1cbe1e08f8938560ae81a4d5e40f07c6f1f0025988c0e34b92338497d26d4b83

Sharing

Copy URL Twitter E-mail

General

Target

1cbe1e08f8938560ae81a4d5e40f07c6f1f0025988c0e34b92338497d26d4b83
Size

11.2MB
MD5

b950d2207db1a235a51a2abfe2e3f9a2
SHA1

7118c9687c9963c80a9c8966b97cf336a44a9d22
SHA256

1cbe1e08f8938560ae81a4d5e40f07c6f1f0025988c0e34b92338497d26d4b83
SHA512

c6c02190696afa7cce9ec3b4a6eecbf15576bc6612bb645fd3ed9ed94554589927fdee83e63bf7b671b8d5a99e34ad32ea15d40d61451983d2eb616db05af4f8
SSDEEP

196608:40AaJV0K3t7VfAnGvnoYfGvnoYdq3DbdoYMZo/4rKKC+r/nLpZEsc6tzhFLOyom2:40AaJVZV4nPYfPYqbSYMC/4rh/nLpsqT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1cbe1e08f8938560ae81a4d5e40f07c6f1f0025988c0e34b92338497d26d4b83

Files

1cbe1e08f8938560ae81a4d5e40f07c6f1f0025988c0e34b92338497d26d4b83
.exe windows:6 windows x64

f47a7bf789e398201fbf9b71104d46e4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetFileSize
GetFileInformationByHandle
UnmapViewOfFile
SystemTimeToFileTime
LocalFileTimeToFileTime
CreateFileW
SetFilePointer
SetFileTime
WriteFile
TerminateThread
GetDriveTypeW
GetVolumeInformationW
GetSystemTimeAsFileTime
GetLocalTime
FileTimeToLocalFileTime
FileTimeToSystemTime
ResetEvent
CreateThread
SetEvent
Sleep
CreateEventW
SetThreadPriority
GetExitCodeProcess
GenerateConsoleCtrlEvent
VirtualQuery
WideCharToMultiByte
CopyFileW
GetModuleHandleW
CreateProcessW
GetCurrentDirectoryW
GetSystemInfo
GlobalFlags
GetFileAttributesExW
GetSystemDirectoryW
GetVersionExW
GetFileAttributesW
WaitForSingleObject
PeekNamedPipe
CreatePipe
GetModuleFileNameW
GetCurrentProcess
FindNextFileW
GetCommandLineW
ReadFile
CreateDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
FreeResource
GetCurrentThreadId
GlobalReAlloc
MulDiv
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
GlobalSize
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
GetCurrentProcessId
MultiByteToWideChar
lstrcpyW
SetLastError
CloseHandle
SetWaitableTimer
CreateWaitableTimerW
IsDebuggerPresent
FindClose
FindFirstFileW
GetTickCount
FindResourceW
LoadResource
LockResource
SizeofResource
ExitProcess
DeleteFileW
TryEnterCriticalSection
InitializeCriticalSection
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
WriteConsoleW
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
LCMapStringW
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
SetStdHandle
VirtualAlloc
HeapQueryInformation
SetFilePointerEx
FreeLibraryAndExitThread
ExitThread
GetCommandLineA
RaiseException
HeapReAlloc
GetLastError
HeapSize
LeaveCriticalSection
RtlPcToFileHeader
RtlUnwindEx
OutputDebugStringW
GetStartupInfoW
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTempFileNameW
GetWindowsDirectoryW
SetErrorMode
GetFileTime
SystemTimeToTzSpecificLocalTime
GetProfileIntW
GetTempPathW
SearchPathW
FindResourceExW
lstrcmpiW
DuplicateHandle
UnlockFile
SetEndOfFile
LockFile
GetFullPathNameW
FlushFileBuffers
VerifyVersionInfoW
VirtualProtect
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
LocalReAlloc
LocalAlloc
GlobalHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GlobalGetAtomNameW
GetThreadLocale
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
ResumeThread
CompareStringA
lstrcmpA
GetCurrentThread
LocalFree
CompareStringW
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
GetModuleHandleExW
EncodePointer
OutputDebugStringA
GetFileSizeEx
CreateFileA
VerifyVersionInfoA
VerSetConditionMask
FormatMessageW
WaitForMultipleObjects
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
LoadLibraryA
GetModuleHandleA
GetSystemDirectoryA
QueryPerformanceFrequency
SleepEx
InitializeCriticalSectionEx
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
HeapFree
RtlUnwind

user32

GetClassInfoW
GetActiveWindow
LoadStringW
GetWindowLongPtrW
RemovePropW
CreateWindowExW
GetPropW
DestroyWindow
PostMessageW
DefWindowProcW
CopyImage
SetForegroundWindow
SetClipboardData
SetTimer
EmptyClipboard
CloseClipboard
GetMonitorInfoW
OpenClipboard
SetActiveWindow
MonitorFromWindow
GetWindowThreadProcessId
wsprintfW
GetSystemMetrics
GetWindowDC
GetClientRect
ReleaseDC
TranslateMessage
DispatchMessageW
RegisterClassW
SetPropW
LoadIconW
GetDesktopWindow
GetParent
LoadImageW
GetWindowRect
MoveWindow
PeekMessageW
MsgWaitForMultipleObjects
AdjustWindowRectEx
SetCursor
GetKeyState
SetFocus
IsWindow
MessageBoxW
GetFocus
SetCursorPos
GetCursorPos
CreateMenu
AppendMenuW
InsertMenuW
TranslateAcceleratorW
RegisterWindowMessageW
GetMessagePos
GetMessageTime
LoadCursorW
IsMenu
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
GetDlgItem
GetMenu
GetMenuItemID
GetMenuItemCount
GetForegroundWindow
BeginPaint
EndPaint
ValidateRect
ScrollWindow
ShowScrollBar
GetWindowTextW
GetWindowTextLengthW
MapWindowPoints
EqualRect
GetClassLongPtrW
GetLastActivePopup
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
SetScrollInfo
GetScrollInfo
GetMenuStringW
GetMenuState
RemoveMenu
DrawTextW
DrawTextExW
GrayStringW
TabbedTextOutW
CheckDlgButton
SetWindowTextW
IsDialogMessageW
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadMenuW
GetKeyNameTextW
MapVirtualKeyW
SystemParametersInfoW
RegisterClipboardFormatW
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
GetMessageW
ShowOwnedPopups
CharNextW
CreateDialogIndirectParamW
EndDialog
DrawFocusRect
NotifyWinEvent
SendDlgItemMessageA
SetRectEmpty
GetMenuItemInfoW
InflateRect
MonitorFromPoint
GetSysColorBrush
RealChildWindowFromPoint
GetAsyncKeyState
BringWindowToTop
LoadAcceleratorsW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
SetLayeredWindowAttributes
EnumDisplayMonitors
DrawStateW
TrackMouseEvent
CharUpperW
ModifyMenuW
PostThreadMessageW
WaitMessage
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
CopyAcceleratorTableW
EnumChildWindows
LockWindowUpdate
SetClassLongPtrW
InvalidateRgn
GetNextDlgGroupItem
DrawEdge
DrawFrameControl
DrawIconEx
UnionRect
GetIconInfo
CharUpperBuffW
UpdateLayeredWindow
EnableScrollBar
GetMenuDefaultItem
SetMenuDefaultItem
CopyIcon
FrameRect
IsClipboardFormatAvailable
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
IsCharLowerW
MapVirtualKeyExW
SubtractRect
GetUpdateRect
HideCaret
InvertRect
GetDoubleClickTime
DestroyCursor
GetComboBoxInfo
GetWindowRgn
DestroyMenu
CreateAcceleratorTableW
DestroyAcceleratorTable
GetSubMenu
TrackPopupMenu
CreatePopupMenu
DeleteMenu
GetDC
InvalidateRect
SendMessageW
EnableWindow
UnregisterClassW
GetClassInfoExW
GetNextDlgTabItem
DestroyIcon
SetWindowLongW
IsZoomed
SetRect
GetWindowLongW
GetSystemMenu
CallWindowProcW
GetWindow
IsWindowVisible
SetWindowPos
SetWindowLongPtrW
SetWindowRgn
FillRect
ScreenToClient
MessageBeep
WindowFromPoint
GetScrollPos
DrawIcon
ShowWindow
OffsetRect
GetCapture
RedrawWindow
GetScrollRange
CopyRect
GetDlgCtrlID
ClientToScreen
IsChild
GetTopWindow
GetSysColor
IsWindowEnabled
SetMenu
WinHelpW
LoadBitmapW
IsRectEmpty
IntersectRect
GetClassNameW
SetParent
SetCapture
SetScrollRange
KillTimer
SetScrollPos
PtInRect
UpdateWindow
ReleaseCapture
IsIconic

gdi32

CreatePen
Rectangle
Ellipse
CreateSolidBrush
CreateEllipticRgn
RoundRect
GetTextExtentPoint32W
BitBlt
CreateCompatibleBitmap
SelectObject
CreateDIBSection
SetDIBColorTable
CreateCompatibleDC
GdiAlphaBlend
StretchBlt
RealizePalette
GetStockObject
GetDIBits
ExcludeClipRect
GetSystemPaletteEntries
SelectPalette
CreatePalette
GetObjectW
SetStretchBltMode
CreateFontIndirectW
DeleteObject
DeleteDC
CreateRoundRectRgn
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SetBkMode
SetMapMode
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
GetTextMetricsW
PatBlt
GetViewportOrgEx
CombineRgn
CreateBitmap
CreateRectRgn
GetPixel
CreatePatternBrush
GetWindowOrgEx
CreateHatchBrush
SetPixel
GetWindowExtEx
ExtTextOutW
LineTo
GetClipBox
Escape
CreateDCW
CopyMetaFileW
SetTextColor
SetBkColor
GetObjectType
GetViewportExtEx
IntersectClipRect
PtVisible
TextOutW
MoveToEx
GetDeviceCaps
SetLayout
SetPixelV
GetTextFaceW
PtInRegion
GetBoundsRect
FrameRgn
FillRgn
SetPaletteEntries
ExtFloodFill
LPtoDP
GetPaletteEntries
GetNearestPaletteIndex
EnumFontFamiliesExW
Polyline
Polygon
CreatePolygonRgn
OffsetRgn
GetRgnBox
GetTextCharsetInfo
EnumFontFamiliesW
CreateDIBitmap
DPtoLP
SetRectRgn
GetMapMode
GetTextColor
GetBkColor
CreateRectRgnIndirect
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx

advapi32

CryptAcquireContextA
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
RegEnumKeyW
RegEnumValueW
CryptReleaseContext
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyW
RegEnumKeyExW
RegQueryValueW
RegDeleteValueW

shell32

SHGetFileInfoW
SHGetDesktopFolder
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
SHAppBarMessage
DragQueryFileW
Shell_NotifyIconW
ShellExecuteW
DragFinish

ole32

OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleLockRunning
OleGetClipboard
DoDragDrop
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoRegisterMessageFilter
OleIsCurrentClipboard
CoRevokeClassObject
CoGetClassObject
CoDisconnectObject
CoInitialize
CoCreateGuid
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CLSIDFromString
CoTaskMemAlloc
CLSIDFromProgID
CreateStreamOnHGlobal
CoCreateInstance
CoSetProxyBlanket
CoUninitialize
CoInitializeSecurity
CoInitializeEx
CreateILockBytesOnHGlobal
OleFlushClipboard

oleaut32

SysAllocString
SysFreeString
VariantChangeType
VariantClear
SystemTimeToVariantTime
VariantCopy
OleCreateFontIndirect
LoadTypeLi
VariantInit
VariantTimeToSystemTime
VarBstrFromDate
SafeArrayDestroy
SysStringLen
SysAllocStringLen

comctl32

ImageList_Create
ImageList_AddMasked
InitCommonControlsEx
ImageList_Destroy

gdiplus

GdiplusShutdown
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdipGetImageHeight
GdipGetImagePaletteSize
GdipCloneImage
GdipBitmapUnlockBits
GdipCreateBitmapFromStream
GdipAlloc
GdipDrawImageRectI
GdipDisposeImage
GdipGetImagePixelFormat
GdipCreateBitmapFromScan0
GdipFree
GdipBitmapLockBits
GdipGetImageGraphicsContext
GdipDrawImageI
GdipDeleteGraphics
GdipGetImagePalette
GdipSetCompositingMode
GdipGetImageWidth
GdipCreateBitmapFromFile

wldap32

ord27
ord35
ord22
ord41
ord50
ord32
ord33
ord79
ord30
ord301
ord200
ord45
ord26
ord143
ord46
ord211
ord60

ws2_32

freeaddrinfo
getaddrinfo
ntohl
listen
htonl
accept
WSAIoctl
setsockopt
ntohs
getsockopt
getsockname
getpeername
bind
WSASetLastError
inet_pton
__WSAFDIsSet
closesocket
WSACloseEvent
WSAStartup
select
WSAGetLastError
ioctlsocket
htons
recv
inet_ntoa
connect
socket
send
inet_addr
shutdown
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
recvfrom
gethostbyname
WSACleanup
sendto
gethostname

msimg32

TransparentBlt
AlphaBlend

shlwapi

PathRemoveFileSpecW
PathStripToRootW
PathIsUNCW
PathFindFileNameW
PathFindExtensionW
StrFormatKBSizeW

uxtheme

IsAppThemed
GetWindowTheme
DrawThemeText
DrawThemeParentBackground
GetThemeColor
GetCurrentThemeName
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor
DrawThemeBackground
CloseThemeData
OpenThemeData
SetWindowTheme
GetThemePartSize

oledlg

OleUIBusyW

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

crypt32

CertOpenStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertCloseStore

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 727KB - Virtual size: 726KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7.8MB - Virtual size: 7.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f47a7bf789e398201fbf9b71104d46e4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

gdiplus

wldap32

ws2_32

msimg32

shlwapi

uxtheme

oledlg

oleacc

imm32

winmm

winspool.drv

crypt32

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 727KB - Virtual size: 726KB

.data Size: 34KB - Virtual size: 75KB

.pdata Size: 115KB - Virtual size: 114KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 7.8MB - Virtual size: 7.8MB

.reloc Size: 65KB - Virtual size: 65KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 727KB - Virtual size: 726KB

.data
Size: 34KB - Virtual size: 75KB

.pdata
Size: 115KB - Virtual size: 114KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 7.8MB - Virtual size: 7.8MB

.reloc
Size: 65KB - Virtual size: 65KB