df0dc9c3bd2c66e3fa68505c37754c791c4e958a3e3f456c28c3261fe7ce1bbc

Sharing

Copy URL Twitter E-mail

General

Target

df0dc9c3bd2c66e3fa68505c37754c791c4e958a3e3f456c28c3261fe7ce1bbc
Size

1.7MB
MD5

dc248c710d7fe07bec69f6da0a21f4b9
SHA1

8e8aec01373a0be165c718bf682635b8b165fa8e
SHA256

df0dc9c3bd2c66e3fa68505c37754c791c4e958a3e3f456c28c3261fe7ce1bbc
SHA512

619a7e9a2b31f8160ea42906f4712e3c3ca41fee6ac79085558d8fea1c1223529b2937748c7fbe17f8ed2fef47da47de2ef0ea46c7b4a7cabe15d2c02c4ab48c
SSDEEP

24576:eddT06XbNsOMDwRfdL3KbPaZ8PzKeGO4N+XuVEmC7amDKlbm/mqZJA:eddTVbnqGazaZy+DOq53uakBZJA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df0dc9c3bd2c66e3fa68505c37754c791c4e958a3e3f456c28c3261fe7ce1bbc

Files

df0dc9c3bd2c66e3fa68505c37754c791c4e958a3e3f456c28c3261fe7ce1bbc
.exe windows:5 windows x86

f6d3b5cf8899680a61a7d3df725ffb28

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mpr

WNetGetConnectionA

basic

?deref@AtomicCount@WQ_LIB@@QAE_NXZ
?ref@AtomicCount@WQ_LIB@@QAE_NXZ
?GetBuf@CAutoBuffer@WQ_LIB@@QAEPADXZ
??1CAutoBuffer@WQ_LIB@@UAE@XZ
??1AtomicCount@WQ_LIB@@QAE@XZ
??0AtomicCount@WQ_LIB@@QAE@XZ

kernel32

SetErrorMode
GetFileAttributesW
GetFileSizeEx
GetFileTime
GetStartupInfoW
RtlUnwind
CreateDirectoryW
RaiseException
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DebugBreak
HeapFree
HeapAlloc
HeapReAlloc
GetTimeFormatA
GetDateFormatA
GetFileType
GetConsoleCP
GetConsoleMode
CreateDirectoryA
GetFileAttributesA
TlsSetValue
ExitProcess
ExitThread
HeapSize
VirtualProtect
VirtualAlloc
VirtualQuery
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapCreate
VirtualFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetProcessHeap
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
InterlockedIncrement
GetConsoleOutputCP
WriteConsoleW
GetCurrentDirectoryA
InitializeCriticalSectionAndSpinCount
SetEnvironmentVariableA
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
WritePrivateProfileStringW
GlobalFlags
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileW
CreateFileW
GetFullPathNameW
GetVolumeInformationW
FindFirstFileW
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
GetThreadLocale
lstrlenA
CompareStringW
GetVersionExA
GlobalGetAtomNameW
FormatMessageW
LocalFree
lstrlenW
InterlockedDecrement
GlobalFree
GetCurrentProcessId
SuspendThread
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
lstrcmpW
GetModuleHandleA
GetModuleFileNameA
QueryPerformanceFrequency
QueryPerformanceCounter
GetLocalTime
SetThreadPriority
TlsFree
WriteConsoleA
LocalReAlloc
GetSystemInfo
ReleaseMutex
WriteFile
GetTimeZoneInformation
GetCurrentDirectoryW
SetCurrentDirectoryW
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetModuleHandleW
SetLastError
GetVersionExW
DeleteFileW
GetVersion
LoadLibraryW
MulDiv
FreeResource
GlobalAlloc
GlobalLock
GlobalUnlock
CreateFileA
ReadFile
GetPrivateProfileIntW
GetLogicalDrives
OutputDebugStringW
ResetEvent
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
GetTickCount
DeleteCriticalSection
InitializeCriticalSection
SetEvent
TerminateThread
GetDriveTypeA
GetDiskFreeSpaceExA
CreateThread
CreateEventW
ResumeThread
GetCurrentThreadId
WaitForSingleObject
LoadResource
LockResource
SizeofResource
FindResourceW
GetPrivateProfileStringW
CloseHandle
FreeLibrary
GetModuleFileNameW
WideCharToMultiByte
LoadLibraryA
GetProcAddress
GetPrivateProfileStringA
GetPrivateProfileIntA
WritePrivateProfileStringA
OutputDebugStringA
Sleep
CreateMutexW
GetLastError
MultiByteToWideChar
OpenProcess

user32

CharUpperW
GetSysColorBrush
CharNextW
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
UnregisterClassW
RegisterClipboardFormatW
PostThreadMessageW
GetMessageTime
MapWindowPoints
TrackPopupMenu
GetScrollPos
SetForegroundWindow
GetClassInfoExW
RegisterClassW
AdjustWindowRectEx
DeferWindowPos
GetScrollInfo
SystemParametersInfoA
GetWindowPlacement
UnpackDDElParam
ReuseDDElParam
WinHelpW
SetFocus
LoadAcceleratorsW
IsIconic
InsertMenuItemW
GetClassInfoW
BringWindowToTop
TranslateAcceleratorW
BeginDeferWindowPos
EndDeferWindowPos
GetDlgCtrlID
EqualRect
SetRectEmpty
GetMenuStringW
ScreenToClient
SetWindowContextHelpId
MapDialogRect
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetDlgItem
EndDialog
GetLastActivePopup
IsWindowEnabled
MessageBoxW
ShowOwnedPopups
GetMessageW
TranslateMessage
DispatchMessageW
IsWindowVisible
GetKeyState
PeekMessageW
SetWindowTextW
GetMenuCheckMarkDimensions
EnableMenuItem
CheckMenuItem
PostQuitMessage
GetWindow
CreateWindowExW
LoadCursorW
DefWindowProcW
ValidateRect
BeginPaint
EndPaint
DrawMenuBar
SetMenu
CallNextHookEx
GetClassNameW
SetPropW
GetPropW
RemovePropW
UnhookWindowsHookEx
SetWindowsHookExW
SetLayeredWindowAttributes
CreatePopupMenu
IsRectEmpty
RedrawWindow
GetMenuState
LoadMenuW
ModifyMenuW
GetMenuDefaultItem
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetMessagePos
GetSubMenu
GetMenu
WindowFromDC
GetMenuInfo
CopyAcceleratorTableW
MapVirtualKeyW
GetKeyNameTextW
GetMenuItemInfoW
GetMenuItemRect
IsMenu
SetMenuInfo
FillRect
DrawStateW
FrameRect
OffsetRect
InflateRect
SendDlgItemMessageA
GetActiveWindow
GetNextDlgTabItem
DestroyIcon
DestroyCursor
SetCursor
LoadBitmapW
DrawEdge
GetCapture
WindowFromPoint
DrawFocusRect
CallWindowProcW
GetParent
SetCapture
IsDialogMessageW
ReleaseCapture
GetWindowRgn
GetDesktopWindow
SendDlgItemMessageW
RegisterWindowMessageW
GetClassLongW
GetWindowTextLengthW
GetWindowTextW
SetMenuItemBitmaps
GetTopWindow
GetMenuItemID
GetMenuItemCount
ShowWindow
UpdateWindow
SystemParametersInfoW
PtInRect
InvalidateRect
GetWindowDC
GetSystemMetrics
IsWindow
SetWindowPos
GetWindowLongW
SetWindowLongW
GetSysColor
ReleaseDC
GetDC
GetWindowRect
SetRect
MoveWindow
ClientToScreen
FindWindowW
PostMessageW
GetClientRect
SetWindowRgn
LoadImageW
CopyRect
GetForegroundWindow
AttachThreadInput
MonitorFromWindow
GetMonitorInfoW
SetTimer
LoadIconW
EnableWindow
IsChild
GetFocus
MenuItemFromPoint
SendMessageW
GetCursorPos
KillTimer
DestroyMenu
GetSystemMenu
EnumWindows
GetWindowThreadProcessId
GetWindowTextA
IntersectRect

gdi32

ExcludeClipRect
IntersectClipRect
LineTo
GetViewportExtEx
GetWindowExtEx
RectVisible
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
ExtSelectClipRgn
GetMapMode
DPtoLP
GetBkColor
GetRgnBox
SetMapMode
SetStretchBltMode
SetBkMode
RestoreDC
SaveDC
CreateRectRgnIndirect
SetBrushOrgEx
UnrealizeObject
Escape
CreateRoundRectRgn
CreateSolidBrush
PtVisible
Rectangle
GetTextExtentPoint32W
GetNearestColor
SetWindowOrgEx
CreatePatternBrush
CreateFontIndirectW
GetCurrentObject
GetTextAlign
GetLayout
SetTextAlign
MoveToEx
GetTextExtentPointW
GetCurrentPositionEx
GetTextColor
SetPixel
SetBkColor
SetTextColor
RoundRect
CreatePen
GetTextMetricsW
ExtTextOutW
GetStockObject
PtInRegion
SelectClipRgn
CreateICW
GetDIBits
DeleteDC
ExtCreateRegion
CreateBitmap
SelectObject
GetDeviceCaps
BitBlt
CreateCompatibleBitmap
StretchBlt
DeleteObject
GetPixel
CreateCompatibleDC
CombineRgn
CreateRectRgn
GetObjectW
TextOutW

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyW
RegEnumKeyW
RegOpenKeyW
RegQueryValueW
RegCloseKey

shell32

DragFinish
DragQueryFileW
ShellExecuteExW

comctl32

_TrackMouseEvent
ImageList_GetIconSize

shlwapi

PathFindFileNameW
PathStripToRootW
PathIsUNCW
PathFindExtensionW

oledlg

OleUIBusyW

ole32

CLSIDFromProgID
CLSIDFromString
CoTaskMemFree
CoCreateGuid
CoRegisterMessageFilter
OleFlushClipboard
CoTaskMemAlloc
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard

oleaut32

VariantCopy
SysAllocString
SafeArrayDestroy
OleCreateFontIndirect
VariantInit
VariantTimeToSystemTime
SystemTimeToVariantTime
VarUdateFromDate
SysFreeString
SysAllocStringLen
SysStringLen
VariantClear
VariantChangeType

ws2_32

htonl
listen
recvfrom
sendto
recv
send
getsockopt
connect
inet_addr
ioctlsocket
setsockopt
bind
getpeername
getsockname
htons
ntohs
inet_pton
getaddrinfo
WSACleanup
ntohl
accept
shutdown
freeaddrinfo
getnameinfo
socket
WSAIoctl
WSAGetLastError
closesocket
inet_ntoa
gethostbyname
WSAStartup
__WSAFDIsSet
select

qpwd

DecryptString

libmodel

ord43
ord9
ord10
ord131
ord18
ord99
ord75
ord53
ord15
ord16
ord108
ord8
ord115
ord7
ord74
ord116
ord65
ord64
ord61
ord57
ord58
ord48
ord82
ord97
ord12
_SDK_SetCustomer@4
ord102
ord63
ord55
ord22
ord45
ord23
ord85
ord81
ord38
ord67
ord96
ord27
ord41
ord42
ord89
ord66
ord83
ord118
ord121
ord50
ord36
ord52
ord114
ord51
ord47

psapi

GetModuleFileNameExA
EnumProcessModules

iphlpapi

GetAdaptersAddresses

libssl-1_1

SSL_get_error
SSL_connect
SSL_set_fd
SSL_new
SSL_CTX_ctrl
SSL_CTX_new
TLS_client_method
SSL_CTX_free
SSL_free
SSL_shutdown
SSL_write
SSL_read
SSL_CTX_check_private_key
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_certificate_file
SSL_CTX_load_verify_locations

Exports

Exports

??0CAutoBuffer@WQ_LIB@@QAE@ABV01@@Z
??4CAutoBuffer@WQ_LIB@@QAEAAV01@ABV01@@Z
??_7CAutoBuffer@WQ_LIB@@6B@

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 188KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f6d3b5cf8899680a61a7d3df725ffb28

Headers

DLL Characteristics

File Characteristics

Imports

mpr

basic

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

ws2_32

qpwd

libmodel

psapi

iphlpapi

libssl-1_1

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 188KB - Virtual size: 187KB

.data Size: 50KB - Virtual size: 70KB

.rsrc Size: 20KB - Virtual size: 19KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 188KB - Virtual size: 187KB

.data
Size: 50KB - Virtual size: 70KB

.rsrc
Size: 20KB - Virtual size: 19KB