6f78f9a2683aebfff4ce9c9b8db7526b7af14fd81f18228ae45e46ac08c1517c

Sharing

Copy URL Twitter E-mail

General

Target

6f78f9a2683aebfff4ce9c9b8db7526b7af14fd81f18228ae45e46ac08c1517c
Size

13.0MB
MD5

7c37ac03cdafa048c7119eda4496aa45
SHA1

1b1d4ddac2277a1cb313537ba1573624646af0ba
SHA256

6f78f9a2683aebfff4ce9c9b8db7526b7af14fd81f18228ae45e46ac08c1517c
SHA512

335d0feec0e78f50599d73012c7a728cd5762a83124933002017a724692d8557f6508e9000a3474cdf329c80f8a113428487c9c4071035426bf6e3ac0fcb5f62
SSDEEP

196608:Uaks73Z3JbV31+Ri5Zx3GY7a/lJsv6tWKFdu9CjNBc:UarR31+Ri5b3n7a/lJsv6tWKFdu9Cfc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6f78f9a2683aebfff4ce9c9b8db7526b7af14fd81f18228ae45e46ac08c1517c

Files

6f78f9a2683aebfff4ce9c9b8db7526b7af14fd81f18228ae45e46ac08c1517c
.exe windows:5 windows x86

17522c59aa6ce37fae9dbb91c337ea43

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

SetupDiEnumDeviceInfo
CM_Get_Device_IDW
SetupDiOpenDevRegKey
CM_Get_Parent
CM_Get_Device_IDA
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
CM_Get_DevNode_Status

iphlpapi

GetNetworkParams
GetAdaptersAddresses
GetAdaptersInfo

advapi32

OpenProcessToken
RegDeleteValueW
RegEnumKeyExW
RegFlushKey
RegQueryInfoKeyW
RegSetValueExW
GetTokenInformation
FreeSid
GetLengthSid
CopySid
RegCreateKeyExW
CryptEnumProvidersA
CryptSignHashA
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
RegCloseKey
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW
RegNotifyChangeKeyValue
SystemFunction036
DeregisterEventSource
RegisterEventSourceA
ReportEventA
CryptAcquireContextA
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
RegDeleteKeyW

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateContext
CertCreateCertificateContext
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

kernel32

WaitForMultipleObjects
CreateEventW
SetHandleInformation
LocalFree
GetNativeSystemInfo
FormatMessageW
CompareStringW
GetUserDefaultLCID
GetCurrentProcessId
GetCommandLineW
OutputDebugStringW
GetConsoleWindow
GetSystemTime
GetLocalTime
GetCurrentProcess
RaiseException
SwitchToThread
CreateThread
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
GetThreadPriority
TerminateThread
ResumeThread
SetEvent
WaitForSingleObject
DuplicateHandle
GetSystemInfo
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
WaitForSingleObjectEx
ResetEvent
GetTickCount
QueryPerformanceCounter
QueryPerformanceFrequency
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
ReleaseSemaphore
ReleaseMutex
CreateMutexW
CreateSemaphoreW
GetSystemDirectoryW
GetModuleFileNameW
GetStartupInfoW
GetFileAttributesExW
GetLongPathNameW
SetErrorMode
GetLogicalDrives
GetFileInformationByHandle
FindClose
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetTempPathW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
RemoveDirectoryW
CancelIo
GetFileAttributesW
DeleteFileW
FindFirstFileW
CopyFileW
MoveFileW
GetFileType
FlushFileBuffers
SetEndOfFile
SetFilePointerEx
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
MoveFileExW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetCurrencyFormatW
GetUserDefaultUILanguage
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetModuleHandleExW
GlobalFree
FindNextFileW
GetTimeZoneInformation
GetGeoInfoW
GetUserGeoID
OpenProcess
LoadLibraryA
ReadConsoleInputW
GetNumberOfConsoleInputEvents
SetConsoleMode
GetConsoleCP
PeekNamedPipe
VirtualQuery
FlushConsoleInputBuffer
GlobalMemoryStatus
FindNextFileA
FindFirstFileA
GetModuleHandleA
SystemTimeToFileTime
GetStringTypeW
HeapQueryInformation
HeapSize
HeapReAlloc
HeapFree
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
GetOEMCP
GetACP
IsValidCodePage
GetFileSizeEx
GetCPInfo
DecodePointer
SetEnvironmentVariableW
SetConsoleCtrlHandler
EnumSystemLocalesW
IsValidLocale
LCMapStringW
HeapValidate
HeapAlloc
GetDriveTypeW
SetStdHandle
SetFileAttributesW
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
FreeLibraryAndExitThread
ExitThread
WriteConsoleW
GetStdHandle
ExitProcess
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
RtlUnwind
LoadLibraryExW
WaitCommEvent
SetCommTimeouts
SetCommState
SetCommMask
SetCommBreak
PurgeComm
GetCommTimeouts
GetCommState
GetCommModemStatus
EscapeCommFunction
ClearCommError
ClearCommBreak
ReadFile
WriteFile
Sleep
QueryDosDeviceA
DeviceIoControl
GetLastError
CloseHandle
CreateFileW
CreateFileA
AttachConsole
GetModuleHandleW
LoadLibraryW
FindFirstFileExW
GetProcAddress
SetLastError
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
VirtualAlloc
GetFullPathNameW
GetCommandLineA
EncodePointer
InterlockedFlushSList
InterlockedPushEntrySList
PeekConsoleInputA

shell32

CommandLineToArgvW
SHGetSpecialFolderPathW

ole32

CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoFreeUnusedLibraries
CoUninitialize
CoCreateGuid
CoTaskMemFree
CoInitialize

ws2_32

gethostname
WSASendTo
WSASend
WSARecvFrom
WSARecv
WSANtohs
WSANtohl
WSAIoctl
WSAHtonl
WSAConnect
WSAAccept
setsockopt
select
listen
htons
getsockname
getpeername
closesocket
bind
WSAGetLastError
gethostbyname
gethostbyaddr
ntohl
inet_addr
getsockopt
htonl
WSAStartup
WSACleanup
WSAAsyncSelect
WSASocketW
WSASetLastError
shutdown
recv
send
__WSAFDIsSet

oleaut32

CreateErrorInfo
SetErrorInfo
VariantChangeType
GetErrorInfo
SysFreeString
SysAllocString
VariantClear
VariantInit

gdi32

GetDeviceCaps
GetDIBits
GetObjectA
DeleteObject
CreateCompatibleBitmap

user32

MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
CharNextExA
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowLongW
GetWindowLongW
KillTimer
GetDC
MsgWaitForMultipleObjectsEx
GetQueueStatus
DestroyWindow
CreateWindowExW
UnregisterClassW
RegisterClassW
DefWindowProcW
PostMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
ReleaseDC
SetTimer

wintrust

WinVerifyTrust

Sections

.text
Size: 8.1MB - Virtual size: 8.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmetad
Size: 1024B - Virtual size: 881B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 782B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 271KB - Virtual size: 270KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

17522c59aa6ce37fae9dbb91c337ea43

Headers

DLL Characteristics

File Characteristics

Imports

setupapi

iphlpapi

advapi32

crypt32

kernel32

shell32

ole32

ws2_32

oleaut32

gdi32

user32

wintrust

Sections

.text Size: 8.1MB - Virtual size: 8.1MB

.rdata Size: 4.5MB - Virtual size: 4.5MB

.data Size: 72KB - Virtual size: 123KB

.idata Size: 11KB - Virtual size: 10KB

.qtmetad Size: 1024B - Virtual size: 881B

.tls Size: 1024B - Virtual size: 782B

.00cfg Size: 512B - Virtual size: 260B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 271KB - Virtual size: 270KB

.text
Size: 8.1MB - Virtual size: 8.1MB

.rdata
Size: 4.5MB - Virtual size: 4.5MB

.data
Size: 72KB - Virtual size: 123KB

.idata
Size: 11KB - Virtual size: 10KB

.qtmetad
Size: 1024B - Virtual size: 881B

.tls
Size: 1024B - Virtual size: 782B

.00cfg
Size: 512B - Virtual size: 260B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 271KB - Virtual size: 270KB