b9d3e960dfac58ee0a256ee7731edf9877c6e9ba6bb2a9e312c86584f84aebf0

Sharing

Copy URL Twitter E-mail

General

Target

b9d3e960dfac58ee0a256ee7731edf9877c6e9ba6bb2a9e312c86584f84aebf0
Size

1.5MB
MD5

08a7811c7822689f6213cc86157385ba
SHA1

42429f2ac3ae2dceb4fb683d4abc43aac6544302
SHA256

b9d3e960dfac58ee0a256ee7731edf9877c6e9ba6bb2a9e312c86584f84aebf0
SHA512

a5cec4e4f5bcde0bc4f9a42802c44c83027a1962c19b4a177521757402a90b35f7579ad8c7411e2fad60a5ed02c57a87d2bbc07a43bc44c4d75ed05293fdccbb
SSDEEP

24576:f8BT3xBSCsG2EkQphlQlc0yFP5hdgRp51ey6q8H7jkO+l1K2OsVjMkxrLE3LhIK2:f8Ba7GthhlX0OI3Pefjknl1ffVjnLE3+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b9d3e960dfac58ee0a256ee7731edf9877c6e9ba6bb2a9e312c86584f84aebf0

Files

b9d3e960dfac58ee0a256ee7731edf9877c6e9ba6bb2a9e312c86584f84aebf0
.exe windows x86

ee9bef2bb811f6642b7b7182bd6f3610

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetLastError
InitializeCriticalSection
DeleteCriticalSection
GetLastError
CreateMutexW
lstrcmpiW
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetCommandLineW
WriteFile
CreateProcessW
FindAtomW
WaitForSingleObject
GlobalAddAtomW
GetTickCount
WideCharToMultiByte
lstrcpyW
FindNextFileW
FindClose
GetFullPathNameW
FindFirstFileW
CreateFileA
GetTempPathA
CreateThread
GetFileSizeEx
SetFilePointerEx
GetFileType
lstrcmpA
FormatMessageW
GetSystemTime
LocalFree
GetSystemTimeAsFileTime
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
EnterCriticalSection
CompareFileTime
GetTempFileNameW
MoveFileW
MoveFileExW
CopyFileW
GetDriveTypeW
GetModuleHandleW
MulDiv
RaiseException
GetPrivateProfileStringW
GetFileAttributesW
lstrcmpiA
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetTempPathW
LCMapStringA
GetModuleHandleA
GetCurrentThreadId
GetTimeFormatA
GetTimeZoneInformation
LCMapStringW
QueryPerformanceCounter
GetStartupInfoA
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleMode
GetConsoleCP
GetModuleFileNameA
HeapCreate
IsValidCodePage
GetOEMCP
GetCPInfo
Sleep
GetCurrentProcess
FlushInstructionCache
GlobalFindAtomW
CreateDirectoryW
WritePrivateProfileStringW
SetFileAttributesW
GetProcAddress
lstrlenA
OutputDebugStringW
DebugBreak
InterlockedIncrement
GetModuleFileNameW
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetStdHandle
ExitProcess
GetStartupInfoW
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
SetEndOfFile
SetFileTime
ReadFile
GetFileSize
UnmapViewOfFile
SetFilePointer
MapViewOfFile
CreateFileMappingW
ReadProcessMemory
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetFileTime
GetExitCodeProcess
GetLongPathNameW
TerminateProcess
OpenProcess
FindResourceExW
GetEnvironmentVariableW
GetVersionExW
LockResource
Thread32Next
Thread32First
Module32NextW
RemoveDirectoryW
DeleteFileW
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDateFormatA
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SuspendThread
Module32FirstW
GetACP
SetEnvironmentVariableW
TlsFree
CreateToolhelp32Snapshot
OpenThread
GetFileAttributesExW
TlsGetValue
TlsSetValue
LoadLibraryW
GetSystemDirectoryW
GetCurrentProcessId
CreateFileW
DeviceIoControl
CloseHandle
lstrlenW
InterlockedDecrement
FreeLibrary
GetStringTypeA
TlsAlloc
ReleaseMutex

user32

wvsprintfW
SendMessageTimeoutW
LoadStringW
CharUpperW
CharNextW
SendMessageW
FindWindowW
CreateWindowExW
DestroyWindow
GetWindowLongW
SetWindowPos
GetWindowRect
GetClientRect
InvalidateRect
ShowWindow
IsWindowVisible
RedrawWindow
SetDlgItemTextW
GetDlgItem
EnumWindows
GetClassNameW
GetWindowThreadProcessId
UpdateWindow
GetDC
ReleaseDC
GetActiveWindow
MessageBoxW
GetWindowPlacement
CopyRect
KillTimer
SetTimer
ScreenToClient
DefWindowProcW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
BringWindowToTop
GetSystemMetrics
LoadImageW
LoadIconW
CreateDialogParamW
IsIconic
PostQuitMessage
InflateRect
GetWindow
MonitorFromWindow
GetMonitorInfoW
IsDialogMessageW
MoveWindow
GetSystemMenu
PostMessageW
EnableMenuItem
GetParent
SetWindowTextW
wsprintfW
ExitWindowsEx
UnregisterClassA
IsWindowEnabled
EnableWindow
GetWindowTextLengthW
GetWindowTextW
MapWindowPoints
MessageBeep
SetFocus
SetWindowLongW
IsWindow

gdi32

DeleteObject
GetStockObject

advapi32

RegDeleteValueW
RegEnumKeyExA
RegQueryValueExA
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyW
RegEnumKeyExW
RegCloseKey
RegOpenKeyExA

shell32

ShellExecuteExW
SHChangeNotify
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetMalloc
ShellExecuteW
ord680
SHBrowseForFolderW
SHGetFolderPathW
ord165
SHFileOperationW

ole32

CoUninitialize
CoCreateInstance
CoTaskMemFree
OleRun
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateGuid
CoInitialize

oleaut32

SystemTimeToVariantTime
VarUdateFromDate
VariantTimeToSystemTime
VariantInit
SysStringLen
SysStringByteLen
SysAllocStringByteLen
VariantClear
SysAllocString
VarUI4FromStr
SysFreeString

shlwapi

PathFindFileNameW
PathIsDirectoryW
SHDeleteKeyW
SHSetValueW
SHGetValueW
SHDeleteValueW
PathRemoveExtensionW
PathMatchSpecW
StrRetToStrW
PathIsPrefixW
SHSetValueA
PathCombineA
PathAppendA
PathFindExtensionW
wnsprintfW
PathFileExistsW
PathCombineW
PathAppendW
PathIsRelativeW
PathRemoveFileSpecW
SHGetValueA

comctl32

InitCommonControlsEx

urlmon

URLDownloadToFileW
URLDownloadToCacheFileW

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState

netapi32

Netbios

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW
EnumProcesses

setupapi

SetupIterateCabinetW

crypt32

CryptMsgClose
CertCloseStore
CryptMsgUpdate
CryptMsgOpenToDecode
CertOpenStore
CertGetCertificateContextProperty
CertGetNameStringW

wintrust

WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData

Sections

.text
Size: 435KB - Virtual size: 435KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 950KB - Virtual size: 950KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ee9bef2bb811f6642b7b7182bd6f3610

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

urlmon

iphlpapi

wininet

netapi32

version

psapi

setupapi

crypt32

wintrust

Sections

.text Size: 435KB - Virtual size: 435KB

.rdata Size: 88KB - Virtual size: 88KB

.data Size: 14KB - Virtual size: 25KB

.rsrc Size: 950KB - Virtual size: 950KB

.reloc Size: 36KB - Virtual size: 36KB

.text
Size: 435KB - Virtual size: 435KB

.rdata
Size: 88KB - Virtual size: 88KB

.data
Size: 14KB - Virtual size: 25KB

.rsrc
Size: 950KB - Virtual size: 950KB

.reloc
Size: 36KB - Virtual size: 36KB