4faf31400f241ff99e2f6fd1911c6911cfe5f14f057b50d244add05e6bc09059

Sharing

Copy URL Twitter E-mail

General

Target

4faf31400f241ff99e2f6fd1911c6911cfe5f14f057b50d244add05e6bc09059
Size

8.1MB
MD5

60c53253dcdb828e3eabb09fb54d56f0
SHA1

200d769e452e35c3cdf2611a569e6045ad37be8f
SHA256

4faf31400f241ff99e2f6fd1911c6911cfe5f14f057b50d244add05e6bc09059
SHA512

1a85ed519affc65a10ff9b49265686808f13bebdad13a9e28a0b013f022e629c7ec052663e38fefa2095f737f5ad2278ec0c75984f9ba463254eeaa37cf859e0
SSDEEP

196608:QNiucWPQ1taVJY/0VMpvZYwM3rizWccRSbeBZ6NCb8RCT2k9vo:Qs1EQr/VpbWriCcsce/T8xuQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4faf31400f241ff99e2f6fd1911c6911cfe5f14f057b50d244add05e6bc09059

Files

4faf31400f241ff99e2f6fd1911c6911cfe5f14f057b50d244add05e6bc09059
.exe windows:5 windows x86

9d73150d08f5eecd7da9b4a65d91504f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

rpcrt4

UuidCreate

advapi32

RegEnumKeyExW
RegEnumValueW
RegQueryValueExW
RegOpenKeyExW
CloseServiceHandle
StartServiceW
QueryServiceStatus
QueryServiceConfigW
ChangeServiceConfigW
ControlService
OpenSCManagerW
OpenServiceW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyW
RegQueryValueW
RegCloseKey

kernel32

GetStringTypeW
IsProcessorFeaturePresent
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
SizeofResource
LockResource
LoadResource
FindResourceW
GetModuleFileNameW
lstrcpyW
GetCurrentDirectoryW
GetTickCount
UnhandledExceptionFilter
Sleep
CreateThread
LCMapStringW
CloseHandle
GetOEMCP
GetPrivateProfileIntW
CreateFileW
CreateDirectoryW
GetUserDefaultLangID
DeviceIoControl
CreateEventW
WriteFile
GetOverlappedResult
ReadFile
GetLastError
FreeLibrary
GetUserDefaultUILanguage
LoadLibraryW
LocalAlloc
LocalFree
InterlockedExchange
LoadLibraryExW
GetLocaleInfoW
GetProcAddress
GetModuleHandleW
GlobalAlloc
lstrcmpW
GlobalLock
WaitForSingleObject
IsValidCodePage
WideCharToMultiByte
SetLastError
DeactivateActCtx
ActivateActCtx
GetACP
GetCPInfo
MultiByteToWideChar
IsDebuggerPresent
TerminateProcess
QueryPerformanceCounter
HeapCreate
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
SetUnhandledExceptionFilter
GetFileType
SetStdHandle
VirtualQuery
GetSystemInfo
VirtualAlloc
GetSystemTimeAsFileTime
HeapSize
HeapQueryInformation
HeapReAlloc
RaiseException
ExitThread
RtlUnwind
ExitProcess
HeapFree
GetSystemDefaultUILanguage
ConvertDefaultLocale
HeapAlloc
DecodePointer
EncodePointer
GetStartupInfoW
HeapSetInformation
GetCommandLineW
FindResourceExW
VirtualProtect
SearchPathW
GetProfileIntW
GetNumberFormatW
GetWindowsDirectoryW
GetTempPathW
GetTempFileNameW
GetFileTime
GetFileSizeEx
GetFileAttributesW
FileTimeToLocalFileTime
GetFileAttributesExW
SetErrorMode
FileTimeToSystemTime
GlobalGetAtomNameW
lstrlenA
InterlockedIncrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
GlobalFlags
GetSystemDirectoryW
GetFullPathNameW
GetVolumeInformationW
FindFirstFileW
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
DeleteFileW
lstrcmpiW
GetThreadLocale
InterlockedDecrement
GetCurrentThreadId
ReleaseActCtx
CreateActCtxW
GlobalFindAtomW
GetVersionExW
CompareStringW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CopyFileW
GlobalSize
FormatMessageW
MulDiv
GetCurrentProcessId
GlobalAddAtomW
ResumeThread
SetThreadPriority
GlobalUnlock
GetPrivateProfileStringW
lstrlenW
WritePrivateProfileStringW
FreeResource
GlobalFree
lstrcmpA
GlobalDeleteAtom
GetCurrentThread

user32

FrameRect
EmptyClipboard
CloseClipboard
SetClipboardData
OpenClipboard
GetIconInfo
HideCaret
InvertRect
RegisterClipboardFormatW
LockWindowUpdate
SetCursorPos
CreateAcceleratorTableW
GetKeyboardState
GetKeyboardLayout
ToUnicodeEx
DrawFocusRect
DrawFrameControl
DrawEdge
DrawIconEx
SetClassLongW
DestroyAcceleratorTable
SetParent
UnpackDDElParam
ReuseDDElParam
LoadImageW
LoadAcceleratorsW
InsertMenuItemW
BringWindowToTop
TranslateAcceleratorW
UnregisterClassW
CopyImage
GetMenuDefaultItem
SetMenuDefaultItem
CreatePopupMenu
IsMenu
MonitorFromPoint
UpdateLayeredWindow
EnableScrollBar
UnionRect
IsZoomed
GetAsyncKeyState
NotifyWinEvent
SetWindowRgn
DestroyIcon
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
IntersectRect
SetRect
IsRectEmpty
CopyAcceleratorTableW
OffsetRect
CharNextW
KillTimer
SetTimer
RealChildWindowFromPoint
GetSysColorBrush
SetLayeredWindowAttributes
EnumDisplayMonitors
SetRectEmpty
DeleteMenu
WaitMessage
ReleaseCapture
LoadCursorW
WindowFromPoint
SetCapture
CharUpperW
SystemParametersInfoW
DestroyMenu
GetMenuItemInfoW
InflateRect
LoadMenuW
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
CopyIcon
CheckDlgButton
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetClassLongW
SetPropW
GetPropW
RemovePropW
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
GetMessagePos
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
DrawMenuBar
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
RedrawWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
SetWindowLongW
MapVirtualKeyW
GetKeyNameTextW
CopyRect
UnhookWindowsHookEx
GetWindowRect
PtInRect
GetSysColor
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
ScreenToClient
CharUpperBuffW
PostThreadMessageW
DefFrameProcW
GetWindowRgn
DestroyCursor
SubtractRect
MapVirtualKeyExW
IsCharLowerW
GetDoubleClickTime
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetMenuStringW
GetMenuItemID
InsertMenuW
GetMenuItemCount
GetSubMenu
RemoveMenu
GetClassNameW
GetUpdateRect
IsClipboardFormatAvailable
CreateMenu
TranslateMDISysAccel
InvalidateRect
UpdateWindow
FillRect
DrawStateW
GetWindowThreadProcessId
GetLastActivePopup
ShowOwnedPopups
SetCursor
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
IsWindowVisible
GetKeyState
PeekMessageW
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetWindowLongW
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
RegisterWindowMessageW
GetWindow
SetWindowContextHelpId
GetParent
MapDialogRect
SetWindowPos
PostQuitMessage
PostMessageW
MessageBoxW
DrawIcon
GetClientRect
GetSystemMetrics
IsIconic
SendMessageW
AppendMenuW
GetSystemMenu
LoadIconW
EnableWindow
ScrollWindow
DefMDIChildProcW

gdi32

LineTo
MoveToEx
SetTextAlign
GetLayout
SetLayout
SelectClipRgn
CreateRectRgn
GetViewportExtEx
GetWindowExtEx
BitBlt
GetPixel
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
CreateCompatibleDC
SelectPalette
GetObjectType
CreatePen
CreateHatchBrush
SetBkColor
PatBlt
CreateFontIndirectW
GetTextExtentPoint32W
CreateDIBitmap
CreateCompatibleBitmap
GetTextMetricsW
GetTextCharsetInfo
ExcludeClipRect
GetTextColor
GetRgnBox
SetRectRgn
CombineRgn
GetMapMode
DPtoLP
CreateRoundRectRgn
CreateDIBSection
CreatePolygonRgn
CreateEllipticRgn
Polyline
Ellipse
Polygon
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
OffsetRgn
SetDIBColorTable
StretchBlt
SetPixel
Rectangle
EnumFontFamiliesExW
ExtFloodFill
SetPaletteEntries
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
GetTextFaceW
SetPixelV
EnumFontFamiliesW
IntersectClipRect
RestoreDC
SaveDC
CreateDCW
CopyMetaFileW
GetDeviceCaps
GetClipBox
SetMapMode
SetTextColor
SetROP2
SetPolyFillMode
GetBkColor
SetBkMode
GetStockObject
GetObjectW
CreateSolidBrush
DeleteObject
CreateRectRgnIndirect
CreateBitmap

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

shell32

DragQueryFileW
SHGetSpecialFolderLocation
SHGetMalloc
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHAppBarMessage
ShellExecuteW
SHGetDesktopFolder
DragFinish

comctl32

ImageList_GetIconSize
InitCommonControlsEx

shlwapi

PathFindFileNameW
PathStripToRootW
PathIsUNCW
PathFindExtensionW
PathRemoveFileSpecW

ole32

StgOpenStorageOnILockBytes
CoGetClassObject
CoUninitialize
CoInitialize
CoCreateInstance
OleDuplicateData
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoInitializeEx
CreateStreamOnHGlobal
OleIsCurrentClipboard
OleFlushClipboard
DoDragDrop
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleLockRunning
CoRevokeClassObject
CoRegisterMessageFilter
OleGetClipboard
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
CoTaskMemAlloc
ReleaseStgMedium
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
CoCreateGuid

oleaut32

SysFreeString
VarBstrFromDate
VariantCopy
SystemTimeToVariantTime
VariantTimeToSystemTime
OleCreateFontIndirect
SysStringLen
VariantInit
VariantChangeType
VariantClear
SysAllocStringLen
SysAllocString
SafeArrayDestroy

oledlg

OleUIBusyW

gdiplus

GdipDrawImageI
GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree

iphlpapi

GetAdaptersAddresses

ws2_32

__WSAFDIsSet
select
connect
ioctlsocket
recv
send
recvfrom
sendto
inet_addr
setsockopt
closesocket
shutdown
bind
htons
gethostbyname
socket
inet_ntoa
WSACleanup
WSAStartup

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

imm32

ImmGetOpenStatus
ImmReleaseContext
ImmGetContext

winmm

PlaySoundW

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 293KB - Virtual size: 292KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40.1MB - Virtual size: 40.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 269KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9d73150d08f5eecd7da9b4a65d91504f

Headers

DLL Characteristics

File Characteristics

Imports

version

rpcrt4

advapi32

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

gdiplus

iphlpapi

ws2_32

oleacc

imm32

winmm

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 293KB - Virtual size: 292KB

.data Size: 25KB - Virtual size: 63KB

.rsrc Size: 40.1MB - Virtual size: 40.1MB

.reloc Size: 269KB - Virtual size: 268KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 293KB - Virtual size: 292KB

.data
Size: 25KB - Virtual size: 63KB

.rsrc
Size: 40.1MB - Virtual size: 40.1MB

.reloc
Size: 269KB - Virtual size: 268KB