b4ba9c39f6623ed44736a86d6e82f6a77ff0db51d0b8dd30da8b5ec17dba26dd

Sharing

Copy URL Twitter E-mail

General

Target

b4ba9c39f6623ed44736a86d6e82f6a77ff0db51d0b8dd30da8b5ec17dba26dd
Size

2.8MB
MD5

26ed2c5d8b694c1fa599477f381882ca
SHA1

820a2e4f1d0d01da9b77d32460181b03711a2f5d
SHA256

b4ba9c39f6623ed44736a86d6e82f6a77ff0db51d0b8dd30da8b5ec17dba26dd
SHA512

e425e00eeec236c07f4f5f0c4d89c5ff986a8b1e4a3d6993b70aa2e93b75be67921f4f3df3c9ce5af9903ca5e56f95ee5cf6f7f249fed39eba3fd72550b25f4b
SSDEEP

49152:MH/DxDOzzyUn1Vtq98JsM/luaXG7LEKryq4ATJH2aKOxjfySAUA/Ja:fnPKryoH2aKyfyK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b4ba9c39f6623ed44736a86d6e82f6a77ff0db51d0b8dd30da8b5ec17dba26dd

Files

b4ba9c39f6623ed44736a86d6e82f6a77ff0db51d0b8dd30da8b5ec17dba26dd
.exe windows x64

25192346f8ca140b7798e364ed41cabc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

gethostbyname
inet_ntoa
select
WSAGetLastError
setsockopt
WSACleanup
__WSAFDIsSet
accept
bind
WSAIoctl
closesocket
gethostname
shutdown
listen
WSAStartup
getpeername
inet_addr
getsockname
send
socket
connect
recv
getsockopt
htonl
htons

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock
ExpandEnvironmentStringsForUserA

kernel32

Process32First
WriteFile
OutputDebugStringA
WaitForMultipleObjects
WaitForSingleObject
CreateFileW
GetSystemDirectoryW
CreateToolhelp32Snapshot
lstrcatW
Process32Next
LoadLibraryW
GetCurrentProcessId
CreateEventA
WaitNamedPipeW
GetExitCodeProcess
GetEnvironmentVariableA
SetCurrentDirectoryA
SetFileAttributesA
ResumeThread
ResetEvent
CompareFileTime
CreateFileA
GetFileSize
GetFileTime
GetStdHandle
WriteConsoleA
FreeConsole
FormatMessageA
AllocConsole
GetExitCodeThread
MoveFileA
GetDriveTypeA
SetFileTime
SetErrorMode
SetFilePointer
SetEndOfFile
GetFileAttributesA
MoveFileExA
FileTimeToSystemTime
GetLogicalDriveStringsA
SystemTimeToFileTime
CreateDirectoryA
GetSystemTime
FlushFileBuffers
TerminateProcess
VirtualAllocEx
ReadProcessMemory
SetThreadExecutionState
VirtualFreeEx
TerminateThread
SizeofResource
FindResourceA
LockResource
LoadResource
CreateMutexA
ReleaseMutex
GlobalGetAtomNameA
GlobalDeleteAtom
GetModuleHandleW
GlobalAddAtomA
VerSetConditionMask
SetLastError
ExitThread
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEnvironmentVariableW
GetCPInfo
SetStdHandle
SetFilePointerEx
ReadConsoleW
GetTimeZoneInformation
GetConsoleMode
GetConsoleOutputCP
GetModuleHandleExW
ExitProcess
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
LoadLibraryExW
RtlUnwind
EncodePointer
RtlPcToFileHeader
RtlUnwindEx
OutputDebugStringW
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateSemaphoreA
TlsFree
TlsGetValue
TlsAlloc
GetCurrentThread
DuplicateHandle
SetThreadPriority
ReleaseSemaphore
TlsSetValue
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SwitchToThread
GetFileType
lstrcatA
lstrcmpiA
lstrcpynA
DosDateTimeToFileTime
GetLocalTime
FileTimeToLocalFileTime
SetVolumeLabelA
LocalFileTimeToFileTime
GetVersion
GetLocaleInfoA
GetFullPathNameA
lstrcpyA
ReadFile
GetVolumeInformationA
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
CreateFileMappingA
WritePrivateProfileSectionA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileStructA
WritePrivateProfileStringA
WritePrivateProfileStructA
RaiseException
InitializeCriticalSectionAndSpinCount
WinExec
GetComputerNameA
GetProcessHeap
HeapAlloc
GetSystemInfo
GetSystemDirectoryA
lstrlenA
HeapFree
MapViewOfFile
OpenFileMappingA
UnmapViewOfFile
FreeLibrary
DeleteFileA
GetTempPathA
FindClose
FindNextFileA
FindFirstFileA
GetProcessTimes
GetSystemTimeAsFileTime
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
GetCurrentProcess
EnterCriticalSection
GetVersionExA
SetEvent
GetLastError
OpenProcess
OpenEventA
CreateThread
CloseHandle
VerifyVersionInfoW
Sleep
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetCurrentThreadId
GetModuleFileNameA
GetTickCount
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
GlobalSize
MultiByteToWideChar
EnumSystemLocalesW
GetStringTypeW
HeapReAlloc
CreateDirectoryW
GetFileSizeEx
DeleteFileW
GetFileAttributesExW
SetFileAttributesW
MoveFileExW
FindFirstFileExW
FindNextFileW
GetUserDefaultLCID
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
RemoveDirectoryW
HeapSize
WriteConsoleW
FreeLibraryAndExitThread
GetModuleFileNameW
SetProcessShutdownParameters

user32

CheckDlgButton
SetDlgItemInt
RedrawWindow
SetWindowLongA
GetWindowLongA
EnumWindows
LoadMenuA
GetMenuItemID
TrackPopupMenu
GetSubMenu
SetMenuDefaultItem
DestroyMenu
RemoveMenu
EnableMenuItem
EnableWindow
VkKeyScanA
GetAsyncKeyState
MapVirtualKeyA
ToAscii
SendInput
DestroyWindow
SetClipboardViewer
GetClipboardOwner
WaitMessage
PostThreadMessageA
ChangeClipboardChain
SendNotifyMessageA
PeekMessageA
IsWindowVisible
FillRect
GetIconInfo
GetDlgItemInt
WindowFromPoint
RegisterWindowMessageA
DrawTextA
FindWindowExA
OpenDesktopA
EnumDesktopWindows
SetRect
DrawIconEx
DestroyIcon
GetKeyboardState
PtInRect
SetActiveWindow
MessageBeep
FlashWindow
EnumDisplaySettingsExA
EnumDisplayDevicesA
ChangeDisplaySettingsExA
GetKeyState
keybd_event
EnumDisplaySettingsA
GetWindowRect
LoadStringA
ScreenToClient
GetScrollInfo
DialogBoxParamA
GetDlgItemTextA
IsDlgButtonChecked
GetTopWindow
GetWindow
GetProcessWindowStation
GetClassNameA
SetWindowTextA
MoveWindow
SetFocus
SendDlgItemMessageA
SetDlgItemTextA
GetDlgItem
SetForegroundWindow
GetCursorPos
ExitWindowsEx
DrawIcon
SetLayeredWindowAttributes
GetClientRect
UpdateWindow
InvalidateRect
BeginPaint
EndPaint
GetWindowThreadProcessId
wsprintfA
SystemParametersInfoA
MessageBoxA
GetForegroundWindow
GetDesktopWindow
PostMessageA
SendMessageA
mouse_event
FindWindowA
GetMessageA
LoadImageA
DispatchMessageA
GetUserObjectInformationA
LoadCursorA
SetWindowPos
GetSystemMetrics
SetThreadDesktop
GetThreadDesktop
ShowWindow
CloseDesktop
SetTimer
AdjustWindowRect
DefWindowProcA
IsRectEmpty
CreateWindowExA
OpenInputDesktop
TranslateMessage
LoadIconA
GetWindowLongPtrA
KillTimer
PostQuitMessage
SetWindowLongPtrA
RegisterClassExA
GetDC
ReleaseDC
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
IsClipboardFormatAvailable
RegisterClipboardFormatA
IntersectRect
OemToCharA
CharToOemA
wvsprintfA
EndDialog

gdi32

GetBitmapBits
SetDIBColorTable
GdiFlush
SetTextColor
SelectPalette
CreatePalette
SetBkColor
CreateFontIndirectA
GetObjectA
ExtEscape
GetSystemPaletteEntries
SetRectRgn
OffsetRgn
GetRegionData
PtInRegion
CombineRgn
GetRgnBox
CreateRectRgn
PatBlt
StretchBlt
DeleteObject
DeleteDC
GetPixel
GetDeviceCaps
GetDIBits
CreateCompatibleDC
CreateDIBSection
SelectObject
CreateCompatibleBitmap
BitBlt
CreateDCA
CreateSolidBrush
SetBkMode
GetClipBox
RealizePalette
GetStockObject

advapi32

GetSecurityDescriptorLength
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorControl
GetSecurityDescriptorOwner
IsValidSid
IsValidSecurityDescriptor
GetKernelObjectSecurity
SetKernelObjectSecurity
IsValidAcl
GetUserNameA
LookupAccountSidA
SetSecurityInfo
RegCreateKeyA
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
CreateServiceA
StartServiceCtrlDispatcherA
QueryServiceStatus
RegDeleteKeyA
SetServiceStatus
RegisterServiceCtrlHandlerA
DeleteService
AdjustTokenPrivileges
SetTokenInformation
LookupPrivilegeValueA
DuplicateTokenEx
RevertToSelf
EqualSid
AllocateAndInitializeSid
ImpersonateLoggedOnUser
FreeSid
GetTokenInformation
EnumServicesStatusA
CloseServiceHandle
QueryServiceConfigA
OpenSCManagerA
OpenServiceA
CreateProcessAsUserA
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
OpenProcessToken
RegOpenKeyExA
RegDeleteValueA

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHFileOperationA
SHGetMalloc
ShellExecuteA
ShellExecuteExA
Shell_NotifyIconA

ole32

CoUninitialize
CoCreateInstance
CoInitialize

imm32

ImmGetDefaultIMEWnd

Exports

Exports

adler32
adler32_combine
adler32_z
compress
compress2
compressBound
crc32
crc32_combine
crc32_final
crc32_init
crc32_update
crc32_z
deflate
deflateBound
deflateCopy
deflateEnd
deflateGetDictionary
deflateInit2_
deflateInit_
deflateParams
deflatePending
deflatePrime
deflateReset
deflateResetKeep
deflateSetDictionary
deflateSetHeader
deflateTune
get_crc_table
inflate
inflateCodesUsed
inflateCopy
inflateEnd
inflateGetDictionary
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateResetKeep
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
inflateValidate
uncompress
uncompress2
zError
zlibCompileFlags
zlibVersion

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 511KB - Virtual size: 510KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 643KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 822KB - Virtual size: 821KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

25192346f8ca140b7798e364ed41cabc

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

version

userenv

kernel32

user32

gdi32

advapi32

shell32

ole32

imm32

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 511KB - Virtual size: 510KB

.data Size: 8KB - Virtual size: 643KB

.pdata Size: 44KB - Virtual size: 43KB

_RDATA Size: 512B - Virtual size: 252B

.rsrc Size: 822KB - Virtual size: 821KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 511KB - Virtual size: 510KB

.data
Size: 8KB - Virtual size: 643KB

.pdata
Size: 44KB - Virtual size: 43KB

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 822KB - Virtual size: 821KB

.reloc
Size: 5KB - Virtual size: 4KB