36940ce4b82bdd744b79c4c6d070442509993c3234ac5e5d998635fe8515fbd6

Sharing

Copy URL Twitter E-mail

General

Target

36940ce4b82bdd744b79c4c6d070442509993c3234ac5e5d998635fe8515fbd6
Size

1.5MB
MD5

dd3dbe7b171d3e7d2d039d0204eac201
SHA1

501a49b17e3c661d27edc9292f7cbb06b51f32fe
SHA256

36940ce4b82bdd744b79c4c6d070442509993c3234ac5e5d998635fe8515fbd6
SHA512

a9068e8da46fe51bfdd43c033af4cf4a30e809e386d3e8855a37c24961604504732fc77fb461580083cb824c24af31204fa5549f86e1a5c94fa3f0480fa0c593
SSDEEP

24576:F29KDm1Jt/yB7VkeDMI3Dato1xmhE3y3NTyiqmA4w1gb9qNr:gd/wpke3ePE3ydT7qmVG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36940ce4b82bdd744b79c4c6d070442509993c3234ac5e5d998635fe8515fbd6

Files

36940ce4b82bdd744b79c4c6d070442509993c3234ac5e5d998635fe8515fbd6
.exe windows:6 windows x86

c3d9b0a1998eafd83313264341a566f1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsW
PathAppendW
PathRemoveFileSpecW
PathFindFileNameW
StrStrIW
StrCpyW
PathIsRelativeW
StrStrIA

comctl32

_TrackMouseEvent
ord17

gdiplus

GdipDrawRectangleI
GdipCloneStringFormat
GdipDrawLineI
GdipCreateLineBrushI
GdipCreateLineBrush
GdipFillRectangle
GdipBitmapApplyEffect
GdipSetEffectParameters
GdipDeleteEffect
GdipCreateEffect
GdipFillEllipseI
GdipDeletePath
GdipTransformPath
GdipIsOutlineVisiblePathPointI
GdipIsVisiblePathPointI
GdipGetPathWorldBoundsI
GdipAddPathPolygonI
GdipAddPathPieI
GdipAddPathArcI
GdipAddPathEllipseI
GdipAddPathRectangleI
GdipAddPathCurveI
GdipAddPathBezierI
GdipAddPathLine2I
GdipAddPathLineI
GdipClosePathFigure
GdipFillPath
GdipMeasureString
GdipScaleMatrix
GdipDrawPath
GdipStringFormatGetGenericTypographic
GdipDeleteFont
GdiplusStartup
GdiplusShutdown
GdipAlloc
GdipStartPathFigure
GdipGetPathFillMode
GdipDeleteStringFormat
GdipDrawEllipseI
GdipDrawString
GdipSetStringFormatTrimming
GdipSetPathFillMode
GdipResetPath
GdipClonePath
GdipCreatePath
GdipCreateTexture
GdipCreateBitmapFromHBITMAP
GdipCreateSolidFill
GdipGetPenDashStyle
GdipSetPenDashStyle
GdipGetPenLineJoin
GdipSetPenLineJoin
GdipGetPenDashCap197819
GdipGetPenEndCap
GdipGetPenStartCap
GdipSetPenDashCap197819
GdipSetPenEndCap
GdipSetPenStartCap
GdipSetPenColor
GdipGetPenWidth
GdipSetPenWidth
GdipClonePen
GdipFree
GdipLoadImageFromFile
GdipCreateFontFromLogfontA
GdipImageRotateFlip
GdipDrawImageRect
GdipSetWorldTransform
GdipRotateMatrix
GdipTranslateMatrix
GdipCreatePen2
GdipSetLineBlend
GdipCloneBrush
GdipDeleteBrush
GdipCreateLineBrushFromRect
GdipDrawArc
GdipDeletePen
GdipCreatePen1
GdipSetSmoothingMode
GdipDeleteMatrix
GdipCreateMatrix
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCreateHBITMAPFromBitmap
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromFile
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipDrawBezierI
GdipCreateFontFromDC
GdipSetStringFormatLineAlign
GdipGetLogFontW
GdipGetFontCollectionFamilyList
GdipDeleteFontFamily
GdipPrivateAddMemoryFont
GdipDeletePrivateFontCollection
GdipNewPrivateFontCollection
GdipDeleteGraphics
GdipCreateFromHDC
GdipCloneFontFamily
GdipCreateFont

winmm

timeSetEvent
timeGetDevCaps
timeGetTime
timeKillEvent

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

msimg32

AlphaBlend

libcurl

curl_easy_setopt
curl_easy_cleanup
curl_easy_perform
curl_easy_getinfo
curl_easy_init

kernel32

UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualAlloc
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
CreateThread
ExitThread
CreateTimerQueue
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
DecodePointer
EncodePointer
MoveFileExW
SetLastError
AreFileApisANSI
GetFileInformationByHandle
GetFileAttributesExW
FindFirstFileExW
GetCurrentThread
SwitchToThread
WaitForSingleObjectEx
DuplicateHandle
GetStringTypeW
IsDebuggerPresent
RtlUnwind
GetModuleHandleExW
ExitProcess
GetFileSizeEx
SetFilePointerEx
HeapAlloc
GetTimeZoneInformation
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapFree
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadConsoleW
HeapReAlloc
SetStdHandle
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
HeapSize
WriteConsoleW
SetEndOfFile
SignalObjectAndWait
OutputDebugStringA
GetFileType
FileTimeToSystemTime
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
VirtualQuery
SetEvent
GetVersionExW
GetStdHandle
TerminateThread
SetThreadPriority
ResetEvent
CreateEventW
WaitForSingleObject
TlsFree
TlsGetValue
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetSystemTimeAsFileTime
GetPrivateProfileIntW
GetModuleFileNameW
GetCurrentThreadId
DeleteFileA
GetCurrentProcessId
SystemTimeToTzSpecificLocalTime
GetSystemTime
GetTickCount
MultiByteToWideChar
WideCharToMultiByte
GetACP
FormatMessageW
GetLastError
OpenProcess
VirtualAllocEx
ReadProcessMemory
VirtualFreeEx
CloseHandle
Sleep
CreateToolhelp32Snapshot
Process32FirstW
TerminateProcess
Process32NextW
MoveFileW
DeleteFileW
CopyFileW
GetModuleHandleW
GetPrivateProfileStringA
RemoveVectoredExceptionHandler
VirtualProtect
GetCurrentProcess
CreateFileW
GetFileAttributesW
OutputDebugStringW
GetNativeSystemInfo
RaiseException
LoadLibraryW
GetLocalTime
AddVectoredExceptionHandler
GetProcAddress
FreeLibrary
IsWow64Process
VerifyVersionInfoW
VerSetConditionMask
GlobalFree
GetCurrentDirectoryW
FindResourceW
LoadResource
SizeofResource
LockResource
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
GlobalSize
GetFileSize
ReadFile
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleHandleA
SetFilePointer
SystemTimeToFileTime
LocalFileTimeToFileTime
CreateDirectoryW
WriteFile
GetEnvironmentVariableW
FindFirstFileW
FindClose
GetCommandLineW
FindNextFileW
RemoveDirectoryW
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
TlsSetValue
TlsAlloc

user32

UnregisterClassW
GetUserObjectInformationW
GetProcessWindowStation
WaitMessage
SetTimer
GetWindowThreadProcessId
SendMessageW
PostMessageW
FindWindowW
FindWindowExW
IsWindow
PostQuitMessage
MessageBoxA
GetWindowLongW
IsIconic
IsZoomed
MonitorFromPoint
MonitorFromWindow
GetMonitorInfoW
ScreenToClient
GetClientRect
OffsetRect
GetWindowRect
SetWindowRgn
SetWindowLongW
MessageBoxW
MoveWindow
ShowWindow
IsWindowVisible
SetForegroundWindow
SetWindowTextW
SetWindowPos
DefWindowProcW
DestroyWindow
ReleaseDC
LoadCursorW
RegisterClassW
GetClassInfoExW
RegisterClassExW
CreateWindowExW
GetWindow
EnableWindow
SetFocus
LoadImageW
GetSystemMetrics
CallWindowProcW
SetPropW
GetPropW
GetDC
InvalidateRect
GetKeyState
GetCursorPos
GetFocus
SetCapture
ReleaseCapture
BeginPaint
EndPaint
GetUpdateRect
IsRectEmpty
IntersectRect
UpdateLayeredWindow
PtInRect
TranslateMessage
DispatchMessageW
CharNextW
GetDesktopWindow
UnionRect
SetCursor
ClientToScreen
GetSysColor
GetAsyncKeyState
OpenClipboard
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
EmptyClipboard
SetClipboardData
wsprintfW
MapWindowPoints
GetParent
KillTimer
GetQueueStatus
CallMsgFilterW
MsgWaitForMultipleObjectsEx
PeekMessageW

gdi32

GetDeviceCaps
CreateDIBSection
GetObjectA
StretchBlt
BitBlt
DeleteDC
SaveDC
RestoreDC
GetWindowOrgEx
SetWindowOrgEx
SetStretchBltMode
CreateRectRgnIndirect
ExtSelectClipRgn
SelectObject
CreateFontIndirectW
GetStockObject
GetObjectW
DeleteObject
CreateCompatibleDC
CreateRoundRectRgn

advapi32

ReportEventA
RegisterEventSourceA
DeregisterEventSource

shell32

ShellExecuteW
ord165

ole32

CoCreateInstance
CreateStreamOnHGlobal

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 897KB - Virtual size: 896KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 279KB - Virtual size: 278KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 548KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1008KB - Virtual size: 1008KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c3d9b0a1998eafd83313264341a566f1

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

comctl32

gdiplus

winmm

imm32

msimg32

libcurl

kernel32

user32

gdi32

advapi32

shell32

ole32

version

Sections

.text Size: 897KB - Virtual size: 896KB

.rdata Size: 279KB - Virtual size: 278KB

.data Size: 26KB - Virtual size: 548KB

.rsrc Size: 1008KB - Virtual size: 1008KB

.reloc Size: 53KB - Virtual size: 52KB

.text
Size: 897KB - Virtual size: 896KB

.rdata
Size: 279KB - Virtual size: 278KB

.data
Size: 26KB - Virtual size: 548KB

.rsrc
Size: 1008KB - Virtual size: 1008KB

.reloc
Size: 53KB - Virtual size: 52KB