6b8256157a79f3a090e55899046b807c73c9963cf6115a4da86479b442b1679c

Sharing

Copy URL Twitter E-mail

General

Target

6b8256157a79f3a090e55899046b807c73c9963cf6115a4da86479b442b1679c
Size

15.7MB
MD5

65e2c85d9ab7acc04208f1bdd215ba28
SHA1

fee9c7a4844fe46f35c2abbe56bf9b1c33d2f1a5
SHA256

6b8256157a79f3a090e55899046b807c73c9963cf6115a4da86479b442b1679c
SHA512

b1cc4cda26748e40411c0e6d9dd86cbcbffe26dbd5c24ccf92157de8913ee1a2cb224b4dff49b20ee7261d4e836c284225a3aaf49e87c2046f6dcb6c5246ca5f
SSDEEP

393216:yJD/+R1d2Rcw2N7quPS2KLiXtuJXTY7Atx488zxfdiK0jJKKNF8DEQZ:yJqTgmwinVd0ZD4z9dB24Pr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6b8256157a79f3a090e55899046b807c73c9963cf6115a4da86479b442b1679c

Files

6b8256157a79f3a090e55899046b807c73c9963cf6115a4da86479b442b1679c
.exe windows x86

1ac08b79fb1f53b9420745b29c4de2e9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempPathW
FindResourceW
WriteFile
SizeofResource
LoadResource
LockResource
SetCurrentDirectoryW
GetCurrentDirectoryW
FreeLibraryAndExitThread
ExitThread
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetModuleHandleW
GetLastError
GetCurrentProcessId
LocalFree
LocalAlloc
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
ExpandEnvironmentStringsW
PeekNamedPipe
WaitForMultipleObjects
DeleteFileW
SleepEx
ResetEvent
SetEvent
lstrlenA
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
GetFileSizeEx
GetFileInformationByHandle
InterlockedCompareExchange
CreateEventW
WideCharToMultiByte
OutputDebugStringA
InterlockedDecrement
InterlockedIncrement
WritePrivateProfileStringW
GetModuleFileNameW
ReadFile
GetFileSize
CreateThread
QueryDosDeviceW
GetWindowsDirectoryW
GetLogicalDriveStringsW
lstrcmpiW
OpenProcess
GlobalAlloc
GlobalLock
GlobalUnlock
GetSystemDirectoryA
MulDiv
MultiByteToWideChar
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetPrivateProfileStringW
GlobalFree
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
DecodePointer
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetSystemInfo
FormatMessageW
FindClose
CreateDirectoryW
FindFirstFileW
FindNextFileW
MoveFileExW
FileTimeToSystemTime
ReleaseMutex
CreateMutexW
GetTickCount
AreFileApisANSI
HeapCreate
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
GetFullPathNameW
FreeResource
GetLocalTime
GetVersionExA
GetModuleHandleA
EncodePointer
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetACP
GetStringTypeW
GetFileType
CompareStringW
LCMapStringW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
OutputDebugStringW
WaitForSingleObjectEx
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
FlushFileBuffers
WriteConsoleW
SetEndOfFile
LoadLibraryA
lstrlenW
SetLastError
GetProcessHeap
HeapFree
HeapAlloc
VirtualFree
VirtualAlloc
GetVersionExW
CreateFileW
LoadLibraryW
CloseHandle
Sleep
GetProcAddress
FreeLibrary

user32

GetCursorPos
CreateCaret
GetCaretBlinkTime
HideCaret
SetCaretPos
ScreenToClient
GetClassNameW
DestroyIcon
LoadBitmapW
CreateIconFromResource
LoadImageW
CharNextW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
ClientToScreen
EnableMenuItem
GetSysColor
GetSystemMetrics
IsWindowVisible
DrawTextW
SystemParametersInfoA
CharLowerBuffW
MapVirtualKeyA
UpdateLayeredWindow
IsMenu
IsWindowEnabled
CreatePopupMenu
DestroyMenu
GetMenuItemCount
AppendMenuW
TrackPopupMenu
GetMenuInfo
SetMenuInfo
GetMenuItemInfoW
SetMenuContextHelpId
MsgWaitForMultipleObjects
InvalidateRect
CreateWindowExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
GetWindowLongW
GetFocus
SetFocus
PtInRect
EqualRect
IsRectEmpty
UnionRect
CopyRect
SetRect
SetCursor
KillTimer
SetTimer
DestroyWindow
DestroyCursor
LoadCursorW
IntersectRect
GetKeyState
GetForegroundWindow
UnregisterClassW
GetIconInfo
DrawIconEx
OffsetRect
InflateRect
ReleaseDC
GetDC
SendMessageW
ShowWindow
SetWindowPos
SetWindowTextW
IsWindow
SetForegroundWindow
FindWindowW
LoadStringW
EndPaint
BeginPaint
UpdateWindow
ReleaseCapture
SetCapture
GetCapture
IsZoomed
IsIconic
SetLayeredWindowAttributes
AnimateWindow
PostQuitMessage
PostMessageW
TrackMouseEvent
GetMonitorInfoW
MonitorFromWindow
GetWindow
GetParent
MapWindowPoints
SetWindowLongW
SystemParametersInfoW
GetWindowRect
GetClientRect
GetActiveWindow
GetDlgItem

advapi32

InitializeSecurityDescriptor
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegCloseKey
ImpersonateLoggedOnUser
RevertToSelf
DuplicateTokenEx
CreateProcessAsUserW
OpenProcessToken
GetTokenInformation
SetTokenInformation
LookupAccountSidW
SetSecurityDescriptorDacl

shell32

SHBrowseForFolderW
SHChangeNotify
SHGetFolderPathW
ShellExecuteW
SHGetPathFromIDListW
SHGetSpecialFolderPathW

ole32

CoCreateInstance
OleLockRunning
CLSIDFromString
CLSIDFromProgID
OleInitialize
OleUninitialize
CreateStreamOnHGlobal
CreateBindCtx
CoCreateGuid

shlwapi

SHDeleteKeyW
SHDeleteValueW
SHGetValueW
SHSetValueW
PathFileExistsW
StrToIntExW

psapi

EnumProcessModules
GetModuleFileNameExW
EnumProcesses
GetProcessImageFileNameW

crypt32

CryptQueryObject
CryptMsgGetParam
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptMsgClose

gdiplus

GdiplusStartup
GdipFree
GdipAlloc
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdiplusShutdown
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipImageGetFrameDimensionsCount
GdipCloneImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipGetPropertyItem
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipDrawImageRectI
GdipDrawImageI
GdipGraphicsClear
GdipSaveImageToFile

imm32

ImmAssociateContext
ImmReleaseContext
ImmGetContext

gdi32

GetCurrentObject
Rectangle
GetObjectW
SetBkMode
GetStockObject
StretchBlt
GetViewportOrgEx
SetViewportOrgEx
EnumFontFamiliesExW
GetCharABCWidthsW
GetFontData
GetGlyphOutlineW
GetOutlineTextMetricsW
GetFontUnicodeRanges
GetGlyphIndicesW
GetTextExtentPointI
AddFontMemResourceEx
RemoveFontMemResourceEx
SetTextColor
SetTextAlign
DeleteDC
DeleteObject
ExtCreateRegion
GetRegionData
IntersectClipRect
SelectClipRgn
SelectObject
CreateDIBSection
CreateSolidBrush
CreateFontIndirectW
SetGraphicsMode
GetDeviceCaps
CreateBitmap
CreateRoundRectRgn
EnumFontsW
CreateCompatibleDC
GdiFlush
GetTextFaceW
ExtTextOutW
SetWorldTransform
GetTextMetricsW
BitBlt

oleaut32

SysAllocString
SysFreeString

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

ws2_32

ntohs
setsockopt
WSASetLastError
htonl
inet_addr
inet_ntoa
gethostbyaddr
gethostbyname
getservbyport
htons
__WSAFDIsSet
select
recvfrom
sendto
accept
listen
ioctlsocket
gethostname
getsockopt
getsockname
getpeername
recv
connect
bind
socket
closesocket
WSAGetLastError
send
getservbyname
WSAStartup
WSACleanup

usp10

ScriptShape
ScriptFreeCache
ScriptItemize

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 453KB - Virtual size: 452KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 57KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 376B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 82.8MB - Virtual size: 82.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1ac08b79fb1f53b9420745b29c4de2e9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

psapi

crypt32

gdiplus

imm32

gdi32

oleaut32

userenv

ws2_32

usp10

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 453KB - Virtual size: 452KB

.data Size: 57KB - Virtual size: 154KB

.gfids Size: 512B - Virtual size: 376B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 82.8MB - Virtual size: 82.8MB

.reloc Size: 115KB - Virtual size: 115KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 453KB - Virtual size: 452KB

.data
Size: 57KB - Virtual size: 154KB

.gfids
Size: 512B - Virtual size: 376B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 82.8MB - Virtual size: 82.8MB

.reloc
Size: 115KB - Virtual size: 115KB