b0943fb55a03166f89c9caeff72451c7fde6893f7bbd14c2cf1eb45ca6560021

Sharing

Copy URL

Twitter E-mail

General

Target

b0943fb55a03166f89c9caeff72451c7fde6893f7bbd14c2cf1eb45ca6560021
Size

10.0MB
MD5

ab12e60fd12e268f5b24fef9668b4aef
SHA1

422088d57410513aa543d66613590486a28ad1bd
SHA256

b0943fb55a03166f89c9caeff72451c7fde6893f7bbd14c2cf1eb45ca6560021
SHA512

44f378e7afdd75771c3a626445af428afea8d104ed2a8377adb33315e2a3be6a08f3abf5b46e2b716bbd572f74e88d8870c962aafdeca2f72f71cb8ea9526f5c
SSDEEP

196608:O1ZqFWv7WwiVL1ow+oDhIB/bROtGV6xJ9auv8sSZhAW2aeK5vS:s6Wv7ziVuw+oDhIJR5VC3vb+Ar/4S

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b0943fb55a03166f89c9caeff72451c7fde6893f7bbd14c2cf1eb45ca6560021

Files

b0943fb55a03166f89c9caeff72451c7fde6893f7bbd14c2cf1eb45ca6560021
.exe windows:6 windows x86

2fb093b22ba1440efe85031c8fa96488

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

getaddrinfo
freeaddrinfo
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
__WSAFDIsSet
ioctlsocket
listen
htonl
recvfrom
sendto
accept
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
select
shutdown
getnameinfo
gethostbyname
closesocket
connect
bind
WSAGetLastError
send
recv
gethostname

crypt32

CertOpenSystemStoreW
CertCloseStore
CertEnumCertificatesInStore
CertGetIntendedKeyUsage
CertDuplicateCertificateContext
CertFindCertificateInStore
CertOpenStore
CertGetEnhancedKeyUsage
CertGetCertificateContextProperty
CertFreeCertificateContext

wldap32

ord167
ord301
ord127
ord27
ord26
ord147
ord41
ord208
ord216
ord14
ord46
ord219
ord145
ord133
ord79
ord117
ord142

kernel32

VerifyVersionInfoW
GetTempPathW
GetCommandLineW
GetTickCount
GetCurrentProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Module32FirstW
Module32NextW
GetDiskFreeSpaceW
GetTempFileNameW
GetFileAttributesW
GetCurrentProcessId
TerminateProcess
GetLogicalDrives
GetDriveTypeW
FindNextFileW
FindClose
CreateProcessW
LoadResource
LockResource
SizeofResource
FindResourceW
SetCurrentDirectoryW
CreateMutexW
CreateEventW
InterlockedIncrement
InterlockedDecrement
FlushInstructionCache
HeapCreate
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
MulDiv
FreeResource
SetLastError
GetFullPathNameW
GetVersionExW
GetVersionExA
LoadLibraryA
GetModuleHandleA
IsBadReadPtr
FormatMessageW
InitializeCriticalSectionEx
SleepEx
GetSystemDirectoryW
QueryPerformanceCounter
WaitForSingleObjectEx
GetEnvironmentVariableA
GetCurrentThreadId
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
CompareFileTime
GetSystemTimeAsFileTime
GetStdHandle
GetFileType
FreeLibrary
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
WriteFile
GetModuleHandleExW
SwitchToFiber
DeleteFiber
CreateFiber
GetSystemTime
SystemTimeToFileTime
ConvertFiberToThread
ConvertThreadToFiber
GlobalUnlock
GlobalLock
GlobalAlloc
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
SwitchToThread
SetFilePointer
GetWindowsDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
RemoveDirectoryW
MoveFileW
GetLogicalDriveStringsW
FindFirstChangeNotificationW
FindCloseChangeNotification
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
LoadLibraryExW
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileAttributesExW
SetFilePointerEx
SetConsoleCtrlHandler
ExitProcess
VerSetConditionMask
GetModuleFileNameW
FindFirstFileW
ReadFile
GetModuleFileNameA
GetACP
GetConsoleCP
GetCurrentThread
GetDateFormatW
GetTimeFormatW
IsValidLocale
SetEndOfFile
GetUserDefaultLCID
EnumSystemLocalesW
GetFullPathNameA
SetStdHandle
GetTimeZoneInformation
FlushFileBuffers
FindFirstFileExA
FindFirstFileExW
FindNextFileA
IsValidCodePage
GetProcAddress
GetModuleHandleW
MultiByteToWideChar
LocalFree
OpenProcess
WideCharToMultiByte
GetLocalTime
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
WaitForSingleObject
Sleep
CopyFileW
GetPrivateProfileStringW
OutputDebugStringW
SetEvent
DeleteFileW
CloseHandle
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
DecodePointer
GetLastError
RaiseException
OutputDebugStringA
MoveFileExW
GetCommandLineA
GetEnvironmentStringsW
LoadLibraryW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
WriteConsoleW
SetFileTime
CreateFileW
SetFileAttributesW
LocalFileTimeToFileTime
VirtualAlloc
VirtualFree
FileTimeToDosDateTime
DosDateTimeToFileTime
GlobalMemoryStatus
GetSystemInfo
FileTimeToLocalFileTime
ResetEvent
ReleaseSemaphore
CreateSemaphoreW
GetFileSize
QueryPerformanceFrequency
lstrlenA
GetOEMCP

user32

CreateIconFromResource
LoadBitmapW
DestroyCursor
GetKeyState
GetFocus
EqualRect
SetRect
SetCursor
PtInRect
DestroyIcon
IsRectEmpty
UnionRect
IntersectRect
InflateRect
CopyRect
ScreenToClient
SetCaretPos
HideCaret
GetCaretBlinkTime
CreateCaret
SetWindowTextW
InvalidateRect
EndPaint
CharNextW
GetIconInfo
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
ClientToScreen
EnableMenuItem
GetSysColor
BeginPaint
ReleaseDC
GetDC
UpdateWindow
KillTimer
ReleaseCapture
SetCapture
GetCapture
SetFocus
IsZoomed
SetLayeredWindowAttributes
GetSystemMetrics
TrackMouseEvent
MessageBoxW
LoadIconW
GetWindowPlacement
DrawTextW
SystemParametersInfoA
CharLowerBuffW
MapVirtualKeyA
UpdateLayeredWindow
LoadImageW
IsMenu
CreatePopupMenu
DestroyMenu
CheckMenuItem
GetMenuItemCount
InsertMenuW
MonitorFromWindow
LoadCursorW
MapWindowPoints
GetClientRect
GetDlgItem
CallWindowProcW
GetDesktopWindow
SetActiveWindow
IsWindowEnabled
EnableWindow
SetWindowPos
PostQuitMessage
DestroyWindow
GetActiveWindow
OffsetRect
wsprintfW
GetAncestor
GetWindow
GetParent
GetForegroundWindow
SendMessageW
SetPropW
GetPropW
WindowFromPoint
GetCursorPos
IsWindowVisible
SetParent
SetTimer
SetWindowLongW
GetWindowLongW
SendMessageTimeoutW
GetClassNameW
EnumWindows
GetWindowThreadProcessId
IsWindow
ShowWindow
GetWindowRect
AppendMenuW
DeleteMenu
TrackPopupMenu
FindWindowExW
FindWindowW
GetMonitorInfoW
EnumDisplayMonitors
DefWindowProcW
CreateWindowExW
RegisterClassExW
PostMessageW
UnregisterClassW
GetMenuInfo
FillRect
InvertRect
DrawIconEx
CharUpperW
CharPrevExA
SetMenuInfo
GetUserObjectInformationW
GetProcessWindowStation
FindWindowA
SendMessageA
MsgWaitForMultipleObjects
SetMenuContextHelpId
SetForegroundWindow
AnimateWindow
GetMenuItemInfoW
IsIconic

gdi32

Ellipse
CreateRectRgnIndirect
CreateRectRgn
CreatePatternBrush
CreatePen
GetClipRgn
CombineRgn
Arc
CreateFontIndirectW
CreateSolidBrush
GetClipBox
GetStockObject
Rectangle
SetBkMode
GetDCOrgEx
ExcludeClipRect
CreateCompatibleBitmap
SetViewportOrgEx
GetRgnBox
GetTextColor
GetTextExtentPoint32W
IntersectClipRect
OffsetRgn
Pie
PtInRegion
RectInRegion
RestoreDC
RoundRect
SaveDC
ExtSelectClipRgn
SetRectRgn
SetROP2
SetTextColor
GetWorldTransform
SetWorldTransform
CreateDIBSection
ExtCreatePen
Polyline
GetCurrentObject
GetViewportOrgEx
SetGraphicsMode
GetDeviceCaps
CreateBitmap
EnumFontsW
GetObjectW
StretchBlt
SelectObject
DeleteDC
CreateCompatibleDC
DeleteObject
CreateEllipticRgnIndirect
BitBlt
CreateRoundRectRgn

comdlg32

GetOpenFileNameW

advapi32

CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CreateProcessAsUserW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
DuplicateTokenEx
OpenProcessToken
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegDeleteValueW
RegCreateKeyExW
RegOpenKeyExW

shell32

ShellExecuteExW
SHGetSpecialFolderPathW
ShellExecuteW
SHCreateDirectoryExW
ord165
CommandLineToArgvW
SHFileOperationW
SHGetPathFromIDListW
SHBrowseForFolderW

ole32

CreateBindCtx
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
OleLockRunning
OleUninitialize
OleInitialize
CoUninitialize
CoCreateGuid
CoInitializeSecurity
CoInitializeEx
CoInitialize
CoCreateInstance

oleaut32

SetErrorInfo
SysAllocStringByteLen
GetErrorInfo
SysFreeString
VariantCopy
CreateErrorInfo
SysStringLen
VariantChangeType
SysAllocStringLen
SysAllocString
VariantInit
VariantClear

shlwapi

ord176
SHDeleteKeyW
SHCreateStreamOnFileEx
StrToIntExW

psapi

GetModuleFileNameExW

setupapi

SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

imm32

ImmReleaseContext
ImmAssociateContext
ImmGetContext

bcrypt

BCryptGenRandom

gdiplus

GdipDrawImageRectI
GdipGraphicsClear
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipGetImageEncodersSize
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetPropertyItem
GdipGetImageEncoders
GdipCreateBitmapFromScan0
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize

msimg32

AlphaBlend
GradientFill

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 949KB - Virtual size: 949KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 51KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 97.7MB - Virtual size: 97.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 195KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2fb093b22ba1440efe85031c8fa96488

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

crypt32

wldap32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

psapi

setupapi

version

imm32

bcrypt

gdiplus

msimg32

Sections

.text Size: 3.7MB - Virtual size: 3.7MB

.rdata Size: 949KB - Virtual size: 949KB

.data Size: 51KB - Virtual size: 162KB

.rsrc Size: 97.7MB - Virtual size: 97.7MB

.reloc Size: 195KB - Virtual size: 194KB

.text
Size: 3.7MB - Virtual size: 3.7MB

.rdata
Size: 949KB - Virtual size: 949KB

.data
Size: 51KB - Virtual size: 162KB

.rsrc
Size: 97.7MB - Virtual size: 97.7MB

.reloc
Size: 195KB - Virtual size: 194KB