3873a78b365b98be010a393c0ee637fd12494d46329f872f5518364359ca9e3e

Sharing

Copy URL

Twitter E-mail

General

Target

3873a78b365b98be010a393c0ee637fd12494d46329f872f5518364359ca9e3e
Size

759KB
MD5

b96dabb1d2a4afe7db44d39630a41159
SHA1

eddccf9099be46a8a3d4ea9f6b8c6b49810fd4f7
SHA256

3873a78b365b98be010a393c0ee637fd12494d46329f872f5518364359ca9e3e
SHA512

3af7c42a45b46929e54815105a18941145c1dc3a32bd187f640ca594953d3a62c6a91dc15e6f9d3091d6a018344b507bb872c30d422b930a27915c2bb3c186ae
SSDEEP

6144:0nM9z7DMw/7Cde1yxOok99taOdHKo99H6erYKMfcw/Fz:0nM9z7DMw2decxOok99fHFrM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3873a78b365b98be010a393c0ee637fd12494d46329f872f5518364359ca9e3e

Files

3873a78b365b98be010a393c0ee637fd12494d46329f872f5518364359ca9e3e
.exe windows:5 windows x64

eb62837002990ada5c168ecd5d605925

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

gdi32

ExtTextOutW
GetDIBits
GetObjectW
GetRgnBox
GetStockObject
GetTextExtentExPointW
GetTextMetricsW
LineTo
MoveToEx
Rectangle
SelectObject
SetBkColor
SetBkMode
SetDIBits
SetTextAlign
SetTextColor
CreateRectRgn
CreateFontIndirectW
CreatePen
CreateCompatibleDC
CreateCompatibleBitmap
CombineRgn
GetDeviceCaps
DeleteObject
ExtCreatePen
DeleteDC

user32

GetDesktopWindow
GetDC
SetWindowLongPtrW
SetDlgItemTextW
SendMessageW
PostMessageW
MessageBoxW
LoadStringW
LoadIconW
GetWindowLongPtrW
GetSystemMetrics
GetParent
GetDlgItemTextW
GetDlgItem
EndDialog
EnableWindow
DialogBoxParamW
CheckDlgButton
KillTimer
PostThreadMessageW
RegisterHotKey
ReleaseDC
SendDlgItemMessageW
SetTimer
SetWindowPos
SetWindowTextW
ShowWindow
SystemParametersInfoW
UnregisterHotKey
BeginPaint
CallWindowProcW
GetMessageW
CreateWindowExW
DefWindowProcW
DestroyWindow
DrawFrameControl
DrawTextW
EndPaint
GetAsyncKeyState
GetClientRect
GetCursorPos
GetFocus
GetKeyState
GetScrollInfo
GetSysColor
GetSysColorBrush
GetWindowLongW
GetWindow
GetWindowTextW
InvalidateRect
IsWindowEnabled
LoadCursorW
MoveWindow
RedrawWindow
RegisterClassExW
ScreenToClient
SetFocus
SetScrollInfo
SetScrollPos
SetWindowLongW
TranslateMessage
UnregisterClassW
WindowFromPoint
ClientToScreen
GetWindowRect
IsDlgButtonChecked

comctl32

ImageList_GetImageInfo
ImageList_AddMasked
ImageList_Draw
InitCommonControlsEx
PropertySheetW
CreatePropertySheetPageW
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Create

shlwapi

StrFormatByteSizeW

setupapi

SetupCloseFileQueue
SetupOpenFileQueue
SetupQueueCopyW
SetupQueueDeleteW
SetupQueueRenameW
pSetupGetField
SetupGetStringFieldW
SetupGetMultiSzFieldW
SetupGetIntField
SetupGetBinaryField
SetupGetFieldCount
SetupFindNextLine
SetupFindFirstLineW
SetupCloseInfFile
SetupOpenInfFileW
SetupCommitFileQueueW

msvcrt

__winitenv
_initterm
_fpreset
_cexit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__setusermatherr
_wcmdln
__lconv_init
malloc
signal
strncpy
isspace
sprintf
iswctype
wcsstr
towupper
wcstoul
memcmp
memcpy
wcsncpy
wcsncmp
wcscmp
abs
memmove
_wcsnicmp
_wcsicmp
wcsrchr
wcscpy
wcschr
swscanf
wcstol
_vsnwprintf
wcslen
memset
strlen
_vsnprintf

kernel32

GetCurrentProcessId
Sleep
SetUnhandledExceptionFilter
GetStartupInfoW
RtlCompareMemory
ReleaseSemaphore
OutputDebugStringW
LoadLibraryW
GetSystemTimeAsFileTime
GetProcAddress
CreateSemaphoreW
WaitForSingleObject
SetEvent
QueryPerformanceCounter
ResetEvent
QueryDosDeviceW
HeapFree
HeapAlloc
GlobalDeleteAtom
GlobalAddAtomW
GetThreadId
GetProcessHeap
GetLogicalDriveStringsW
CreateThread
CreateProcessW
CreateEventW
GetLastError
DeviceIoControl
CreateFileW
CloseHandle
SetThreadLocale
GetThreadLocale
GetModuleHandleA
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
TlsGetValue
GetCurrentThreadId
GetTickCount
ResumeThread

ntdll

RtlAssert
NtClose
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
NtOpenKey
NtQuerySystemInformation
NtDeviceIoControlFile
NtFsControlFile
NtOpenFile
NtQueryVolumeInformationFile
NtReadFile
NtQuerySystemTime
RtlAllocateHeap
RtlFreeHeap
RtlReAllocateHeap
RtlFreeUnicodeString
RtlInitUnicodeString
RtlUnicodeStringToInteger
NtOpenDirectoryObject
LdrFindResource_U
LdrAccessResource
NtUnmapViewOfSection
NtMapViewOfSection
NtCreateSection
NtSetInformationFile
NtCreateFile
DbgPrint
NtQueryValueKey
NtQueryKey
RtlImageNtHeader
RtlEqualUnicodeString
RtlCopyUnicodeString
RtlCreateUnicodeString
NtWriteFile
NtQueryInformationFile
RtlTimeToTimeFields
RtlQueryRegistryValues

Sections

.text
Size: 264KB - Virtual size: 264KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 401KB - Virtual size: 401KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eb62837002990ada5c168ecd5d605925

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

user32

comctl32

shlwapi

setupapi

msvcrt

kernel32

ntdll

Sections

.text Size: 264KB - Virtual size: 264KB

.rdata Size: 69KB - Virtual size: 68KB

.data Size: 13KB - Virtual size: 16KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 401KB - Virtual size: 401KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 264KB - Virtual size: 264KB

.rdata
Size: 69KB - Virtual size: 68KB

.data
Size: 13KB - Virtual size: 16KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 401KB - Virtual size: 401KB

.reloc
Size: 6KB - Virtual size: 5KB