9306eeb92f3196741f9d3eddeae230b56641bab43f0140a2e93b02c4645f8065

Sharing

Copy URL

Twitter E-mail

General

Target

9306eeb92f3196741f9d3eddeae230b56641bab43f0140a2e93b02c4645f8065
Size

709KB
MD5

019f4c3399f1d9aaf4d901f38502c361
SHA1

090ccb0aea49bcecfcbd060c615fa26be0d6ba4d
SHA256

9306eeb92f3196741f9d3eddeae230b56641bab43f0140a2e93b02c4645f8065
SHA512

cfbef4969a36c0b15b748297e9002714c996cbe5e13ebc1e62355b5ef698adc9e5479b6b50cd79e94af9670bfbc524a4396ce35221e4e00d0824cbf72178dbe2
SSDEEP

6144:AYSbc+5ITSnWFZSTPXPq1cBMPGUauP7NXBTa2HRz217o+Bu0OAUsQF:JSbc+5qSLTPEL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9306eeb92f3196741f9d3eddeae230b56641bab43f0140a2e93b02c4645f8065

Files

9306eeb92f3196741f9d3eddeae230b56641bab43f0140a2e93b02c4645f8065
.exe windows:5 windows x64

63a8f778ba5bffc3980aa63b94854dac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCloseKey
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
A_SHAInit
A_SHAUpdate
A_SHAFinal
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCreateKeyExW
RegSetValueExW

comctl32

ImageList_Create
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_Remove
ord328
ord386
ord334
ord332
DrawShadowText
InitCommonControls

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
GetStockObject
PatBlt
SelectObject

wininet

InternetCloseHandle
HttpQueryInfoW
FtpGetFileSize
InternetQueryOptionA
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetSetStatusCallbackW
InternetReadFile
InternetOpenUrlW
InternetOpenW

user32

BeginPaint
SendMessageW
SetWindowTextW
BeginDeferWindowPos
IsWindow
GetCapture
EndPaint
EndDeferWindowPos
EnableMenuItem
DrawIconEx
DestroyWindow
DestroyIcon
DefWindowProcW
DeferWindowPos
CreateWindowExW
EmptyClipboard
GetClientRect
SetProcessDefaultLayout
FindWindowW
SendDlgItemMessageW
CheckRadioButton
GetWindowPlacement
TrackPopupMenu
SetMenuDefaultItem
SetForegroundWindow
SetClipboardData
PeekMessageW
OpenClipboard
MsgWaitForMultipleObjects
GetMenuItemInfoW
EnumDisplaySettingsW
EnableWindow
CallWindowProcW
DestroyMenu
CloseClipboard
SetWindowLongW
SetDlgItemTextW
MessageBoxA
InflateRect
GetWindowLongW
GetDlgItem
GetClassLongPtrW
EndDialog
DialogBoxParamW
CreateDialogParamW
TranslateMessage
TranslateAcceleratorW
SystemParametersInfoW
ShowWindow
RedrawWindow
PostQuitMessage
PostMessageW
LoadAcceleratorsW
GetMessageW
GetKeyState
GetFocus
DispatchMessageW
UpdateWindow
SetWindowPos
SetWindowLongPtrW
SetTimer
SetFocus
SetCursor
SetCapture
ScreenToClient
ReleaseDC
ReleaseCapture
RegisterClassExW
MessageBoxW
LoadMenuW
LoadImageW
LoadIconW
LoadCursorW
KillTimer
IsWindowVisible
InvalidateRect
GetWindowTextLengthW
GetWindowTextW
GetWindowRect
GetWindowLongPtrW
GetSysColorBrush
GetSysColor
GetSubMenu
GetParent
GetMenu
GetDC
GetCursorPos

shell32

SHGetPathFromIDListW
SHGetFolderPathW
StrStrIW
SHGetSpecialFolderPathW
ShellExecuteExW
SHBrowseForFolderW
CommandLineToArgvW
ShellAboutW
ShellExecuteW
ExtractIconW

shlwapi

PathAppendW
PathCanonicalizeW
PathRemoveExtensionW
PathIsURLW
StrFormatByteSizeW
StrToIntExW
StrCmpIW
PathCreateFromUrlW
StrToIntW
PathParseIconLocationW
PathIsDirectoryW
PathFileExistsW

ole32

CoUninitialize
CoTaskMemFree
CoInitializeEx

setupapi

SetupCloseInfFile
SetupFindFirstLineW
SetupOpenInfFileW
SetupGetStringFieldW
SetupFindNextLine

gdiplus

GdiplusShutdown
GdiplusStartup
GdipCreateSolidFill
GdipGetImageWidth
GdipGetImageHeight
GdipDisposeImage
GdipSetSmoothingMode
GdipFillEllipse
GdipDrawImageRect
GdipDeleteGraphics
GdipCreateFromHDC
GdipDeleteBrush
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipFree
GdipAlloc

msvcrt

strrchr
strcmp
__lconv_init
signal
_itow
_itoa
_exit
wcscpy
wcscat
raise
_snwprintf
_onexit
__dllonexit
_unlock
_lock
calloc
_wcmdln
__winitenv
_initterm
_fpreset
_cexit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__setusermatherr
??3@YAXPEAX@Z
__C_specific_handler
_vsnwprintf
_beginthreadex
_vscprintf
vsprintf
wcscspn
memset
_purecall
??2@YAPEAX_K@Z
wcscmp
wcslen
memmove
memcpy
free
malloc
vswprintf
_vscwprintf
wcstol
wcschr
wcsstr
wcsspn
realloc
sin
sqrt
floor
strlen
swprintf
_wcsicmp
wcsrchr
sprintf

kernel32

DeleteCriticalSection
GetModuleHandleExW
TlsGetValue
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
OutputDebugStringW
LoadLibraryExW
IsDebuggerPresent
Sleep
SetUnhandledExceptionFilter
GetStartupInfoW
GetConsoleMode
GetFileType
FindResourceExW
WriteConsoleW
GetConsoleOutputCP
GetUserDefaultUILanguage
GetCommandLineW
AttachConsole
AllocConsole
GetStdHandle
CreateMutexW
GetEnvironmentVariableW
GlobalUnlock
GlobalLock
GlobalAlloc
GetModuleFileNameW
CreateProcessW
LocalFree
GetModuleHandleW
GetFileAttributesW
FormatMessageW
CopyFileW
UnmapViewOfFile
MapViewOfFile
GetFileSizeEx
CreateFileMappingW
GetLocaleInfoW
GetPrivateProfileSectionW
WideCharToMultiByte
MultiByteToWideChar
SetFilePointer
ReadFile
GetProcAddress
WaitForSingleObject
SetEvent
OutputDebugStringA
CreateEventW
WriteFile
VirtualFree
VirtualAlloc
SetLastError
LoadLibraryW
LeaveCriticalSection
GetTempFileNameW
GetCurrentThreadId
GetCurrentProcess
FreeLibrary
FlushInstructionCache
EnterCriticalSection
CreateFileW
CloseHandle
GetUserDefaultLCID
GetDateFormatW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExpandEnvironmentStringsW
SizeofResource
RemoveDirectoryW
RaiseException
LockResource
LoadResource
InitializeCriticalSection
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
GetLastError
FindResourceW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CreateDirectoryW
HeapSize

ntdll

DbgPrint

Sections

.text
Size: 159KB - Virtual size: 159KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

ATL
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 511KB - Virtual size: 510KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63a8f778ba5bffc3980aa63b94854dac

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

comctl32

gdi32

wininet

user32

shell32

shlwapi

ole32

setupapi

gdiplus

msvcrt

kernel32

ntdll

Sections

.text Size: 159KB - Virtual size: 159KB

.rdata Size: 25KB - Virtual size: 24KB

.data Size: 1KB - Virtual size: 14KB

.pdata Size: 10KB - Virtual size: 9KB

ATL Size: 512B - Virtual size: 16B

.rsrc Size: 511KB - Virtual size: 510KB

.reloc Size: 512B - Virtual size: 472B

.text
Size: 159KB - Virtual size: 159KB

.rdata
Size: 25KB - Virtual size: 24KB

.data
Size: 1KB - Virtual size: 14KB

.pdata
Size: 10KB - Virtual size: 9KB

ATL
Size: 512B - Virtual size: 16B

.rsrc
Size: 511KB - Virtual size: 510KB

.reloc
Size: 512B - Virtual size: 472B