2c806d9b932f24c4bc84e86ced7962a75c0161ff732f77eb1827a3a14976b2c1[.]bin[.]sample[.]gz

Sharing

Copy URL Twitter E-mail

General

Target

2c806d9b932f24c4bc84e86ced7962a75c0161ff732f77eb1827a3a14976b2c1.bin.sample.gz
Size

865KB
MD5

1607c0aa36f19d38ef0a3e4e2403b44f
SHA1

0525af23add6cd3bbc6986e7c5cc17f84727e598
SHA256

d0cc31440298b6be27d8cb2071bc3315ccf22574246187d216deb88d25122516
SHA512

97c6a8cce5591955c27a56381b8a1e8e22457f69ece5358d2fd93bc9f339a3eb06f1695f6049d8e3a45947d3d02546ec1eaf2294648721ba4d1941095e13b769
SSDEEP

12288:342syxIjx4dz55poMlHn7b7lw/9AjaF7dMxBAlNM6DtyHM/dM3VAYdJC4Xd0bAQT:IDsIjqjfdayE+0jDtS4yv+A1ys0ZYir

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/sample

Files

2c806d9b932f24c4bc84e86ced7962a75c0161ff732f77eb1827a3a14976b2c1.bin.sample.gz
.gz
sample
.exe windows:6 windows x64

0b48d3a90ac1923d1b943d88798acee0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW
RegisterEventSourceW
ReportEventW
RegDeleteKeyW
DeregisterEventSource
TraceEvent

kernel32

GetCommandLineW
HeapSetInformation
Sleep
lstrcmpW
GlobalAlloc
GlobalLock
GlobalUnlock
SetLastError
SetErrorMode
GetUserDefaultUILanguage
FlushInstructionCache
GetCurrentThreadId
lstrlenW
LocalFree
FormatMessageW
MulDiv
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryW
GetModuleHandleW
lstrcmpiW
RaiseException
LoadLibraryA
LocalAlloc
CreateMutexW
DeleteFileW
CloseHandle
CreateFileW
GetFileAttributesW
FindNextFileW
CreateThread
GetLocaleInfoW
CompareStringOrdinal
EnumResourceLanguagesW
ExpandEnvironmentStringsW
GlobalFree
ReleaseMutex
GetVersionExW
LockResource
FindFirstFileW
GetFullPathNameW
FindClose
OutputDebugStringA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedPushEntrySList
VirtualAlloc
InterlockedPopEntrySList
GetProcessHeap
VirtualFree
HeapSize
HeapReAlloc
HeapDestroy
HeapFree
HeapAlloc
lstrlenA
InitializeCriticalSection
DeleteCriticalSection
CompareStringW
GetVersion
WideCharToMultiByte
GetVersionExA
MultiByteToWideChar
SizeofResource
EnterCriticalSection
FindResourceExW
GetQueuedCompletionStatus
ReadDirectoryChangesW
CreateIoCompletionPort
GetShortPathNameW
FreeResource
FindVolumeClose
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
FindFirstVolumeW
GetVolumeNameForVolumeMountPointW
EnumUILanguagesW
SetEvent
GetWindowsDirectoryW
CreateEventW
WaitForSingleObject
GetDateFormatW
GetACP
LeaveCriticalSection
GetCurrentProcess
LoadLibraryExW
GetModuleFileNameW
GetUserDefaultLCID
LoadResource
FindResourceW

gdi32

CreatePatternBrush
SetBkColor
CreateDIBSection
GetCurrentObject
SetBkMode
CreateBitmap
CreateFontIndirectW
GetTextMetricsW
GetTextExtentPoint32W
AddFontResourceW
SetBrushOrgEx
EnumFontFamiliesExW
PatBlt
SetTextColor
GetObjectA
CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
GetDeviceCaps
GetObjectW
GetStockObject
DeleteObject
SelectObject
DeleteDC

user32

MapDialogRect
CreateDialogIndirectParamW
DrawTextA
SendMessageA
IsWindowUnicode
GetClassNameA
GetWindowLongA
RegisterClipboardFormatW
FindWindowW
RegisterWindowMessageW
GetWindowTextLengthW
FlashWindow
SetWindowTextW
BeginPaint
EndPaint
IsChild
GetFocus
SetFocus
GetWindow
GetClassNameW
GetSysColor
SetWindowPos
DestroyAcceleratorTable
RedrawWindow
DestroyWindow
GetClassInfoExW
CreateAcceleratorTableW
ClientToScreen
ScreenToClient
MoveWindow
SetCapture
ReleaseCapture
FillRect
GetClientRect
InvalidateRect
InvalidateRgn
CallWindowProcW
GetDesktopWindow
GetWindowLongPtrW
GetWindowLongW
SetWindowLongW
DefWindowProcW
LoadCursorW
RegisterClassExW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
CharNextW
IsWindow
GetDlgItem
GetParent
LoadStringW
SetWindowLongPtrW
CreateWindowExW
SendMessageW
ReleaseDC
GetDC
GetWindowTextW
UnregisterClassA
CharLowerW
CharUpperW
LockSetForegroundWindow
ShowWindow
LoadBitmapW
GetWindowRect
SystemParametersInfoW
SetProcessDefaultLayout
MessageBoxW
LoadIconW
MapWindowPoints
GetWindowPlacement
CreateDialogParamW
PostMessageW
GetSystemMetrics
LoadImageW
GetMenuItemCount
GetMenuItemInfoW
EnableMenuItem
GetDlgCtrlID
SetForegroundWindow
SetTimer
LoadAcceleratorsW
TranslateAcceleratorW
InflateRect
GetActiveWindow
OpenClipboard
GetClipboardData
CloseClipboard
KillTimer
PtInRect
DestroyMenu
ModifyMenuW
SetMenuItemInfoW
UpdateWindow
UnhookWindowsHookEx
TrackPopupMenuEx
GetMonitorInfoW
MonitorFromPoint
CallNextHookEx
SetWindowsHookExW
IsMenu
LockWindowUpdate
SetCursor
LoadMenuW
GetSubMenu
IsWindowEnabled
MessageBeep
GetMenuItemID
IsWindowVisible
GetWindowThreadProcessId
GetKeyState
GetSysColorBrush
FrameRect
DrawTextW
GetMessagePos
WindowFromPoint
SetRectEmpty
GetCapture
GetCursorPos
GetWindowDC
DrawFocusRect
OffsetRect
DrawEdge
DrawFrameControl
DrawTextExW
EnableWindow
DialogBoxParamW
EndDialog
InsertMenuW
SetDlgItemTextW

msvcrt

memcmp
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_cexit
_ismbblead
_exit
_XcptFilter
__getmainargs
wcscpy_s
__C_specific_handler
_stricmp
_wsplitpath_s
wcstoul
_wtof
_wfopen
fread
fclose
_wcslwr_s
memset
memmove_s
_wtoi64
wcscat_s
swprintf_s
??2@YAPEAX_K@Z
free
malloc
wcsncpy_s
??_U@YAPEAX_K@Z
__dllonexit
_lock
_onexit
realloc
_errno
memcpy_s
??_V@YAXPEAX@Z
??3@YAXPEAX@Z
wcspbrk
memcpy
wcstol
_wcsicmp
_vsnwprintf
iswspace
wcscoll
qsort
_purecall
wcsstr
wcsrchr
__CxxFrameHandler3
_CxxThrowException
_unlock

shell32

ord190
SHCreateItemFromParsingName
SHGetFolderPathW
CommandLineToArgvW
SHCreateShellItem
ShellExecuteW
DragQueryPoint
DragFinish
SHBrowseForFolderW
SHGetPathFromIDListW
SHCreateQueryCancelAutoPlayMoniker
SHGetSpecialFolderLocation
ord155
DragQueryFileW

ole32

GetRunningObjectTable
CoRevokeClassObject
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
OleInitialize
ReleaseStgMedium
CoUninitialize
CoInitializeEx
RegisterDragDrop
RevokeDragDrop
OleUninitialize
StringFromGUID2
OleLockRunning
CreateStreamOnHGlobal
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoRegisterClassObject
CoResumeClassObjects

oleaut32

LoadRegTypeLi
SysAllocStringLen
VariantInit
VariantClear
SysStringByteLen
LoadTypeLi
SysStringLen
OleCreateFontIndirect
VarBstrCmp
VarUI4FromStr
SysAllocString
SysFreeString

omdproject

OmdGetClassObject

comdlg32

ChooseColorW
GetOpenFileNameW
GetSaveFileNameW

shlwapi

PathFindFileNameW
PathAppendW
SHAutoComplete
PathFileExistsW
PathFindExtensionW

gdiplus

GdipCreateBitmapFromHBITMAP
GdipImageRotateFlip
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipDrawImageRectRectI
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipGetImageHeight
GdipGetImageWidth
GdipSetCompositingMode
GdipDrawImageI
GdipLoadImageFromStream
GdipCreateBitmapFromFile
GdipDrawImageRect
GdipDrawString
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCreateStringFormat
GdiplusStartup
GdipCreateFromHDC
GdipDeleteGraphics
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipSetPixelOffsetMode
GdipSetSmoothingMode
GdipCreateMatrix
GdipDeleteMatrix
GdipTranslateMatrix
GdipGraphicsClear
GdipSetWorldTransform
GdipFillPath
GdipDrawPath
GdipDeletePath
GdipFree
GdipDeletePen
GdipAlloc
GdipCreatePath
GdipAddPathEllipse
ord1
GdipGetPathLastPoint
GdipAddPathLine
GdipClosePathFigure
GdipTransformPath
GdipAddPathRectangle
GdipCreatePathGradientFromPath
GdipDeleteBrush
GdipCloneBrush
GdipSetPathGradientCenterColor
GdipSetPathGradientSurroundColorsWithCount
GdipGetPathGradientPointCount
GdipSetPathGradientCenterPoint
GdipCreatePen1
GdipSetPenMode
GdipGetImageGraphicsContext
GdipCreateSolidFill
GdipFillRectangleI
GdipCreateHBITMAPFromBitmap
GdipCreateFont
GdipFillRectangle
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipGetFamilyName
GdipGetFamily
GdipDrawImageRectI
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromScan0
GdipSetTextRenderingHint
GdipScaleMatrix

d3d9

Direct3DCreate9
Direct3DCreate9Ex

uxtheme

SetWindowTheme

slc

SLGetWindowsInformationDWORD

wmvcore

WMCreateSyncReader

Exports

Exports

??0CtrlContainerFrame@DlgAutoLayout@@QEAA@AEAVIMsoAutoLayoutDialog@1@PEAXPEAVCompositeFrame@1@@Z
??0CtrlFrame@DlgAutoLayout@@QEAA@AEAVIMsoAutoLayoutDialog@1@PEAXPEAVCompositeFrame@1@@Z
??0FrameEqualizer@DlgAutoLayout@@QEAA@AEAVIMsoAutoLayoutDialog@1@@Z
??0GroupBoxFrame@DlgAutoLayout@@QEAA@AEAVIMsoAutoLayoutDialog@1@PEAX1PEAVCompositeFrame@1@@Z
??0GroupBoxFrame@DlgAutoLayout@@QEAA@AEAVIMsoAutoLayoutDialog@1@PEAXPEAVCompositeFrame@1@@Z
??0HorizFrame@DlgAutoLayout@@QEAA@AEAVIMsoAutoLayoutDialog@1@PEAVCompositeFrame@1@@Z
??0IMsoAutoLayoutDialog@DlgAutoLayout@@IEAA@XZ
??0ListEditFrame@DlgAutoLayout@@QEAA@AEAVIMsoAutoLayoutDialog@1@PEAX1PEAVCompositeFrame@1@@Z
??0MsoWCtrlContainerFrame@@QEAA@AEAVIMsoWAutoLayoutDialog@@GPEAVMsoWCompositeFrame@@@Z
??0MsoWCtrlFrame@@QEAA@AEAVIMsoWAutoLayoutDialog@@GPEAVMsoWCompositeFrame@@@Z
??0MsoWFrameEqualizer@@QEAA@AEAVIMsoWAutoLayoutDialog@@@Z
??0MsoWGroupBoxFrame@@QEAA@AEAVIMsoWAutoLayoutDialog@@GGPEAVMsoWCompositeFrame@@@Z
??0MsoWGroupBoxFrame@@QEAA@AEAVIMsoWAutoLayoutDialog@@GPEAVMsoWCompositeFrame@@@Z
??0MsoWHorizFrame@@QEAA@AEAVIMsoWAutoLayoutDialog@@PEAVMsoWCompositeFrame@@@Z
??0MsoWListEditFrame@@QEAA@AEAVIMsoWAutoLayoutDialog@@GGPEAVMsoWCompositeFrame@@@Z
??0MsoWNumInputFrame@@QEAA@AEAVIMsoWAutoLayoutDialog@@GGPEAVMsoWCompositeFrame@@@Z
??0MsoWOverlapFrame@@QEAA@AEAVIMsoWAutoLayoutDialog@@PEAVMsoWCompositeFrame@@@Z
??0MsoWTabCtrlFrame@@QEAA@AEAVIMsoWAutoLayoutDialog@@GPEAVMsoWCompositeFrame@@@Z
??0MsoWTableFrame@@QEAA@AEAVIMsoWAutoLayoutDialog@@HHPEAVMsoWCompositeFrame@@@Z
??0MsoWVertFrame@@QEAA@AEAVIMsoWAutoLayoutDialog@@PEAVMsoWCompositeFrame@@@Z
??0NumInputFrame@DlgAutoLayout@@QEAA@AEAVIMsoAutoLayoutDialog@1@PEAX1PEAVCompositeFrame@1@@Z
??0NumInputFrame@DlgAutoLayout@@QEAA@AEAVIMsoAutoLayoutDialog@1@PEAXPEAVCompositeFrame@1@@Z
??0OverlapFrame@DlgAutoLayout@@QEAA@AEAVIMsoAutoLayoutDialog@1@PEAVCompositeFrame@1@@Z
??0TabCtrlFrame@DlgAutoLayout@@QEAA@AEAVIMsoAutoLayoutDialog@1@PEAX1PEAVCompositeFrame@1@@Z
??0TabCtrlFrame@DlgAutoLayout@@QEAA@AEAVIMsoAutoLayoutDialog@1@PEAXPEAVCompositeFrame@1@@Z
??0TableFrame@DlgAutoLayout@@QEAA@AEAVIMsoAutoLayoutDialog@1@HHPEAVCompositeFrame@1@@Z
??0VertFrame@DlgAutoLayout@@QEAA@AEAVIMsoAutoLayoutDialog@1@PEAVCompositeFrame@1@@Z
??1IMsoAutoLayoutDialog@DlgAutoLayout@@MEAA@XZ
MsoDALCheckBoxBMHeight
MsoDALCheckBoxBMWidth
MsoDALCheckBoxBMWidthPlusMargin
MsoDALDestructFrames
MsoDALEditStrHeightPix
MsoDALFDlgIsValid
MsoDALGroupBoxNoLabelTopAdjustPix
MsoDALMarkDlgInvalid
MsoDALSuspendFrameDestruction
MsoDUToPix
MsoDestroyIMsoWAutoLayoutDialog
MsoFCreateIMsoWAutoLayoutDialog
MsoPixToDU
MsoWIsAutoLayoutEnabled
MsoWTabCtrlIndexToHwnd

Sections

.text
Size: 638KB - Virtual size: 638KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0b48d3a90ac1923d1b943d88798acee0

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

shell32

ole32

oleaut32

omdproject

comdlg32

shlwapi

gdiplus

d3d9

uxtheme

slc

wmvcore

Exports

Exports

Sections

.text Size: 638KB - Virtual size: 638KB

.data Size: 3KB - Virtual size: 6KB

.pdata Size: 41KB - Virtual size: 40KB

.rsrc Size: 1.5MB - Virtual size: 1.5MB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 638KB - Virtual size: 638KB

.data
Size: 3KB - Virtual size: 6KB

.pdata
Size: 41KB - Virtual size: 40KB

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

.reloc
Size: 9KB - Virtual size: 8KB