ed5593091f7455fb7e459a6626bc7712a897563c95d225032bf423d780863e0d

Sharing

Copy URL Twitter E-mail

General

Target

ed5593091f7455fb7e459a6626bc7712a897563c95d225032bf423d780863e0d
Size

11.8MB
MD5

43b6d5953cccb193e301ba02962c889d
SHA1

31ba43445b4299c277f80cac8b8e5ef31a94f5f2
SHA256

ed5593091f7455fb7e459a6626bc7712a897563c95d225032bf423d780863e0d
SHA512

3c82049a2e84134c4409ae2410838d0857ec5f20e843d7dcadb1a4153630f1d90d84e979d7addf18994cb84511ef1b9b6ffda7ecae580ef8a4ba1d69551ff60c
SSDEEP

196608:wbei94CEmtOLdGfaHBKsnWSbP9n7jxbEaR/oYGDGZhVhc6Tf0yAFXnOX3uVy3Mw5:CcvmYWSbF7dbvjGDgVc6so3uVy8Xx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ed5593091f7455fb7e459a6626bc7712a897563c95d225032bf423d780863e0d

Files

ed5593091f7455fb7e459a6626bc7712a897563c95d225032bf423d780863e0d
.exe windows:6 windows x86

e04864b82fdab8d6dc0a2434c81d344b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

netapi32

Netbios

kernel32

GetCPInfo
SwitchToThread
LCMapStringW
RtlUnwind
GetDriveTypeW
GetFileType
GetSystemInfo
VirtualAlloc
VirtualQuery
GetCommandLineA
GetCommandLineW
GetTimeZoneInformation
CreateThread
ExitThread
FreeLibraryAndExitThread
SetStdHandle
HeapQueryInformation
QueryPerformanceFrequency
GetStdHandle
ExitProcess
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
LoadLibraryExA
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
WaitForSingleObjectEx
ResetEvent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FindResourceExW
GetWindowsDirectoryW
SearchPathW
SetErrorMode
VerifyVersionInfoW
FreeResource
LockResource
LoadResource
OutputDebugStringW
VerSetConditionMask
GetCurrentDirectoryW
VirtualProtect
GetUserDefaultUILanguage
GetLocaleInfoW
GlobalFlags
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
GlobalGetAtomNameW
GetUserDefaultLCID
ReplaceFileW
GetDiskFreeSpaceW
CompareStringA
lstrcmpA
GetThreadLocale
GetStringTypeExW
lstrcmpiW
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetVolumeInformationW
GetShortPathNameW
GetFullPathNameW
GetFileSize
FlushFileBuffers
ResumeThread
GetStringTypeW
SetThreadPriority
CreateEventW
SetEvent
GetProfileIntW
GetVersionExW
FindNextFileW
SystemTimeToTzSpecificLocalTime
SetFileTime
LocalFileTimeToFileTime
GetFileTime
GetFileSizeEx
GetFileAttributesExW
FileTimeToLocalFileTime
GetCurrentProcessId
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
GetModuleHandleA
GetCurrentThreadId
EncodePointer
OutputDebugStringA
MulDiv
MoveFileW
FormatMessageW
DeleteCriticalSection
RaiseException
GetProcessHeap
HeapSize
HeapFree
SizeofResource
HeapReAlloc
HeapAlloc
DecodePointer
CreateFileW
GetModuleFileNameA
WinExec
SetDllDirectoryW
GetSystemDirectoryW
ExpandEnvironmentStringsW
GetModuleHandleExW
LoadLibraryW
LoadLibraryA
GetFileAttributesW
SetFileAttributesW
RemoveDirectoryW
IsWow64Process
GetNativeSystemInfo
FreeLibrary
InterlockedCompareExchange
CreateDirectoryW
GlobalSize
CreateMutexW
ReleaseMutex
SetLastError
GetCurrentThread
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrlenW
GetSystemDefaultUILanguage
GetModuleFileNameW
lstrcpyW
lstrcpynW
GetACP
CopyFileW
GetTempFileNameW
GetTempPathW
GetTickCount
GetLocalTime
GetModuleHandleW
FileTimeToSystemTime
SystemTimeToFileTime
CloseHandle
GetCurrentProcess
LocalFree
LocalAlloc
GetProcAddress
MultiByteToWideChar
WaitForSingleObject
TerminateThread
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetLastError
InterlockedExchange
FindFirstFileW
DeleteFileW
FindClose
Sleep
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetVersion
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
FindResourceW
SuspendThread
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
ValidateRect
GetForegroundWindow
TrackPopupMenu
SetMenu
GetMenu
IsIconic
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
DestroyWindow
IsChild
IsMenu
CreateWindowExW
GetClassInfoExW
RegisterClassW
GetMessageTime
RegisterWindowMessageW
IsDialogMessageW
IsWindowEnabled
SetFocus
SendDlgItemMessageW
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
SetDlgItemTextW
GetDlgItemInt
SetDlgItemInt
GetDlgItem
MoveWindow
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
SendDlgItemMessageA
EndPaint
TranslateMDISysAccel
SetParent
WindowFromPoint
SendMessageW
GetFocus
EnableWindow
GetSystemMetrics
GetDC
ReleaseDC
InvalidateRect
BeginPaint
RemoveMenu
InsertMenuW
SetPropW
GetMenuState
RegisterClassExW
LockWindowUpdate
AppendMenuW
IsZoomed
ShowWindow
LoadImageW
FrameRect
GetCaretPos
SetCaretPos
LoadBitmapW
GetDesktopWindow
UnregisterClassW
GetWindowTextW
EnableScrollBar
GetAsyncKeyState
GetMonitorInfoW
MonitorFromPoint
BringWindowToTop
GetClassInfoW
CheckMenuItem
GetSysColorBrush
GetComboBoxInfo
GetWindow
GetCursorPos
CreateDialogIndirectParamW
DeleteMenu
EnableMenuItem
EqualRect
IntersectRect
SetRectEmpty
ShowCaret
EndDialog
GetNextDlgTabItem
GetActiveWindow
GetWindowThreadProcessId
GetKeyNameTextW
MapVirtualKeyW
IsClipboardFormatAvailable
ShowOwnedPopups
CharUpperW
LoadAcceleratorsW
DestroyMenu
PostThreadMessageW
WaitMessage
DefMDIChildProcW
MessageBeep
TranslateAcceleratorW
CreatePopupMenu
InsertMenuItemW
GetPropW
DestroyCursor
SetCursor
LoadMenuW
UnionRect
EmptyClipboard
RemovePropW
MessageBoxW
MapWindowPoints
GetClassLongW
GetTopWindow
GetLastActivePopup
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
SetScrollInfo
GetScrollInfo
WinHelpW
GetMenuItemID
MonitorFromWindow
GetClientRect
GetWindowRect
AdjustWindowRectEx
ScreenToClient
GetSysColor
PtInRect
GetWindowLongW
SetWindowLongW
GetParent
GetMessagePos
UpdateWindow
DestroyIcon
OffsetRect
IsRectEmpty
LoadIconW
SystemParametersInfoW
FillRect
CopyRect
InflateRect
PostMessageW
SetTimer
KillTimer
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
PostQuitMessage
IsWindow
IsWindowVisible
DrawTextW
DrawTextExW
GrayStringW
DrawStateW
TabbedTextOutW
SetForegroundWindow
SetWindowRgn
RedrawWindow
SetRect
LoadCursorW
CharLowerBuffW
SetClassLongW
TrackMouseEvent
GetSystemMenu
NotifyWinEvent
UnpackDDElParam
ReuseDDElParam
DrawMenuBar
DefFrameProcW
GetKeyState
SetCapture
ReleaseCapture
GetWindowTextLengthW
ClientToScreen
DrawFocusRect
GetWindowRgn
InvalidateRgn
wsprintfW
SetWindowPos
GetDlgCtrlID
GetMenuStringW
GetSubMenu
GetMenuItemCount
GetMenuItemInfoW
SetMenuItemInfoW
SetWindowTextW
EnumChildWindows
GetClassNameW
DefWindowProcW
SetActiveWindow
GetWindowDC
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
RegisterClipboardFormatW
CallWindowProcW
ModifyMenuW
DestroyAcceleratorTable
CharUpperBuffW
RealChildWindowFromPoint
CopyImage
MapDialogRect
GetMenuDefaultItem
SetMenuDefaultItem
UpdateLayeredWindow
SetLayeredWindowAttributes
EnumDisplayMonitors
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
CreateAcceleratorTableW
CopyAcceleratorTableW
DrawEdge
DrawFrameControl
DrawIconEx
GetIconInfo
SetCursorPos
CopyIcon
GetUpdateRect
GetNextDlgGroupItem
HideCaret
InvertRect
DrawIcon
IsCharLowerW
MapVirtualKeyExW
SubtractRect
GetDoubleClickTime
CreateMenu
GetCapture

gdi32

ExcludeClipRect
GetCurrentPositionEx
GetObjectType
GetPixel
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
ArcTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
PathToRegion
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
PatBlt
SetRectRgn
DPtoLP
OffsetRgn
AbortDoc
SetAbortProc
GetTextMetricsW
EnumFontFamiliesW
GetTextCharsetInfo
GetTextColor
GetDIBits
RealizePalette
CreatePatternBrush
CreatePalette
GetPaletteEntries
ExtFloodFill
SetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
FrameRgn
GetBoundsRect
GetTextFaceW
SetPixelV
EndPath
BeginPath
CreateBrushIndirect
Arc
CreateDCW
SetTextColor
SetBkColor
CreateBitmap
EndPage
StartPage
EndDoc
StartDocW
ResetDCW
GetMapMode
CreateRectRgn
GetClipBox
CreateDIBitmap
GetTextFaceA
CreateFontW
SetPixel
FillRgn
Polyline
PtInRegion
MoveToEx
ExtCreatePen
LineTo
GetRgnBox
CreateRectRgnIndirect
CombineRgn
GetOutlineTextMetricsW
GetFontData
EnumFontFamiliesExW
CreatePolygonRgn
Polygon
ExtTextOutW
TextOutW
CreateHatchBrush
CopyMetaFileW
GetBkColor
CreateEllipticRgn
Rectangle
RectVisible
PtVisible
Escape
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreatePen
CreateSolidBrush
DeleteObject
GetDeviceCaps
SelectObject
GetStockObject
GetTextExtentPoint32W
CreateFontIndirectW
DeleteDC
GetCurrentObject
RoundRect
StretchBlt
CreateDIBSection
GetDIBColorTable
SetDIBColorTable
GetObjectW
CreateRoundRectRgn
GetROP2
SetWindowOrgEx
Ellipse

msimg32

TransparentBlt
AlphaBlend

winspool.drv

DeviceCapabilitiesW
GetPrinterW
EnumPrintersW
ClosePrinter
DocumentPropertiesW
GetJobW
OpenPrinterW

advapi32

RegSetValueW
GetTokenInformation
LookupAccountSidW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
ConvertSidToStringSidW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
ImpersonateSelf
RevertToSelf
AccessCheck
OpenThreadToken
AllocateAndInitializeSid
FreeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
IsValidSecurityDescriptor
SetSecurityDescriptorDacl
SetFileSecurityW
GetFileSecurityW
RegQueryValueW
RegEnumKeyW
OpenProcessToken
RegQueryValueExA
GetUserNameW
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner

shell32

SHGetDesktopFolder
SHAddToRecentDocs
SHAppBarMessage
DragFinish
SHBrowseForFolderW
ShellExecuteExW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
SHGetFolderPathW
DragAcceptFiles
SHGetSpecialFolderPathW
SHChangeNotify
SHGetFileInfoW
DragQueryFileW
ShellExecuteW
ExtractIconW

comctl32

ImageList_ReplaceIcon
InitCommonControlsEx
_TrackMouseEvent
ImageList_SetBkColor

shlwapi

UrlUnescapeW
PathStripToRootW
PathIsUNCW
PathRemoveFileSpecW
PathRemoveExtensionW
PathFindFileNameW
PathFindExtensionW
StrCmpW
PathIsRelativeW
PathFileExistsW
PathIsDirectoryW
StrFormatByteSizeW
StrFormatKBSizeW

uxtheme

GetThemeColor
GetCurrentThemeName
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
GetThemeSysColor
CloseThemeData
OpenThemeData
DrawThemeBackground
IsAppThemed
GetWindowTheme
DrawThemeText
DrawThemeParentBackground

ole32

RevokeDragDrop
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CoInitialize
CoDisconnectObject
CreateStreamOnHGlobal
CoRevokeClassObject
CoRegisterMessageFilter
OleLockRunning
CoLockObjectExternal
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
OleGetClipboard
CoInitializeEx
CoUninitialize
ReleaseStgMedium
OleDuplicateData
CoTaskMemAlloc
StringFromCLSID
CoCreateGuid
CoTaskMemFree
CoCreateInstance
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
RegisterDragDrop

oleaut32

oledlg

OleUIBusyW

gdiplus

GdipDrawImageRectRect
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCreateBitmapFromStream
GdipDrawImagePointRectI
GdipFillEllipseI
GdipDrawEllipseI
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipSetClipRect
GdipFillPath
GdipSetPenDashStyle
GdipSetPathGradientPresetBlend
GdipCreatePathGradientFromPath
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipAddPathArc
GdipAddPathLine
GdipClosePathFigure
GdipStartPathFigure
GdipDrawPath
GdipAddPathArcI
GdipAddPathLineI
GdipDeletePath
GdipCreatePath
GdipSetSmoothingMode
GdipDrawImageI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipGetImagePaletteSize
GdipGetImagePalette
GdiplusStartup
GdiplusShutdown
GdipGetImagePixelFormat
GdipCreatePen1
GdipDeletePen
GdipCreateFromHDC
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc
GdipDrawRectangleI
GdipDeleteGraphics
GdipDrawLineI

amindpdfcore

PDSDK_NewDocument
PDSDK_ReleaseDocument
PDSDK_NewMatrix
PDSDK_NewDIBitmap
PDSDK_NewRenderContext
PDSDK_CreateWindowsDevice
PDSDK_ArcFourCryptBlock
PDSDK_NewCreator
PDSDK_ParseXmlFromBuf
PDSDK_CreateLogicalStructAnalyser
PDSDK_CreateFxgeDevice
_PDF_LoadSDK@4
PDF_UnLoadSDK
PDSDK_NewPDFCombinner
PDSDK_NewXmlElement
PDSDK_NewAnnotFromXML
PDSDK_CreateParaUndoItem
PDSDK_LoadDIBitmap
PDSDK_NewPageObjectFromXML
PDSDK_NewViewer
PDSDK_ClonePageHandler
PDSDK_DestroyPageHandlerClone
PDSDK_CopyPageHandler
PDSDK_CreateSigner
PDSDK_NewProgressiveRenderer
PDSDK_SHA256

rpcrt4

UuidCreate
UuidToStringA
RpcStringFreeA

libcurl

msi

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

imm32

ImmGetContext
ImmGetOpenStatus
ImmReleaseContext

wininet

InternetOpenW
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetConnectW
InternetOpenUrlW
InternetReadFile
InternetSetFilePointer
InternetWriteFile
InternetQueryDataAvailable
InternetQueryOptionW
InternetSetOptionW
InternetGetLastResponseInfoW
InternetSetStatusCallbackW
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW
HttpSendRequestExW
HttpEndRequestW
HttpQueryInfoW
InternetCloseHandle

winmm

PlaySoundW

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 640KB - Virtual size: 640KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sap
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.w3v
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.q#9
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 420KB - Virtual size: 420KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.l1
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e04864b82fdab8d6dc0a2434c81d344b

Headers

DLL Characteristics

File Characteristics

Imports

netapi32

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

amindpdfcore

rpcrt4

libcurl

msi

oleacc

imm32

wininet

winmm

Sections

.text Size: 3.2MB - Virtual size: 3.2MB

.rdata Size: 640KB - Virtual size: 640KB

.data Size: 52KB - Virtual size: 52KB

.sap Size: 1.7MB - Virtual size: 1.7MB

.w3v Size: 4KB - Virtual size: 4KB

.q#9 Size: 5.8MB - Virtual size: 5.8MB

.reloc Size: 4KB - Virtual size: 4KB

.rsrc Size: 420KB - Virtual size: 420KB

.l1 Size: 32KB - Virtual size: 32KB

.text
Size: 3.2MB - Virtual size: 3.2MB

.rdata
Size: 640KB - Virtual size: 640KB

.data
Size: 52KB - Virtual size: 52KB

.sap
Size: 1.7MB - Virtual size: 1.7MB

.w3v
Size: 4KB - Virtual size: 4KB

.q#9
Size: 5.8MB - Virtual size: 5.8MB

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 420KB - Virtual size: 420KB

.l1
Size: 32KB - Virtual size: 32KB