af6c46e7d3ff1b8b4ff6aaa1372b04ea6ee2120550e92715f97f99d90f8cf617

Sharing

Copy URL

Twitter E-mail

General

Target

af6c46e7d3ff1b8b4ff6aaa1372b04ea6ee2120550e92715f97f99d90f8cf617
Size

3.4MB
MD5

376bd31e3e189f47eb6209dae765b344
SHA1

27760b7cf583b876585f3cc7fedcedd0391d1c6a
SHA256

af6c46e7d3ff1b8b4ff6aaa1372b04ea6ee2120550e92715f97f99d90f8cf617
SHA512

8cc766d4fb799bbd2033b936bb38ea7c7fb7167218d0dfd0a518b00c812a37e031ab3937dec42c3b5d1113feba1295ffd0759a3169b41421a7bb06ddecdab18c
SSDEEP

98304:GgkBpJYfuu+YOl5bsgR9Qif+zY8Y0PfjiI:Hk7J7n5bob

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af6c46e7d3ff1b8b4ff6aaa1372b04ea6ee2120550e92715f97f99d90f8cf617

Files

af6c46e7d3ff1b8b4ff6aaa1372b04ea6ee2120550e92715f97f99d90f8cf617
.exe windows x86

774e43bd5ebb7e7a625b0a5c09ba509c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapFree
GetProcessHeap
SwitchToThread
SetFilePointer
LocalFree
FormatMessageA
Module32First
CreateToolhelp32Snapshot
GetModuleFileNameA
ReadProcessMemory
GetCurrentDirectoryA
FindNextFileA
HeapAlloc
GetCurrentProcessId
GetCurrentProcess
GetLastError
CloseHandle
FindFirstFileA
FindClose
SetFileAttributesA
GetSystemInfo
MultiByteToWideChar
Sleep
WriteFile
WaitForSingleObject
SetEvent
DeleteCriticalSection
LeaveCriticalSection
WriteConsoleW
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
SetStdHandle
GetTimeZoneInformation
CreateProcessW
GetExitCodeProcess
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
ReadConsoleW
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
GetStdHandle
GetModuleFileNameW
GetFileType
ExitProcess
GetModuleHandleExW
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
InterlockedPushEntrySList
RtlUnwind
RaiseException
GetSystemTimeAsFileTime
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
TerminateProcess
UnhandledExceptionFilter
ReadFile
GetFileSize
CreateFileA
QueryPerformanceFrequency
QueryPerformanceCounter
GetPrivateProfileStringA
lstrlenA
GlobalFree
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
EnterCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
HeapValidate
GetCPInfo
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
GetTickCount
Module32Next
AreFileApisANSI
SetFilePointerEx
SetEndOfFile
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
CreateFileW
CreateDirectoryW
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
FreeLibrary
GetVersionExA
GetSystemDirectoryA
GetModuleHandleA
GetCurrentDirectoryW
OutputDebugStringA
LoadLibraryA
GetProcAddress
GetCurrentThreadId
SetUnhandledExceptionFilter
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
CreateDirectoryA
GlobalAlloc
GetSystemTime

user32

SetWindowLongA
GetWindowLongA
UpdateWindow
SetFocus
MoveWindow
DestroyWindow
IsWindow
CreateWindowExA
RegisterClassA
UnregisterClassA
DefWindowProcA
GetKeyboardLayout
OpenClipboard
CloseClipboard
GetClipboardData
CharNextW
CharNextExA
CharPrevExA
GetMenu
GetWindowRect
AdjustWindowRectEx
LoadCursorA
GetMessageA
TranslateMessage
DispatchMessageA
RegisterClassExA
GetDC
MessageBoxA
LoadStringA
IsIconic
GetSystemMetrics
ChangeDisplaySettingsA
ReleaseCapture
SetCapture
GetCapture
ShowWindow
SetCursorPos
LoadImageA
DestroyCursor
SetCursor
ShowCursor
GetKeyState
SystemParametersInfoA
LoadIconA
FindWindowA
ScreenToClient
GetCursorPos
SetWindowPos
PostQuitMessage
OffsetRect
SetRect
FillRect
ClientToScreen
GetClientRect
InvalidateRect
ReleaseDC
GetKeyboardLayoutNameA
GetAsyncKeyState
PeekMessageA

gdi32

EnumFontFamiliesExA
GetStockObject
SetBkMode
CreateCompatibleDC
DeleteDC
SelectObject
SetBkColor
SetTextColor
CreateDIBSection
TextOutA
CreateFontIndirectA
GetCharABCWidthsFloatW
GetTextExtentPoint32W
TextOutW
StretchBlt
DeleteObject
CreateSolidBrush
GetTextExtentPoint32A

ole32

OleSetContainedObject
OleUninitialize
OleInitialize
CoGetClassObject
CoCreateInstance
CoUninitialize
CoInitialize
CoInitializeEx

winmm

timeBeginPeriod
timeGetDevCaps
timeGetTime
timeEndPeriod

d3d8

Direct3DCreate8

python27

PyExc_RuntimeError
PyErr_SetString
PyModule_AddIntConstant
Py_InitModule4
Py_BuildValue
PyDict_New
PyDict_SetItemString
PyString_FromString
PyDict_Next
PyDict_Size
PyLong_AsLongLong
PyModule_AddStringConstant
PyInt_AsLong
PyTuple_GetItem
PyTuple_SetItem
PyTuple_New
PyImport_ImportModule
PyString_InternFromString
PyObject_GetAttrString
PyDict_GetItemString
PyTuple_Size
PyLong_AsLong
PyList_Append
PyInt_FromLong
PyObject_GetAttr
PyFloat_AsDouble
PyString_AsString
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyImport_AddModule
PyList_New
PyCallable_Check

imm32

ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmNotifyIME

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

dinput8

DirectInput8Create

ws2_32

send
socket
WSAGetLastError
WSAStartup
WSACleanup
recv
htons
inet_addr
gethostbyname
ioctlsocket
connect
select
__WSAFDIsSet
closesocket

ddraw

DirectDrawCreate

mss32

_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_set_sample_volume_pan@12
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_open_digital_driver@16
_AIL_file_type@8
_AIL_decompress_ASI@24
_AIL_WAV_info@8
_AIL_set_file_callbacks@16
_AIL_file_read@8
_AIL_mem_free_lock@4
_AIL_decompress_ADPCM@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_last_error@0
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_auto_update_3D_position@8

advapi32

RegOpenKeyA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA

shell32

SHGetSpecialFolderPathA

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 394KB - Virtual size: 393KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 157KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 177KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

774e43bd5ebb7e7a625b0a5c09ba509c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

ole32

winmm

d3d8

python27

imm32

version

dinput8

ws2_32

ddraw

mss32

advapi32

shell32

oleaut32

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 394KB - Virtual size: 393KB

.data Size: 157KB - Virtual size: 1.1MB

.data1 Size: 2KB - Virtual size: 2KB

.rsrc Size: 177KB - Virtual size: 176KB

.reloc Size: 125KB - Virtual size: 124KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 394KB - Virtual size: 393KB

.data
Size: 157KB - Virtual size: 1.1MB

.data1
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 177KB - Virtual size: 176KB

.reloc
Size: 125KB - Virtual size: 124KB