fa4debb561875afa18936aa55dff4915c8951af66543c3e55c86a53ae8f7eaff

Sharing

Copy URL

Twitter E-mail

General

Target

fa4debb561875afa18936aa55dff4915c8951af66543c3e55c86a53ae8f7eaff
Size

2.1MB
MD5

2d3740c1403c9324137fd64d541405b4
SHA1

878171f1eba385f61ba28f1db63c1202ff020744
SHA256

fa4debb561875afa18936aa55dff4915c8951af66543c3e55c86a53ae8f7eaff
SHA512

6c717cd43dea6f44a833d30bead501015515d4f9c2d52b54a7508b9305c775a9835c978756ddb8aede58465c9dc7c3d8d5e2213a676a317bf5cdd3bbd13469b1
SSDEEP

24576:kcLTz0wqri3Je3qrM8bnQnnAQDJUYJJsxrQLszlQS2Q8DQijwIygapTCJx:kcLTzDqrorM8bgDJBJJsxELCHGoFT0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa4debb561875afa18936aa55dff4915c8951af66543c3e55c86a53ae8f7eaff

Files

fa4debb561875afa18936aa55dff4915c8951af66543c3e55c86a53ae8f7eaff
.dll windows:6 windows x86

4486868a2bc244dfe8338c0459faba28

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LocalFree
ResetEvent
GetExitCodeThread
DecodePointer
WaitForMultipleObjects
CreateEventW
GetDiskFreeSpaceExW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetPrivateProfileStringA
LoadLibraryW
OpenProcess
MoveFileExW
RemoveDirectoryW
GetDriveTypeW
FindNextFileW
FindFirstFileW
FindClose
VerifyVersionInfoW
lstrcpyW
lstrcpynW
GlobalFree
GlobalAlloc
GetProcAddress
GetModuleHandleW
GetVersionExW
Sleep
OpenEventW
SetEvent
SetFileAttributesW
GetFileAttributesW
VerSetConditionMask
WideCharToMultiByte
MultiByteToWideChar
WaitForSingleObject
CloseHandle
WriteFile
ReadFile
GetFileSize
DeleteFileW
CreateFileW
CreateDirectoryW
FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleFileNameW
FindResourceExW
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
OutputDebugStringA
SetEndOfFile
WriteConsoleW
FlushFileBuffers
SetConsoleCtrlHandler
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
GetTimeZoneInformation
SetStdHandle
GetConsoleCP
SetFilePointerEx
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetStringTypeW
GetFileType
GetStdHandle
GetACP
GetCurrentThread
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
GetFileAttributesExW
InterlockedFlushSList
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentProcessId
SetLastError
GetLastError
RaiseException
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
GetCurrentProcess
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
HeapCreate
InitializeCriticalSection
FreeResource
FreeLibrary
MulDiv
lstrlenW
GetTickCount
GlobalLock
GlobalUnlock
GetModuleHandleA
LoadLibraryA
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
TerminateProcess
QueryPerformanceCounter

user32

GetWindowRect
FindWindowW
OffsetRect
LoadIconW
EnumChildWindows
FindWindowExW
GetClassNameW
IsIconic
SetWindowTextW
SetForegroundWindow
SetWindowPos
ShowWindow
PostMessageW
SendMessageW
IntersectRect
wsprintfW
LoadCursorW
SetWindowLongW
GetWindowLongW
DestroyWindow
IsWindow
CreateWindowExW
GetDC
ReleaseDC
SetCursor
CopyRect
InflateRect
IsRectEmpty
EqualRect
PtInRect
GetDesktopWindow
ScreenToClient
GetKeyState
GetDlgItem
GetParent
TrackMouseEvent
GetMessageW
TranslateMessage
GetClassInfoExW
PeekMessageW
PostThreadMessageW
AnimateWindow
UpdateLayeredWindow
PrintWindow
SetLayeredWindowAttributes
KillTimer
IsZoomed
SetFocus
GetActiveWindow
GetCapture
SetCapture
ReleaseCapture
EnableWindow
IsWindowEnabled
EndMenu
UpdateWindow
SetActiveWindow
BeginPaint
EndPaint
InvalidateRect
GetClientRect
GetCursorPos
CreateCaret
GetCaretBlinkTime
SetCaretPos
ClientToScreen
MapWindowPoints
GetWindow
MonitorFromWindow
GetMonitorInfoW
LoadBitmapW
LoadImageW
EnableMenuItem
GetSysColor
CharNextW
DrawTextW
DestroyIcon
DrawIconEx
FillRect
SetRect
CharLowerBuffW
MapVirtualKeyA
GetSystemMetrics
UnionRect
SetRectEmpty
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
MessageBeep
IsMenu
CreatePopupMenu
DestroyMenu
GetSubMenu
InsertMenuW
AppendMenuW
TrackPopupMenu
GetMenuItemInfoW
MoveWindow
RegisterClassExW
UnregisterClassW
CallWindowProcW
IsWindowVisible
SetTimer
DefWindowProcW
DispatchMessageW

gdi32

ExcludeClipRect
GetClipRgn
GetStockObject
CreateRectRgnIndirect
Rectangle
RestoreDC
SaveDC
SelectClipRgn
CreateRectRgn
CreatePen
BitBlt
SetViewportOrgEx
SelectObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
TextOutW
CreateBitmap
RectInRegion
SetBkMode
DeleteObject
ExtSelectClipRgn
SetBkColor
MoveToEx
SetTextColor
ExtTextOutW
OffsetViewportOrgEx
CombineRgn
GetCurrentObject
GetRgnBox
StretchBlt
GetObjectW
GetClipBox
GetDeviceCaps
GetTextColor
GetTextMetricsW
GetTextExtentPointW
GetTextExtentPoint32W
CreateFontIndirectW
GetObjectA
CreateSolidBrush
GetViewportOrgEx
LineTo
RoundRect
CreateDIBSection
ExtCreatePen
CreateDIBitmap

advapi32

RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
DuplicateTokenEx
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegDeleteKeyW

shell32

ShellExecuteW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetSpecialFolderPathW

ole32

CreateBindCtx
CreateStreamOnHGlobal
OleLockRunning
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
StringFromCLSID
CoCreateGuid
CoTaskMemFree

oleaut32

SysAllocString
GetErrorInfo
VariantChangeType
SetErrorInfo
CreateErrorInfo
SysAllocStringLen
SysStringLen
SysStringByteLen
SysAllocStringByteLen
VariantInit
SysFreeString
VariantClear
VarBstrCmp

shlwapi

PathIsDirectoryW
SHDeleteKeyW
StrToIntExA
StrToIntW
PathIsUNCW
PathIsRootW
wvnsprintfW

wininet

InternetWriteFile
HttpQueryInfoA
HttpEndRequestA
HttpSendRequestExA
HttpAddRequestHeadersA
InternetOpenA
InternetCloseHandle
InternetConnectA
InternetReadFile
InternetQueryDataAvailable
InternetSetOptionA
HttpOpenRequestA

gdiplus

GdipSetImageAttributesWrapMode
GdipFillRectangleI
GdipDrawImageRectRectI
GdipAlloc
GdipSetImageAttributesColorMatrix
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageRectI
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCloneBrush
GdipDeleteBrush
GdipCreateTexture2I
GdipLoadImageFromStream
GdipLoadImageFromFile
GdipLoadImageFromStreamICM
GdipLoadImageFromFileICM
GdipCloneImage
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage

imm32

ImmReleaseContext
ImmGetContext

msimg32

GradientFill
AlphaBlend

Exports

Exports

CheckDiskFreeSpace
ClearDesktopVirtualFolder
ClearVirtualFolderAndUnpinIcon
CloseBaiduWangpan
CloseUI
CloseUninstallUI
FindMainWindowAndShow
FindUninstallMainWindowAndShow
GetChangedInstallPath
GetUiState
GetUninstallUiState
GetWangpanVersion
GetWindowsVersion
InitSkin
InitUninstallSkin
IsBaiduWangpanRun
IsInstallOfficeAddin
IsInstallPathChanged
IsRestartExplorer
IsUiInitializedDone
LaunchAsUser
PromptDegradeTipDlg
PromptMessageBox
SetInstallPackageSize
SetInstallPath
SetIsInstallForAllUser
SetMultiUserDefDir
SetNsisState
SetOverwriteModeFlag
SetProductName
SetProductVersion
SetProgress
SetUninstallNsisState
SetUninstallVersion
ShowUI
ShowUninstallUI
UnInitSkin
UninitUninstallSkin
UninstallPromptMessageBox
UploadInstallLog
UploadUninstallLog
WaitForUserNextInstructionArrival
WaitForUserNextUninstallInstructionArrival
WriteChannel

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 187KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4486868a2bc244dfe8338c0459faba28

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

gdiplus

imm32

msimg32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 187KB - Virtual size: 187KB

.data Size: 24KB - Virtual size: 109KB

.idata Size: 13KB - Virtual size: 12KB

.gfids Size: 1KB - Virtual size: 1KB

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 260B

.rsrc Size: 2.2MB - Virtual size: 2.2MB

.reloc Size: 58KB - Virtual size: 58KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 187KB - Virtual size: 187KB

.data
Size: 24KB - Virtual size: 109KB

.idata
Size: 13KB - Virtual size: 12KB

.gfids
Size: 1KB - Virtual size: 1KB

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 260B

.rsrc
Size: 2.2MB - Virtual size: 2.2MB

.reloc
Size: 58KB - Virtual size: 58KB