a0e9e0b1a8de3e7eb4ed4c8054aabcdcfe90e831e1a5018b630772e4f49ccd89

Sharing

Copy URL Twitter E-mail

General

Target

a0e9e0b1a8de3e7eb4ed4c8054aabcdcfe90e831e1a5018b630772e4f49ccd89
Size

12.5MB
MD5

43e4ffd6b3f3b8b7bd6442dba18e6734
SHA1

a813bd05bb9449194a7a0d4b2a08563c9c251c7c
SHA256

a0e9e0b1a8de3e7eb4ed4c8054aabcdcfe90e831e1a5018b630772e4f49ccd89
SHA512

19293d9fbfc0348f0fc324af643e7578c4330a7853f2c8dd550a82dd55462fa9f1b0d2409a243a064289115ef1e811369e8293d986aa510a14bde4e2a298ea78
SSDEEP

196608:URuSWp+BhiSG2SDnlpe1ivqO4NEXJs+NeeCdQU/Xe3S0FiN9wBsma86X01QPPHxy:URuS9BhS2SzrbbPNjmKPi7wBC01QfXY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a0e9e0b1a8de3e7eb4ed4c8054aabcdcfe90e831e1a5018b630772e4f49ccd89

Files

a0e9e0b1a8de3e7eb4ed4c8054aabcdcfe90e831e1a5018b630772e4f49ccd89
.exe windows:5 windows x86

e135bed31e7d55815d1e6e78c9d8f2c6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
TerminateProcess
RemoveDirectoryW
PeekNamedPipe
GetFileAttributesW
GetFileAttributesExW
GlobalFlags
GetCurrentDirectoryW
SetCurrentDirectoryW
CreateProcessW
CopyFileW
VirtualQuery
FileTimeToSystemTime
GetSystemTimeAsFileTime
lstrcmpW
lstrcmpiW
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
HeapSize
GetLastError
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
DeleteFileW
ExitProcess
InitializeCriticalSection
EnterCriticalSection
TryEnterCriticalSection
ResetEvent
WaitForSingleObject
CreateProcessA
GetThreadContext
VirtualAllocEx
Sleep
SetEvent
GetDriveTypeW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetWindowsDirectoryW
GetSystemDirectoryW
GetTempPathW
GetModuleFileNameW
FindClose
FindNextFileW
FindFirstFileW
CloseHandle
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetEndOfFile
SetStdHandle
FlushFileBuffers
GetFileSizeEx
GetTimeZoneInformation
GetStringTypeW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetConsoleCP
GetFullPathNameW
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
SetConsoleCtrlHandler
SetEnvironmentVariableW
FreeLibraryAndExitThread
ExitThread
GetCommandLineA
RtlUnwind
LocalFree
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
lstrlenA
VerifyVersionInfoW
GetModuleHandleA
VerSetConditionMask
CompareFileTime
CreateFileMappingA
MapViewOfFile
GetEnvironmentVariableA
MoveFileExW
QueryPerformanceFrequency
SleepEx
SystemTimeToFileTime
GetSystemTime
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
GetEnvironmentVariableW
LoadLibraryA
ConvertThreadToFiber
ConvertFiberToThread
QueryPerformanceCounter
FormatMessageW
CreateFiber
DeleteFiber
SwitchToFiber
GetFileType
GetStdHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetModuleHandleExW
CreateFileW
SetFilePointer
SetFilePointerEx
ReadFile
WriteFile
CreateThread
ResumeThread
CreateEventW
IsDebuggerPresent
HeapFree
lstrlenW
GetModuleHandleW
GetCurrentThreadId
GetCommandLineW
CreateDirectoryW
FreeLibrary
LoadLibraryW
GetTickCount
FreeResource
GlobalReAlloc
MulDiv
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
WaitForMultipleObjects
MapViewOfFileEx
CreateFileMappingW
GetFileSize
GetProcAddress
MultiByteToWideChar
UnmapViewOfFile
GetSystemInfo
WideCharToMultiByte
FindResourceW
LoadResource
FindResourceExW
LockResource
SizeofResource
CreateSemaphoreW
SwitchToThread
GetCurrentProcessId
SetLastError
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
HeapCreate
CreateFileA
GetLogicalDriveStringsW
CreateDirectoryA
LeaveCriticalSection

user32

TranslateMessage
DispatchMessageW
DefWindowProcW
GetSysColor
SetWindowPos
InvalidateRect
GetWindowLongW
SendMessageW
DestroyWindow
MessageBoxW
WindowFromPoint
GetCapture
UpdateWindow
DrawTextW
MessageBeep
OffsetRect
SetParent
PtInRect
GetLastActivePopup
GetSystemMenu
GetSystemMetrics
SetWindowLongW
UnregisterClassW
IsZoomed
GetTopWindow
SetRect
GetMessageW
PeekMessageW
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
IsWindowVisible
ShowWindow
EnableWindow
GetWindowRect
GetParent
ScreenToClient
GetFocus
IsWindow
SetFocus
EqualRect
MoveWindow
PostMessageW
GetKeyState
SetCursor
FindWindowA
SendMessageA
GetUserObjectInformationW
GetProcessWindowStation
AdjustWindowRectEx
MsgWaitForMultipleObjects
ReleaseDC
GetClientRect
GetWindowDC
GetDC
LoadImageW
GetDesktopWindow
LoadCursorW
LoadIconW
RegisterClassW
GetClassInfoW
GetActiveWindow
LoadStringW
CreateWindowExW
EnumWindows
GetMonitorInfoW
WaitForInputIdle
SetActiveWindow
MonitorFromWindow
GetWindowThreadProcessId
wsprintfW
EndPaint
BeginPaint
ReleaseCapture
RegisterWindowMessageW
GetClassInfoExW
GetDlgItem
SetCapture
GetClassNameW
CharNextW
CreateAcceleratorTableW
IsChild
DestroyAcceleratorTable
ClientToScreen
IsRectEmpty
RedrawWindow
InvalidateRgn
RegisterClassExW
FillRect
GetWindow
CallWindowProcW
GetCursorPos
KillTimer
DestroyIcon
SetTimer
PostQuitMessage
TranslateAcceleratorW
DeleteMenu
SetPropW
RemovePropW
GetPropW
FindWindowExW
GetNextDlgTabItem
IsIconic
SetWindowRgn
DrawIcon
IsDialogMessageW
GetDlgCtrlID
IsWindowEnabled
SetMenu
WinHelpW
IntersectRect

gdi32

GetEnhMetaFileHeader
GetEnhMetaFilePaletteEntries
PlayEnhMetaFile
SetWinMetaFileBits
ExtTextOutW
SetEnhMetaFileBits
DeleteEnhMetaFile
SetPixel
GetPixel
ExtCreateRegion
CreateRectRgn
CombineRgn
PatBlt
SetBkMode
GetTextMetricsW
ExcludeClipRect
GetClipBox
CreateRoundRectRgn
CreateEllipticRgn
SetTextColor
SetBkColor
CreateSolidBrush
BitBlt
CreateCompatibleBitmap
SelectObject
CreateDIBSection
SetDIBColorTable
CreateCompatibleDC
GdiAlphaBlend
StretchBlt
RealizePalette
GetStockObject
GetDIBits
GetDeviceCaps
DeleteDC
SelectPalette
CreatePalette
GetObjectW
SetStretchBltMode
CreateFontIndirectW
DeleteObject

advapi32

RegDeleteValueW
RegEnumKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegCloseKey
RegQueryValueW
RegCreateKeyExW
RegSetValueExW
CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegOpenKeyExW

shell32

SHGetMalloc
SHGetFileInfoW
SHGetSpecialFolderPathW
SHBrowseForFolderW
Shell_NotifyIconW
ShellExecuteW
DragFinish
SHGetPathFromIDListW
DragQueryFileW

ole32

CoTaskMemRealloc
OleLockRunning
OleInitialize
CoTaskMemFree
StringFromGUID2
CoTaskMemAlloc
OleUninitialize
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoInitializeEx
CoUninitialize
CreateStreamOnHGlobal
CoCreateInstance

oleaut32

VariantTimeToSystemTime
VariantInit
LoadTypeLi
OleCreateFontIndirect
SysAllocString
VarUI4FromStr
SafeArrayDestroy
LoadRegTypeLi
SafeArrayUnlock
DispCallFunc
SysStringLen
SysAllocStringLen
SysFreeString
VariantClear
VariantChangeType
SystemTimeToVariantTime

comctl32

InitCommonControlsEx
ImageList_AddMasked
ImageList_Create
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_LoadImageW
ImageList_GetImageCount
ImageList_GetImageInfo

shlwapi

StrPBrkW
StrChrW
PathIsDirectoryA

wldap32

ord41
ord117
ord26
ord27
ord127
ord167
ord142
ord216
ord133
ord147
ord301
ord145
ord219
ord46
ord14
ord208
ord79

ws2_32

ntohs
WSAGetLastError
htons
setsockopt
ioctlsocket
gethostname
select
__WSAFDIsSet
accept
getnameinfo
recvfrom
listen
WSACloseEvent
WSACreateEvent
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
recv
WSAEnumNetworkEvents
WSACleanup
bind
WSAStartup
socket
connect
WSAIoctl
closesocket
ntohl
shutdown
WSASetLastError
WSAStringToAddressW
getaddrinfo
getpeername
getsockname
send
WSAAddressToStringW
getsockopt
htonl
freeaddrinfo
sendto

uxtheme

SetWindowTheme

winmm

timeGetDevCaps
timeGetTime
timeBeginPeriod
timeEndPeriod

gdiplus

GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipGetImageWidth
GdipSetCompositingMode
GdipGetImagePalette
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipBitmapLockBits
GdipFree
GdipGetImagePixelFormat
GdipDisposeImage
GdipDrawImageRectI
GdipAlloc
GdipCreateBitmapFromStream
GdipBitmapUnlockBits
GdipCloneImage
GdipGetImagePaletteSize
GdipGetImageHeight
GdiplusShutdown
GdiplusStartup

crypt32

CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW
CertFreeCertificateContext
CertGetCertificateContextProperty
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenStore

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8.0MB - Virtual size: 8.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e135bed31e7d55815d1e6e78c9d8f2c6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

shlwapi

wldap32

ws2_32

uxtheme

winmm

gdiplus

crypt32

Sections

.text Size: 3.2MB - Virtual size: 3.2MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 44KB - Virtual size: 112KB

.rsrc Size: 8.0MB - Virtual size: 8.0MB

.text
Size: 3.2MB - Virtual size: 3.2MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 44KB - Virtual size: 112KB

.rsrc
Size: 8.0MB - Virtual size: 8.0MB