c05293f4b891b1fa2a1871efa805c7f9749649d348b177d693ac8973f09aa848

Sharing

Copy URL Twitter E-mail

General

Target

c05293f4b891b1fa2a1871efa805c7f9749649d348b177d693ac8973f09aa848
Size

729KB
MD5

3fe277e77b0d1ec289c58d3fa3492fc6
SHA1

c8b28f35219d55632916fd0cc9b7a6724f464bec
SHA256

c05293f4b891b1fa2a1871efa805c7f9749649d348b177d693ac8973f09aa848
SHA512

3384e00a58224fd3f33a6ebf135c2d96e3c95e2093e63f08bcbb06f610491702507dc7b958f95ac3cb2ea8d742ca82499a05b61eed16aaaa5720daf81c4bee85
SSDEEP

12288:npk3PttyacCLATZWJYU1Qj8PH7wUxcVQUoeZxr:ItOCL4cp1cWH77cVQUoe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c05293f4b891b1fa2a1871efa805c7f9749649d348b177d693ac8973f09aa848

Files

c05293f4b891b1fa2a1871efa805c7f9749649d348b177d693ac8973f09aa848
.exe windows x86

98d17653123dbd6d37ef27aa7f3f7f4b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcessId
CreateThread
TerminateThread
ResetEvent
SetFileAttributesW
MoveFileW
SetFilePointer
GetExitCodeProcess
GetCurrentDirectoryA
GetFullPathNameA
FindFirstFileA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
FormatMessageA
ExpandEnvironmentStringsA
SleepEx
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
QueryPerformanceCounter
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetTimeZoneInformation
GetStartupInfoA
GetFileType
SetHandleCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStringTypeW
LoadLibraryExW
IsValidLocale
EnumSystemLocalesA
WaitForMultipleObjects
GetModuleFileNameA
GetStdHandle
HeapCreate
IsValidCodePage
GetOEMCP
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
ExitProcess
GetModuleHandleA
GetCPInfo
LCMapStringW
LCMapStringA
RtlUnwind
GetStartupInfoW
ExitThread
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
GetThreadLocale
GetLocaleInfoA
GetACP
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
SetEvent
CreateEventW
WideCharToMultiByte
FreeLibrary
InterlockedDecrement
UnmapViewOfFile
GetPrivateProfileIntW
GlobalAlloc
OutputDebugStringW
QueryDosDeviceW
GetLogicalDriveStringsW
TerminateProcess
Module32FirstW
WritePrivateProfileStringW
FindClose
GetSystemDirectoryW
CreateDirectoryW
GetFileAttributesW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
ProcessIdToSessionId
WaitForSingleObject
OpenEventW
DeleteFileW
WriteFile
GlobalFree
ReadFile
InitializeCriticalSection
GetPrivateProfileStringW
GetModuleFileNameW
SetLastError
CreateFileW
FlushInstructionCache
GetUserDefaultLCID
GetCurrentThreadId
InterlockedIncrement
lstrlenW
InterlockedExchange
GetModuleHandleW
GetVersionExW
GlobalLock
CreateMutexW
MultiByteToWideChar
GlobalUnlock
GetLocalTime
Sleep
GetLastError
RaiseException
GetProcAddress
LoadLibraryW
FreeResource
GetCurrentProcess
GetFileSize
GetWindowsDirectoryW
CloseHandle
lstrlenA
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetTickCount
FindResourceExW
LoadResource
FindResourceW
LockResource
SizeofResource
GetStringTypeA

user32

SetRect
UpdateLayeredWindow
EqualRect
UnregisterClassA
GetWindowLongW
GetWindowRect
IsWindowVisible
GetWindow
WindowFromPoint
GetSystemMetrics
DestroyWindow
GetClientRect
MoveWindow
RegisterClassExW
CreateWindowExW
PeekMessageW
MapWindowPoints
SetWindowLongW
GetMessageW
TranslateMessage
GetFocus
IsIconic
LoadIconW
SetCapture
SetRectEmpty
DispatchMessageW
IsChild
CopyRect
PostThreadMessageW
DestroyIcon
IsDialogMessageW
InflateRect
MonitorFromWindow
IsRectEmpty
ReleaseCapture
SetWindowRgn
IntersectRect
GetMonitorInfoW
IsWindow
SetFocus
IsWindowEnabled
RegisterWindowMessageW
KillTimer
DrawFrameControl
InvalidateRect
PtInRect
GetActiveWindow
GetClassInfoExW
EnableWindow
CallWindowProcW
SetCursor
DefWindowProcW
GetDlgCtrlID
EndPaint
LoadCursorW
LoadImageW
SystemParametersInfoW
GetNextDlgTabItem
PostMessageW
DrawIconEx
GetDesktopWindow
GetWindowThreadProcessId
SetActiveWindow
BeginPaint
GetDC
ClientToScreen
GetForegroundWindow
DrawTextW
SetTimer
LoadBitmapW
OffsetRect
AttachThreadInput
SendMessageW
ShowWindow
ScreenToClient
CharNextW
SetWindowPos
SetForegroundWindow
ReleaseDC
GetCursorPos
GetDlgItem
GetParent
EnumDisplayMonitors
EnumChildWindows
SetWindowTextW
FindWindowW

gdi32

RectInRegion
CreateDIBSection
SelectClipRgn
RestoreDC
GetCurrentObject
CreateRectRgn
CreateCompatibleBitmap
SaveDC
CreateCompatibleDC
GetDeviceCaps
DeleteDC
ExtTextOutW
GetTextExtentPoint32W
SetBkColor
CreateFontIndirectW
SetTextColor
CombineRgn
GetStockObject
DeleteObject
GetViewportOrgEx
OffsetRgn
CreateRectRgnIndirect
SetBkMode
ExtSelectClipRgn
SetViewportOrgEx
SetStretchBltMode
Rectangle
StretchBlt
BitBlt
CreateRoundRectRgn
CreateBitmap
LineTo
RoundRect
MoveToEx
GetTextColor
SelectObject
CreatePen
GetClipRgn
GetObjectW
TextOutW

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
RegOpenCurrentUser
ImpersonateLoggedOnUser
RevertToSelf
OpenProcessToken
RegEnumKeyExW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyW
RegQueryInfoKeyW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

shell32

SHCreateDirectoryExW
ShellExecuteExW
ExtractIconW
ShellExecuteW
SHGetSpecialFolderPathW

ole32

CoTaskMemRealloc
CoCreateInstance
CoInitialize
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize

oleaut32

VarUI4FromStr

shlwapi

PathFindFileNameW
StrToIntA
PathAddBackslashW
StrToIntW
PathRemoveFileSpecW
PathFileExistsW

comctl32

_TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdipDeleteFont
GdipCreatePen1
GdipDeleteFontFamily
GdipCreateBitmapFromStream
GdipCreateSolidFill
GdipCreateImageAttributes
GdipCreateBitmapFromHICON
GdipCreateFontFromLogfontW
GdipAddPathRectangleI
GdipDrawRectangleI
GdipSetCompositingQuality
GdipMeasureString
GdipDisposeImageAttributes
GdipCreateHBITMAPFromBitmap
GdipSetSmoothingMode
GdipDrawPath
GdipDeleteGraphics
GdipFillRectangleI
GdipSetClipPath
GdipCreateFromHDC
GdipSetImageAttributesColorMatrix
GdipNewPrivateFontCollection
GdipAddPathArcI
GdipCreateStringFormat
GdipCreateBitmapFromScan0
GdipDeletePrivateFontCollection
GdipTranslateWorldTransform
GdipDeleteStringFormat
GdipFillPath
GdipCreateLineBrushFromRectWithAngleI
GdipRotateWorldTransform
GdipGetImageGraphicsContext
GdipPrivateAddFontFile
GdipSetStringFormatFlags
GdipResetWorldTransform
GdipSetInterpolationMode
GdipGetFontCollectionFamilyCount
GdipSetStringFormatAlign
GdipSetPixelOffsetMode
GdipSetStringFormatLineAlign
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipGetImagePixelFormat
GdipSetStringFormatTrimming
GdipGetFamily
GdipDrawImageRectRect
GdipGetImageWidth
GdipFree
GdipDrawImageRectRectI
GdiplusShutdown
GdipSetTextRenderingHint
GdipCreatePath
GdipCloneBrush
GdipCloneBitmapArea
GdipAddPathStringI
GdipDrawString
GdipDeletePath
GdipGetImageHeight
GdipAlloc
GdipGetFontSize
GdipSetPenDashStyle
GdipSetPenEndCap
GdipDeleteBrush
GdipDisposeImage
GdipGraphicsClear
GdipImageRotateFlip
GdipSetPenStartCap
GdiplusStartup
GdipCreateFont
GdipAddPathPieI
GdipCloneImage
GdipDrawImageRectI
GdipSetPenMode
GdipClosePathFigure
GdipDrawImageI
GdipDrawLinesI
GdipFillRectangle
GdipDeletePen
GdipLoadImageFromFile
GdipDrawLine
GdipLoadImageFromStream
GdipDrawImagePointsRectI

ws2_32

WSACleanup
WSAStartup
closesocket
WSAGetLastError
recv
send
getsockname
ntohs
bind
htons
getsockopt
getpeername
setsockopt
connect
socket
WSASetLastError
freeaddrinfo
getaddrinfo
__WSAFDIsSet
select
ioctlsocket

psapi

GetModuleFileNameExW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Sections

.text
Size: 532KB - Virtual size: 529KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

98d17653123dbd6d37ef27aa7f3f7f4b

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

ws2_32

psapi

version

Sections

.text Size: 532KB - Virtual size: 529KB

.rdata Size: 112KB - Virtual size: 111KB

.data Size: 20KB - Virtual size: 25KB

.rsrc Size: 48KB - Virtual size: 46KB

.text Size: 8KB - Virtual size: 4KB

.text
Size: 532KB - Virtual size: 529KB

.rdata
Size: 112KB - Virtual size: 111KB

.data
Size: 20KB - Virtual size: 25KB

.rsrc
Size: 48KB - Virtual size: 46KB

.text
Size: 8KB - Virtual size: 4KB