54aca64b3359624f967c426bc9ed23de1275f16fff490936cc06de8acea1ca40

Sharing

Copy URL

Twitter E-mail

General

Target

54aca64b3359624f967c426bc9ed23de1275f16fff490936cc06de8acea1ca40
Size

1.6MB
MD5

a29c10258fbc132373c327433e8d7117
SHA1

0921800309f023683af8eff32dd27c6a6d061f81
SHA256

54aca64b3359624f967c426bc9ed23de1275f16fff490936cc06de8acea1ca40
SHA512

79326b6a377b65a85f9b6ad42633dfd3b3af905570ee472004eeb683cbee6632f71c000b8ae42ddea56899c9bafbae816828dcd46d0b230c75d49f3f97a4e6d3
SSDEEP

24576:nG4L7Kh4fq79MVxJw++T6mD98DJd3qYTzlK/:ndLmhiqR0P+SlK/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
54aca64b3359624f967c426bc9ed23de1275f16fff490936cc06de8acea1ca40

Files

54aca64b3359624f967c426bc9ed23de1275f16fff490936cc06de8acea1ca40
.exe windows x86

9dbd349818830234d1379c6612d10385

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

vDbgPrintExWithPrefix

advapi32

GetUserNameW
RegCloseKey
RegCreateKeyExW
RegCreateKeyW
RegDeleteValueW
RegEnumValueW
RegOpenKeyExW
RegOpenKeyW
RegQueryInfoKeyW
RegQueryValueExW

browseui

ord106
ord107

comctl32

CreatePropertySheetPageW
ord328
ord329
ord385
ord334
ImageList_Create
ImageList_Destroy
ImageList_GetIconSize
ImageList_LoadImageW
ImageList_Remove
ImageList_ReplaceIcon
ImageList_SetIconSize
InitCommonControls
PropertySheetW

kernel32

CloseHandle
CreateEventW
CreateMutexW
CreateProcessW
CreateSemaphoreW
CreateThread
DeleteCriticalSection
DeleteFileW
DuplicateHandle
EnterCriticalSection
ExpandEnvironmentStringsW
FindClose
FindFirstFileW
FindNextFileW
FindResourceW
FlushInstructionCache
FreeLibrary
GetBinaryTypeW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeProcess
GetLastError
GetLocalTime
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetSystemTimeAsFileTime
GetTickCount
GetTimeFormatW
GetUserDefaultLangID
GetWindowsDirectoryW
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
LoadResource
LocalAlloc
LocalFree
LocalReAlloc
LockResource
MapViewOfFile
MulDiv
OpenEventW
OpenProcess
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReleaseMutex
ReleaseSemaphore
SetCurrentDirectoryW
SetEvent
SetLastError
SetProcessShutdownParameters
SetUnhandledExceptionFilter
SizeofResource
Sleep
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject

msvcrt

__dllonexit
__lconv_init
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_beginthreadex
_cexit
_exit
_fpreset
_initterm
_iob
_itoa
_itow
_lock
_onexit
_snprintf
_snwprintf
_unlock
_vsnprintf
_vsnwprintf
_wcmdln
abort
bsearch
calloc
exit
free
fwrite
malloc
memcmp
memmove
memset
raise
realloc
signal
sprintf
strcat
strchr
strcmp
strcpy
strcspn
strncmp
strrchr
vfprintf
vsprintf
wcscat
wcschr
wcscmp
wcscpy
wcslen
wcsncpy

ole32

CLSIDFromString
CoCreateInstance
OleInitialize
OleLoadFromStream
OleUninitialize

oleaut32

SysAllocString
SysFreeString

shell32

ord60
ord660
ILClone
ILFindLastID
ILFree
ILRemoveLastID
IsUserAnAdmin
ord54
ord181
ord61
SHCloneSpecialIDList
ord723
ord91
SHFindFiles
SHFree
SHGetDesktopFolder
SHGetFolderPathW
SHGetPathFromIDListA
SHGetSpecialFolderPathW
SHRestricted
ShellExecuteExW
ShellExecuteW
Shell_MergeMenus

shlwapi

ord164
ord172
ord173
ord174
SHGetValueW
ord279
SHOpenRegStreamW
SHRegGetBoolUSValueW
SHSetValueW
ord165
wnsprintfW

uxtheme

CloseThemeData
DrawThemeBackground
DrawThemeParentBackground
GetThemeColor
GetThemeFont
GetThemeMargins
GetThemePartSize
IsAppThemed
IsThemeActive
IsThemeBackgroundPartiallyTransparent
OpenThemeData
SetWindowTheme

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

gdi32

CreateFontIndirectW
CreateRectRgnIndirect
CreateSolidBrush
DeleteObject
GetObjectW
GetStockObject
GetTextExtentPointW
Rectangle
SelectObject
SetBkMode
SetTextColor
TextOutW

user32

AppendMenuW
BeginDeferWindowPos
BeginPaint
CallWindowProcW
CascadeWindows
CheckDlgButton
CheckMenuItem
ChildWindowFromPoint
ChildWindowFromPointEx
ClientToScreen
CreatePopupMenu
CreateWindowExW
DefWindowProcW
DeferWindowPos
DeleteMenu
DestroyMenu
DestroyWindow
DialogBoxParamW
DispatchMessageW
DrawFrameControl
EnableMenuItem
EnableWindow
EndDeferWindowPos
EndDialog
EndPaint
EnumWindows
EqualRect
FillRect
FindWindowW
GetAncestor
GetClassLongW
GetClassNameW
GetClientRect
GetCursorPos
GetDC
GetDCEx
GetDesktopWindow
GetDlgItem
GetForegroundWindow
GetKeyState
GetLastActivePopup
GetMenuItemCount
GetMenuItemInfoW
GetMessageTime
GetMessageW
GetMonitorInfoW
GetParent
GetShellWindow
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMenu
GetSystemMetrics
GetWindow
GetWindowDC
GetWindowInfo
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowThreadProcessId
InflateRect
InternalGetWindowText
IntersectRect
InvalidateRect
IsChild
IsDlgButtonChecked
IsIconic
IsRectEmpty
IsWindow
IsWindowEnabled
IsWindowVisible
KillTimer
LoadBitmapW
LoadCursorW
LoadIconW
LoadImageW
LoadMenuW
LoadStringW
MapWindowPoints
MessageBoxW
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
MsgWaitForMultipleObjects
OffsetRect
PeekMessageW
PostMessageW
PostQuitMessage
PostThreadMessageW
PtInRect
RegisterClassExW
RegisterHotKey
RegisterWindowMessageW
ReleaseDC
RemoveMenu
ScreenToClient
SendMessageCallbackW
SendMessageTimeoutW
SendMessageW
SendNotifyMessageW
SetFocus
SetForegroundWindow
SetMenuItemInfoW
SetTimer
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowRgn
SetWindowTextW
ShowWindow
ShowWindowAsync
SwitchToThisWindow
SystemParametersInfoW
TileWindows
TrackPopupMenuEx
TranslateMessage

Sections

.text
Size: 230KB - Virtual size: 230KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ATL
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rossym
Size: 326KB - Virtual size: 326KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9dbd349818830234d1379c6612d10385

Headers

File Characteristics

Imports

ntdll

advapi32

browseui

comctl32

kernel32

msvcrt

ole32

oleaut32

shell32

shlwapi

uxtheme

version

gdi32

user32

Sections

.text Size: 230KB - Virtual size: 230KB

.data Size: 2KB - Virtual size: 1KB

ATL Size: 512B - Virtual size: 8B

.rdata Size: 47KB - Virtual size: 46KB

.bss Size: - Virtual size: 5KB

.idata Size: 10KB - Virtual size: 10KB

.CRT Size: 512B - Virtual size: 52B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 1.0MB - Virtual size: 1.0MB

.rossym Size: 326KB - Virtual size: 326KB

.text
Size: 230KB - Virtual size: 230KB

.data
Size: 2KB - Virtual size: 1KB

ATL
Size: 512B - Virtual size: 8B

.rdata
Size: 47KB - Virtual size: 46KB

.bss
Size: - Virtual size: 5KB

.idata
Size: 10KB - Virtual size: 10KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

.rossym
Size: 326KB - Virtual size: 326KB