65f28dbb36d308a827538a25297ebc5a560e4ffea69f0d58af5bcc870e05be21

Sharing

Copy URL Twitter E-mail

General

Target

65f28dbb36d308a827538a25297ebc5a560e4ffea69f0d58af5bcc870e05be21
Size

1.9MB
MD5

712cb21dbec97122cbedef65bcc0d50c
SHA1

40fbbb6724f352035963d435bde37ef913f32fe0
SHA256

65f28dbb36d308a827538a25297ebc5a560e4ffea69f0d58af5bcc870e05be21
SHA512

0bc923ad33d6b9c054bcf2cd3207023492c3bd48ea7c16cd0195bf46c134d368bf43c6406c3f3b75124a4627379542904ddc5d3791e1d21b86a531ed0d367ca6
SSDEEP

49152:hAzkJ8lfePL7M15m6UAFwhQioPHNWeaHpW/DpdN2+4:Ozke1OOR/DN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
65f28dbb36d308a827538a25297ebc5a560e4ffea69f0d58af5bcc870e05be21

Files

65f28dbb36d308a827538a25297ebc5a560e4ffea69f0d58af5bcc870e05be21
.exe windows:5 windows x86

75101bb033aa8202493b54ae1d31a5f2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsBadReadPtr
RemoveDirectoryW
FindFirstFileW
GetFileSizeEx
SetFilePointer
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
FlushViewOfFile
lstrcpynA
lstrlenA
MoveFileExW
GetFileSize
SetFileAttributesW
HeapSize
HeapDestroy
InterlockedIncrement
InterlockedDecrement
GetThreadLocale
SetThreadLocale
OutputDebugStringA
VerSetConditionMask
DeleteCriticalSection
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetSystemInfo
GetWindowsDirectoryW
GetSystemDirectoryW
FormatMessageW
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
GetCurrentThreadId
WideCharToMultiByte
SetEndOfFile
WriteConsoleW
FlushFileBuffers
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
SetConsoleCtrlHandler
GetConsoleCP
SetStdHandle
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetFileType
GetCurrentThread
GetACP
GetStdHandle
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindNextFileW
FindFirstFileExW
FindClose
ReadFile
InterlockedFlushSList
RtlUnwind
QueryPerformanceCounter
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetVolumeInformationW
GetLongPathNameW
SystemTimeToFileTime
GetSystemTime
lstrlenW
GetVersionExW
DeleteFileW
CreateDirectoryW
CreateDirectoryA
lstrcatA
lstrcpynW
GetTempPathW
GetTickCount
lstrcatW
GetPrivateProfileStringW
GetLocalTime
GetPrivateProfileIntW
GetCommandLineW
GetCurrentProcess
TerminateProcess
LocalFree
CloseHandle
WriteFile
CreateFileW
LocalAlloc
MulDiv
GlobalFree
GlobalUnlock
SetLastError
lstrcmpW
FreeResource
GlobalLock
GlobalAlloc
DecodePointer
OutputDebugStringW
CreateMutexW
FindResourceExW
LockResource
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
GetLastError
EnterCriticalSection
RaiseException
LeaveCriticalSection
lstrcmpiW
GetModuleHandleW
VerifyVersionInfoW
GetModuleHandleA
OpenProcess
GetCurrentProcessId
GetTempFileNameW
GetVersion
WaitForSingleObjectEx
ResetEvent
SetEvent
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
LoadLibraryW
SetFileTime
GetFileTime
InitializeCriticalSection
WaitForSingleObject
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
IsDebuggerPresent
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
GetProcAddress
FreeLibrary
GetEnvironmentStringsW
TerminateThread
Sleep
TlsGetValue
TlsAlloc
CreateEventW
GetCPInfo
EncodePointer
GetStringTypeW
CopyFileW
GlobalSize
CreateThread
GetProfileIntW

user32

FindWindowW
DestroyCursor
LoadStringW
LoadMenuW
LoadAcceleratorsW
UnregisterClassW
GetDC
GetDCEx
UpdateWindow
SetCapture
GetCapture
InvalidateRect
SetRect
SetCursor
PeekMessageW
SetWindowLongW
RegisterClassExW
LoadImageW
GetClassInfoExW
CreateWindowExW
GetDesktopWindow
GetWindowRect
SendMessageW
MapWindowPoints
TrackMouseEvent
SetWindowPos
GetWindowLongW
BeginPaint
EndPaint
IsClipboardFormatAvailable
RegisterClipboardFormatW
GetSysColor
SetCaretPos
CreateCaret
GetCaretBlinkTime
KillTimer
SetTimer
wsprintfW
GetMessageW
DispatchMessageW
TranslateMessage
ShowWindow
CharNextW
DefWindowProcW
ReleaseCapture
ReleaseDC
CreateDialogParamW
GetSysColorBrush
CopyRect
PtInRect
InflateRect
DrawTextW
LoadCursorW
FillRect
GetCursorPos
ScreenToClient
GetMessagePos
SystemParametersInfoW
MonitorFromRect
MonitorFromPoint
CreatePopupMenu
DestroyMenu
TrackPopupMenuEx
AppendMenuW
GetMenuItemCount
RemoveMenu
GetMenuItemInfoW
MessageBeep
TranslateAcceleratorW
PostQuitMessage
LoadStringA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
SendMessageTimeoutW
SetWindowTextW
IsRectEmpty
SetForegroundWindow
GetSystemMetrics
FindWindowExW
GetWindowTextW
GetWindowTextLengthW
CallWindowProcW
GetWindow
MonitorFromWindow
GetMonitorInfoW
MoveWindow
IsWindowVisible
IsWindow
PostMessageW
GetKeyState
DestroyWindow
GetClientRect
SetFocus
GetDlgItem
SetClassLongW
GetParent
IsIconic
ClientToScreen
SetWindowRgn
EnableWindow
GetForegroundWindow
IsZoomed
OffsetRect
SetLayeredWindowAttributes
UpdateLayeredWindow
SetRectEmpty
GetDoubleClickTime
IntersectRect
GetWindowThreadProcessId
AttachThreadInput
BringWindowToTop
SetActiveWindow
GetIconInfo
DrawIconEx
GetFocus
EqualRect

gdi32

CreateRectRgn
GetBitmapBits
SetBitmapBits
CreateDCW
StretchBlt
EnumFontFamiliesExW
CreateCompatibleBitmap
CreateFontW
CreateDIBSection
BitBlt
CreateCompatibleDC
GetDIBits
GetObjectW
GetDeviceCaps
GetPixel
SetPixel
RestoreDC
CreateSolidBrush
PatBlt
UnrealizeObject
SetROP2
SetWindowOrgEx
SetViewportOrgEx
SetMapMode
SaveDC
CreatePatternBrush
CreateBitmap
CreatePen
DeleteDC
GetStockObject
Rectangle
SelectObject
SetTextColor
SetBkMode
DeleteObject
LineTo
Polygon
MoveToEx
CreateRoundRectRgn
CombineRgn
ExtSelectClipRgn
CreateRectRgnIndirect
CreateFontIndirectW
SetStretchBltMode
SetBkColor
GetTextColor
GetCurrentObject
SetTextCharacterExtra
GetViewportOrgEx
CopyMetaFileW

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

GetUserNameW
RegQueryValueExW
GetSidIdentifierAuthority
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
GetSidSubAuthority
GetSidSubAuthorityCount
IsValidSid

shell32

SHGetFolderPathW
CommandLineToArgvW
ShellExecuteW
SHGetFolderPathA
SHCreateDirectoryExW
SHGetSpecialFolderPathW
ord165

ole32

RegisterDragDrop
RevokeDragDrop
OleSetContainedObject
OleCreateStaticFromData
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleDuplicateData
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
ReleaseStgMedium

oleaut32

SysFreeString
SysAllocString
OleLoadPicture
VarUI4FromStr
SysAllocStringByteLen
VarBstrCmp
SysAllocStringLen
LoadTypeLi
SysStringByteLen
LoadRegTypeLi
SysStringLen

shlwapi

StrCmpIW
PathAddBackslashW
PathAppendW
SHSetValueW
PathFileExistsW
PathRemoveFileSpecW
PathIsDirectoryW
PathIsRootW
StrFormatByteSizeW
PathRelativePathToW
PathCommonPrefixW
PathIsPrefixW
PathRemoveBackslashW
PathCanonicalizeW
PathCombineW
StrCpyNW
PathSearchAndQualifyW
SHGetValueW

comctl32

ord17
InitCommonControlsEx

msimg32

AlphaBlend

gdiplus

GdipCreateCustomLineCap
GdipDeleteCustomLineCap
GdipSetCustomLineCapWidthScale
GdipSetCustomLineCapStrokeCaps
GdipSetPenCustomEndCap
GdipSetPenStartCap
GdipSetPenBrushFill
GdipDrawLineI
GdipAddPathEllipseI
GdipDrawPath
GdipSetPenEndCap
GdiplusStartup
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipDisposeImage
GdipCloneImage
GdipAddPathLineI
GdipLoadImageFromStreamICM
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageRectRectI
GdipDeletePath
GdipCreatePath
GdipCloneBrush
GdipFree
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDrawString
GdipSetTextRenderingHint
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipGetImagePixelFormat
GdipDrawImageRectI
GdipGetImageGraphicsContext
GdipDeleteBrush
GdipCreateSolidFill
GdipSetSmoothingMode
GdipDeletePen
GdipCreatePen1
GdipDeleteGraphics
GdipCreateFromHDC
GdipLoadImageFromStream
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipSaveImageToFile
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSetInterpolationMode
GdipAlloc

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

crypt32

CryptBinaryToStringA
CryptBinaryToStringW
CryptStringToBinaryA
CryptStringToBinaryW

riched20

ord4

imagehlp

ImageNtHeader

wintrust

CryptCATCatalogInfoFromContext
CryptCATAdminAcquireContext
WinVerifyTrust
CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 223KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 93KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

75101bb033aa8202493b54ae1d31a5f2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

version

crypt32

riched20

imagehlp

wintrust

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 223KB - Virtual size: 223KB

.data Size: 93KB - Virtual size: 169KB

.gfids Size: 2KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 79KB - Virtual size: 78KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 223KB - Virtual size: 223KB

.data
Size: 93KB - Virtual size: 169KB

.gfids
Size: 2KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 79KB - Virtual size: 78KB