8e7f7898d2679305cc305e5f5d5c40be8c3994c46657abf6055ba6a7c01deed3

Sharing

Copy URL Twitter E-mail

General

Target

8e7f7898d2679305cc305e5f5d5c40be8c3994c46657abf6055ba6a7c01deed3
Size

6.5MB
MD5

f3fc7f37ac1f42859d541ead14f41004
SHA1

31862641892418d76a971ac847fef58072ce1e18
SHA256

8e7f7898d2679305cc305e5f5d5c40be8c3994c46657abf6055ba6a7c01deed3
SHA512

b9755763140de37cb3d743114a30e4abb7b1f3cb3ead225982a2a17d1b0bfbf4bdf0e85981c2251c932bf8cad0f6b5bd3fbed3d25fbc789c018f390a72fd14bb
SSDEEP

196608:m6Jirn9ACgO75k7B+fU7xNqVc6aClTv2Rx:mZrh9axxNqS6VlTE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e7f7898d2679305cc305e5f5d5c40be8c3994c46657abf6055ba6a7c01deed3

Files

8e7f7898d2679305cc305e5f5d5c40be8c3994c46657abf6055ba6a7c01deed3
.exe windows x86

5827df127f8306240c106505e956bd32

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winhttp

WinHttpSetStatusCallback
WinHttpSetTimeouts
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpSendRequest
WinHttpOpen
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpOpenRequest
WinHttpCrackUrl
WinHttpConnect
WinHttpCloseHandle

comctl32

ImageList_GetIconSize
ImageList_GetIcon
ImageList_Remove
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_GetImageCount
ord17
ImageList_Add
ImageList_Destroy
ImageList_Create

rasapi32

RasEnumConnectionsA
RasGetErrorStringA
RasHangUpA
RasGetProjectionInfoA
RasDialA
RasSetEntryPropertiesA
RasGetConnectionStatistics
RasClearConnectionStatistics
RasGetConnectStatusA
RasGetEntryPropertiesA
RasEnumEntriesA
RasGetEntryDialParamsA

setupapi

SetupDiEnumDeviceInfo
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

iphlpapi

GetIfTable
GetPerAdapterInfo
GetAdaptersInfo

ws2_32

WSAGetLastError
WSAEnumNetworkEvents
WSAEventSelect
WSAWaitForMultipleEvents
ntohl
inet_addr
htons
WSAStartup
socket
WSACleanup
getaddrinfo
freeaddrinfo
inet_ntoa
gethostbyname
gethostname
htonl
setsockopt
send
select
recv
ioctlsocket
connect
WSACloseEvent
closesocket
__WSAFDIsSet
WSACreateEvent

wininet

FtpCommandA
InternetQueryDataAvailable
InternetQueryOptionA
InternetSetOptionA
InternetGetLastResponseInfoA
FtpOpenFileA
InternetOpenUrlA
HttpSendRequestA
HttpQueryInfoA
InternetConnectA
InternetCloseHandle
InternetOpenA
InternetReadFile

pdh

PdhOpenQueryA
PdhAddCounterW
PdhCollectQueryData
PdhGetFormattedCounterValue
PdhLookupPerfNameByIndexW
PdhCloseQuery

dnsapi

DnsQuery_A
DnsFree
DnsFlushResolverCache

crypt32

CryptUnprotectData
CryptProtectData

winscard

SCardReleaseContext
SCardEstablishContext
SCardFreeMemory
SCardGetStatusChangeA
SCardCancel
SCardConnectA
SCardReconnect
SCardTransmit
g_rgSCardT1Pci
SCardDisconnect
SCardGetAttrib
g_rgSCardT0Pci
SCardListReadersA

psapi

GetProcessImageFileNameA
GetProcessMemoryInfo

kernel32

FindNextFileW
LockResource
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
LoadResource
SizeofResource
FindResourceW
FindResourceExW
MultiByteToWideChar
WideCharToMultiByte
CreateThread
GetLastError
SetEvent
ResetEvent
WaitForSingleObject
Sleep
CloseHandle
GetSystemTime
SystemTimeToFileTime
CreateEventA
WaitForSingleObjectEx
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
FreeLibrary
GetProcAddress
RaiseException
InitializeCriticalSectionAndSpinCount
lstrcmpiA
LoadLibraryExA
GetModuleFileNameA
GetModuleHandleA
FindResourceA
IsDBCSLeadByte
GetCurrentDirectoryA
DeleteFileA
GetLocalTime
WriteFile
CreateFileA
ReadFile
ClearCommError
PurgeComm
GetSystemTimeAsFileTime
FileTimeToSystemTime
LocalAlloc
OpenProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
SetFilePointer
FormatMessageA
lstrlenA
GetFileAttributesA
TerminateProcess
OpenEventA
SetFileAttributesA
MoveFileExA
DeviceIoControl
ReleaseSemaphore
DuplicateHandle
CreateSemaphoreA
WaitForMultipleObjects
WaitForMultipleObjectsEx
SetupComm
SetCommState
SetCommTimeouts
InterlockedExchange
GetExitCodeThread
GetNativeSystemInfo
FindResourceExA
GetVersionExA
GetThreadLocale
SetThreadLocale
GlobalFree
SetErrorMode
LoadLibraryA
HeapCreate
HeapValidate
TerminateThread
LocalFree
GetFileInformationByHandle
FlushFileBuffers
CompareFileTime
GetTickCount
CreateDirectoryA
VirtualAlloc
VirtualFree
VirtualProtect
GetSystemInfo
GetModuleFileNameW
DeleteFileW
GetLocaleInfoA
GetFileSize
FindClose
FindFirstFileA
FindNextFileA
GetTimeZoneInformation
CopyFileA
CreateFileW
GetCommandLineA
GlobalAlloc
GlobalLock
GlobalUnlock
FileTimeToLocalFileTime
GetFileAttributesExW
RtlCaptureContext
GetCurrentThreadId
GetProcessId
SetLastError
ReadProcessMemory
GetThreadContext
SuspendThread
ResumeThread
GetEnvironmentVariableA
OutputDebugStringA
GetFileSizeEx
SetFilePointerEx
DecodePointer
FlushInstructionCache
VirtualQuery
SetUnhandledExceptionFilter
MulDiv
GetModuleHandleW
IsBadReadPtr
GetUserDefaultLangID
FreeResource
SetEndOfFile
lstrcmpA
RemoveDirectoryA
EscapeCommFunction
GetProfileStringA
GetWindowsDirectoryA
SetCurrentDirectoryA
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GlobalMemoryStatusEx
OpenThread
GetSystemDirectoryA
SetSystemTime
CreateWaitableTimerA
SetWaitableTimer
CancelWaitableTimer
GetVolumeInformationA
MoveFileA
GetOverlappedResult
CancelIo
ReleaseMutex
InterlockedExchangeAdd
SetThreadPriority
MapViewOfFile
UnmapViewOfFile
CreateMutexA
OpenMutexA
OpenFileMappingA
GetFileAttributesW
SetLocalTime
QueryPerformanceCounter
GetThreadTimes
CopyFileW
MoveFileExW
AreFileApisANSI
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLogicalProcessorInformation
RtlUnwind
ExitThread
LoadLibraryExW
CreateTimerQueue
InterlockedFlushSList
QueryDepthSList
SignalObjectAndWait
SwitchToThread
GetThreadPriority
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCPInfo
UnhandledExceptionFilter
CreateEventW
GetStartupInfoW
CreateSemaphoreW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesW
FreeLibraryAndExitThread
ExitProcess
GetModuleHandleExW
GetStringTypeW
EncodePointer
IsDebuggerPresent
OutputDebugStringW
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
IsProcessorFeaturePresent
GetCurrentDirectoryW
CreateDirectoryW
FindFirstFileW
GetStdHandle
IsValidCodePage
GetACP
GetOEMCP
GetConsoleCP
GetConsoleMode
GetFileType
ReadConsoleW
UnregisterWaitEx
LocalFileTimeToFileTime
RemoveDirectoryW
GetVersionExW
LoadLibraryW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
WriteConsoleW
SetEnvironmentVariableA
LCMapStringA
GetStringTypeExA
CreateProcessA

user32

EqualRect
OffsetRect
UnionRect
SetWindowRgn
GetFocus
CharNextW
IsChild
GetClassInfoExA
PostThreadMessageA
PeekMessageA
CreateDialogIndirectParamA
CreateDialogParamA
DialogBoxIndirectParamA
DialogBoxParamA
SetCursorPos
MapVirtualKeyA
mouse_event
ToAscii
GetKeyboardState
IsClipboardFormatAvailable
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
ExitWindowsEx
CreateIconFromResourceEx
LookupIconIdFromDirectoryEx
LoadIconA
LoadCursorA
FindWindowExA
GetDesktopWindow
FillRect
GetSysColor
SetWindowTextA
InvalidateRect
UpdateWindow
DrawTextA
EnableWindow
SetFocus
SendDlgItemMessageA
SetDlgItemTextW
SetDlgItemTextA
GetDlgItemInt
SetDlgItemInt
PtInRect
InSendMessage
MessageBoxA
DispatchMessageA
TranslateMessage
GetMessageA
SetCursor
GetKeyState
FindWindowA
SendMessageTimeoutA
GetWindowThreadProcessId
EnumWindows
GetWindowTextA
IsWindow
LoadImageA
LoadBitmapA
GetParent
SetWindowLongA
GetWindowLongA
IntersectRect
InflateRect
GetWindowRect
GetClientRect
EndPaint
BeginPaint
ReleaseDC
GetDC
GetSystemMetrics
KillTimer
SetTimer
ReleaseCapture
SetCapture
keybd_event
VkKeyScanA
GetDlgItemTextA
GetDlgItem
EndDialog
MoveWindow
DestroyWindow
CreateWindowExA
RegisterClassA
CallWindowProcA
DefWindowProcA
ActivateKeyboardLayout
LoadKeyboardLayoutA
PostMessageA
IsDialogMessageA
OemToCharA
OemToCharBuffA
SetLayeredWindowAttributes
DrawTextW
GetWindowRgn
SetRect
RegisterWindowMessageA
SendNotifyMessageA
WaitMessage
IsWindowVisible
GetAsyncKeyState
LoadMenuA
CreatePopupMenu
DestroyMenu
GetSubMenu
RemoveMenu
TrackPopupMenuEx
GetMenuDefaultItem
SwitchToThisWindow
LockSetForegroundWindow
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
GetWindow
GetClassNameA
WindowFromPoint
ScreenToClient
SetWindowPos
CharNextA
UnregisterClassA
SendMessageA
ReplyMessage
PostMessageW
UnregisterHotKey
GetWindowTextLengthA
RedrawWindow
InvalidateRgn
DestroyAcceleratorTable
CreateAcceleratorTableA
PostQuitMessage
CharToOemA
RegisterHotKey
CharLowerBuffA
CharLowerBuffW
SystemParametersInfoA
DestroyIcon
SetRectEmpty
DrawFocusRect
MapWindowPoints
ClientToScreen
AdjustWindowRectEx
AllowSetForegroundWindow
RegisterClassExA
SetForegroundWindow
LoadStringA
ShowWindow

gdi32

EndDoc
StartPage
EndPage
TextOutW
DPtoLP
EnumFontFamiliesExA
SetDCPenColor
ExtTextOutA
SetBkColor
GetTextExtentPointA
GetClipBox
SetTextAlign
SetMapMode
SaveDC
RestoreDC
GetDeviceCaps
DeleteMetaFile
CreateRectRgnIndirect
CreateMetaFileA
CreateDCA
CloseMetaFile
StartDocA
SetTextColor
RoundRect
GetTextExtentPoint32A
FillRgn
CreateSolidBrush
CreateFontA
CreateCompatibleBitmap
GetObjectA
SelectObject
MoveToEx
SetPixel
Rectangle
LineTo
GetPixel
CreateRectRgn
CreatePen
CreateFontIndirectA
CreateBitmap
SetBkMode
FrameRgn
GetStockObject
DeleteObject
GetTextMetricsA
GetMapMode
CreatePolygonRgn
GetTextExtentPoint32W
DeleteDC
CreateCompatibleDC
StretchBlt
BitBlt
CombineRgn
SetWindowOrgEx
SetWindowExtEx
CreateRoundRectRgn
SetViewportOrgEx
LPtoDP
TextOutA

winspool.drv

ClosePrinter
EndDocPrinter
EndPagePrinter
WritePrinter
StartPagePrinter
StartDocPrinterA
GetPrinterA
OpenPrinterA
EnumPrintersA
GetJobA
SetJobA
ord201

advapi32

RegCreateKeyExA
RegDeleteKeyA
ControlService
CryptSignHashA
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetProvParam
CryptDestroyKey
CryptGenKey
QueryServiceConfig2A
OpenServiceA
OpenSCManagerA
EnumServicesStatusExA
RegDeleteValueA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyW
RegSetValueExA
RegCreateKeyA
RegOpenKeyA
RegQueryValueExA
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
CloseServiceHandle
GetTokenInformation
RegEnumValueA
RegQueryInfoKeyA
GetUserNameA
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
RegCloseKey

shell32

ShellExecuteA
ord155
ord89
SHGetDesktopFolder
ord102
SHGetSpecialFolderPathA
SHFileOperationW
ShellExecuteExA

ole32

OleSaveToStream
WriteClassStm
ReadClassStm
CreateDataAdviseHolder
StringFromGUID2
CoRevokeClassObject
CoRegisterClassObject
CLSIDFromProgID
OleUninitialize
OleInitialize
CoInitializeEx
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoInitialize
CoUninitialize
CreateOleAdviseHolder
OleRegGetUserType
OleRegGetMiscStatus
OleRegEnumVerbs
CLSIDFromString
CoGetClassObject
OleLockRunning
CreateStreamOnHGlobal
OleRun
CoTaskMemAlloc

oleaut32

VarBstrCmp
OleCreateFontIndirect
DispCallFunc
VarBstrCat
OleCreatePropertyFrame
UnRegisterTypeLi
RegisterTypeLi
SysAllocString
VariantInit
VariantClear
VariantCopy
SysFreeString
SysStringLen
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
VariantChangeType
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen

shlwapi

PathGetArgsA
PathRemoveArgsA
PathRemoveFileSpecA
PathUnquoteSpacesA
StrRetToBufA
PathGetDriveNumberA
PathFindFileNameW
PathRelativePathToA
PathCreateFromUrlW
StrToIntA
SHSetValueA
StrChrW
SHGetValueA
StrStrIA
PathFindExtensionA
SHDeleteValueA
PathBuildRootA
PathFindFileNameA

urlmon

IsValidURL

usp10

ScriptStringAnalyse
ScriptStringCPtoX
ScriptStringOut
ScriptStringFree

Sections

.text
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 144KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 806KB - Virtual size: 806KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 280KB - Virtual size: 280KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5827df127f8306240c106505e956bd32

Headers

DLL Characteristics

File Characteristics

Imports

winhttp

comctl32

rasapi32

setupapi

version

iphlpapi

ws2_32

wininet

pdh

dnsapi

crypt32

winscard

psapi

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

shlwapi

urlmon

usp10

Sections

.text Size: 4.1MB - Virtual size: 4.1MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 144KB - Virtual size: 224KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 806KB - Virtual size: 806KB

.reloc Size: 280KB - Virtual size: 280KB

.text
Size: 4.1MB - Virtual size: 4.1MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 144KB - Virtual size: 224KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 806KB - Virtual size: 806KB

.reloc
Size: 280KB - Virtual size: 280KB