6222eedd254bf862f8e34af33d43403fbc5cf5ac0c08f381b953923ed490b18b

Sharing

Copy URL Twitter E-mail

General

Target

6222eedd254bf862f8e34af33d43403fbc5cf5ac0c08f381b953923ed490b18b
Size

3.1MB
MD5

8541b55b986f841cfdde7faee350adc4
SHA1

7d3df91ec080ecb57b8caab81e365ad1d43bf79f
SHA256

6222eedd254bf862f8e34af33d43403fbc5cf5ac0c08f381b953923ed490b18b
SHA512

3bfb85debec582e59e3bdc075565c41a5b1fb6ba2a8e2f0740cb46bbfcbeb1ee208307f3963a7d286ef7b16a5071e74af47ed8c7517a825adb324f3b0bc0094b
SSDEEP

49152:HqXDfcRw6sGgdLMvpR1T5MJ6Km4tZlhMQz8kMXeFleU5buRo++j8sMgaxVL:KX7cRw6m9hMkoerzco+yM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6222eedd254bf862f8e34af33d43403fbc5cf5ac0c08f381b953923ed490b18b

Files

6222eedd254bf862f8e34af33d43403fbc5cf5ac0c08f381b953923ed490b18b
.exe windows:6 windows x86

57336e4e6b93de8064a4c3b1f2af0752

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
VerQueryValueW

ws2_32

WSASendTo
shutdown
WSARecvFrom
bind
WSAIoctl
WSASend
listen
setsockopt
inet_ntoa
WSASocketA
WSARecv
WSAStringToAddressA
inet_pton
gethostbyname
getsockname
WSACleanup
__WSAFDIsSet
closesocket
select
WSAStartup
inet_addr
send
socket
ntohs
connect
recv
WSAGetLastError
ioctlsocket
htons

iphlpapi

IcmpCreateFile
GetAdaptersInfo
IcmpSendEcho

dnsapi

DnsFree
DnsQuery_W

kernel32

lstrcmpiW
GetProcessTimes
ReadFile
WriteFile
SetFilePointer
CreateFileW
UnmapViewOfFile
CreateFileA
FreeLibrary
CreateDirectoryA
MapViewOfFile
GetModuleFileNameA
WritePrivateProfileStringW
GetPrivateProfileStringW
WritePrivateProfileStringA
GetPrivateProfileStringA
GetCurrentProcess
InitializeCriticalSection
GetCurrentThreadId
GetCurrentThread
SetUnhandledExceptionFilter
lstrlenW
SetLastError
GetTickCount
GetComputerNameA
CreateFileMappingW
GlobalFree
DeleteFileW
CreateDirectoryW
SetErrorMode
GetErrorMode
GetSystemTimeAsFileTime
FreeResource
GetCurrentDirectoryW
GetACP
MulDiv
CreateWaitableTimerW
SetWaitableTimer
GetVersionExW
DuplicateHandle
SystemTimeToFileTime
GetFileType
DosDateTimeToFileTime
AreFileApisANSI
ReleaseSemaphore
CreateSemaphoreW
DeleteFileA
GetFileSize
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
CreateEventA
SetEndOfFile
GetExitCodeProcess
GetSystemInfo
GetModuleHandleA
LoadLibraryA
OutputDebugStringW
GetTempPathA
GetVersionExA
DeviceIoControl
CancelIo
GetOverlappedResult
Process32First
Process32Next
GetLongPathNameA
HeapCreate
VirtualProtect
Thread32Next
Thread32First
SuspendThread
ResumeThread
GetThreadContext
FlushInstructionCache
SetThreadContext
OpenThread
VirtualFree
VirtualAlloc
VirtualQuery
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
WideCharToMultiByte
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
QueryPerformanceCounter
GetStringTypeW
EncodePointer
GetExitCodeThread
WaitForSingleObjectEx
TryEnterCriticalSection
GetProcAddress
FileTimeToLocalFileTime
Process32FirstW
FileTimeToSystemTime
GetLocalTime
ResetEvent
LoadLibraryW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
OutputDebugStringA
CreateProcessW
FindResourceW
LoadResource
FindResourceExW
LockResource
MultiByteToWideChar
WaitForSingleObject
GetModuleFileNameW
SizeofResource
LocalFree
GetCommandLineW
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
HeapFree
CreateProcessA
GetModuleHandleW
GetCurrentProcessId
CloseHandle
SetEvent
Sleep
CreateEventW
WaitForMultipleObjects
TerminateProcess
QueryDepthSList
UnregisterWaitEx
RtlUnwind
ExitThread
GetModuleHandleExW
FindClose
FindFirstFileExW
FindNextFileW
SystemTimeToTzSpecificLocalTime
ExitProcess
Process32NextW
GetStdHandle
GetDateFormatW
CreateToolhelp32Snapshot
GetTimeFormatW
IsValidLocale
OpenProcess
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
GetFileAttributesExW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
SetStdHandle
ReadConsoleW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
GetSystemDirectoryA

user32

LoadImageW
EnableWindow
GetDesktopWindow
ReleaseCapture
SetCapture
GetFocus
PeekMessageW
MsgWaitForMultipleObjects
InflateRect
MapWindowPoints
GetDC
IsRectEmpty
GetUpdateRect
EndPaint
BeginPaint
SetFocus
GetWindow
GetKeyState
MessageBoxW
EnumThreadWindows
IntersectRect
wvsprintfW
SetCursor
LoadCursorW
CreateCaret
ShowCaret
HideCaret
SetCaretPos
GetSysColor
GetCaretPos
EnumChildWindows
GetGUIThreadInfo
MoveWindow
MonitorFromPoint
ReleaseDC
GetWindowRgn
FillRect
GetMonitorInfoW
SetWindowLongW
TranslateMessage
SetRect
CharPrevW
EqualRect
SetWindowTextW
GetWindowTextLengthW
InvalidateRgn
GetCaretBlinkTime
GetClassInfoExW
CallWindowProcW
SetPropW
GetPropW
OffsetRect
CharNextW
DispatchMessageW
IsWindow
RegisterClassExW
CreateWindowExW
DestroyWindow
PostMessageW
DefWindowProcW
IsWindowEnabled
SetWindowRgn
IsZoomed
GetClientRect
MonitorFromWindow
GetSystemMetrics
LoadStringW
GetMessageW
GetWindowLongW
UpdateLayeredWindow
DrawTextW
MessageBoxA
GetParent
GetCursorPos
ScreenToClient
IsIconic
ShowWindow
SendMessageW
LoadStringA
IsWindowVisible
InvalidateRect
SetForegroundWindow
PtInRect
PostQuitMessage
KillTimer
AppendMenuW
DestroyMenu
ClientToScreen
SetTimer
TrackPopupMenu
CreatePopupMenu
GetWindowRect
LoadIconW
wsprintfW
GetForegroundWindow
AttachThreadInput
SetWindowPos
GetWindowThreadProcessId
GetWindowTextW
SystemParametersInfoW
GetClassNameW
EnumWindows
RegisterClassW

gdi32

SetStretchBltMode
CreatePenIndirect
StretchBlt
ExtSelectClipRgn
SelectClipRgn
MoveToEx
LineTo
CreateRectRgnIndirect
GetClipBox
SetWorldTransform
SetGraphicsMode
TextOutW
GetTextExtentPoint32W
GetCharABCWidthsW
SetBkColor
SetTextColor
SetBkMode
GetObjectA
SetPixel
PtInRegion
CombineRgn
GetPixel
CreateDIBSection
DeleteObject
CreateRoundRectRgn
CreateSolidBrush
CreateRectRgn
CreatePen
SelectObject
GetStockObject
Rectangle
SaveDC
BitBlt
SetWindowOrgEx
RestoreDC
GetTextMetricsW
GetObjectW
GetDeviceCaps
CreateFontIndirectW
GetCurrentObject
CreateCompatibleDC
DeleteDC

advapi32

RegOpenKeyExA
RegOpenKeyExW
RegEnumKeyExW
EnumServicesStatusExA
RegSetValueExA
QueryServiceStatus
OpenServiceA
StartServiceA
CloseServiceHandle
CreateServiceA
OpenSCManagerA
LookupPrivilegeValueA
RegEnumKeyExA
GetTokenInformation
RegCreateKeyW
RegQueryValueExA
RegQueryValueExW
RegQueryInfoKeyW
RegCreateKeyExW
RegSetValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
OpenThreadToken
RegCloseKey

shell32

SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
ShellExecuteExW
ShellExecuteA
SHCreateDirectoryExW
Shell_NotifyIconW
ShellExecuteW
SHCreateDirectoryExA
ShellExecuteExA
CommandLineToArgvW
DragAcceptFiles
DragQueryFileW

ole32

CLSIDFromString
OleLockRunning
OleInitialize
CoInitialize
OleUninitialize
CoInitializeEx
CoTaskMemFree
CoCreateInstance
CoUninitialize
CLSIDFromProgID

oleaut32

VariantInit
SysAllocString
VariantCopy
VariantClear
SysFreeString
VariantChangeType

shlwapi

PathAppendW
PathFindFileNameW
PathFindFileNameA
PathRemoveFileSpecA
PathRemoveFileSpecW
PathFileExistsA
PathFileExistsW
ord12

winmm

timeKillEvent
timeSetEvent
timeBeginPeriod
timeGetDevCaps
timeEndPeriod
timeGetTime

comctl32

_TrackMouseEvent
ord17

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

wininet

InternetSetOptionW
InternetQueryOptionW

rasapi32

RasEnumConnectionsW
RasGetConnectStatusW

winhttp

WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpWriteData
WinHttpSendRequest
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpCloseHandle
WinHttpOpen
WinHttpSetTimeouts
WinHttpConnect
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpCrackUrl
WinHttpReceiveResponse

d3d9

Direct3DCreate9

gdiplus

GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDeleteBrush
GdipAlloc
GdipCreateFont
GdipCreateSolidFill
GdipGetGenericFontFamilySansSerif
GdipDrawPath
GdipDrawString
GdipCreateFromHDC
GdipFillRegion
GdipSetTextRenderingHint
GdipCloneBrush
GdipMeasureString
GdipDeleteRegion
GdipDeleteGraphics
GdipDeleteFont
GdipDrawLineI
GdipDrawRectangle
GdipSetPenDashStyle
GdipDeletePen
GdipCreatePen1
GdipCreateLineBrushI
GdipFillRectangleI
GdipAddPathLine
GdipStartPathFigure
GdipSetLineGammaCorrection
GdipCreateLineBrush
GdipSetPixelOffsetMode
GdipGetFamily
GdipFillPath
GdipDeletePath
GdipCreatePath
GdipGraphicsClear
GdipDrawImageRectI
GdipSetInterpolationMode
GdipClosePathFigure
GdipAddPathArc
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipReleaseDC
GdipGetDC
GdipSetSmoothingMode
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipLoadImageFromStream
GdipLoadImageFromFile
GdipSetClipRectI
GdipCreateHBITMAPFromBitmap
GdipGetImageHeight
GdipGetImageWidth
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipDrawImageI
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromFile
GdiplusStartup
GdipFree
GdiplusShutdown
GdipCreateRegionHrgn

psapi

GetModuleFileNameExA

normaliz

IdnToAscii

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 315KB - Virtual size: 315KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 578KB - Virtual size: 605KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 535KB - Virtual size: 534KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

57336e4e6b93de8064a4c3b1f2af0752

Headers

DLL Characteristics

File Characteristics

Imports

version

ws2_32

iphlpapi

dnsapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

winmm

comctl32

imm32

wininet

rasapi32

winhttp

d3d9

gdiplus

psapi

normaliz

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 315KB - Virtual size: 315KB

.data Size: 578KB - Virtual size: 605KB

.gfids Size: 4KB - Virtual size: 4KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 535KB - Virtual size: 534KB

.reloc Size: 95KB - Virtual size: 95KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 315KB - Virtual size: 315KB

.data
Size: 578KB - Virtual size: 605KB

.gfids
Size: 4KB - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 535KB - Virtual size: 534KB

.reloc
Size: 95KB - Virtual size: 95KB