7c7bb5001c917ed93684193be45f86d4cc5562b901926d86c8a6732c8ff921dd

Sharing

Copy URL Twitter E-mail

General

Target

7c7bb5001c917ed93684193be45f86d4cc5562b901926d86c8a6732c8ff921dd
Size

4.3MB
MD5

030c120764a0fb9346286a79a05068db
SHA1

c044042cf5948d7a831ebc5a46c3cb36e490c440
SHA256

7c7bb5001c917ed93684193be45f86d4cc5562b901926d86c8a6732c8ff921dd
SHA512

ed364fcff0b8352957091e8f4a25568c01fbc502e461ed5481402642c7dbd5911029ae56eaf59fed2d55eccffa929bd5909765b177fec7a06b2d7b7285b06dc0
SSDEEP

98304:1DDoxUlOgx+ZpR6sV3jHAg2imZZze9tIto8:1DDox2OXzHL2NZReJ8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7c7bb5001c917ed93684193be45f86d4cc5562b901926d86c8a6732c8ff921dd

Files

7c7bb5001c917ed93684193be45f86d4cc5562b901926d86c8a6732c8ff921dd
.exe windows:6 windows x86

68de9598f472878ef4635ef88737c905

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

recvfrom
WSACleanup
WSAIoctl
WSASetLastError
accept
setsockopt
ntohs
htons
getsockopt
listen
getaddrinfo
freeaddrinfo
shutdown
__WSAFDIsSet
select
htonl
ioctlsocket
getsockname
getpeername
connect
ntohl
getnameinfo
gethostbyname
sendto
bind
recv
WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSASetEvent
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
WSAStartup
gethostname
socket

wldap32

ord50
ord45
ord30
ord33
ord22
ord46
ord217
ord143
ord301
ord26
ord41
ord27
ord200
ord32
ord211
ord79
ord60
ord35

crypt32

CertOpenStore
CertFindCertificateInStore
CertOpenSystemStoreA
CertGetCertificateContextProperty
CertCloseStore
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertDuplicateCertificateContext
CertEnumCertificatesInStore

shlwapi

AssocQueryStringW
SHDeleteKeyW
SHGetValueW
PathRemoveFileSpecW
PathCombineW
PathAppendW
PathFileExistsW

shell32

DragQueryFileW
CommandLineToArgvW
SHChangeNotify
SHGetSpecialFolderPathW
ord165
ShellExecuteW

dbghelp

MakeSureDirectoryPathExists

kernel32

SetLastError
GetCurrentProcess
lstrlenW
TerminateProcess
SetFilePointer
GetTempPathW
WaitForSingleObject
GetFileAttributesW
K32GetProcessImageFileNameW
UnmapViewOfFile
OpenProcess
SetFileAttributesW
GetLogicalDriveStringsW
CreateToolhelp32Snapshot
MultiByteToWideChar
Sleep
FormatMessageW
GetFileAttributesExW
Process32NextW
lstrcatW
DeleteFileW
Process32FirstW
GetWindowsDirectoryW
MoveFileExW
GetCurrentProcessId
lstrcpyW
MapViewOfFile
lstrcmpiW
MoveFileW
GetDriveTypeW
FreeResource
GetSystemDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
RemoveDirectoryW
GetModuleFileNameW
GetTickCount
DeviceIoControl
GetVersionExW
CreateFileA
VerSetConditionMask
GetProcAddress
MulDiv
LoadLibraryW
VerifyVersionInfoW
GlobalLock
GlobalUnlock
GetFileSize
CreateMutexW
GetACP
ExitProcess
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
InitializeCriticalSectionAndSpinCount
GlobalAlloc
GetLocalTime
lstrcpynW
InterlockedIncrement
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
LoadLibraryA
MoveFileExA
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
QueryPerformanceCounter
CompareFileTime
GetSystemTimeAsFileTime
WaitForSingleObjectEx
VerifyVersionInfoA
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetSystemTime
WaitNamedPipeA
GetCurrentThread
CreateThread
InterlockedCompareExchange
InterlockedExchange
VirtualQuery
InitializeSListHead
GetStartupInfoW
ResetEvent
SetEvent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OutputDebugStringW
IsDebuggerPresent
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStringTypeW
EncodePointer
SwitchToThread
CreateEventW
QueryDosDeviceW
InterlockedDecrement
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
CreateEventA
CancelIo
GetOverlappedResult
CreateFileMappingA
GetProcessHeap
DeleteCriticalSection
LocalFree
DecodePointer
HeapAlloc
FindResourceW
LoadResource
RaiseException
CloseHandle
HeapReAlloc
LockResource
GetLastError
HeapSize
CreateFileW
FindClose
InitializeCriticalSectionEx
WriteFile
FindNextFileW
HeapFree
GetFileSizeEx
FindFirstFileW
SizeofResource
ReadFile
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
ReleaseMutex
GetFileInformationByHandle
FlushFileBuffers
SetEndOfFile
SetFilePointerEx
DuplicateHandle
SetHandleInformation
GetNativeSystemInfo
SystemTimeToTzSpecificLocalTime
CreateDirectoryW
FileTimeToSystemTime
FormatMessageA
GetModuleHandleExA
GetCommandLineW
OutputDebugStringA
RtlUnwind
LoadLibraryExW
WriteConsoleW
FindFirstFileExW
ExitThread
FreeLibraryAndExitThread
SetConsoleCtrlHandler
GetConsoleOutputCP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
GetFullPathNameW
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetModuleHandleW

user32

TrackPopupMenu
AppendMenuW
EnableMenuItem
DestroyMenu
CreatePopupMenu
SetRect
FillRect
DrawTextW
CharPrevW
GetWindowRgn
IsWindowEnabled
MoveWindow
UpdateLayeredWindow
SetWindowRgn
GetPropW
SetPropW
EnableWindow
ShowWindow
GetClassInfoExW
RegisterClassExW
RegisterClassW
CallWindowProcW
DefWindowProcW
InflateRect
LoadCursorW
SetCursor
GetMonitorInfoW
MonitorFromWindow
LoadImageW
GetWindow
GetParent
SetWindowLongW
GetWindowLongW
PtInRect
IsRectEmpty
OffsetRect
UnionRect
IntersectRect
PostMessageW
TranslateMessage
GetCaretBlinkTime
MessageBoxW
GetMessageW
GetDC
ReleaseDC
MonitorFromPoint
CreateWindowExW
SetWindowPos
IsWindowVisible
IsIconic
IsZoomed
CharNextW
GetSysColor
MapWindowPoints
ScreenToClient
GetCursorPos
HideCaret
SetFocus
GetActiveWindow
GetFocus
GetKeyState
GetWindowRect
GetClientRect
InvalidateRect
GetUpdateRect
SetCapture
ReleaseCapture
ShowCaret
IsWindow
FindWindowW
FindWindowA
SendMessageA
MsgWaitForMultipleObjectsEx
GetQueueStatus
CallMsgFilterW
DestroyWindow
PeekMessageW
PostQuitMessage
SendMessageW
wsprintfW
UnregisterClassW
SetCaretPos
GetCaretPos
ClientToScreen
SetTimer
KillTimer
BeginPaint
EndPaint
UpdateWindow
EqualRect
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
wsprintfA
DrawTextA
CreateCaret
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
SetForegroundWindow
GetKeyboardLayout
GetKeyNameTextW
MapVirtualKeyExW
GetProcessWindowStation
GetUserObjectInformationW
DispatchMessageW
WaitMessage

gdi32

GetTextExtentPointA
CreatePatternBrush
GdiFlush
TextOutW
MoveToEx
SetBitmapBits
GetBitmapBits
GetObjectA
SetTextColor
SetStretchBltMode
StretchBlt
SetBkMode
SetBkColor
ExtSelectClipRgn
SelectClipRgn
LineTo
GetTextExtentPoint32W
GetClipBox
GetCharABCWidthsW
CreateSolidBrush
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBitmap
CreateFontIndirectW
CreatePen
DeleteDC
DeleteObject
GetStockObject
AddFontMemResourceEx
RemoveFontMemResourceEx
Rectangle
RestoreDC
SaveDC
SelectObject
CloseEnhMetaFile
CreateEnhMetaFileW
GetEnhMetaFileHeader
PlayEnhMetaFile
GetTextMetricsW
GetObjectW
SetWindowOrgEx
CreateRoundRectRgn
CreateRectRgn
PtInRegion
CreateDIBSection
CombineRgn
CreatePenIndirect
GetDeviceCaps
CreateRectRgnIndirect

advapi32

RegOpenKeyExW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegQueryValueExW
CloseServiceHandle
OpenSCManagerW
DeleteService
ControlService
OpenServiceW
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW

ole32

CLSIDFromString
OleLockRunning
CoCreateInstance
ReleaseStgMedium
OleDuplicateData
DoDragDrop
CoUninitialize
CoInitialize
CoInitializeEx
CoCreateGuid
CLSIDFromProgID
CreateStreamOnHGlobal

oleaut32

VariantInit
VariantClear
SysAllocString
SysFreeString

comctl32

ord17
_TrackMouseEvent
InitCommonControlsEx

gdiplus

GdipCreatePath
GdipFree
GdipAlloc
GdiplusShutdown
GdipDeletePath
GdipAddPathLine
GdipAddPathArc
GdipCreateMatrix
GdipDrawImageI
GdipDrawLine
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipSetPenEndCap
GdipSetPenStartCap
GdipCreatePen2
GdipRotateWorldTransform
GdipDrawImageRectI
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdiplusStartup
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipGetImageWidth
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawImageRectRect
GdipFillPath
GdipFillRectangleI
GdipDrawPath
GdipDrawRectangleI
GdipResetWorldTransform
GdipSetWorldTransform
GdipSetInterpolationMode
GdipImageGetFrameCount
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipReleaseDC
GdipDeleteGraphics
GdipCreateFromHDC
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipSetPenDashStyle
GdipSetPenMode
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipRotateMatrix
GdipTranslateMatrix
GdipDeleteMatrix
GdipTranslateWorldTransform

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

bcrypt

BCryptGenRandom

winmm

timeEndPeriod
timeGetTime
timeBeginPeriod

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 642KB - Virtual size: 641KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 80KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

68de9598f472878ef4635ef88737c905

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wldap32

crypt32

shlwapi

shell32

dbghelp

kernel32

user32

gdi32

advapi32

ole32

oleaut32

comctl32

gdiplus

imm32

bcrypt

winmm

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 642KB - Virtual size: 641KB

.data Size: 80KB - Virtual size: 103KB

.rsrc Size: 1.0MB - Virtual size: 1.0MB

.reloc Size: 119KB - Virtual size: 119KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 642KB - Virtual size: 641KB

.data
Size: 80KB - Virtual size: 103KB

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

.reloc
Size: 119KB - Virtual size: 119KB