f22837fee4e613f371e42ea4d48f6c421c21d2e742270b978be409cc3218d91a

Sharing

Copy URL Twitter E-mail

General

Target

f22837fee4e613f371e42ea4d48f6c421c21d2e742270b978be409cc3218d91a
Size

5.5MB
MD5

934f96221d7b15466b0dd87f01e692ad
SHA1

e9f41039a81af30e75868a454c63e61bb49e7e26
SHA256

f22837fee4e613f371e42ea4d48f6c421c21d2e742270b978be409cc3218d91a
SHA512

d9036a0ff6964948670031185378f88cae77cb34b5a6852ce6ef0f2505633f84e51f0ebece47b88193bd053e205c4583829211b0306eb31bea776463a2b4f8d2
SSDEEP

49152:7ZVwASOJGtlqWpIU6iHC6ry+SrYcyZTxhXtIuaspKV+J/0XaCABjziylyQ4D9US8:AO+dmGHueBjzieaUYIjZ3vIxFPTTDqx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f22837fee4e613f371e42ea4d48f6c421c21d2e742270b978be409cc3218d91a

Files

f22837fee4e613f371e42ea4d48f6c421c21d2e742270b978be409cc3218d91a
.exe windows:6 windows x64

f0510be827693e3f46961fbda501da50

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

WSAGetLastError
ioctlsocket
inet_pton
listen
recv
recvfrom
select
send
sendto
shutdown
socket
gethostbyaddr
gethostbyname
WSAStartup
WSACleanup
connect
closesocket
bind
accept
__WSAFDIsSet
getnameinfo
freeaddrinfo
getaddrinfo
gethostname
setsockopt
inet_ntoa
htonl
getsockname
getsockopt
ntohs
WSASetLastError
getpeername

kernel32

CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
VirtualQuery
FindClose
FindFirstFileA
FindNextFileA
CopyFileA
MultiByteToWideChar
WideCharToMultiByte
DecodePointer
RaiseException
GetLastError
SetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
SetConsoleOutputCP
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount64
AllocConsole
GetConsoleWindow
FreeLibrary
GetModuleFileNameA
GetProcAddress
LoadLibraryExA
FormatMessageA
Sleep
GetSystemTimeAsFileTime
MoveFileExW
DeleteFileW
GetFileAttributesExW
SetFileAttributesW
GetFileAttributesW
CreateFileW
GetFileType
WriteFile
CloseHandle
AcquireSRWLockExclusive
CreateEventExW
GetFileSizeEx
GetFileTime
ReadFile
SetFilePointerEx
GetSystemTime
SystemTimeToFileTime
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
FindFirstFileW
FindNextFileW
GetModuleHandleExW
FormatMessageW
GetStdHandle
GetEnvironmentVariableW
GetModuleHandleW
ConvertFiberToThread
ConvertThreadToFiber
GetCurrentProcessId
RtlVirtualUnwind
LoadLibraryA
LoadLibraryW
GetCurrentProcess
TerminateProcess
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetFileInformationByHandleEx
CreateSymbolicLinkW
EncodePointer
CompareStringEx
GetCPInfo
WaitForSingleObjectEx
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
IsDebuggerPresent
OutputDebugStringW
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
SetEvent
ResetEvent
CreateEventW
GetStartupInfoW
InitializeConditionVariable
ReleaseSRWLockExclusive
InitOnceExecuteOnce
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetFileInformationByHandle
SleepConditionVariableSRW
SleepConditionVariableCS
WakeConditionVariable
WakeAllConditionVariable
LocalFree
TryEnterCriticalSection
InitializeSRWLock
GetNativeSystemInfo
GetExitCodeThread
SwitchToThread
GetTickCount
InitializeSListHead

user32

LoadIconW
GetProcessWindowStation
GetUserObjectInformationW
LoadCursorW
GetDesktopWindow
MessageBoxW
GetWindowRect
SetWindowTextW
EndPaint
BeginPaint
UpdateWindow
TranslateAcceleratorW
LoadAcceleratorsW
EnableWindow
ShowWindow
RegisterClassExW
PostQuitMessage
DefWindowProcW
DispatchMessageW
TranslateMessage
GetMessageW
LoadStringW
UnregisterClassW
CreateWindowExW

gdi32

GetObjectW
SetDIBColorTable
CreateDIBSection
SetPixel
SelectObject
GetPixel
DeleteObject
DeleteDC
CreateCompatibleDC

comdlg32

GetOpenFileNameW

advapi32

CryptReleaseContext
ReportEventW
RegisterEventSourceW
DeregisterEventSource
GetSecurityInfo
CryptGenRandom
CryptAcquireContextW

shell32

SHGetPathFromIDListW
SHBrowseForFolderW

ole32

CoCreateGuid

shlwapi

PathFindExtensionW

gdiplus

GdipCreateBitmapFromFileICM
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipBitmapLockBits
GdipGetImagePaletteSize
GdipDeleteGraphics
GdipDrawImageI
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromFile
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipSaveImageToFile
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipBitmapUnlockBits

bcrypt

BCryptGenRandom
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptDestroyKey
BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptDeriveKeyPBKDF2

vcruntime140d

strstr
memcmp
__std_type_info_destroy_list
__vcrt_LoadLibraryExW
__vcrt_GetModuleHandleW
__vcrt_GetModuleFileNameW
__current_exception_context
__current_exception
__intrinsic_setjmp
__C_specific_handler_noexcept
__C_specific_handler
__uncaught_exception
wcsstr
strrchr
longjmp
__RTDynamicCast
memcpy
memmove
memset
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memchr
_purecall
strchr

vcruntime140_1d

__CxxFrameHandler4

ucrtbased

wmemcpy_s
_free_dbg
_malloc_dbg
_resetstkoflw
_wassert
terminate
_ftime64
_beginthreadex
sqrtf
cosf
sinf
__stdio_common_vfprintf
powf
sin
logf
srand
rand
tanf
acos
cos
acosf
ceilf
_calloc_dbg
__stdio_common_vsscanf
strcspn
abs
pow
frexp
ldexp
strtof
strtod
isalnum
toupper
tolower
localeconv
_getcwd
freopen_s
feof
ferror
freopen
getc
strerror
strncmp
strpbrk
strspn
floor
_time64
abort
strcoll
fmod
isdigit
clock
isxdigit
isspace
clearerr
_ftelli64
_pclose
_popen
tmpfile
exit
getenv
system
_difftime64
_gmtime64
_localtime64
_mktime64
strftime
rename
tmpnam
isalpha
isupper
islower
ispunct
isgraph
iscntrl
asin
atan2
ceil
cosh
exp
log
log10
sinh
sqrt
tan
__stdio_common_vsprintf_s
fgets
strtol
strncpy
_dclass
strtoll
_stricmp
_strdup
_wcsdup
qsort
_strnicmp
strerror_s
_stat64i32
_fileno
_setmode
strtoul
_gmtime64_s
_exit
raise
_wfopen
fputs
signal
_lock_locales
_unlock_locales
___lc_locale_name_func
___lc_collate_cp_func
_wcsdup_dbg
__pctype_func
___lc_codepage_func
_wfsopen
_fsopen
_endthreadex
___mb_cur_max_func
_realloc_dbg
__strncnt
_Getdays
_Getmonths
_W_Getdays
_W_Getmonths
_W_Gettnames
_Wcsftime
_Gettnames
_Strftime
wcsnlen
_callnewh
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
strcpy_s
strcat_s
_seh_filter_exe
_set_app_type
__setusermatherr
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
_set_fmode
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
_wmakepath_s
_wsplitpath_s
__stdio_common_vfprintf_s
setlocale
_CrtDbgReport
_findnext64i32
_findfirst64i32
remove
_findclose
_access
_rmdir
_mkdir
wcstombs
mbstowcs
strlen
strcmp
wcslen
_invalid_parameter
_unlock_file
_lock_file
ungetc
setvbuf
fwrite
ftell
_fseeki64
fseek
fsetpos
fread
fputc
fopen
fgetpos
fgetc
fflush
fclose
_get_stream_buffer_pointers
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf_s
__stdio_common_vswprintf
__acrt_iob_func
atoi
_recalloc
realloc
malloc
free
calloc
atan2f
asinf
atof
fabs
labs
_wcsicmp
wcsspn
wcscspn
_CrtDbgReportW
_errno
_invalid_parameter_noinfo
tanh
__stdio_common_vsprintf
wcscpy_s

Exports

Exports

LZ4_compress
LZ4_compressBound
LZ4_compress_continue
LZ4_compress_default
LZ4_compress_destSize
LZ4_compress_fast
LZ4_compress_fast_continue
LZ4_compress_fast_extState
LZ4_compress_limitedOutput
LZ4_compress_limitedOutput_continue
LZ4_compress_limitedOutput_withState
LZ4_compress_withState
LZ4_create
LZ4_createStream
LZ4_createStreamDecode
LZ4_decoderRingBufferSize
LZ4_decompress_fast
LZ4_decompress_fast_continue
LZ4_decompress_fast_usingDict
LZ4_decompress_fast_withPrefix64k
LZ4_decompress_safe
LZ4_decompress_safe_continue
LZ4_decompress_safe_partial
LZ4_decompress_safe_usingDict
LZ4_decompress_safe_withPrefix64k
LZ4_freeStream
LZ4_freeStreamDecode
LZ4_initStream
LZ4_loadDict
LZ4_resetStream
LZ4_resetStreamState
LZ4_resetStream_fast
LZ4_saveDict
LZ4_setStreamDecode
LZ4_sizeofState
LZ4_sizeofStreamState
LZ4_slideInputBuffer
LZ4_uncompress
LZ4_uncompress_unknownOutputSize
LZ4_versionNumber
LZ4_versionString
lsec_get_ssl_options
luaopen_cjson
luaopen_cjson_safe
luaopen_mime_core
luaopen_socket_core
luaopen_ssl
luaopen_ssl_config
luaopen_ssl_context
luaopen_ssl_core
luaopen_ssl_x509

Sections

.text
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 671KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 249KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f0510be827693e3f46961fbda501da50

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

shlwapi

gdiplus

bcrypt

vcruntime140d

vcruntime140_1d

ucrtbased

Exports

Exports

Sections

.text Size: 3.9MB - Virtual size: 3.9MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 60KB - Virtual size: 671KB

.pdata Size: 249KB - Virtual size: 248KB

.msvcjmc Size: 3KB - Virtual size: 2KB

.rsrc Size: 84KB - Virtual size: 84KB

.reloc Size: 34KB - Virtual size: 34KB

.text
Size: 3.9MB - Virtual size: 3.9MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 60KB - Virtual size: 671KB

.pdata
Size: 249KB - Virtual size: 248KB

.msvcjmc
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 84KB - Virtual size: 84KB

.reloc
Size: 34KB - Virtual size: 34KB