ed437a5c200b198dbf648d8c6ad61b8958295e1cd7fa5cad8985a2c3efb142c6

Sharing

Copy URL Twitter E-mail

General

Target

ed437a5c200b198dbf648d8c6ad61b8958295e1cd7fa5cad8985a2c3efb142c6
Size

4.4MB
MD5

c55817038919698d12f5253562473a0f
SHA1

7536f7c594420af2e12d76695872ae7be5d06569
SHA256

ed437a5c200b198dbf648d8c6ad61b8958295e1cd7fa5cad8985a2c3efb142c6
SHA512

ae35aa6aac702fa21c64fdb7a625ec629b00213708e243882a5642bfe25c1812698fddcc3638d3f3c4bcd4f9d292ee01d0952a3a3d3bc715518abc25270a90ae
SSDEEP

49152:NYatd7lXP/DlJ0EBsFkRHDYlJ3kK3IM4aulwfLELE2D9OACQLFYPxJuIMq/tFZ1z:NYOFlHIEBsAHM7UaIM3ELTD99ZmII9H

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ed437a5c200b198dbf648d8c6ad61b8958295e1cd7fa5cad8985a2c3efb142c6

Files

ed437a5c200b198dbf648d8c6ad61b8958295e1cd7fa5cad8985a2c3efb142c6
.exe windows x86

4b8d0837e6cef735fb7ddc8b95d05926

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlCaptureStackBackTrace
GetNumberOfConsoleInputEvents
PeekConsoleInputA
ReadConsoleInputA
SetConsoleMode
CreateEventW
WaitForSingleObject
ResetEvent
SetEvent
CreateMutexW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryA
lstrcpyW
lstrcmpW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
GetVersionExW
GetSystemInfo
OpenProcess
TerminateProcess
GetCurrentProcessId
FlushConsoleInputBuffer
GlobalMemoryStatus
FindFirstFileA
GetSystemTime
SetEndOfFile
FlushFileBuffers
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
FindClose
GetTimeZoneInformation
SetStdHandle
GetFullPathNameA
GetFullPathNameW
MoveFileExW
GetFileAttributesExW
HeapQueryInformation
HeapSize
HeapReAlloc
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
OutputDebugStringA
GetConsoleMode
GetConsoleCP
SetFilePointerEx
ResumeThread
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
HeapValidate
WriteConsoleW
GetModuleHandleExW
GetModuleFileNameA
RtlUnwind
WaitForMultipleObjectsEx
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
SetProcessAffinityMask
VirtualProtect
VirtualFree
VirtualAlloc
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetCurrentProcess
Sleep
GetLastError
CloseHandle
FindNextFileW
FindFirstFileW
DeleteFileW
CreateDirectoryW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTickCount
LoadLibraryW
IsBadStringPtrW
OutputDebugStringW
IsBadStringPtrA
GetACP
ExitProcess
FreeResource
LoadResource
LockResource
SizeofResource
FindResourceW
CreateFileW
GetFileSize
ReadFile
MulDiv
GetFileType
SetFilePointer
SetFileTime
WriteFile
DuplicateHandle
DosDateTimeToFileTime
SystemTimeToFileTime
GetLocalTime
InitializeCriticalSectionAndSpinCount
GlobalAlloc
GlobalLock
GlobalUnlock
WaitForSingleObjectEx
GetCurrentThread
GetCurrentThreadId
GetExitCodeThread
GetNativeSystemInfo
TryEnterCriticalSection
FormatMessageW
QueryPerformanceCounter
QueryPerformanceFrequency
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
RaiseException
GetStartupInfoW
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
InitializeSListHead
FormatMessageA
GetTickCount64
InitializeCriticalSectionEx
SleepEx
GetStdHandle
PeekNamedPipe
WaitForMultipleObjects
ExpandEnvironmentStringsA
VerSetConditionMask
GetSystemDirectoryA
GetModuleHandleA
VerifyVersionInfoA
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
SetFileAttributesW

user32

SetTimer
KillTimer
PostQuitMessage
LoadIconW
SetClassLongW
GetWindowThreadProcessId
MessageBoxW
GetWindowRect
GetUserObjectInformationW
GetProcessWindowStation
GetGUIThreadInfo
InvalidateRgn
CreateAcceleratorTableW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
GetSysColor
ClientToScreen
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
GetCaretBlinkTime
CreateCaret
SetRect
FillRect
DrawTextW
GetSystemMetrics
GetActiveWindow
CharLowerBuffW
PostMessageW
wsprintfW
MessageBoxA
CharPrevW
SetWindowRgn
IsZoomed
OffsetRect
InflateRect
SetCursor
wvsprintfW
GetWindowRgn
MoveWindow
GetMonitorInfoW
MonitorFromWindow
LoadImageW
LoadCursorW
AdjustWindowRectEx
GetPropW
GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
CreateWindowExW
IsWindow
DestroyWindow
SetWindowPos
IsWindowVisible
IsIconic
CharNextW
SetFocus
GetFocus
GetKeyState
SetCapture
ReleaseCapture
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetClientRect
GetCursorPos
ScreenToClient
MapWindowPoints
IntersectRect
UnionRect
IsRectEmpty
PtInRect
GetWindowLongW
SetWindowLongW
GetParent
GetWindow
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
ShowWindow
EnableWindow
GetMenu
SetPropW

advapi32

RegQueryValueExW
RegQueryValueExA
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyW
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
CreateProcessAsUserW
DeregisterEventSource
RegisterEventSourceA
ReportEventA
RegSetValueExW

shell32

ShellExecuteW
SHGetSpecialFolderPathW
ShellExecuteA
SHFileOperationW

ole32

OleLockRunning
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoUninitialize
CoCreateGuid
CoInitialize
CreateStreamOnHGlobal

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

gdiplus

GdipDisposeImage
GdipCloneImage
GdipCreateLineBrushI
GdipDeleteBrush
GdipCloneBrush
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetCompositingQuality
GdipSetPixelOffsetMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipGraphicsClear
GdipDrawImage
GdipDrawImageRectI
GdipDeleteFontFamily
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipGetFamily
GdipDrawString
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipGetImageWidth
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipSetSmoothingMode
GdipCreateStringFormat

shlwapi

PathFileExistsW
PathIsDirectoryW
wvnsprintfW
StrCmpW
StrCpyW

ws2_32

WSASetLastError
recv
send
bind
closesocket
connect
select
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSAIoctl
getaddrinfo
__WSAFDIsSet
WSAGetLastError
gethostname
ioctlsocket
sendto
recvfrom
listen
accept
freeaddrinfo
WSACleanup
WSAStartup
shutdown
getservbyname
gethostbyname
ntohl
htonl
getpeername

wldap32

ord26
ord22
ord27
ord32
ord33
ord301
ord200
ord35
ord41
ord50
ord60
ord211
ord30
ord79
ord143
ord46

comctl32

ord17
_TrackMouseEvent

imm32

ImmReleaseContext
ImmSetCompositionFontW
ImmSetCompositionWindow
ImmGetContext

gdi32

GetObjectW
TextOutW
CreateRectRgn
PtInRegion
CreateDIBSection
CreateRoundRectRgn
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
RestoreDC
GetClipBox
GetObjectType
GetTextExtentPoint32W
LineTo
RoundRect
GetTextMetricsW
ExtSelectClipRgn
SetBkColor
Rectangle
GetStockObject
DeleteObject
GetDIBits
CreatePatternBrush
GetObjectA
GetDeviceCaps
GdiFlush
DeleteDC
CreatePen
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
SelectObject
SelectClipRgn
SaveDC
MoveToEx
SetTextColor
SetStretchBltMode
StretchBlt
GetCharABCWidthsW
SetWindowOrgEx
ExtTextOutW
SetBkMode

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

Exports

Exports

?FromHex@@YAEE@Z
?ToHex@@YAEE@Z
?UrlDecode@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV12@@Z
?UrlEncode@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV12@@Z
?base64_decode@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV12@@Z
?base64_encode@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBEI@Z

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 751KB - Virtual size: 750KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 58KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 145KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4b8d0837e6cef735fb7ddc8b95d05926

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

userenv

gdiplus

shlwapi

ws2_32

wldap32

comctl32

imm32

gdi32

oleaut32

Exports

Exports

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 751KB - Virtual size: 750KB

.data Size: 58KB - Virtual size: 84KB

.gfids Size: 6KB - Virtual size: 6KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 95KB - Virtual size: 95KB

.reloc Size: 145KB - Virtual size: 144KB

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 751KB - Virtual size: 750KB

.data
Size: 58KB - Virtual size: 84KB

.gfids
Size: 6KB - Virtual size: 6KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 95KB - Virtual size: 95KB

.reloc
Size: 145KB - Virtual size: 144KB