9d4ab85b652e26bc0bd8e68a04ac84f97b3f268cd010854d6815089ee8ad0dc7

Sharing

Copy URL Twitter E-mail

General

Target

9d4ab85b652e26bc0bd8e68a04ac84f97b3f268cd010854d6815089ee8ad0dc7
Size

13.0MB
MD5

f42b9b1d73d32f1046b08094ef38f113
SHA1

168b201c720af1f2b7624151d8b17f3c880fd550
SHA256

9d4ab85b652e26bc0bd8e68a04ac84f97b3f268cd010854d6815089ee8ad0dc7
SHA512

09209af81e6d14eb0b30d82374c72651121a7c8a4d68162fe0ec4474520a0c9ec844708c137d6c3789e1ab2aead659d37a47e1ff4501646824bb87dc1551c096
SSDEEP

393216:fDL9DrJz7N7epKKpPhzuFkC3BPdByEpgIEVqMI:/9pBepK+pu2OBFY1IeqMI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9d4ab85b652e26bc0bd8e68a04ac84f97b3f268cd010854d6815089ee8ad0dc7

Files

9d4ab85b652e26bc0bd8e68a04ac84f97b3f268cd010854d6815089ee8ad0dc7
.exe windows:5 windows x86

5608dd0feb90b01b492806facbe43456

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSACleanup
WSAStartup
shutdown
ioctlsocket
setsockopt
inet_ntoa
getsockopt
getsockname
ntohs
ntohl
htonl
closesocket
connect
htons
inet_addr
recv
select
send
socket
gethostbyname
WSAGetLastError
__WSAFDIsSet

kernel32

QueryPerformanceCounter
QueryPerformanceFrequency
SetConsoleTextAttribute
GetCurrentProcessId
WinExec
FreeLibrary
GetProcAddress
GetCurrentThread
GetLastError
SetLastError
SuspendThread
ResumeThread
CloseHandle
LoadLibraryA
GetModuleFileNameA
OutputDebugStringA
GetVersionExA
InitializeCriticalSection
Sleep
CreateThread
GetStdHandle
GetModuleHandleA
GetWindowsDirectoryA
GetVolumeInformationA
SetConsoleTitleA
GetConsoleWindow
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentThreadId
SetThreadPriority
GetThreadPriority
TerminateThread
GetExitCodeThread
WaitForSingleObject
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
ReleaseSemaphore
GetCurrentProcess
CreateSemaphoreA
MoveFileA
lstrcmpA
GetLocalTime
RtlUnwind
RaiseException
GetStringTypeW
MultiByteToWideChar
DecodePointer
EncodePointer
WideCharToMultiByte
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
ExitProcess
GetModuleHandleExW
AreFileApisANSI
ReadFile
HeapReAlloc
GetCommandLineA
GetTimeZoneInformation
ExitThread
LoadLibraryExW
GetTempPathA
GetCPInfo
GetTickCount
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CreateDirectoryW
MoveFileExW
GetPrivateProfileStringA
OutputDebugStringW
SetStdHandle
WriteConsoleW
SetEnvironmentVariableA
CreateFileW
GetExitCodeProcess
CreateProcessA
SetEndOfFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapSize
WriteFile
GetModuleFileNameW
GetConsoleCP
GetConsoleMode
IsValidCodePage
GetACP
GetOEMCP
FlushFileBuffers
GetFileType
ReadConsoleW
GetPrivateProfileIntA
lstrcpyA
GetFileAttributesExW
DeleteFileW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetFilePointerEx
IsDebuggerPresent
GetSystemTimeAsFileTime
CreateEventA
GetModuleHandleA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
HeapAlloc
HeapFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetModuleHandleW
LoadResource
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
VirtualQuery

user32

TranslateMessage
SetDlgItemTextA
BeginPaint
MessageBoxA
SendMessageA
PostQuitMessage
ShowWindow
SetWindowPos
CreateDialogParamA
EnableMenuItem
EndPaint
InvalidateRect
SetWindowTextA
GetWindowTextA
GetSystemMenu
PeekMessageA
DispatchMessageA
GetClientRect
FillRect
GetCursorPos
GetWindowRect
GetDlgItem

gdi32

DeleteObject
SetTextColor
TextOutA
MoveToEx
SetPixel
SetBkMode
SelectObject
Rectangle
LineTo
CreateSolidBrush

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA

odbc32

ord24
ord4
ord11
ord13
ord31
ord16
ord18
ord9
ord41
ord51
ord75
ord39
ord36
ord29

wininet

HttpOpenRequestA
InternetReadFile
InternetConnectA
InternetCloseHandle
InternetOpenA
HttpSendRequestA

iphlpapi

GetAdaptersInfo

icuin48

??0MessageFormat@icu_48@@QAE@ABVUnicodeString@1@AAW4UErrorCode@@@Z
??1MessageFormat@icu_48@@UAE@XZ
?format@MessageFormat@icu_48@@QBEAAVUnicodeString@2@PBVFormattable@2@HAAV32@AAVFieldPosition@2@AAW4UErrorCode@@@Z
??_7FieldPosition@icu_48@@6B@
??0Formattable@icu_48@@QAE@XZ
??1Formattable@icu_48@@UAE@XZ
?setLong@Formattable@icu_48@@QAEXH@Z
?setString@Formattable@icu_48@@QAEXABVUnicodeString@2@@Z
?getDynamicClassID@Formattable@icu_48@@UBEPAXXZ
??1FieldPosition@icu_48@@UAE@XZ

icuuc48

??1UnicodeString@icu_48@@UAE@XZ
??2UMemory@icu_48@@SAPAXI@Z
??3UMemory@icu_48@@SAXPAX@Z
?getTerminatedBuffer@UnicodeString@icu_48@@QAEPB_WXZ
??0UnicodeString@icu_48@@QAE@XZ
?resetIterator@ResourceBundle@icu_48@@QAEXXZ
?hasNext@ResourceBundle@icu_48@@QBECXZ
??0Locale@icu_48@@QAE@PBD000@Z
??1Locale@icu_48@@UAE@XZ
?setDefault@Locale@icu_48@@SAXABV12@AAW4UErrorCode@@@Z
??0ResourceBundle@icu_48@@QAE@PBDABVLocale@1@AAW4UErrorCode@@@Z
??1ResourceBundle@icu_48@@UAE@XZ
?getString@ResourceBundle@icu_48@@QBE?AVUnicodeString@2@AAW4UErrorCode@@@Z
??0UnicodeString@icu_48@@QAE@PBD@Z
?getKey@ResourceBundle@icu_48@@QBEPBDXZ
?getNext@ResourceBundle@icu_48@@QAE?AV12@AAW4UErrorCode@@@Z
?getStringEx@ResourceBundle@icu_48@@QBE?AVUnicodeString@2@PBDAAW4UErrorCode@@@Z
ucnv_open_48
ucnv_close_48
ucnv_getMaxCharSize_48
ucnv_fromUChars_48
?getDynamicClassID@ResourceBundle@icu_48@@UBEPAXXZ
??_UUMemory@icu_48@@SAPAXI@Z
??_VUMemory@icu_48@@SAXPAX@Z
?getChinese@Locale@icu_48@@SAABV12@XZ

Sections

.text
Size: - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 502KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 464KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.]^M
Size: - Virtual size: 7.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Xo<
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.O-0
Size: 12.9MB - Virtual size: 12.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5608dd0feb90b01b492806facbe43456

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

gdi32

advapi32

odbc32

wininet

iphlpapi

icuin48

icuuc48

Sections

.text Size: - Virtual size: 1.8MB

.rdata Size: - Virtual size: 502KB

.data Size: - Virtual size: 464KB

.]^M Size: - Virtual size: 7.0MB

.Xo< Size: 2KB - Virtual size: 1KB

.O-0 Size: 12.9MB - Virtual size: 12.9MB

.rsrc Size: 10KB - Virtual size: 10KB

.text
Size: - Virtual size: 1.8MB

.rdata
Size: - Virtual size: 502KB

.data
Size: - Virtual size: 464KB

.]^M
Size: - Virtual size: 7.0MB

.Xo<
Size: 2KB - Virtual size: 1KB

.O-0
Size: 12.9MB - Virtual size: 12.9MB

.rsrc
Size: 10KB - Virtual size: 10KB