ca9d747998f4ae146ee34eceb839cdedc9fa4ccab51064c882308826be203930

Sharing

Copy URL Twitter E-mail

General

Target

ca9d747998f4ae146ee34eceb839cdedc9fa4ccab51064c882308826be203930
Size

11.1MB
MD5

10c0ba2a8d598bbf7cc2c2b288e61d29
SHA1

314410cea9498d3721ade2f4bc2ec43076856596
SHA256

ca9d747998f4ae146ee34eceb839cdedc9fa4ccab51064c882308826be203930
SHA512

2916bcc354ab6263f61caa30858b781295685ff28f94ec04f190426f07efb8efe5d604dabe16f1c3dea593c04ad2b58b36af88d0eb0b91b5d1e9fd395aa7b18a
SSDEEP

196608:W3p0JyGuOtKOZsBGwpdVsjzWgtrSvrXiad2IidN/OMvLY8RXX8/hI01e6d:WOvuOtKOZVfjz1cr9IIidN/OMv/XX8/1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ca9d747998f4ae146ee34eceb839cdedc9fa4ccab51064c882308826be203930

Files

ca9d747998f4ae146ee34eceb839cdedc9fa4ccab51064c882308826be203930
.exe windows:5 windows x86

b903c43e073b21e0dc13612d263e1135

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

devil

ilLoadL
ilOriginFunc
ilSaveL
ilTexImage
ilGetInteger
ilSave
ilBindImage
ilGenImages
ilGetData
ilEnable
ilInit
ilDeleteImages
ilLoadImage

ilut

ilutConvertToHBitmap
ilutInit

imagehlp

StackWalk
GetTimestampForLoadedLibrary

wsock32

winmm

mmioGetInfo
mmioSetInfo
mmioAdvance
mmioDescend
mmioAscend
mmioSeek
timeGetTime
mixerClose
mmioRead
mmioClose
mmioOpenA

imm32

ImmSetCompositionWindow
ImmNotifyIME
ImmGetContext
ImmSetCandidateWindow
ImmReleaseContext
ImmGetCompositionStringA
ImmGetCandidateListA
ImmSetConversionStatus
ImmSetOpenStatus

wke

jsStringW
jsUndefined
jsFalse
jsTrue
wkeSetUserAgent
wkeSetFileSystem
wkeCreateWebView
wkeDestroyWebView
jsBindFunction
jsArg
jsToInt
jsToStringW
jsInt
wkeInit
wkeShutdown

kernel32

ReadFile
DeviceIoControl
CreatePipe
CreateProcessA
GetCurrentProcessId
Sleep
CreateThread
TerminateThread
GetTickCount
GetLastError
OutputDebugStringA
DecodePointer
InterlockedExchange
GlobalAlloc
GlobalSize
GlobalLock
GlobalUnlock
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
GetNativeSystemInfo
FindFirstFileA
FindNextFileA
IsWow64Process
ReleaseMutex
CreateMutexA
CopyFileA
SetThreadLocale
GetLogicalDriveStringsA
GetDriveTypeA
GetDiskFreeSpaceExA
FindClose
MoveFileA
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
InterlockedDecrement
GetCurrentDirectoryA
CreateDirectoryA
GetFileSize
SetEndOfFile
SetFilePointer
WriteFile
QueryPerformanceCounter
SetEvent
WaitForSingleObject
CreateEventA
OpenEventA
ExitProcess
GetExitCodeProcess
GetCurrentThreadId
SetThreadPriority
ResumeThread
GetLocalTime
GetSystemDirectoryA
VirtualQuery
FreeLibrary
GetModuleFileNameW
WaitForMultipleObjects
lstrcatA
OpenMutexA
MoveFileExA
IsBadReadPtr
lstrcpyA
GetStdHandle
SetStdHandle
DuplicateHandle
PeekNamedPipe
Process32Next
RemoveDirectoryA
GetComputerNameA
SystemTimeToFileTime
SetCurrentDirectoryA
FlushFileBuffers
GetFileInformationByHandle
GetFileType
FileTimeToDosDateTime
FileTimeToSystemTime
GetWindowsDirectoryA
GetSystemInfo
GetModuleHandleW
GlobalMemoryStatus
GetLocaleInfoA
SetLastError
SleepEx
FormatMessageA
ExpandEnvironmentStringsA
Process32First
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
Module32Next
ResetEvent
Module32First
GlobalHandle
GlobalReAlloc
WinExec
GetCurrentThread
SetUnhandledExceptionFilter
GetCurrentProcess
WriteConsoleW
CreateDirectoryW
FindFirstFileExA
GetCommandLineW
GetCommandLineA
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
GetCPInfo
SetFileAttributesW
MoveFileExW
DeleteFileW
GetVersionExA
CreateFileA
GetModuleHandleA
GetModuleFileNameA
LoadLibraryA
OpenFileMappingA
CreateFileMappingA
lstrlenA
lstrcpynA
VirtualProtect
VirtualFree
VirtualAlloc
GetProcAddress
DeleteFileA
IsDBCSLeadByte
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetCurrentDirectoryW
GetStringTypeW
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetACP
SetFilePointerEx
SystemTimeToTzSpecificLocalTime
GetFileAttributesExW
UnmapViewOfFile
MapViewOfFile
CloseHandle
DeleteCriticalSection
GetTimeZoneInformation
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
QueryPerformanceFrequency
GetFullPathNameA
GetFullPathNameW
GetDriveTypeW
LeaveCriticalSection
EnterCriticalSection
CreateFileW
WaitForSingleObjectEx
CreateEventW
LoadLibraryExW
UnhandledExceptionFilter
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
EncodePointer
LocalFree
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
InitializeCriticalSection
GetSystemTimeAsFileTime
CreateEventA
GetModuleFileNameW
GetModuleHandleA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetModuleHandleW
LoadResource
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
WriteConsoleW
SetStdHandle
IsProcessorFeaturePresent
DecodePointer
GetCommandLineA
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
RaiseException
LCMapStringW
GetStringTypeW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapSize
WriteFile
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetActiveWindow
DrawIcon
LoadImageA
GetDesktopWindow
SetWindowTextA
AdjustWindowRectEx
GetWindowRect
GetMenu
ClientToScreen
DefWindowProcA
InvalidateRect
LoadIconA
TranslateAcceleratorA
wsprintfA
ShowWindow
RegisterClassExA
CreateWindowExA
DestroyWindow
GetWindowTextA
UnregisterClassA
SetRect
LoadAcceleratorsA
GetSystemMetrics
RegisterClassW
PeekMessageA
MessageBoxA
DispatchMessageA
TranslateMessage
GetCursorPos
SetWindowLongA
GetWindowLongA
GetClientRect
UpdateWindow
MoveWindow
GetDC
ReleaseDC
LoadCursorA
DestroyCursor
CopyIcon
GetIconInfo
GetCursorInfo
GetKeyboardLayoutNameA
SetCursor
SetFocus
PostMessageA
MessageBoxW
DefWindowProcW
ScreenToClient
OpenClipboard
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
keybd_event
CharUpperBuffW

gdi32

GetDeviceCaps
TextOutA
BitBlt
StretchBlt
SetPixel
GetStockObject
SetBkMode
CreateFontA
GetObjectA
CreateDIBSection
SelectObject
CreateCompatibleDC
DeleteObject
DeleteDC
SetTextColor

advapi32

CryptDeriveKey
RegCreateKeyA
RegOpenKeyExA
SystemFunction036
RegQueryValueExA
RegSetValueExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCreateKeyExA
RegDeleteValueA
RegEnumValueA
CryptAcquireContextA
CryptReleaseContext
CryptDestroyKey
CryptImportKey
CryptEncrypt
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptVerifySignatureA
GetUserNameA
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

shell32

ShellExecuteA
SHGetSpecialFolderPathA

ole32

CoGetClassObject
CoCreateInstance
CoSetProxyBlanket
CoUninitialize
CreateStreamOnHGlobal
GetHGlobalFromStream
CoInitialize
CoInitializeSecurity
CoInitializeEx
OleSetContainedObject
OleUninitialize
OleInitialize

oleaut32

gdiplus

GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipSaveImageToStream
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdipFree
GdipAlloc
GdiplusStartup

soundsystem

ELSS_SetStreamOff
ELSS_Cleanup
ELSS_CloseStream
ELSS_PlayStreamLoop
ELSS_CloseAllSamples
ELSS_SetStreamOn
ELSS_Startup
ELSS_InitRedistPathz
ELSS_OpenStream

iphlpapi

GetAdaptersInfo
GetNetworkParams

netapi32

NetApiBufferFree
NetWkstaGetInfo
Netbios

wldap32

wininet

InternetCloseHandle

ddraw

DirectDrawCreateEx

dsound

dinput8

DirectInput8Create

ws2_32

WSASend
freeaddrinfo
getaddrinfo

comdlg32

GetOpenFileNameA

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 168KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Ry4
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Ou$
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.KD"
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.l1
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b903c43e073b21e0dc13612d263e1135

Headers

DLL Characteristics

File Characteristics

Imports

devil

ilut

imagehlp

wsock32

winmm

imm32

wke

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

soundsystem

iphlpapi

netapi32

wldap32

wininet

ddraw

dsound

dinput8

ws2_32

comdlg32

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 168KB - Virtual size: 168KB

.data Size: 1.4MB - Virtual size: 1.4MB

Shared Size: 4KB - Virtual size: 4KB

.tls Size: 4KB - Virtual size: 4KB

.Ry4 Size: 2.8MB - Virtual size: 2.8MB

.Ou$ Size: 4KB - Virtual size: 4KB

.KD" Size: 5.4MB - Virtual size: 5.4MB

.rsrc Size: 1KB - Virtual size: 1KB

.l1 Size: 21KB - Virtual size: 21KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 168KB - Virtual size: 168KB

.data
Size: 1.4MB - Virtual size: 1.4MB

Shared
Size: 4KB - Virtual size: 4KB

.tls
Size: 4KB - Virtual size: 4KB

.Ry4
Size: 2.8MB - Virtual size: 2.8MB

.Ou$
Size: 4KB - Virtual size: 4KB

.KD"
Size: 5.4MB - Virtual size: 5.4MB

.rsrc
Size: 1KB - Virtual size: 1KB

.l1
Size: 21KB - Virtual size: 21KB