c1ea3a9fd7f5be4d691bf9641c27e5838a43f8119da8a10fb1aa0ef2e8ce3f42

Sharing

Copy URL

Twitter E-mail

General

Target

c1ea3a9fd7f5be4d691bf9641c27e5838a43f8119da8a10fb1aa0ef2e8ce3f42
Size

13.4MB
MD5

a58f16461c549b4d0e1e33c535ec7f3c
SHA1

915d9f01a67dc89e2514c6c3d1b32748bac12cb5
SHA256

c1ea3a9fd7f5be4d691bf9641c27e5838a43f8119da8a10fb1aa0ef2e8ce3f42
SHA512

eb00744b70be15f9626db41d5e5ea5700d2c1bbf9b824ff8ca6703f34a511f93d84b31f957d0ba68e8e481aa13a16a8efe083beada96bf99bf6df20ecf7c3c18
SSDEEP

393216:R8V+6IEaD4d7e17jifqKnhQbUf9x0TqeXKobk:76vy3ShQbUfjEk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c1ea3a9fd7f5be4d691bf9641c27e5838a43f8119da8a10fb1aa0ef2e8ce3f42

Files

c1ea3a9fd7f5be4d691bf9641c27e5838a43f8119da8a10fb1aa0ef2e8ce3f42
.exe windows x86

703f93fcde6dcd2a8bb9a24f40e2a325

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
GetFileInformationByHandle
GetFullPathNameA
GetCurrentDirectoryW
GetTimeZoneInformation
GetWindowsDirectoryW
CopyFileExW
lstrcpyW
GetSystemDirectoryW
OpenMutexW
GetCurrentProcessId
CreateMutexW
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetDriveTypeW
InitializeCriticalSectionAndSpinCount
lstrcmpW
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
FlushInstructionCache
RaiseException
CreateFileMappingW
OpenFileMappingW
GetModuleFileNameW
InitializeCriticalSection
GetFileSizeEx
FormatMessageA
WaitForMultipleObjects
PeekNamedPipe
ExpandEnvironmentStringsA
GetSystemDirectoryA
VerSetConditionMask
VerifyVersionInfoA
SleepEx
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
WriteConsoleW
SetEvent
CreateDirectoryA
SetFileTime
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
VirtualAlloc
VirtualFree
CreateFileA
SetFilePointer
GetFileSize
GetTickCount
OutputDebugStringW
GetCurrentThreadId
WritePrivateProfileStringW
GetSystemInfo
LocalFree
GetModuleHandleW
MoveFileExW
CreateDirectoryW
HeapFree
GetModuleHandleA
GetProcessHeap
HeapAlloc
FindClose
DeleteFileW
SetFileAttributesW
FindNextFileW
lstrcmpiW
RemoveDirectoryW
FindFirstFileW
lstrcatW
lstrlenW
GetFileAttributesW
lstrcpynW
TerminateProcess
OpenProcess
SystemTimeToFileTime
LoadLibraryExW
SetErrorMode
WriteFile
lstrlenA
CreateEventW
Sleep
GetTempPathW
GlobalFree
GetPrivateProfileStringW
MultiByteToWideChar
ReadFile
CreateFileW
WideCharToMultiByte
FindResourceExW
FindResourceW
LoadResource
SetStdHandle
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapCreate
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
SetHandleCount
GetLocaleInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
LCMapStringW
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetCommandLineW
GetSystemTimeAsFileTime
ExitProcess
VirtualQuery
VirtualProtect
CreateThread
ExitThread
DecodePointer
EncodePointer
InterlockedExchange
InterlockedPopEntrySList
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapDestroy
GetVersionExA
LoadLibraryA
GlobalMemoryStatus
QueryPerformanceCounter
GetStdHandle
GetFileType
GetVersion
GlobalReAlloc
lstrcmpiA
InterlockedIncrement
LockResource
SizeofResource
GetCurrentProcess
InterlockedDecrement
GetLastError
CreateProcessW
SetLastError
OutputDebugStringA
GetVersionExW
FreeLibrary
GetProcAddress
LoadLibraryW
GetLocalTime
CloseHandle
Process32NextW
GetFileAttributesA
Process32FirstW
CreateToolhelp32Snapshot
CopyFileW
TerminateThread
WaitForSingleObject

user32

DrawTextW
GetClassNameW
IsWindow
SendMessageW
GetDlgItem
GetWindow
SetFocus
GetFocus
IsChild
EndPaint
BeginPaint
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
RegisterWindowMessageW
SetTimer
KillTimer
GetSystemMenu
UnregisterClassA
MessageBoxA
CallWindowProcW
InvalidateRect
GetDC
ReleaseDC
GetDesktopWindow
InflateRect
GetProcessWindowStation
GetUserObjectInformationW
IsWindowEnabled
TrackMouseEvent
DestroyAcceleratorTable
SetMenuItemInfoW
DefWindowProcW
SetForegroundWindow
RemoveMenu
GetMenuState
SetMenuInfo
GetMenuInfo
GetClassNameA
CallNextHookEx
GetCursorPos
SetWindowsHookExW
SetPropA
SetClassLongW
GetClassLongW
UnhookWindowsHookEx
GetMenuItemInfoW
SetWindowTextA
FindWindowA
GetWindowDC
GetMenuItemCount
UpdateWindow
GetPropA
OffsetRect
EqualRect
CopyRect
IsWindowVisible
SetParent
EndDialog
DialogBoxParamW
DrawIconEx
SetRect
IsRectEmpty
GetWindowThreadProcessId
MapWindowPoints
SetWindowLongW
GetSysColor
CharNextW
SetWindowPos
RedrawWindow
GetClassInfoExW
CreateWindowExW
DestroyWindow
CreateAcceleratorTableW
ClientToScreen
GetParent
ScreenToClient
MoveWindow
SetCapture
ReleaseCapture
FillRect
GetClientRect
GetWindowLongW
InvalidateRgn
IsIconic
IsDialogMessageW
LoadCursorW
SetWindowRgn
SetRectEmpty
IsZoomed
GetWindowRect
LoadIconW
FindWindowExW
SendMessageTimeoutW
EnableWindow
FindWindowW
RegisterClassExW
GetSystemMetrics
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW
GetMessageW
DispatchMessageW
TranslateMessage
PeekMessageW
PostQuitMessage
SetCursor
PtInRect
EnableMenuItem
PostMessageW
ShowWindow
MessageBoxW

gdi32

SetBkMode
GetPixel
CreateFontW
SetBkColor
ExtTextOutW
CreatePen
CreateFontIndirectW
GetClipBox
ExcludeClipRect
Rectangle
SetTextColor
RoundRect
GetTextExtentPoint32W
Ellipse
CreateDCW
SelectPalette
RealizePalette
GetDIBits
CreateDIBitmap
CreateDIBSection
ExtCreateRegion
CombineRgn
SelectObject
GetDeviceCaps
GetObjectW
GetStockObject
DeleteDC
BitBlt
DeleteObject
CreateCompatibleBitmap
CreateCompatibleDC
CreateSolidBrush
GetRgnBox
StretchBlt

advapi32

GetFileSecurityW
CryptCreateHash
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegEnumKeyExW
RegDeleteKeyW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumValueW
DeleteService
ControlService
CloseServiceHandle
StartServiceW
OpenServiceW
CreateServiceW
OpenSCManagerW
GetUserNameW
BuildExplicitAccessWithNameW
DeleteAce
GetExplicitEntriesFromAclW
SetNamedSecurityInfoW
SetEntriesInAclW
GetNamedSecurityInfoW
RegQueryInfoKeyW
RegDeleteValueW
RegOpenKeyW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
SetFileSecurityW
GetSecurityDescriptorControl
SetSecurityDescriptorDacl
AddAccessAllowedAce
AddAce
EqualSid
GetAce
InitializeAcl
GetLengthSid
GetAclInformation
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
CryptHashData
LookupAccountNameW

shell32

SHGetPathFromIDListW
SHGetFolderPathW
SHCreateDirectoryExW
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHChangeNotify
SHFileOperationW
ShellExecuteW
SHGetSpecialFolderPathW
SHGetMalloc

ole32

OleInitialize
OleUninitialize
CoTaskMemFree
PropVariantClear
CoUninitialize
CLSIDFromString
CoTaskMemRealloc
CoGetClassObject
CreateStreamOnHGlobal
OleLockRunning
StringFromGUID2
CoTaskMemAlloc
CoInitialize
CLSIDFromProgID
CoCreateInstance

oleaut32

SysStringLen
OleCreateFontIndirect
VariantInit
LoadTypeLi
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
LoadRegTypeLi
VariantClear
VarUI4FromStr

wininet

InternetGetConnectedState

sensapi

IsNetworkAlive

shlwapi

PathAddBackslashW
PathFileExistsW
PathAppendW
SHGetValueW
PathIsDirectoryW
SHSetValueW
SHDeleteKeyW
SHDeleteValueW
StrCmpW
PathStripToRootW
PathRemoveFileSpecW
PathSkipRootW
PathIsSameRootW
SHStrDupW
StrChrIW
StrStrIW

comctl32

_TrackMouseEvent
InitCommonControlsEx

msimg32

TransparentBlt
AlphaBlend

urlmon

CoInternetSetFeatureEnabled

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

winhttp

WinHttpSetOption
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpConnect
WinHttpSetTimeouts
WinHttpOpen
WinHttpCloseHandle
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpWriteData
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpCrackUrl

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

iphlpapi

GetAdaptersInfo

winmm

timeKillEvent
timeSetEvent

ws2_32

freeaddrinfo
getaddrinfo
sendto
recvfrom
connect
listen
ioctlsocket
gethostname
htonl
ntohl
closesocket
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
send
recv
socket
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSACleanup
WSAStartup
accept

normaliz

IdnToAscii

wldap32

ord217
ord143
ord22
ord30
ord200
ord32
ord35
ord79
ord26
ord50
ord33
ord301
ord27
ord41
ord46
ord60
ord45
ord211

crypt32

CertFindCertificateInStore
CryptStringToBinaryA
CertOpenStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CryptQueryObject
CertGetNameStringA
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertGetCertificateChain
CertCreateCertificateChainEngine
CertCloseStore
CertFreeCertificateContext

gdiplus

GdipGetImageHeight
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipDrawImageRectRect
GdipSetInterpolationMode
GdipSetPixelOffsetMode
GdiplusStartup
GdiplusShutdown
GdipDeleteGraphics
GdipFree
GdipReleaseDC
GdipAlloc
GdipCreateFromHDC
GdipSetCompositingMode
GdipSetCompositingQuality
GdipSetSmoothingMode
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipFillRectangle
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipGetImageWidth
GdipGetPropertyItemSize
GdipCreateBitmapFromStream
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 243KB - Virtual size: 242KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 54KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99.9MB - Virtual size: 99.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 336KB - Virtual size: 335KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

703f93fcde6dcd2a8bb9a24f40e2a325

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wininet

sensapi

shlwapi

comctl32

msimg32

urlmon

wtsapi32

winhttp

version

iphlpapi

winmm

ws2_32

normaliz

wldap32

crypt32

gdiplus

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 243KB - Virtual size: 242KB

.data Size: 54KB - Virtual size: 78KB

.rsrc Size: 99.9MB - Virtual size: 99.9MB

.reloc Size: 336KB - Virtual size: 335KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 243KB - Virtual size: 242KB

.data
Size: 54KB - Virtual size: 78KB

.rsrc
Size: 99.9MB - Virtual size: 99.9MB

.reloc
Size: 336KB - Virtual size: 335KB