size: 355KB

.data
Size: 17KB - Virtual size: 44KB

.pdata
Size: 71KB - Virtual size: 71KB

.rsrc
Size: 19KB - Virtual size: 18KB

.reloc
Size: 27KB - Virtual size: 27KB