b7afa9b9d90c666c55e89488277e0c9cec7f0e68022d365c4aa70f07b812d526

Sharing

Copy URL Twitter E-mail

General

Target

b7afa9b9d90c666c55e89488277e0c9cec7f0e68022d365c4aa70f07b812d526
Size

1.1MB
MD5

4541e3d81cca5903f524d03c64417a48
SHA1

96047d7574c8a4556c412288132c0ebaedfdc684
SHA256

b7afa9b9d90c666c55e89488277e0c9cec7f0e68022d365c4aa70f07b812d526
SHA512

95a1a5244d998c8313d5722436ae0de39edfb97ec7b78d71e6bb88c7e9e7370ee88263aad895112f981f4df7aeb957a049a5cc0929da52ffe74765e62d2b03f8
SSDEEP

24576:wkrftCV7nLDX0HoCaqTkK80TcUfbYB22kmpb24f54MvMl:wuwL72TQ0TBYB22kmpb24f54l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b7afa9b9d90c666c55e89488277e0c9cec7f0e68022d365c4aa70f07b812d526

Files

b7afa9b9d90c666c55e89488277e0c9cec7f0e68022d365c4aa70f07b812d526
.exe windows:5 windows x86

fe1f2e4d7152de49a56bae29cef62f97

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileW
GetSystemTimeAsFileTime
GetCommandLineW
GetCurrentThreadId
SetEvent
DeleteFileW
CopyFileW
GetDiskFreeSpaceExW
CreateDirectoryW
RemoveDirectoryW
GetTempPathW
GetFileAttributesW
GetTickCount
GetACP
SetLastError
HeapFree
HeapSize
HeapReAlloc
HeapAlloc
GetProcessHeap
InterlockedCompareExchange
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
GetVersionExW
GetNativeSystemInfo
WaitForSingleObject
GetStartupInfoW
CreateProcessW
LocalFree
InitializeCriticalSection
FormatMessageW
FindClose
FindFirstFileExW
FindNextFileW
CreateEventA
DuplicateHandle
ReleaseSemaphore
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
InterlockedDecrement
GlobalAlloc
GlobalLock
InterlockedIncrement
GlobalUnlock
lstrcmpW
MulDiv
ReadFile
SetFilePointer
WriteFile
EncodePointer
SetThreadPriority
SignalObjectAndWait
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
DecodePointer
EnumSystemLocalesW
IsValidLocale
GetConsoleCP
FlushFileBuffers
GetFileType
ReadConsoleW
GetConsoleMode
GetCurrentThread
FreeLibraryAndExitThread
CreateThread
GetStdHandle
GetModuleHandleExW
ExitProcess
LoadLibraryExW
InterlockedFlushSList
RtlUnwind
GetModuleHandleA
GetLogicalProcessorInformation
OpenEventA
GetUserDefaultLCID
Sleep
SetFilePointerEx
SetEndOfFile
LeaveCriticalSection
GetModuleFileNameW
EnterCriticalSection
GetPhysicallyInstalledSystemMemory
GetModuleHandleW
CreateEventW
GetExitCodeProcess
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryW
GetFileSize
GetStringTypeW
TryEnterCriticalSection
InitializeSListHead
GetCurrentProcessId
FormatMessageA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
OutputDebugStringW
GetCPInfo
GetLocaleInfoW
LCMapStringW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
DeleteCriticalSection
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
GetThreadPriority
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
SwitchToThread

user32

RegisterClassExW
PeekMessageW
TranslateMessage
DispatchMessageW
SetWindowLongW
DestroyWindow
GetWindowLongW
SetTimer
KillTimer
UnregisterClassW
GetCursorPos
SendMessageW
PostThreadMessageW
wsprintfW
DefWindowProcW
GetDesktopWindow
MsgWaitForMultipleObjects
GetWindowTextLengthW
GetWindow
GetFocus
GetDC
SetWindowPos
SetWindowRgn
FillRect
ScreenToClient
GetSystemMetrics
SetWindowTextW
ShowWindow
IsWindow
InvalidateRgn
RedrawWindow
ClientToScreen
DestroyAcceleratorTable
IsChild
GetSysColor
MoveWindow
CreateAcceleratorTableW
SetFocus
CharNextW
GetClassNameW
SetCapture
GetClientRect
GetDlgItem
PostQuitMessage
SystemParametersInfoW
GetParent
RegisterWindowMessageW
ReleaseCapture
InvalidateRect
ReleaseDC
BeginPaint
EndPaint
GetWindowTextW
CallWindowProcW
CreateWindowExW
GetClassInfoExW
LoadCursorW

gdi32

BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetStockObject
CreateRoundRectRgn
GetDeviceCaps
DeleteDC
GetObjectW
DeleteObject
CreateSolidBrush

shell32

SHGetFolderPathW
CommandLineToArgvW

ole32

OleUninitialize
CoCreateInstance
CoAddRefServerProcess
CoTaskMemFree
CoCreateGuid
CoGetClassObject
CoTaskMemAlloc
StringFromGUID2
CLSIDFromProgID
CreateStreamOnHGlobal
CLSIDFromString
OleLockRunning
CoReleaseServerProcess
OleInitialize
StringFromCLSID

oleaut32

DispCallFunc
VariantChangeType
LoadRegTypeLi
VariantInit
LoadTypeLi
SysStringByteLen
OleCreateFontIndirect
SysAllocString
VariantCopy
SysStringLen
SysAllocStringLen
VariantClear
SysFreeString
SysAllocStringByteLen

advapi32

CryptDestroyKey
CryptVerifySignatureW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptReleaseContext
RegSetValueExW
RegNotifyChangeKeyValue
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
CryptAcquireContextW

shlwapi

PathFindFileNameW

ws2_32

ntohl

Sections

.text
Size: 408KB - Virtual size: 408KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 544KB - Virtual size: 543KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe1f2e4d7152de49a56bae29cef62f97

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

shlwapi

ws2_32

Sections

.text Size: 408KB - Virtual size: 408KB

.rdata Size: 140KB - Virtual size: 140KB

.data Size: 29KB - Virtual size: 34KB

.rsrc Size: 544KB - Virtual size: 543KB

.reloc Size: 31KB - Virtual size: 30KB

.text
Size: 408KB - Virtual size: 408KB

.rdata
Size: 140KB - Virtual size: 140KB

.data
Size: 29KB - Virtual size: 34KB

.rsrc
Size: 544KB - Virtual size: 543KB

.reloc
Size: 31KB - Virtual size: 30KB