70f639c27a6303a67b5df3c7b27b4a28c57f7bfb683a6f31db021da86aa4cc15

Sharing

Copy URL Twitter E-mail

General

Target

70f639c27a6303a67b5df3c7b27b4a28c57f7bfb683a6f31db021da86aa4cc15
Size

8.1MB
MD5

ca0218e4965bf792354782dabac556c8
SHA1

f3aef80237fc7c32360e028d8cac1febf40ff854
SHA256

70f639c27a6303a67b5df3c7b27b4a28c57f7bfb683a6f31db021da86aa4cc15
SHA512

225ff083b1826025ccea4a2c1b9d2ddb0de0f480a11a065cffa6fa9c18a1aad4c1bb02f6cb7374ac9a2ca4d21e879b011e8a502a5e2eea1f59c5858362485f10
SSDEEP

98304:EhlVykYpt/lISKTKR/pBV7kEIGbUJ/2ZDsAUbQg/TM/22Es:slVykYpt/lISKTKVTVZbw/2N9UD4j

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
70f639c27a6303a67b5df3c7b27b4a28c57f7bfb683a6f31db021da86aa4cc15

Files

70f639c27a6303a67b5df3c7b27b4a28c57f7bfb683a6f31db021da86aa4cc15
.exe windows:6 windows x64

baedb9bbaf87bcc5e0d76c8e8bb65c0b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

LockFileEx
CreateFileMappingW
MapViewOfFile
UnlockFile
HeapCompact
DeleteFileA
CreateFileA
FlushViewOfFile
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
UnmapViewOfFile
CreateMutexW
UnlockFileEx
GetFullPathNameA
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
HeapCreate
AreFileApisANSI
GetGeoInfoW
RtlCaptureStackBackTrace
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
RaiseException
DecodePointer
UnregisterWaitUntilOOBECompleted
RegisterWaitUntilOOBECompleted
OOBEComplete
SetDllDirectoryW
SetDefaultDllDirectories
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
CreateWaitableTimerW
Sleep
CancelWaitableTimer
SetWaitableTimer
CreateEventW
WaitForSingleObject
ResetEvent
SetLastError
SetUnhandledExceptionFilter
CreateFileW
CreateDirectoryW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WideCharToMultiByte
FormatMessageW
FormatMessageA
LocalFree
GetProcAddress
GetModuleHandleW
ProcessIdToSessionId
GetCurrentProcessId
CreateEventA
SetEvent
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
LoadLibraryA
QueryPerformanceCounter
GetTickCount
MultiByteToWideChar
MoveFileExA
WaitForSingleObjectEx
CompareFileTime
GetSystemTimeAsFileTime
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
VerSetConditionMask
GetLastError
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
WriteFile
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryW
FindClose
FindFirstFileW
FindNextFileW
GetSystemTime
SystemTimeToFileTime
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
GetTickCount64
CreateHardLinkW
DuplicateHandle
TerminateThread
CreateSemaphoreA
GetStringTypeExW
LCMapStringW
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetUserDefaultLCID
GetLocaleInfoEx
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
DeleteFileW
FindFirstFileExW
GetDiskFreeSpaceExW
GetFileAttributesExW
GetFileInformationByHandle
GetLongPathNameW
GetTempFileNameW
SetFilePointer
GetTempPathW
IsWow64Process
CopyFileW
MoveFileExW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
OpenEventW
OpenProcess
LocalAlloc
QueryFullProcessImageNameW
GetVolumeInformationW
GetSystemDirectoryW
GetComputerNameW
GetUserGeoID
GetVersionExW
GetModuleFileNameW
GetCurrentPackageFamilyName
LoadLibraryExW
EnumResourceNamesW
OutputDebugStringW
GetCurrentThread
GetThreadLocale
SetThreadLocale
GetExitCodeProcess
GetFileAttributesW
GetFileSizeEx
FreeResource
LoadResource
LockResource
SizeofResource
FindResourceW
CreateThread
SetThreadPriority
GetThreadPriority
GetExitCodeThread
InitializeCriticalSection
TryEnterCriticalSection
ReleaseMutex
CreateMutexA
FindResourceExW
GetFileSize
DosDateTimeToFileTime
CompareStringW
GlobalFree
FreeConsole
AttachConsole
GetConsoleDisplayMode
FindResourceA
GetLocaleInfoA
CreateDirectoryA
IsDebuggerPresent
GetStringTypeW
EncodePointer
SwitchToThread
GetCPInfo
ReleaseSemaphore
WaitForMultipleObjectsEx
OpenEventA
ResumeThread
GetLogicalProcessorInformation
CreateWaitableTimerA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
GetStartupInfoW
SignalObjectAndWait
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
VirtualAlloc
VirtualFree
SetProcessAffinityMask
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
RtlPcToFileHeader
RtlUnwindEx
RtlUnwind
ExitProcess
GetModuleHandleExW
GetDriveTypeW
ExitThread
SetFilePointerEx
SetConsoleCtrlHandler
GetConsoleCP
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
FlushFileBuffers
SetStdHandle
SetEndOfFile
SetCurrentDirectoryW
GetCurrentDirectoryW
GetFullPathNameW
GetTimeZoneInformation
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
WriteConsoleW
VerifyVersionInfoW
CloseHandle

gdiplus

GdipCreateStringFormat
GdiplusShutdown
GdipCreatePen1
GdipDeletePen
GdipSetImageAttributesColorMatrix
GdipDeleteBrush
GdipMeasureString
GdipFlush
GdipCloneBrush
GdipAddPathLine
GdipClosePathFigures
GdipDeletePath
GdipCreatePath
GdipDeleteFont
GdipCreateFont
GdipDeleteStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipCreateSolidFill
GdipCreateFromHDC
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipBitmapSetPixel
GdipBitmapGetPixel
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromHICON
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdipSaveImageToFile
GdipDrawImageRectRectI
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipSetCompositingMode
GdipDeleteGraphics
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipSetClipRectI
GdipDrawImageRectRect
GdipDrawImage
GdipFillPath
GdipFillEllipse
GdipFillRectangle
GdipSetImageAttributesWrapMode
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc
GdipCreateFromHWND
GdipGraphicsClear
GdipDrawRectangle
GdipDrawLines
GdipDrawLine
GdipSetTextRenderingHint
GdipSetCompositingQuality
GdipDrawString
GdipCreateFromHWNDICM

wldap32

ord26
ord22
ord217
ord41
ord27
ord301
ord200
ord32
ord50
ord46
ord211
ord60
ord45
ord30
ord79
ord35
ord33
ord143

normaliz

IdnToAscii
IdnToUnicode

dbghelp

MiniDumpWriteDump

wtsapi32

WTSFreeMemory
WTSRegisterSessionNotification
WTSUnRegisterSessionNotification
WTSQueryUserToken
WTSEnumerateSessionsW

secur32

GetUserNameExW

netapi32

NetGetJoinInformation
NetApiBufferFree

gdi32

GetObjectW
CreateDIBSection
SelectObject
CreateCompatibleDC
GetDIBits
DeleteObject
CreateBitmap
DeleteDC

advapi32

CryptHashData
SetSecurityInfo
LookupAccountNameW
GetSidSubAuthority
OpenThreadToken
RegOpenKeyW
SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
RegCloseKey
RegOpenKeyExW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
OpenProcessToken
RegQueryValueExW
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegFlushKey
RegQueryInfoKeyW
RegSetValueExW
RegDeleteTreeW
RegCopyTreeW
AddAccessAllowedAceEx
AddAce
DuplicateTokenEx
GetAce
GetAclInformation
GetLengthSid
GetSecurityDescriptorSacl
GetTokenInformation
InitializeAcl
CryptGetHashParam
GetUserNameW
ConvertSidToStringSidW
CryptSignHashW
CryptEnumProvidersW
GetSecurityInfo

shell32

ShellExecuteExW
SHGetSettings
SHGetDesktopFolder
SHGetKnownFolderPath
SHGetFolderPathW
SHCreateDirectoryExW
SHGetMalloc
SHGetFileInfoW
SHFileOperationW
ShellExecuteW
SHEvaluateSystemCommandTemplate
SHAppBarMessage
SHBindToParent
CommandLineToArgvW
SHQueryUserNotificationState

ole32

PropVariantClear
StringFromGUID2
CoUninitialize
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoCreateGuid
CoSetProxyBlanket
CoCreateInstance
CoInitializeSecurity

oleaut32

SysFreeString
SysAllocStringLen
CreateErrorInfo
SysAllocString
VariantChangeType
GetErrorInfo
SysStringLen
VariantCopy
VariantInit
VariantClear
SetErrorInfo

bcrypt

BCryptGenRandom

msi

ord173
ord217

rpcrt4

UuidToStringW
UuidCreateSequential
RpcStringFreeW

wininet

DeleteUrlCacheEntryW
InternetQueryOptionW

winhttp

WinHttpCloseHandle
WinHttpGetProxyForUrl
WinHttpOpen

wintrust

WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData

crypt32

CryptVerifyMessageSignature
CertGetNameStringW
CertCloseStore
CertEnumCertificatesInStore
CryptQueryObject
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreA
CertOpenStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CryptMsgGetParam
CryptMsgClose
CertDuplicateCertificateContext

userenv

GetUserProfileDirectoryW
ExpandEnvironmentStringsForUserW

shlwapi

ord176
SHRegDuplicateHKey
PathFileExistsW
StrChrIW
PathGetArgsW
AssocQueryStringW
StrRetToBufW
ord487

ws2_32

getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
ioctlsocket
gethostname
gethostbyname
getsockname
getnameinfo
shutdown
send
WSACloseEvent
getpeername
connect
WSACreateEvent
bind
recv
WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSASetEvent
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents

version

VerQueryValueW

comdlg32

GetSaveFileNameW

Sections

.text
Size: 5.3MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 63KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 304KB - Virtual size: 304KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 193KB - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 604KB - Virtual size: 608KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

baedb9bbaf87bcc5e0d76c8e8bb65c0b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

gdiplus

wldap32

normaliz

dbghelp

wtsapi32

secur32

netapi32

gdi32

advapi32

shell32

ole32

oleaut32

bcrypt

msi

rpcrt4

wininet

winhttp

wintrust

crypt32

userenv

shlwapi

ws2_32

version

comdlg32

Sections

.text Size: 5.3MB - Virtual size: 5.3MB

.rdata Size: 1.6MB - Virtual size: 1.6MB

.data Size: 63KB - Virtual size: 100KB

.pdata Size: 304KB - Virtual size: 304KB

.rsrc Size: 193KB - Virtual size: 193KB

.reloc Size: 604KB - Virtual size: 608KB

.text
Size: 5.3MB - Virtual size: 5.3MB

.rdata
Size: 1.6MB - Virtual size: 1.6MB

.data
Size: 63KB - Virtual size: 100KB

.pdata
Size: 304KB - Virtual size: 304KB

.rsrc
Size: 193KB - Virtual size: 193KB

.reloc
Size: 604KB - Virtual size: 608KB