781d8e1882b38a6e7ec75d49e513e0d7f8a54db384910c5d46db67b3cefa1494

Sharing

Copy URL Twitter E-mail

General

Target

781d8e1882b38a6e7ec75d49e513e0d7f8a54db384910c5d46db67b3cefa1494
Size

11.3MB
MD5

ddaea4e6b4f69ddec3f2ce88d76b9c34
SHA1

caa9f874cbb2f49a0f32bcdfdf227948ac638585
SHA256

781d8e1882b38a6e7ec75d49e513e0d7f8a54db384910c5d46db67b3cefa1494
SHA512

8cc116dc6d4ae28c07d4ee8743acb00e118f0e1c8e16feac2cee4e05e09618fc41fe4e4f594bc545c72e221d854a56e16ef6a21ddb916d58237cedd9a4e0bb4e
SSDEEP

196608:vywwzIssSrcwaafeIWK3erZC9HsIj3XRD9Ovw/650r2/SKzT7UO6IVHF+3esjqpD:zwzIf8vake4OrZC9HsIDXNxrqSKzTRCy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
781d8e1882b38a6e7ec75d49e513e0d7f8a54db384910c5d46db67b3cefa1494

Files

781d8e1882b38a6e7ec75d49e513e0d7f8a54db384910c5d46db67b3cefa1494
.exe windows:5 windows x86

c18017f4402a3bece032367a1aed89f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateThread
GetExitCodeThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateEventW
LoadLibraryExW
GetModuleFileNameW
WritePrivateProfileStringW
GetProcAddress
LocalAlloc
LocalFree
VirtualAlloc
VirtualFree
OpenProcess
GetCurrentProcessId
GetLastError
lstrlenW
GetModuleHandleW
QueryDosDeviceW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
DecodePointer
InterlockedIncrement
InterlockedDecrement
FreeLibrary
RaiseException
InitializeCriticalSectionAndSpinCount
LoadResource
SizeofResource
lstrcmpiW
LoadLibraryW
SetThreadPriority
ReleaseSemaphore
CreateEventA
GetDiskFreeSpaceExW
GetTempPathW
WriteFile
LockResource
MultiByteToWideChar
CreateThread
WideCharToMultiByte
ReadFile
GetLogicalDriveStringsW
FindResourceW
GetFileSize
SetEndOfFile
GetFullPathNameW
DeleteFileW
CreateFileW
RemoveDirectoryW
GetSystemDirectoryW
GetPrivateProfileStringW
CloseHandle
DeviceIoControl
Sleep
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
FlushFileBuffers
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
SetFilePointerEx
FreeLibraryAndExitThread
ExitThread
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
WriteConsoleW
GetModuleHandleExW
RtlUnwind
ExpandEnvironmentStringsW
PeekNamedPipe
GetStdHandle
GetFileType
WaitForMultipleObjects
GetSystemDirectoryA
LoadLibraryA
SleepEx
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
ResetEvent
UnhandledExceptionFilter
IsProcessorFeaturePresent
FindClose
CreateDirectoryW
FindFirstFileW
FindNextFileW
MoveFileExW
CopyFileW
GetWindowsDirectoryW
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
GetVolumeInformationW
GetTickCount
GetCurrentProcess
GetCurrentThreadId
GetSystemInfo
FormatMessageW
GetVersionExW
GetLongPathNameW
lstrcpyW
FileTimeToSystemTime
GlobalAlloc
GlobalFree
TerminateProcess
GetExitCodeProcess
CreateProcessW
ReleaseMutex
CreateMutexW
GetFileAttributesW
AreFileApisANSI
SetUnhandledExceptionFilter
SetErrorMode
GetLocalTime
GetCommandLineW
OutputDebugStringA
SetPriorityClass
GetACP
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
SetFilePointer
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
FreeResource
ExitProcess
MulDiv
VerSetConditionMask
VerifyVersionInfoW
lstrcpynW
QueryPerformanceCounter
EncodePointer
SetLastError
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
FindFirstFileA
FindNextFileA
ExpandEnvironmentStringsA
OutputDebugStringW
CreateFileA
CreateSemaphoreA

user32

SetWindowLongW
GetWindowLongW
InvalidateRect
SetTimer
SetForegroundWindow
PostQuitMessage
MessageBoxA
MapVirtualKeyExW
GetKeyNameTextW
IsWindow
IsRectEmpty
SetRectEmpty
SetWindowPos
CharNextW
ShowWindow
PostMessageW
FindWindowW
wsprintfW
LoadStringW
GetKeyState
SetCursor
InflateRect
UnionRect
OffsetRect
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
CreateWindowExW
DestroyWindow
IsWindowVisible
IsIconic
IsZoomed
SetFocus
GetActiveWindow
GetFocus
SetCapture
ReleaseCapture
KillTimer
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
GetClientRect
GetWindowRect
GetCursorPos
ScreenToClient
MapWindowPoints
GetSysColor
IntersectRect
PtInRect
GetParent
GetWindow
LoadImageW
MonitorFromWindow
GetMonitorInfoW
CharPrevW
DrawTextW
FillRect
SetRect
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
UpdateWindow
SetWindowRgn
MessageBoxW
UpdateLayeredWindow
MoveWindow
IsWindowEnabled
GetWindowRgn
CreatePopupMenu
DestroyMenu
EnableMenuItem
AppendMenuW
TrackPopupMenu
CreateCaret
GetCaretBlinkTime
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
EqualRect
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
wsprintfA
DrawTextA
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
GetKeyboardLayout

advapi32

CreateServiceW
CloseServiceHandle
OpenSCManagerW
RegFlushKey
DeleteService
StartServiceW
OpenServiceW
DuplicateTokenEx
RevertToSelf
ImpersonateLoggedOnUser
OpenProcessToken
GetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupAccountSidW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyW
RegEnumKeyW
RegCloseKey
RegQueryValueExA

shell32

SHGetFolderPathW
DragQueryFileW
ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderPathW

ole32

OleDuplicateData
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
OleLockRunning
ReleaseStgMedium
DoDragDrop
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoInitialize
CoUninitialize

oleaut32

VarUI4FromStr
SysAllocString
VariantClear
VariantInit
SysFreeString

iphlpapi

GetAdaptersInfo

comctl32

_TrackMouseEvent
InitCommonControlsEx
ord17

gdiplus

GdipAddPathLine
GdipDeletePath
GdipCreatePath
GdiplusShutdown
GdiplusStartup
GdipDrawImageRectI
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
ord1
GdipCloneImage
GdipDeleteBrush
GdipAlloc
GdipCreateSolidFill
GdipCreatePen1
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipSetStringFormatTrimming
GdipDisposeImage
GdipDeletePen
GdipSetPenMode
GdipLoadImageFromStream
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipDrawRectangleI
GdipDrawPath
GdipFillRectangleI
GdipFillPath
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipFree

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow

psapi

EnumProcessModules
GetModuleFileNameExW
GetProcessImageFileNameW

crypt32

CryptMsgClose
CryptQueryObject
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptMsgGetParam

shlwapi

PathFileExistsW

urlmon

URLDownloadToFileW

ws2_32

sendto
recvfrom
select
__WSAFDIsSet
getservbyname
getservbyport
gethostbyaddr
inet_ntoa
inet_addr
htonl
WSASetLastError
listen
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
socket
closesocket
WSAGetLastError
send
recv
WSACleanup
WSAStartup
gethostname
ioctlsocket
gethostbyname
accept
setsockopt

gdi32

GetObjectA
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBitmap
CreateFontIndirectW
CreatePen
DeleteDC
DeleteObject
GetDeviceCaps
GetStockObject
AddFontMemResourceEx
RemoveFontMemResourceEx
Rectangle
RestoreDC
SaveDC
SelectObject
CloseEnhMetaFile
CreateEnhMetaFileW
GetEnhMetaFileHeader
PlayEnhMetaFile
GetTextMetricsW
GetObjectW
SetWindowOrgEx
CombineRgn
CreateBitmap
CreatePenIndirect
CreateRectRgnIndirect
CreateRoundRectRgn
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
RectVisible
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
StretchDIBits
SetStretchBltMode
SetTextColor
SetBitmapBits
GetBitmapBits
GetTextExtentPointA
CreateDIBSection
MoveToEx
TextOutW
GdiFlush
CreateRectRgn
CreatePatternBrush
PtInRegion
BitBlt

Exports

Exports

AddInjectPreventDll
AddProtectFile
AddProtectProcess
AddProtectReg
AddTrustProcess
ClearInjectPreventDll
ClearProtectFile
ClearProtectProcess
ClearProtectReg
ClearTrustProcess
DeleteInjectPreventDll
DeleteProtectFile
DeleteProtectProcess
DeleteProtectReg
DeleteTrustProcess
GetAndShowProtectFileOperate
GetInjectPreventDllList
GetProcessInformation
GetProtectFileList
GetProtectProcessList
GetProtectRegList
GetTrustProcessList
SHDeleteFile
SHDeleteSelfProtectService
SHGetDumpPath
SHRegDeleteKey
SHRegDeleteValueKey
SHRegSetValueKey
SHStartSelfProtectService
SHTerminateProcessById
StartCreateProcessCallBack
StartLoadImageCallBack
StartMiniFilter
StartObjectCallBack
StartRegCallBack
StopCreateProcessCallBack
StopLoadImageCallBack
StopMiniFilter
StopObjectCallBack
StopRegCallBack

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 222KB - Virtual size: 221KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13.1MB - Virtual size: 13.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c18017f4402a3bece032367a1aed89f8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

iphlpapi

comctl32

gdiplus

imm32

psapi

crypt32

shlwapi

urlmon

ws2_32

gdi32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 222KB - Virtual size: 221KB

.data Size: 10KB - Virtual size: 28KB

.rsrc Size: 13.1MB - Virtual size: 13.1MB

.reloc Size: 59KB - Virtual size: 59KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 222KB - Virtual size: 221KB

.data
Size: 10KB - Virtual size: 28KB

.rsrc
Size: 13.1MB - Virtual size: 13.1MB

.reloc
Size: 59KB - Virtual size: 59KB