b6fd2bfe061ab644a48a8391b566488c1cb0624b162ec9b244dbbd18ee7c9d48

Sharing

Copy URL Twitter E-mail

General

Target

b6fd2bfe061ab644a48a8391b566488c1cb0624b162ec9b244dbbd18ee7c9d48
Size

2.4MB
MD5

aef272d57f95e2c397982fc3a4736e60
SHA1

88063739b55fccd01396bdc0b1830476a646560b
SHA256

b6fd2bfe061ab644a48a8391b566488c1cb0624b162ec9b244dbbd18ee7c9d48
SHA512

530df04df5af225c9423bd280f3078d4a70c64014e0856e93ebf1d9ed935c330b41594aab6dc8bc33fa5dc220c4a2fe989a68cdc15334a78e6b07563bc533b90
SSDEEP

24576:irW2jKmoDGIb1qcLuT/WxwtOKgfsxXClQeiqVa2BCtONIdCJNbK67Xzshup5:CWnD59geQO6SlQPqYdgWCnKYL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b6fd2bfe061ab644a48a8391b566488c1cb0624b162ec9b244dbbd18ee7c9d48

Files

b6fd2bfe061ab644a48a8391b566488c1cb0624b162ec9b244dbbd18ee7c9d48
.exe windows x64

8ea5194646018faf7b60c7da42e10e9f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

WritePrivateProfileStringW
DeleteFileW
FindFirstFileW
FindNextFileW
GetLocalTime
GetWindowsDirectoryW
FreeLibrary
WinExec
lstrcpyW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FlushFileBuffers
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetCurrentProcessId
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
GetSystemInfo
HeapReAlloc
DeleteFileA
WaitForSingleObjectEx
LoadLibraryA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
HeapSize
HeapValidate
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
HeapCreate
GetModuleHandleW
AreFileApisANSI
TryEnterCriticalSection
DecodePointer
OpenProcess
InitializeCriticalSectionEx
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
GetPrivateProfileIntW
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
InitializeSListHead
GetStringTypeW
EncodePointer
CompareStringW
LCMapStringW
GetCurrentDirectoryW
MulDiv
GlobalSize
LocalFileTimeToFileTime
GetModuleHandleA
GetEnvironmentVariableW
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableCS
SetThreadPriority
TerminateProcess
ExitProcess
GetModuleHandleExW
GetLocaleInfoEx
LCIDToLocaleName
GetCurrentThreadId
GetCurrentProcess
CreateMutexW
ReleaseMutex
GetLastError
CreateDirectoryW
SetCurrentDirectoryW
GlobalAddAtomW
QueryPerformanceFrequency
QueryPerformanceCounter
VerifyVersionInfoW
CreateFileMappingA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
FindResourceW
SizeofResource
LockResource
GetPrivateProfileStringW
LoadResource
OpenFileMappingW
CreateFileMappingW
WriteProcessMemory
GetModuleFileNameW
UnmapViewOfFile
VirtualFreeEx
VirtualAllocEx
RtlLookupFunctionEntry
InitializeCriticalSectionAndSpinCount
MapViewOfFile
GetFileSizeEx
GetFileAttributesW
GetTickCount
CreateFileW
SearchPathW
CreateThread
Sleep
WaitForSingleObject
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetProcessHeap
HeapFree
ExpandEnvironmentStringsW
VerSetConditionMask
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryW
GetProcAddress
HeapAlloc
ReadFile
CloseHandle

user32

SendMessageW
WaitMessage
DefWindowProcW
PostQuitMessage
RegisterClassExW
GetClassInfoExW
CreateWindowExW
DestroyWindow
FindWindowW
PrivateExtractIconsW
DestroyIcon
LoadImageW
GetIconInfo
RegisterHotKey
ClientToScreen
MsgWaitForMultipleObjects
IsZoomed
UnregisterHotKey
GetKeyboardLayout
IsHungAppWindow
PostMessageW
AttachThreadInput
SetWindowPos
IsWindowVisible
IsIconic
BringWindowToTop
GetKeyState
GetKeyNameTextW
MapVirtualKeyExW
GetForegroundWindow
PeekMessageW
DispatchMessageW
GetMonitorInfoW
SetForegroundWindow
AllowSetForegroundWindow
GetWindowRect
MessageBoxW
GetCursorPos
PtInRect
SetWindowLongW
GetDesktopWindow
FindWindowExW
GetShellWindow
GetClassNameW
GetWindowThreadProcessId
CharNextW
GetDC
MonitorFromWindow
LoadIconW
LoadCursorW
InflateRect
TranslateMessage
ReleaseDC
SetWindowTextW
MonitorFromPoint
RegisterClassW
SetWindowLongPtrW
GetWindowLongW
GetWindow
EnableWindow
SetFocus
ShowWindow
GetWindowLongPtrW
CallWindowProcW
SetPropW
GetPropW
InvalidateRect
ScreenToClient
GetFocus
SetCapture
ReleaseCapture
BeginPaint
EndPaint
GetUpdateRect
GetClientRect
IsRectEmpty
IntersectRect
UpdateLayeredWindow
UnionRect
GetWindowPlacement
MonitorFromRect
SetWindowRgn
MapWindowPoints
GetParent
GetSysColor
GetAsyncKeyState
IsClipboardFormatAvailable
GetClipboardData
DrawTextW
SetWindowsHookExW
UnhookWindowsHookEx
OffsetRect
CallNextHookEx
RegisterWindowMessageW
IsWindow
MoveWindow
OpenClipboard
CloseClipboard
SetClipboardData
RegisterClipboardFormatW
EmptyClipboard
CharLowerW
SetTimer
KillTimer
GetSystemMetrics
CreatePopupMenu
DestroyMenu
TrackPopupMenuEx
SetCursor
GetMessageW

gdi32

SetBkMode
SetTextColor
GetObjectW
DeleteObject
SetStretchBltMode
GetObjectA
GetTextExtentPoint32W
SetWindowOrgEx
ExtSelectClipRgn
GetWindowOrgEx
RestoreDC
SaveDC
CreateCompatibleDC
StretchBlt
AddFontResourceExW
AddFontMemResourceEx
DeleteDC
GetDIBits
CreateDCW
CreateDIBSection
CreateRoundRectRgn
BitBlt
GetDeviceCaps
SelectObject
CreateFontIndirectW
GetStockObject
CreateRectRgnIndirect

comdlg32

GetOpenFileNameW

advapi32

RegGetValueW
SetTokenInformation
GetTokenInformation
GetLengthSid
FreeSid
AllocateAndInitializeSid
OpenProcessToken

shell32

SHCreateItemFromIDList
SHGetNameFromIDList
ord25
ord152
SHGetPathFromIDListW
SHOpenFolderAndSelectItems
SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetDesktopFolder
SHBindToParent
ShellExecuteExW
Shell_NotifyIconW
ShellExecuteW
DragAcceptFiles
DragFinish
DragQueryFileW
SHGetSpecialFolderLocation
ord190
ord155
ord727
SHGetFileInfoW
SHAppBarMessage
SHParseDisplayName

ole32

OleInitialize
OleUninitialize
CLSIDFromString
RegisterDragDrop
RevokeDragDrop
ReleaseStgMedium
CoTaskMemFree
CoCreateInstance
CreateStreamOnHGlobal

shlwapi

ord219
StrCpyW
PathIsDirectoryW
PathFileExistsW
PathIsRelativeW

gdiplus

GdipAddPathString
GdipGetFontSize
GdipGetFontStyle
GdipFillPath
GdipDrawString
GdipDrawEllipseI
GdipFillEllipseI
GdipAddPathArc
GdipAddPathLine
GdipCreatePathGradientFromPath
GdipSetPathGradientWrapMode
GdipSetPathGradientPresetBlend
GdipCreateRegionPath
GdipDeleteRegion
GdipSetClipRegion
GdipCreateEffect
GdipDeleteEffect
GdipSetEffectParameters
GdipBitmapApplyEffect
GdipMeasureString
GdipScaleMatrix
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipCloneStringFormat
GdipDeleteFont
GdipDeleteFontFamily
GdipCreateFontFromDC
GdipGetFontCollectionFamilyCount
GdipNewInstalledFontCollection
GdipDrawPath
GdipDrawRectangleI
GdipDrawBezierI
GdipSetSmoothingMode
GdipDrawLineI
GdipFillRectangle
GdipDeletePath
GdipTransformPath
GdipIsOutlineVisiblePathPointI
GdipIsVisiblePathPointI
GdipGetPathWorldBoundsI
GdipAddPathPolygonI
GdipAddPathPieI
GdipAddPathArcI
GdipAddPathEllipseI
GdipAddPathRectangleI
GdipAddPathCurveI
GdipSetTextRenderingHint
GdipAddPathLine2I
GdipAddPathLineI
GdipClosePathFigure
GdipStartPathFigure
GdipGetPathFillMode
GdipSetPathFillMode
GdipResetPath
GdipClonePath
GdipCreatePath
GdipCreateTexture
GdipDeletePen
GdipGetPenDashStyle
GdipSetPenDashStyle
GdipGetPenLineJoin
GdipSetPenLineJoin
GdipGetPenDashCap197819
GdipGetPenEndCap
GdipGetPenStartCap
GdipSetPenDashCap197819
GdipSetPenEndCap
GdipSetPenStartCap
GdipSetPenColor
GdipGetPenWidth
GdipSetPenWidth
GdipClonePen
GdipCreatePen1
GdipSetStringFormatLineAlign
GdipDrawImageRectRect
GdipCreateFromHDC
GdipDrawImage
GdipSetWorldTransform
GdipRotateMatrix
GdipTranslateMatrix
GdipGetWorldTransform
GdipDeleteMatrix
GdipCreateMatrix
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdiplusShutdown
GdiplusStartup
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateHBITMAPFromBitmap
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipAddPathBezierI
GdipSetInterpolationMode
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromHICON
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetImageThumbnail
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipSaveImageToStream
GdipCloneImage
GdipFree
GdipAlloc
GdipGetFamily
GdipCreateFontFromLogfontA
GdipDisposeImage

imm32

ImmAssociateContext
ImmSetOpenStatus
ImmGetOpenStatus
ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

winmm

timeKillEvent
timeSetEvent

comctl32

ord17
_TrackMouseEvent

msimg32

AlphaBlend

msvcrt

?_set_new_mode@@YAHH@Z
_commode
?terminate@@YAXXZ
___lc_handle_func
_strtoi64
_isatty
fflush
_fileno
_wcstoui64
_strtoui64
ceil
log10
_clearfp
_wcmdln
__set_app_type
_XcptFilter
__wgetmainargs
iswctype
wctomb_s
_mbtowc_l
strnlen
_iob
_unlock
_lock
strcpy_s
_wtof
_wtoi
iswalnum
wcsncmp
wcsncpy
fgets
fopen
strncpy
strtol
wcstoul
wcstok
isspace
abort
pow
wcsnlen
___lc_collate_cp_func
___mb_cur_max_func
___lc_codepage_func
_wcsdup
__pctype_func
calloc
_stricmp
_set_fmode
_initterm_e
_initterm
_callnewh
strcmp
_endthreadex
_beginthreadex
_localtime64_s
strncmp
strcspn
_msize
malloc
_wcsicmp
wcscpy_s
wcscat_s
tolower
realloc
wcstol
atoi
free
ftell
fseek
fread
fclose
_wfopen_s
_wtol
_errno
qsort
sqrtf
wcsstr
strstr
__C_specific_handler
memcmp
strrchr
strchr
__RTDynamicCast
memmove
__CxxFrameHandler3
_CxxThrowException
memset
memcpy
sqrt
sinf
fmodf
floorf
floor
cosf
ceilf
atan2f
acosf
_amsg_exit
wcsrchr
tanf

Exports

Exports

Everything_CleanUp
Everything_DeleteRunHistory
Everything_Exit
Everything_GetBuildNumber
Everything_GetLastError
Everything_GetMajorVersion
Everything_GetMatchCase
Everything_GetMatchPath
Everything_GetMatchWholeWord
Everything_GetMax
Everything_GetMinorVersion
Everything_GetNumFileResults
Everything_GetNumFolderResults
Everything_GetNumResults
Everything_GetOffset
Everything_GetRegex
Everything_GetReplyID
Everything_GetReplyWindow
Everything_GetRequestFlags
Everything_GetResultAttributes
Everything_GetResultDateAccessed
Everything_GetResultDateCreated
Everything_GetResultDateModified
Everything_GetResultDateRecentlyChanged
Everything_GetResultDateRun
Everything_GetResultExtensionA
Everything_GetResultExtensionW
Everything_GetResultFileListFileNameA
Everything_GetResultFileListFileNameW
Everything_GetResultFileNameA
Everything_GetResultFileNameW
Everything_GetResultFullPathNameA
Everything_GetResultFullPathNameW
Everything_GetResultHighlightedFileNameA
Everything_GetResultHighlightedFileNameW
Everything_GetResultHighlightedFullPathAndFileNameA
Everything_GetResultHighlightedFullPathAndFileNameW
Everything_GetResultHighlightedPathA
Everything_GetResultHighlightedPathW
Everything_GetResultListRequestFlags
Everything_GetResultListSort
Everything_GetResultPathA
Everything_GetResultPathW
Everything_GetResultRunCount
Everything_GetResultSize
Everything_GetRevision
Everything_GetRunCountFromFileNameA
Everything_GetRunCountFromFileNameW
Everything_GetSearchA
Everything_GetSearchW
Everything_GetSort
Everything_GetTargetMachine
Everything_GetTotFileResults
Everything_GetTotFolderResults
Everything_GetTotResults
Everything_IncRunCountFromFileNameA
Everything_IncRunCountFromFileNameW
Everything_IsAdmin
Everything_IsAppData
Everything_IsDBLoaded
Everything_IsFileResult
Everything_IsFolderResult
Everything_IsQueryReply
Everything_IsVolumeResult
Everything_QueryA
Everything_QueryW
Everything_RebuildDB
Everything_Reset
Everything_SaveDB
Everything_SaveRunHistory
Everything_SetMatchCase
Everything_SetMatchPath
Everything_SetMatchWholeWord
Everything_SetMax
Everything_SetOffset
Everything_SetRegex
Everything_SetReplyID
Everything_SetReplyWindow
Everything_SetRequestFlags
Everything_SetRunCountFromFileNameA
Everything_SetRunCountFromFileNameW
Everything_SetSearchA
Everything_SetSearchW
Everything_SetSort
Everything_SortResultsByPath
Everything_UpdateAllFolderIndexes

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 351KB - Virtual size: 350KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 191KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8ea5194646018faf7b60c7da42e10e9f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

shlwapi

gdiplus

imm32

winmm

comctl32

msimg32

msvcrt

Exports

Exports

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 351KB - Virtual size: 350KB

.data Size: 34KB - Virtual size: 42KB

.pdata Size: 79KB - Virtual size: 79KB

.rsrc Size: 191KB - Virtual size: 190KB

.reloc Size: 16KB - Virtual size: 16KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 351KB - Virtual size: 350KB

.data
Size: 34KB - Virtual size: 42KB

.pdata
Size: 79KB - Virtual size: 79KB

.rsrc
Size: 191KB - Virtual size: 190KB

.reloc
Size: 16KB - Virtual size: 16KB