ad8f99a42ee678e87f19bc1d6439c2db30b71c83511ed60345bcdac07938f39d

Sharing

Copy URL Twitter E-mail

General

Target

ad8f99a42ee678e87f19bc1d6439c2db30b71c83511ed60345bcdac07938f39d
Size

709KB
MD5

b8a0e3f0a45f1c6c6379c80a7ee4c327
SHA1

32ad7bf080101377487159473c8dc51962a6f7be
SHA256

ad8f99a42ee678e87f19bc1d6439c2db30b71c83511ed60345bcdac07938f39d
SHA512

5078d82cc65a4394f9f1b75cc43309e19c00d01894a22fa912783ccf4c2ae22ff9a9a2cfce99d24f0929972ce88180c7da8067ab19d8a070308743b670df6386
SSDEEP

6144:gYSbc+5ITSnWFfSTPXPq1cBMPGUauP7NXBTa2HRz217o+Bu0OAUsQF:pSbc+5qSxTPEL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad8f99a42ee678e87f19bc1d6439c2db30b71c83511ed60345bcdac07938f39d

Files

ad8f99a42ee678e87f19bc1d6439c2db30b71c83511ed60345bcdac07938f39d
.exe windows:5 windows x64

63a8f778ba5bffc3980aa63b94854dac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCloseKey
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
A_SHAInit
A_SHAUpdate
A_SHAFinal
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCreateKeyExW
RegSetValueExW

comctl32

ImageList_Create
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_Remove
ord328
ord386
ord334
ord332
DrawShadowText
InitCommonControls

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
GetStockObject
PatBlt
SelectObject

wininet

InternetCloseHandle
HttpQueryInfoW
FtpGetFileSize
InternetQueryOptionA
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetSetStatusCallbackW
InternetReadFile
InternetOpenUrlW
InternetOpenW

user32

BeginPaint
SendMessageW
SetWindowTextW
BeginDeferWindowPos
IsWindow
GetCapture
EndPaint
EndDeferWindowPos
EnableMenuItem
DrawIconEx
DestroyWindow
DestroyIcon
DefWindowProcW
DeferWindowPos
CreateWindowExW
EmptyClipboard
GetClientRect
SetProcessDefaultLayout
FindWindowW
SendDlgItemMessageW
CheckRadioButton
GetWindowPlacement
TrackPopupMenu
SetMenuDefaultItem
SetForegroundWindow
SetClipboardData
PeekMessageW
OpenClipboard
MsgWaitForMultipleObjects
GetMenuItemInfoW
EnumDisplaySettingsW
EnableWindow
CallWindowProcW
DestroyMenu
CloseClipboard
SetWindowLongW
SetDlgItemTextW
MessageBoxA
InflateRect
GetWindowLongW
GetDlgItem
GetClassLongPtrW
EndDialog
DialogBoxParamW
CreateDialogParamW
TranslateMessage
TranslateAcceleratorW
SystemParametersInfoW
ShowWindow
RedrawWindow
PostQuitMessage
PostMessageW
LoadAcceleratorsW
GetMessageW
GetKeyState
GetFocus
DispatchMessageW
UpdateWindow
SetWindowPos
SetWindowLongPtrW
SetTimer
SetFocus
SetCursor
SetCapture
ScreenToClient
ReleaseDC
ReleaseCapture
RegisterClassExW
MessageBoxW
LoadMenuW
LoadImageW
LoadIconW
LoadCursorW
KillTimer
IsWindowVisible
InvalidateRect
GetWindowTextLengthW
GetWindowTextW
GetWindowRect
GetWindowLongPtrW
GetSysColorBrush
GetSysColor
GetSubMenu
GetParent
GetMenu
GetDC
GetCursorPos

shell32

SHGetPathFromIDListW
SHGetFolderPathW
StrStrIW
SHGetSpecialFolderPathW
ShellExecuteExW
SHBrowseForFolderW
CommandLineToArgvW
ShellAboutW
ShellExecuteW
ExtractIconW

shlwapi

PathAppendW
PathCanonicalizeW
PathRemoveExtensionW
PathIsURLW
StrFormatByteSizeW
StrToIntExW
StrCmpIW
PathCreateFromUrlW
StrToIntW
PathParseIconLocationW
PathIsDirectoryW
PathFileExistsW

ole32

CoUninitialize
CoTaskMemFree
CoInitializeEx

setupapi

SetupCloseInfFile
SetupFindFirstLineW
SetupOpenInfFileW
SetupGetStringFieldW
SetupFindNextLine

gdiplus

GdiplusShutdown
GdiplusStartup
GdipCreateSolidFill
GdipGetImageWidth
GdipGetImageHeight
GdipDisposeImage
GdipSetSmoothingMode
GdipFillEllipse
GdipDrawImageRect
GdipDeleteGraphics
GdipCreateFromHDC
GdipDeleteBrush
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipFree
GdipAlloc

msvcrt

strrchr
strcmp
__lconv_init
signal
_itow
_itoa
_exit
wcscpy
wcscat
raise
_snwprintf
_onexit
__dllonexit
_unlock
_lock
calloc
_wcmdln
__winitenv
_initterm
_fpreset
_cexit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__setusermatherr
??3@YAXPEAX@Z
__C_specific_handler
_vsnwprintf
_beginthreadex
_vscprintf
vsprintf
wcscspn
memset
_purecall
??2@YAPEAX_K@Z
wcscmp
wcslen
memmove
memcpy
free
malloc
vswprintf
_vscwprintf
wcstol
wcschr
wcsstr
wcsspn
realloc
sin
sqrt
floor
strlen
swprintf
_wcsicmp
wcsrchr
sprintf

kernel32

DeleteCriticalSection
GetModuleHandleExW
TlsGetValue
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
OutputDebugStringW
LoadLibraryExW
IsDebuggerPresent
Sleep
SetUnhandledExceptionFilter
GetStartupInfoW
GetConsoleMode
GetFileType
FindResourceExW
WriteConsoleW
GetConsoleOutputCP
GetUserDefaultUILanguage
GetCommandLineW
AttachConsole
AllocConsole
GetStdHandle
CreateMutexW
GetEnvironmentVariableW
GlobalUnlock
GlobalLock
GlobalAlloc
GetModuleFileNameW
CreateProcessW
LocalFree
GetModuleHandleW
GetFileAttributesW
FormatMessageW
CopyFileW
UnmapViewOfFile
MapViewOfFile
GetFileSizeEx
CreateFileMappingW
GetLocaleInfoW
GetPrivateProfileSectionW
WideCharToMultiByte
MultiByteToWideChar
SetFilePointer
ReadFile
GetProcAddress
WaitForSingleObject
SetEvent
OutputDebugStringA
CreateEventW
WriteFile
VirtualFree
VirtualAlloc
SetLastError
LoadLibraryW
LeaveCriticalSection
GetTempFileNameW
GetCurrentThreadId
GetCurrentProcess
FreeLibrary
FlushInstructionCache
EnterCriticalSection
CreateFileW
CloseHandle
GetUserDefaultLCID
GetDateFormatW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExpandEnvironmentStringsW
SizeofResource
RemoveDirectoryW
RaiseException
LockResource
LoadResource
InitializeCriticalSection
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
GetLastError
FindResourceW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CreateDirectoryW
HeapSize

ntdll

DbgPrint

Sections

.text
Size: 159KB - Virtual size: 159KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

ATL
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 511KB - Virtual size: 510KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63a8f778ba5bffc3980aa63b94854dac

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

comctl32

gdi32

wininet

user32

shell32

shlwapi

ole32

setupapi

gdiplus

msvcrt

kernel32

ntdll

Sections

.text Size: 159KB - Virtual size: 159KB

.rdata Size: 25KB - Virtual size: 24KB

.data Size: 1KB - Virtual size: 14KB

.pdata Size: 10KB - Virtual size: 9KB

ATL Size: 512B - Virtual size: 16B

.rsrc Size: 511KB - Virtual size: 510KB

.reloc Size: 512B - Virtual size: 472B

.text
Size: 159KB - Virtual size: 159KB

.rdata
Size: 25KB - Virtual size: 24KB

.data
Size: 1KB - Virtual size: 14KB

.pdata
Size: 10KB - Virtual size: 9KB

ATL
Size: 512B - Virtual size: 16B

.rsrc
Size: 511KB - Virtual size: 510KB

.reloc
Size: 512B - Virtual size: 472B