9cbd2081d5a8d375aa377883768aa932352cdd79d4f152e925f7b2f7e56c910a

Sharing

Copy URL Twitter E-mail

General

Target

9cbd2081d5a8d375aa377883768aa932352cdd79d4f152e925f7b2f7e56c910a
Size

4.8MB
MD5

00656d70747e20121e449367a76ca35b
SHA1

6d221c083d43efadd96cd714d0ac01d158d8fe38
SHA256

9cbd2081d5a8d375aa377883768aa932352cdd79d4f152e925f7b2f7e56c910a
SHA512

5f1d9403e09f310dfa94b9104e5dfd1215a79001c7e468168e47833f554edc1483233be67d1619f0f098eefebfe6bbe2e0efc4d933e296e91f259b3eb400341e
SSDEEP

98304:FBBplC++gv65jLn+wKCHIlcYt3KKu44oe/u6VoQTcfhnjV6ylZ/yA7z:Ps+Vv6dOlcYt3Kxb/G6ynjV6ylP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9cbd2081d5a8d375aa377883768aa932352cdd79d4f152e925f7b2f7e56c910a

Files

9cbd2081d5a8d375aa377883768aa932352cdd79d4f152e925f7b2f7e56c910a
.exe windows:6 windows x86

6edd25d8984fcc99cf3abaf163694a1d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalFree
FreeResource
GlobalUnlock
GlobalLock
GlobalAlloc
DeleteCriticalSection
DecodePointer
InitializeCriticalSectionEx
GetCurrentProcess
GetModuleHandleExW
GetCurrentThreadId
GetLocalTime
OutputDebugStringW
Process32NextW
TerminateProcess
OpenProcess
Process32FirstW
CreateToolhelp32Snapshot
WriteFile
RemoveDirectoryW
FindClose
FindNextFileW
FindFirstFileW
MoveFileExW
MoveFileW
DeleteFileW
SetLastError
GetVersionExW
WaitForSingleObject
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
Sleep
CreateDirectoryW
GetFileAttributesW
OpenMutexW
OpenSemaphoreW
LocalFree
GetCommandLineW
CloseHandle
CreateMutexW
GetModuleFileNameW
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
SetEndOfFile
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
HeapDestroy
FindResourceExW
FindResourceW
GetStdHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
WaitForSingleObjectEx
RaiseException
IsDebuggerPresent
GetCPInfo
LCMapStringEx
EncodePointer
GetStringTypeW
InitializeCriticalSection
TerminateThread
ResumeThread
FormatMessageW
DeviceIoControl
GetFileSizeEx
QueryPerformanceCounter
LoadResource
LockResource
SizeofResource
GetLastError
GetCurrentProcessId
GetFullPathNameW
DosDateTimeToFileTime
GetFileType
SystemTimeToFileTime
GetModuleHandleW
GetProcAddress
TlsSetValue
TlsAlloc
TlsGetValue
TlsFree
SetUnhandledExceptionFilter
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetSystemTimeAsFileTime
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
WaitForMultipleObjects
CreateEventW
SetEvent
ResetEvent
LoadLibraryW
GetCurrentDirectoryW
GetTickCount
ExitProcess
GetACP
FreeLibrary
MulDiv
ReadFile
GetFileSize
SetFilePointer
DuplicateHandle

user32

SetWindowPos
GetClientRect
UnregisterClassW
SendMessageW
GetWindowLongW
GetWindow
GetParent
MapWindowPoints
GetDC
CreateWindowExW
RegisterClassExW
DefWindowProcW
GetClassInfoExW
IsWindow
DispatchMessageW
TranslateMessage
DestroyWindow
PostQuitMessage
PostMessageW
SetTimer
PtInRect
GetWindowRect
ReleaseDC
GetCursorPos
KillTimer
IsWindowVisible
BringWindowToTop
SetForegroundWindow
ShowWindow
FindWindowW
UpdateLayeredWindow
InvalidateRgn
GetQueueStatus
CallMsgFilterW
MsgWaitForMultipleObjectsEx
PeekMessageW
WaitMessage
EndPaint
BeginPaint
InvalidateRect
ReleaseCapture
SetWindowLongW
SetCapture
GetUpdateRect
SetFocus
IsRectEmpty
IsWindowEnabled
GetActiveWindow
ScreenToClient
GetFocus
GetKeyState
EnableWindow
LoadImageW
LoadCursorW
SetPropW
RegisterClassW
GetMonitorInfoW
GetSystemMetrics
MonitorFromWindow
GetPropW
CallWindowProcW
IsIconic
IsZoomed
SetWindowRgn
MessageBoxW
SetCursor
OffsetRect
InflateRect
CharNextW
ShowCaret
IntersectRect
GetSysColor
CreateCaret
ClientToScreen
SetCaretPos
HideCaret
GetCaretPos
SetRect
DrawTextW
CharPrevW
FillRect
GetWindowTextW
SetWindowTextW
GetWindowTextLengthW
CreateAcceleratorTableW
MoveWindow

gdi32

SaveDC
SetWindowOrgEx
GetStockObject
GetTextMetricsW
CreatePen
Rectangle
CombineRgn
CreateRectRgnIndirect
DeleteDC
DeleteObject
SelectObject
CreateDIBSection
CreateCompatibleDC
ExtTextOutW
RoundRect
ExtSelectClipRgn
CreateCompatibleBitmap
GetDeviceCaps
SetStretchBltMode
SetBkColor
MoveToEx
GetCharABCWidthsW
SelectClipRgn
LineTo
SetBkMode
SetTextColor
GetTextExtentPoint32W
TextOutW
GetClipBox
GetObjectW
RestoreDC
CreateFontIndirectW
BitBlt
CreateSolidBrush
CreateRoundRectRgn
GetObjectA
CreatePenIndirect
StretchBlt

advapi32

RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
RegCreateKeyW
GetFileSecurityW
GetSecurityDescriptorDacl
GetAclInformation
GetAce
RegCreateKeyExW

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
CommandLineToArgvW
ShellExecuteExW
SHChangeNotify
ord165
SHGetSpecialFolderLocation
SHGetMalloc
ShellExecuteW

ole32

OleLockRunning
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoInitializeEx
CreateStreamOnHGlobal
CoUninitialize

shlwapi

PathRemoveBackslashW
PathRemoveFileSpecW
PathFileExistsA
StrStrIA
PathFileExistsW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

psapi

GetModuleFileNameExW
GetModuleBaseNameW

winmm

timeGetTime

comctl32

ord17
_TrackMouseEvent

gdiplus

GdipCloneImage
GdipDisposeImage
GdipSetStringFormatAlign
GdipDeleteFont
GdipDeleteStringFormat
GdipGetImageHeight
GdipSetTextRenderingHint
GdipDrawString
GdipCreateFontFromDC
GdipSetStringFormatLineAlign
GdipDeleteBrush
GdipCreateLineBrushI
GdipCreateFontFromLogfontA
GdipFree
GdiplusShutdown
GdiplusStartup
GdipGetImageWidth
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromStream
GdipAlloc
GdipCreateStringFormat
GdipDrawImageRectRectI
GdipCloneBrush

imm32

ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow

wininet

InternetOpenUrlW
InternetCloseHandle
InternetOpenW

iphlpapi

GetAdaptersInfo

oleaut32

VariantInit
SysFreeString
SysAllocString
VariantClear

Sections

.text
Size: 558KB - Virtual size: 558KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 47.0MB - Virtual size: 47.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6edd25d8984fcc99cf3abaf163694a1d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

version

psapi

winmm

comctl32

gdiplus

imm32

wininet

iphlpapi

oleaut32

Sections

.text Size: 558KB - Virtual size: 558KB

.rdata Size: 138KB - Virtual size: 138KB

.data Size: 8KB - Virtual size: 15KB

.rsrc Size: 47.0MB - Virtual size: 47.0MB

.reloc Size: 29KB - Virtual size: 28KB

.text
Size: 558KB - Virtual size: 558KB

.rdata
Size: 138KB - Virtual size: 138KB

.data
Size: 8KB - Virtual size: 15KB

.rsrc
Size: 47.0MB - Virtual size: 47.0MB

.reloc
Size: 29KB - Virtual size: 28KB