484ea59370ec6ec11d7aaefef21265f1a658ba219543c6cd4cc7f710df03d2d3

Sharing

Copy URL Twitter E-mail

General

Target

484ea59370ec6ec11d7aaefef21265f1a658ba219543c6cd4cc7f710df03d2d3
Size

6.3MB
MD5

38371f2c09ecd0aabfd54f2919e31d52
SHA1

da95a5c8ba904e919a473e85cc854b2a5ddfd07a
SHA256

484ea59370ec6ec11d7aaefef21265f1a658ba219543c6cd4cc7f710df03d2d3
SHA512

89ff8c9c6d522e9afb1c452dc19c5df58ae50c4449c5eee0993bc0ef4bd145481720bca5186f518f9f4e893685cdc7f033d1ba629c6f92e0f36c4c3d9f6793f9
SSDEEP

98304:7ZvdAIVeEOJzZ+rIYCOVhrPIRLKq3Ee3d6FMJrCqKRArJP60:lvYN+/RlPI0q0E6FM1CqKRArJp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
484ea59370ec6ec11d7aaefef21265f1a658ba219543c6cd4cc7f710df03d2d3

Files

484ea59370ec6ec11d7aaefef21265f1a658ba219543c6cd4cc7f710df03d2d3
.exe windows x86

9526b7953bcb21f92cfb462f393f6fd8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateProcess
WaitForMultipleObjects
GetOverlappedResult
CreateNamedPipeW
SetNamedPipeHandleState
DisconnectNamedPipe
ConnectNamedPipe
PulseEvent
CreateEventW
ReleaseMutex
ResetEvent
SetEvent
GetStartupInfoW
CreateProcessW
CreateMutexW
GetCommandLineW
ExpandEnvironmentStringsW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GlobalLock
GlobalUnlock
GlobalSize
UnmapViewOfFile
OpenFileMappingW
CreateFileMappingW
GetSystemDirectoryW
GetProcessId
GetCurrentThread
Sleep
OutputDebugStringW
WriteFile
SetFileAttributesW
SetEndOfFile
ReadFile
GetFileSize
GetFileAttributesW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
CreateFileW
WideCharToMultiByte
lstrlenW
lstrcpynW
FreeLibrary
GetCurrentProcess
MultiByteToWideChar
LoadLibraryW
IsBadReadPtr
GetProcAddress
GetModuleHandleW
VirtualProtect
GetCurrentThreadId
GetCurrentProcessId
WaitForSingleObject
SetUnhandledExceptionFilter
CloseHandle
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleFileNameW
FindResourceExW
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
ExitThread
WriteConsoleW
GetModuleHandleExW
GetFileType
GetStdHandle
GetFileAttributesExW
RtlUnwind
WaitForMultipleObjectsEx
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
ReleaseSemaphore
DuplicateHandle
SetProcessAffinityMask
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
InitializeCriticalSection
GetProcessHeap
SignalObjectAndWait
GetSystemWindowsDirectoryW
InterlockedCompareExchange
CreateFileA
lstrcmpiA
lstrcmpA
DeviceIoControl
UnhandledExceptionFilter
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
WaitForSingleObjectEx
GetLocalTime
ResumeThread
GetTempFileNameW
GlobalFree
RaiseException
DecodePointer
GlobalAlloc
GetVersion
SystemTimeToFileTime
DosDateTimeToFileTime
FileTimeToDosDateTime
GetSystemTime
SetFileTime
LocalFileTimeToFileTime
GetFileTime
FileTimeToLocalFileTime
lstrcmpW
OpenProcess
FreeResource
ExitProcess
MulDiv
GetCurrentDirectoryW
SetCurrentDirectoryW
GetACP
FlushFileBuffers
GetTempPathW
FindNextFileW
FindNextFileA
FindFirstFileW
FindFirstFileA
FindClose
InterlockedDecrement
InterlockedIncrement
LocalFree
SetFilePointer
GetFileSizeEx
MapViewOfFile
GetVersionExW
LoadLibraryExW
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
QueryPerformanceFrequency
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
RtlCaptureStackBackTrace
TlsAlloc
SwitchToThread
InitializeCriticalSectionAndSpinCount
SetLastError
TryEnterCriticalSection
FormatMessageW
GetStringTypeW
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
IsDebuggerPresent
EncodePointer
InitializeSListHead
InterlockedPopEntrySList

user32

GetSystemMetrics
ShowCursor
SendMessageW
SetFocus
CallWindowProcW
CreateWindowExW
DestroyWindow
GetFocus
DrawTextW
GetWindowDC
BeginPaint
EndPaint
InvalidateRect
SetCaretPos
GetCaretPos
FillRect
FrameRect
UnregisterClassA
IsWindowEnabled
FindWindowExW
RemovePropW
InvalidateRgn
CreateAcceleratorTableW
GetWindowTextLengthW
PostMessageW
IsWindow
EnableWindow
SendMessageTimeoutW
MapVirtualKeyW
GetKeyNameTextW
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromWindow
MonitorFromRect
SystemParametersInfoW
GetWindow
GetWindowThreadProcessId
FindWindowW
GetParent
GetWindowLongW
PtInRect
IntersectRect
CopyRect
MapWindowPoints
UnregisterClassW
AttachThreadInput
ShowWindow
MoveWindow
GetWindowRect
GetClientRect
SetForegroundWindow
GetForegroundWindow
GetClipboardData
CloseClipboard
OpenClipboard
BringWindowToTop
SetWindowPos
DefWindowProcW
GetWindowTextW
ClientToScreen
IsWindowVisible
ScreenToClient
GetCursorPos
KillTimer
SetTimer
PostQuitMessage
SetWindowLongW
OffsetRect
wsprintfW
wvsprintfW
SetCursor
InflateRect
UnionRect
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
IsChild
SetWindowTextW
IsZoomed
CharNextW
GetKeyState
SetCapture
ReleaseCapture
GetDC
ReleaseDC
GetUpdateRect
CreateCaret
GetCaretBlinkTime
IsRectEmpty
GetClassNameW
RegisterClassW
RegisterClassExW
GetClassInfoExW
GetMenu
SetPropW
GetPropW
AdjustWindowRectEx
LoadImageW
IsIconic
SetWindowRgn
MessageBoxW
MonitorFromPoint
CopyImage
CharPrevW
SetRect
DestroyIcon
DrawIconEx
GetIconInfo
HideCaret
ShowCaret
GetSysColor
UpdateLayeredWindow

gdi32

CreateRoundRectRgn
GetDeviceCaps
GetTextExtentPoint32W
CombineRgn
GetStockObject
GetCharABCWidthsW
GetClipBox
SelectClipRgn
ExtSelectClipRgn
StretchBlt
SetStretchBltMode
SetWindowOrgEx
SetDIBColorTable
TextOutW
GdiFlush
CreateDCW
GetDIBits
SetDIBitsToDevice
Rectangle
SelectObject
SetBkColor
SetBkMode
SetTextColor
ExtTextOutW
GetObjectW
GetTextMetricsW
SaveDC
RestoreDC
CreateFontIndirectW
DeleteObject
CreateCompatibleBitmap
BitBlt
CreatePen
CreateSolidBrush
CreateDIBSection
DeleteDC
CreateCompatibleDC
CreateRectRgnIndirect

advapi32

CryptCreateHash
CryptHashData
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
CryptGetHashParam
CryptContextAddRef
CryptDecrypt
CryptDestroyHash
RegCreateKeyW
CryptEncrypt
RegSetValueExW
RegDeleteValueA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
QueryServiceStatus
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegGetValueW
GetTokenInformation
FreeSid
EqualSid
AllocateAndInitializeSid
OpenThreadToken
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumKeyExA
CryptImportKey
CryptGenRandom
CryptSetKeyParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
RegOpenKeyExA
RegQueryValueExA

shell32

ShellExecuteW
SHGetFileInfoW
SHBindToParent
SHGetFolderLocation
ord155
SHCreateDirectoryExW
SHGetFolderPathW
ShellExecuteExW
SHGetSpecialFolderPathW
ord165

ole32

CoInitializeSecurity
CoInitializeEx
CoCreateGuid
StringFromGUID2
OleLockRunning
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
CoUninitialize
CoCreateInstance
CoInitialize
OleInitialize
OleUninitialize
CoSetProxyBlanket

oleaut32

CreateErrorInfo
SetErrorInfo
VariantChangeType
VariantClear
VariantInit
SafeArrayPutElement
SafeArrayCreate
SysAllocString
SysFreeString
GetErrorInfo

shlwapi

SHSetValueA
SHGetValueA
StrCmpNIW
StrTrimA
StrToIntExW
PathCompactPathW
SHAutoComplete
PathIsRootW
StrStrIA
StrStrIW
PathAppendW
PathFileExistsW
PathRemoveFileSpecW
PathCombineW
wnsprintfW
StrRetToBufW
PathAddBackslashW
PathFindExtensionW
PathFindFileNameW
PathIsDirectoryW
PathRemoveExtensionW
PathAppendA
StrCmpIW
PathIsRelativeW

urlmon

URLDownloadToFileW
URLDownloadToCacheFileW

ws2_32

ntohs
htonl
htons
ntohl

imm32

ImmAssociateContext

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

dxva2

GetPhysicalMonitorsFromHMONITOR
GetNumberOfPhysicalMonitorsFromHMONITOR
SetVCPFeature

crypt32

CryptStringToBinaryW
CryptStringToBinaryA
CertGetNameStringW
CryptBinaryToStringW
CryptBinaryToStringA

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

gdiplus

GdipAlloc
GdipFree
GdipCreatePath
GdipDeletePath
GdipAddPathLineI
GdipAddPathArcI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipSetPenDashStyle
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawLineI
GdipDrawRectangleI
GdipDrawPath
GdipFillEllipseI
GdipClosePathFigure
GdipCreateTexture
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromScan0
GdipCreateHBITMAPFromBitmap
GdipCloneBitmapAreaI
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipSetInterpolationMode
GdipGraphicsClear
GdipFillPath
GdipDrawImagePointsI
GdipDrawImageRectRectI
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipDrawEllipseI
GdipLoadImageFromFile
GdipLoadImageFromFileICM
GdipGetImagePixelFormat
GdipDrawImageRectI
GdipLoadImageFromStreamICM
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipAddPathArc

comctl32

InitCommonControlsEx
ord17
_TrackMouseEvent
ImageList_DrawEx

msimg32

AlphaBlend
GradientFill

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 429KB - Virtual size: 428KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.msvcjmc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9526b7953bcb21f92cfb462f393f6fd8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

urlmon

ws2_32

imm32

version

dxva2

crypt32

wintrust

wininet

iphlpapi

gdiplus

comctl32

msimg32

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 429KB - Virtual size: 428KB

.data Size: 30KB - Virtual size: 62KB

.msvcjmc Size: 3KB - Virtual size: 3KB

.rsrc Size: 3.8MB - Virtual size: 3.8MB

.reloc Size: 112KB - Virtual size: 111KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 429KB - Virtual size: 428KB

.data
Size: 30KB - Virtual size: 62KB

.msvcjmc
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 3.8MB - Virtual size: 3.8MB

.reloc
Size: 112KB - Virtual size: 111KB