b7b39d3e4491349742378bb3b1b5610d66f6cf8c93886be2acf136d80f4980bd

Sharing

Copy URL Twitter E-mail

General

Target

b7b39d3e4491349742378bb3b1b5610d66f6cf8c93886be2acf136d80f4980bd
Size

10.3MB
MD5

ced6d6e5d3028b3de8ed801ac44a5664
SHA1

fab400e17c06edc38bb8a5ee91e9c1f0c9b5f189
SHA256

b7b39d3e4491349742378bb3b1b5610d66f6cf8c93886be2acf136d80f4980bd
SHA512

998ec70fff651509b9eff197fd08917b8297e8188159154302506aa9dc7859c5477b1a63ef1775d1f0d36a3fea9ca7c6759924d21f668fb12b75c9d850873a8a
SSDEEP

196608:jE0U04UdVEy9qMBNLtUsXsCgoYVgX6FXLcnN8vPwh/Fo43mYZWiHB60w410o8NZ8:34UdVEy9qMBNLtrdQWKhmN8v4L3mPEsI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b7b39d3e4491349742378bb3b1b5610d66f6cf8c93886be2acf136d80f4980bd

Files

b7b39d3e4491349742378bb3b1b5610d66f6cf8c93886be2acf136d80f4980bd
.exe windows x86

98604fca8f4b0f871e8c27bee9577b5e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DecodePointer
LoadLibraryExW
lstrcmpiW
WritePrivateProfileStringW
GetDriveTypeW
SwitchToThread
GetFileInformationByHandle
CompareFileTime
FindFirstChangeNotificationW
FindCloseChangeNotification
SetFileTime
CreateDirectoryW
SearchPathW
GetCurrentDirectoryW
VerifyVersionInfoW
GetCurrentThreadId
InitializeCriticalSectionEx
RaiseException
VerSetConditionMask
lstrcpynW
LocalFree
GetLocalTime
WaitForMultipleObjects
Sleep
CreateEventW
WaitForSingleObject
SetEvent
DeleteCriticalSection
K32GetProcessImageFileNameW
LoadLibraryW
GetProcAddress
GetModuleHandleW
FreeLibrary
GetTickCount
GetCurrentProcess
ReadFile
QueryDosDeviceW
GetLogicalDriveStringsW
GetFileSize
CreateFileW
MultiByteToWideChar
WideCharToMultiByte
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
K32GetModuleFileNameExW
GetModuleFileNameW
OpenProcess
GetCurrentProcessId
WriteConsoleW
SetEndOfFile
SetFilePointerEx
ReadConsoleW
SetStdHandle
SetConsoleCtrlHandler
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
GetStringTypeW
EnumSystemLocalesW
CreateMutexW
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetLongPathNameW
MoveFileExW
MoveFileW
lstrlenW
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetWindowsDirectoryW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
SetLastError
GetLastError
GetTempPathW
SetFileAttributesW
RemoveDirectoryW
GetFullPathNameW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CloseHandle
GetTempFileNameA
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetFileType
GetCurrentThread
GetACP
GetStdHandle
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedFlushSList
RtlUnwind
lstrcmpiA
lstrcmpA
GetSystemWindowsDirectoryW
FreeResource
InterlockedCompareExchange
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
WaitForSingleObjectEx
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
GetTempPathA
WriteFile
DeleteFileA
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
CreateFileA
GetCommandLineW
InitializeSListHead
EncodePointer
IsDebuggerPresent
GetShortPathNameW
GetPrivateProfileStringW
LocalAlloc
DeviceIoControl
GetSystemDirectoryW
GetDiskFreeSpaceExW
GetVersionExW
GetEnvironmentVariableW
GetFileAttributesExW
SetFilePointer
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
TerminateProcess
GetExitCodeProcess
CopyFileW
OutputDebugStringA
OutputDebugStringW
GetFileSizeEx
ResetEvent
GetSystemInfo
GetTempFileNameW
FormatMessageW

user32

GetShellWindow
LoadImageW
SetForegroundWindow
GetSystemMetrics
GetActiveWindow
DialogBoxParamW
IsIconic
IsWindowVisible
PostQuitMessage
CharNextW
BringWindowToTop
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
FillRect
ScreenToClient
GetWindowTextLengthW
GetWindowTextW
LoadStringW
DrawTextW
GetAsyncKeyState
wsprintfW
MessageBoxW
RegisterWindowMessageW
SendMessageTimeoutW
SendNotifyMessageW
FindWindowW
UnionRect
OffsetRect
EqualRect
DestroyCursor
DrawFocusRect
MoveWindow
UnregisterClassA
GetFocus
UpdateLayeredWindow
ShowWindow
DestroyWindow
IsWindow
CreateWindowExW
GetWindowThreadProcessId
RegisterClassExW
UnregisterClassW
CallWindowProcW
DefWindowProcW
MonitorFromWindow
IsDialogMessageW
LoadCursorW
GetWindow
GetParent
SetWindowLongW
GetWindowLongW
PtInRect
MapWindowPoints
SetCursor
GetWindowRect
GetClientRect
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
ReleaseCapture
SetCapture
SetFocus
EndDialog
SetWindowPos
SendMessageW
GetMonitorInfoW
FindWindowExW
PostMessageW
KillTimer
SetTimer
CopyRect
SetWindowTextW
GetClassInfoExW

gdi32

CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
SelectObject
SetViewportOrgEx
CreateFontW
RectVisible
GetStockObject
BitBlt
SaveDC
SelectClipRgn
SetBkMode
SetTextColor
CreateDIBSection
GetObjectW
EnumFontFamiliesW
OffsetViewportOrgEx
CreateRectRgnIndirect
RestoreDC

advapi32

FreeSid
RegOpenKeyExA
RegEnumKeyExA
GetTokenInformation
CryptContextAddRef
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegEnumValueW
RegCloseKey
LookupPrivilegeValueW
DuplicateTokenEx
AdjustTokenPrivileges
OpenProcessToken
CryptDecrypt
CryptEncrypt
CryptImportKey
CryptGenRandom
CryptSetKeyParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
GetTrusteeNameW
BuildExplicitAccessWithNameW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
GetExplicitEntriesFromAclW
SetEntriesInAclW
LookupAccountNameW
LookupAccountSidW
EqualSid
RegQueryValueExA
DeleteAce
StartServiceW
OpenServiceW
GetUserNameW
AllocateAndInitializeSid
CheckTokenMembership
OpenSCManagerW
CloseServiceHandle
CreateServiceW

shell32

ord165
SHCreateDirectoryExW
SHGetFolderPathW
CommandLineToArgvW
SHGetPathFromIDListW
SHBrowseForFolderW
SHFileOperationW
ShellExecuteExW
SHGetSpecialFolderPathW
SHChangeNotify
ShellExecuteW

ole32

CoCreateGuid
CoUninitialize
CLSIDFromProgID
OleRun
CreateStreamOnHGlobal
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoInitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoInitializeEx

oleaut32

VarUI4FromStr
VariantCopy
CreateErrorInfo
SetErrorInfo
VariantChangeType
GetErrorInfo
VariantInit
SysStringLen
SysAllocStringByteLen
SysStringByteLen
SysFreeString
VarBstrCmp
VariantClear
SysAllocString

shlwapi

PathRenameExtensionA
PathFindFileNameA
PathIsDirectoryW
SHSetValueW
PathIsPrefixW
PathCombineW
StrStrIA
PathFileExistsW
PathFindExtensionW
PathFindFileNameW
StrStrIW
StrCmpNIW
StrCmpIW
PathRemoveFileSpecW
SHGetValueA
StrToIntExW
PathAppendW
SHGetValueW
PathIsRelativeW
PathIsRootW
SHSetValueA
AssocQueryStringW
StrTrimA
wnsprintfW

comctl32

InitCommonControlsEx
_TrackMouseEvent

gdiplus

GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFileICM
GdiplusShutdown
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipAlloc
GdipFree
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipGetImageWidth
GdipGetImageHeight
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetTextRenderingHint
GdipDrawRectangleI
GdipFillRectangleI
GdipDrawImagePointRectI
GdipDrawImageRectRect
GdipDrawImageRectRectI
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign

psapi

EnumProcesses
GetModuleFileNameExW
GetProcessImageFileNameW

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

setupapi

SetupIterateCabinetW

Exports

Exports

InstallEntryW
_BasicEntry@12
_Start@4

Sections

.text
Size: 925KB - Virtual size: 924KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 207KB - Virtual size: 206KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

98604fca8f4b0f871e8c27bee9577b5e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

psapi

iphlpapi

wininet

urlmon

version

setupapi

Exports

Exports

Sections

.text Size: 925KB - Virtual size: 924KB

.rdata Size: 207KB - Virtual size: 206KB

.data Size: 25KB - Virtual size: 44KB

.rsrc Size: 2.5MB - Virtual size: 2.5MB

.reloc Size: 46KB - Virtual size: 46KB

.text
Size: 925KB - Virtual size: 924KB

.rdata
Size: 207KB - Virtual size: 206KB

.data
Size: 25KB - Virtual size: 44KB

.rsrc
Size: 2.5MB - Virtual size: 2.5MB

.reloc
Size: 46KB - Virtual size: 46KB