768da4068e0ab71cba56e4d867229c29916966662f1f16ba0e44aee07014db17

Sharing

Copy URL Twitter E-mail

General

Target

768da4068e0ab71cba56e4d867229c29916966662f1f16ba0e44aee07014db17
Size

1.8MB
MD5

5e897b464ab0e2742b1b9d53d7c382ea
SHA1

e290ead2252a27c015089e9363ada1ba7f2fa934
SHA256

768da4068e0ab71cba56e4d867229c29916966662f1f16ba0e44aee07014db17
SHA512

74efec69c67e0fc48e7494a596fd02c4c0f267f16e594adb75991ac51dc737b89b28bd7d2935a1e9076788f5e658602d56d083e7c535908a88f1230000424752
SSDEEP

49152:YGdqYxidId/sYzyyqqDOXk4FKoIJV8HzYoF:Jd//Nqqyj7Hz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
768da4068e0ab71cba56e4d867229c29916966662f1f16ba0e44aee07014db17

Files

768da4068e0ab71cba56e4d867229c29916966662f1f16ba0e44aee07014db17
.exe windows x86

2590d867a56f3851cefe001c9069b1c4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateProcess
WaitForMultipleObjects
GetOverlappedResult
SetNamedPipeHandleState
CreateEventW
ReleaseMutex
ResetEvent
SetEvent
GetStartupInfoW
CreateProcessW
CreateMutexW
GetCommandLineW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GlobalLock
GlobalUnlock
UnmapViewOfFile
OpenFileMappingW
CreateFileMappingW
GetSystemDirectoryW
GetCurrentThread
Sleep
OutputDebugStringW
WriteFile
SetEndOfFile
ReadFile
GetFileSize
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
SetStdHandle
EnumSystemLocalesW
DeleteFileW
CreateFileW
WideCharToMultiByte
lstrlenW
lstrcpynW
FreeLibrary
GetCurrentProcess
LoadLibraryW
IsBadReadPtr
GetProcAddress
GetModuleHandleW
VirtualProtect
GetCurrentThreadId
GetCurrentProcessId
WaitForSingleObject
SetUnhandledExceptionFilter
CloseHandle
MultiByteToWideChar
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleFileNameW
FindResourceExW
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetStdHandle
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileType
GetModuleHandleExW
ExitThread
GetFileAttributesExW
RtlUnwind
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
ReleaseSemaphore
DuplicateHandle
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
GetSystemWindowsDirectoryW
InitializeCriticalSection
GetProcessHeap
InterlockedCompareExchange
CreateFileA
lstrcmpiA
lstrcmpA
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
DeviceIoControl
UnhandledExceptionFilter
WaitForSingleObjectEx
GetLocalTime
ResumeThread
RaiseException
DecodePointer
GetTempFileNameW
GlobalFree
GlobalAlloc
GetVersion
lstrcmpW
FreeResource
ExitProcess
MulDiv
GetACP
FlushFileBuffers
GetTempPathW
FindNextFileW
FindClose
InterlockedDecrement
InterlockedIncrement
LocalFree
SetFilePointer
GetFileSizeEx
MapViewOfFile
GetVersionExW
LoadLibraryExW
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
QueryPerformanceFrequency
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
InitializeCriticalSectionAndSpinCount
SetLastError
TryEnterCriticalSection
FormatMessageW
GetStringTypeW
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
IsDebuggerPresent
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache

user32

IsWindow
MapVirtualKeyW
SetFocus
SetTimer
KillTimer
EnableWindow
EnumWindows
SendMessageW
DefWindowProcW
CallWindowProcW
CreateWindowExW
DestroyWindow
GetFocus
DrawTextW
GetWindowDC
BeginPaint
EndPaint
IsWindowEnabled
FindWindowExW
GetKeyNameTextW
EnumDisplayMonitors
SendMessageTimeoutW
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW
GetWindow
GetWindowThreadProcessId
FindWindowW
GetParent
GetWindowLongW
PtInRect
IntersectRect
CopyRect
MapWindowPoints
ShowCursor
GetWindowRect
GetClientRect
GetWindowTextW
AttachThreadInput
ShowWindow
MoveWindow
SetForegroundWindow
GetForegroundWindow
GetSystemMetrics
BringWindowToTop
IsWindowVisible
SetWindowPos
PostMessageW
InvalidateRgn
ClientToScreen
ScreenToClient
GetCursorPos
PostQuitMessage
SetWindowLongW
OffsetRect
FrameRect
FillRect
GetCaretPos
SetCaretPos
InvalidateRect
wsprintfW
wvsprintfW
SetCursor
InflateRect
UnionRect
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
IsChild
UpdateLayeredWindow
CreateAcceleratorTableW
CharNextW
GetKeyState
SetCapture
ReleaseCapture
GetDC
ReleaseDC
GetUpdateRect
CreateCaret
GetCaretBlinkTime
IsRectEmpty
GetClassNameW
RegisterClassW
RegisterClassExW
GetClassInfoExW
SetPropW
GetPropW
LoadImageW
IsIconic
SetWindowRgn
MessageBoxW
MonitorFromPoint
RemovePropW
CharPrevW
SetRect
DestroyIcon
DrawIconEx
GetIconInfo
HideCaret
ShowCaret
GetSysColor
SetWindowTextW
GetWindowTextLengthW
IsZoomed

gdi32

CreateRoundRectRgn
GetDeviceCaps
GetTextExtentPoint32W
CreateDIBSection
CombineRgn
GetStockObject
GetCharABCWidthsW
GetClipBox
SelectClipRgn
ExtSelectClipRgn
StretchBlt
SetWindowOrgEx
SetDIBColorTable
TextOutW
CreateDCW
GetDIBits
SetDIBitsToDevice
Rectangle
SelectObject
SetBkColor
SetBkMode
SetTextColor
ExtTextOutW
GetObjectW
GetTextMetricsW
SaveDC
RestoreDC
CreateFontIndirectW
DeleteObject
CreateCompatibleBitmap
BitBlt
CreatePen
CreateSolidBrush
SetStretchBltMode
DeleteDC
CreateCompatibleDC
CreateRectRgnIndirect

advapi32

RegCreateKeyExW
RegEnumKeyExW
RegCreateKeyW
RegSetValueExW
RegDeleteValueA
RegGetValueW
GetTokenInformation
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA

shell32

ShellExecuteW
SHGetFolderPathW
ShellExecuteExW
SHGetSpecialFolderPathW
ord165

ole32

CoCreateGuid
OleLockRunning
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
CoUninitialize
CoCreateInstance
CoInitialize
OleInitialize
OleUninitialize

oleaut32

VariantClear
VariantInit
SafeArrayPutElement
SafeArrayCreate
SysAllocString

shlwapi

SHSetValueA
SHGetValueA
StrCmpNIW
StrTrimA
SHAutoComplete
StrStrIA
StrStrIW
PathAppendW
PathFileExistsW
PathRemoveFileSpecW
PathCombineW
wnsprintfW
PathFindFileNameW
PathIsDirectoryW
StrCmpIW

urlmon

URLDownloadToFileW
URLDownloadToCacheFileW

imm32

ImmAssociateContext

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

gdiplus

GdipAlloc
GdipFree
GdipCreatePath
GdipDeletePath
GdipAddPathLineI
GdipAddPathArcI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipSetPenDashStyle
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawLineI
GdipDrawRectangleI
GdipDrawPath
GdipFillEllipseI
GdipClosePathFigure
GdipCreateTexture
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipCreateHBITMAPFromBitmap
GdipCloneBitmapAreaI
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipSetInterpolationMode
GdipGraphicsClear
GdipFillPath
GdipDrawImagePointsI
GdipDrawImageRectRectI
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipDrawEllipseI
GdipLoadImageFromFile
GdipGetImagePixelFormat
GdipDrawImageRectI
GdipLoadImageFromStreamICM
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipAddPathArc

comctl32

InitCommonControlsEx
ord17
_TrackMouseEvent
ImageList_DrawEx

msimg32

AlphaBlend
GradientFill

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 269KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 229KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2590d867a56f3851cefe001c9069b1c4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

urlmon

imm32

version

crypt32

wintrust

wininet

iphlpapi

gdiplus

comctl32

msimg32

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 269KB - Virtual size: 268KB

.data Size: 25KB - Virtual size: 48KB

.rsrc Size: 229KB - Virtual size: 228KB

.reloc Size: 73KB - Virtual size: 73KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 269KB - Virtual size: 268KB

.data
Size: 25KB - Virtual size: 48KB

.rsrc
Size: 229KB - Virtual size: 228KB

.reloc
Size: 73KB - Virtual size: 73KB