501312ca3d78c09f5716c3bd4e11ebd6ba1d22d53bc7e995260db2c5b8c4b0ff

Sharing

Copy URL Twitter E-mail

General

Target

501312ca3d78c09f5716c3bd4e11ebd6ba1d22d53bc7e995260db2c5b8c4b0ff
Size

4.8MB
MD5

c15dc2f213306afc7021a2782cf7eed1
SHA1

b23b5f9004974c9e3c15a6b7e1553ff4330ee3e8
SHA256

501312ca3d78c09f5716c3bd4e11ebd6ba1d22d53bc7e995260db2c5b8c4b0ff
SHA512

6460600b909b2435dbb709d1d1199a0f4b874e148341079afb24d4a61f29e6a1c694dce69072ee64f11687d4f19ed4d1a70b42d9f4e1740aa9c2b8f2bfcb0ee0
SSDEEP

98304:FBBplC++gv65jLn+wKCHIlcYt3KKu44oe/u6VoQTcfhnjV6ylZ/yA7B:Ps+Vv6dOlcYt3Kxb/G6ynjV6yld

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
501312ca3d78c09f5716c3bd4e11ebd6ba1d22d53bc7e995260db2c5b8c4b0ff

Files

501312ca3d78c09f5716c3bd4e11ebd6ba1d22d53bc7e995260db2c5b8c4b0ff
.exe windows x86

6edd25d8984fcc99cf3abaf163694a1d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalFree
FreeResource
GlobalUnlock
GlobalLock
GlobalAlloc
DeleteCriticalSection
DecodePointer
InitializeCriticalSectionEx
GetCurrentProcess
GetModuleHandleExW
GetCurrentThreadId
GetLocalTime
OutputDebugStringW
Process32NextW
TerminateProcess
OpenProcess
Process32FirstW
CreateToolhelp32Snapshot
WriteFile
RemoveDirectoryW
FindClose
FindNextFileW
FindFirstFileW
MoveFileExW
MoveFileW
DeleteFileW
SetLastError
GetVersionExW
WaitForSingleObject
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
Sleep
CreateDirectoryW
GetFileAttributesW
OpenMutexW
OpenSemaphoreW
LocalFree
GetCommandLineW
CloseHandle
CreateMutexW
GetModuleFileNameW
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
SetEndOfFile
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
HeapDestroy
FindResourceExW
FindResourceW
GetStdHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
WaitForSingleObjectEx
RaiseException
IsDebuggerPresent
GetCPInfo
LCMapStringEx
EncodePointer
GetStringTypeW
InitializeCriticalSection
TerminateThread
ResumeThread
FormatMessageW
DeviceIoControl
GetFileSizeEx
QueryPerformanceCounter
LoadResource
LockResource
SizeofResource
GetLastError
GetCurrentProcessId
GetFullPathNameW
DosDateTimeToFileTime
GetFileType
SystemTimeToFileTime
GetModuleHandleW
GetProcAddress
TlsSetValue
TlsAlloc
TlsGetValue
TlsFree
SetUnhandledExceptionFilter
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetSystemTimeAsFileTime
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
WaitForMultipleObjects
CreateEventW
SetEvent
ResetEvent
LoadLibraryW
GetCurrentDirectoryW
GetTickCount
ExitProcess
GetACP
FreeLibrary
MulDiv
ReadFile
GetFileSize
SetFilePointer
DuplicateHandle

user32

SetWindowPos
GetClientRect
UnregisterClassW
SendMessageW
GetWindowLongW
GetWindow
GetParent
MapWindowPoints
GetDC
CreateWindowExW
RegisterClassExW
DefWindowProcW
GetClassInfoExW
IsWindow
DispatchMessageW
TranslateMessage
DestroyWindow
PostQuitMessage
PostMessageW
SetTimer
PtInRect
GetWindowRect
ReleaseDC
GetCursorPos
KillTimer
IsWindowVisible
BringWindowToTop
SetForegroundWindow
ShowWindow
FindWindowW
UpdateLayeredWindow
InvalidateRgn
GetQueueStatus
CallMsgFilterW
MsgWaitForMultipleObjectsEx
PeekMessageW
WaitMessage
EndPaint
BeginPaint
InvalidateRect
ReleaseCapture
SetWindowLongW
SetCapture
GetUpdateRect
SetFocus
IsRectEmpty
IsWindowEnabled
GetActiveWindow
ScreenToClient
GetFocus
GetKeyState
EnableWindow
LoadImageW
LoadCursorW
SetPropW
RegisterClassW
GetMonitorInfoW
GetSystemMetrics
MonitorFromWindow
GetPropW
CallWindowProcW
IsIconic
IsZoomed
SetWindowRgn
MessageBoxW
SetCursor
OffsetRect
InflateRect
CharNextW
ShowCaret
IntersectRect
GetSysColor
CreateCaret
ClientToScreen
SetCaretPos
HideCaret
GetCaretPos
SetRect
DrawTextW
CharPrevW
FillRect
GetWindowTextW
SetWindowTextW
GetWindowTextLengthW
CreateAcceleratorTableW
MoveWindow

gdi32

SaveDC
SetWindowOrgEx
GetStockObject
GetTextMetricsW
CreatePen
Rectangle
CombineRgn
CreateRectRgnIndirect
DeleteDC
DeleteObject
SelectObject
CreateDIBSection
CreateCompatibleDC
ExtTextOutW
RoundRect
ExtSelectClipRgn
CreateCompatibleBitmap
GetDeviceCaps
SetStretchBltMode
SetBkColor
MoveToEx
GetCharABCWidthsW
SelectClipRgn
LineTo
SetBkMode
SetTextColor
GetTextExtentPoint32W
TextOutW
GetClipBox
GetObjectW
RestoreDC
CreateFontIndirectW
BitBlt
CreateSolidBrush
CreateRoundRectRgn
GetObjectA
CreatePenIndirect
StretchBlt

advapi32

RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
RegCreateKeyW
GetFileSecurityW
GetSecurityDescriptorDacl
GetAclInformation
GetAce
RegCreateKeyExW

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
CommandLineToArgvW
ShellExecuteExW
SHChangeNotify
ord165
SHGetSpecialFolderLocation
SHGetMalloc
ShellExecuteW

ole32

OleLockRunning
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoInitializeEx
CreateStreamOnHGlobal
CoUninitialize

shlwapi

PathRemoveBackslashW
PathRemoveFileSpecW
PathFileExistsA
StrStrIA
PathFileExistsW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

psapi

GetModuleFileNameExW
GetModuleBaseNameW

winmm

timeGetTime

comctl32

ord17
_TrackMouseEvent

gdiplus

GdipCloneImage
GdipDisposeImage
GdipSetStringFormatAlign
GdipDeleteFont
GdipDeleteStringFormat
GdipGetImageHeight
GdipSetTextRenderingHint
GdipDrawString
GdipCreateFontFromDC
GdipSetStringFormatLineAlign
GdipDeleteBrush
GdipCreateLineBrushI
GdipCreateFontFromLogfontA
GdipFree
GdiplusShutdown
GdiplusStartup
GdipGetImageWidth
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromStream
GdipAlloc
GdipCreateStringFormat
GdipDrawImageRectRectI
GdipCloneBrush

imm32

ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow

wininet

InternetOpenUrlW
InternetCloseHandle
InternetOpenW

iphlpapi

GetAdaptersInfo

oleaut32

VariantInit
SysFreeString
SysAllocString
VariantClear

Sections

.text
Size: 558KB - Virtual size: 558KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 47.0MB - Virtual size: 47.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6edd25d8984fcc99cf3abaf163694a1d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

version

psapi

winmm

comctl32

gdiplus

imm32

wininet

iphlpapi

oleaut32

Sections

.text Size: 558KB - Virtual size: 558KB

.rdata Size: 138KB - Virtual size: 138KB

.data Size: 8KB - Virtual size: 15KB

.rsrc Size: 47.0MB - Virtual size: 47.0MB

.reloc Size: 29KB - Virtual size: 28KB

.text
Size: 558KB - Virtual size: 558KB

.rdata
Size: 138KB - Virtual size: 138KB

.data
Size: 8KB - Virtual size: 15KB

.rsrc
Size: 47.0MB - Virtual size: 47.0MB

.reloc
Size: 29KB - Virtual size: 28KB