50004b62e9be1966cb6b139d46f0dbbbb7391f73030e190c11da85a0c16b11bf

Sharing

Copy URL Twitter E-mail

General

Target

50004b62e9be1966cb6b139d46f0dbbbb7391f73030e190c11da85a0c16b11bf
Size

16.0MB
MD5

112a589f26d17ed6d1191a67832b24db
SHA1

7f3142fca5743084110eebfdfd2e664dfd4e5054
SHA256

50004b62e9be1966cb6b139d46f0dbbbb7391f73030e190c11da85a0c16b11bf
SHA512

a10dbe59ac13442396077231326a9d856923ca56f40e68a6ef798088f3d8ebf305f518d9cc47625b1f94555b4f7a2ca80c91aa3489dfc3172bcdd9062d022522
SSDEEP

393216:3QhAdeE7EKdxg1tV1KT/QNwpMVBlkboGlb:3wEnXg1ETINwmRkbbb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
50004b62e9be1966cb6b139d46f0dbbbb7391f73030e190c11da85a0c16b11bf

Files

50004b62e9be1966cb6b139d46f0dbbbb7391f73030e190c11da85a0c16b11bf
.exe windows:5 windows x86

cc2d20e3a2e2d6ea9213c43ebb0a5e7a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32NextW
InitializeCriticalSection
GetExitCodeThread
SetEvent
CreateEventW
FreeResource
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
ResumeThread
ResetEvent
MulDiv
GetCurrentProcessId
DeviceIoControl
CreateFileA
lstrcmpA
lstrcmpiA
MoveFileExW
GetFileAttributesW
CreateProcessW
GetModuleHandleW
lstrlenA
Sleep
WaitForSingleObject
RaiseException
GetExitCodeProcess
GetCurrentProcess
LocalFree
InterlockedDecrement
InterlockedIncrement
GetProcAddress
FreeLibrary
FileTimeToSystemTime
CompareFileTime
SetFilePointer
SetEndOfFile
GetFileSize
GetFileInformationByHandle
FindCloseChangeNotification
FindFirstChangeNotificationW
WriteConsoleW
FindNextFileW
FlushFileBuffers
SetStdHandle
OutputDebugStringA
SetConsoleCtrlHandler
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
Process32FirstW
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
ReadConsoleW
GetConsoleMode
HeapReAlloc
HeapSize
GetStringTypeW
GetCurrentThread
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetACP
GetModuleFileNameA
FreeLibraryAndExitThread
ExitThread
GetModuleHandleExW
InterlockedFlushSList
RtlUnwind
TlsGetValue
ReleaseMutex
OpenThread
HeapWalk
HeapUnlock
HeapLock
SetFilePointerEx
LocalFileTimeToFileTime
QueryPerformanceCounter
GetStartupInfoW
WaitForSingleObjectEx
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
IsDebuggerPresent
TlsFree
TlsAlloc
SetWaitableTimer
CreateWaitableTimerW
CancelWaitableTimer
CreateToolhelp32Snapshot
WritePrivateProfileStringW
GetPrivateProfileStringW
GetFileSizeEx
OutputDebugStringW
CreateMutexW
lstrcmpiW
GetTickCount
SystemTimeToFileTime
GetLocalTime
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetCurrentThreadId
DecodePointer
lstrcpyW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetDiskFreeSpaceExW
FindResourceW
SizeofResource
LoadResource
LockResource
GetVersionExW
GetOEMCP
GetVolumeInformationW
FindFirstFileW
GetLogicalDriveStringsW
FindClose
MoveFileW
SearchPathW
DeleteFileW
SetFileAttributesW
CreateFileW
GetFullPathNameW
RemoveDirectoryW
CreateDirectoryW
GetCurrentDirectoryW
GetWindowsDirectoryW
GetTempFileNameW
GetTempPathW
GetSystemDirectoryW
lstrlenW
CloseHandle
SetFileTime
GetShortPathNameW
GetModuleFileNameW
LoadLibraryExW
LoadLibraryW
WideCharToMultiByte
MultiByteToWideChar
ReadFile
WriteFile
GetStdHandle
GetConsoleCP
TlsSetValue
IsBadWritePtr
IsBadReadPtr
CreateThread
ExpandEnvironmentStringsW
GetLastError
GetSystemTime
LocalAlloc
GetSystemInfo
GetProcessTimes
GetSystemTimeAsFileTime
DuplicateHandle
HeapFree
GetProcessHeap
DebugBreak
CopyFileW
OpenProcess
TerminateProcess
WaitForMultipleObjects
SetProcessWorkingSetSize
ExitProcess
VirtualQuery
GetFileTime
HeapAlloc
SetErrorMode
FileTimeToLocalFileTime

user32

IsClipboardFormatAvailable
OpenClipboard
MonitorFromPoint
wvsprintfW
UnhookWindowsHookEx
CallNextHookEx
DrawEdge
PostThreadMessageW
AttachThreadInput
PostQuitMessage
CallWindowProcW
GetClipboardData
GetClassInfoExW
CreateWindowExW
SetWindowPos
IsWindowVisible
IsIconic
GetDlgItem
GetDlgCtrlID
GetCapture
SetCapture
ReleaseCapture
SetTimer
KillTimer
EnableWindow
IsWindowEnabled
GetSystemMetrics
GetMenu
DrawTextW
UpdateWindow
CloseClipboard
EmptyClipboard
SetClipboardData
FindWindowExW
SendMessageTimeoutW
SubtractRect
MapVirtualKeyW
CharToOemW
GetKeyNameTextW
SetWindowsHookExW
FindWindowW
SetWindowLongW
MessageBoxW
GetActiveWindow
SetDlgItemTextW
DialogBoxParamW
CreateDialogParamW
RegisterClassExW
CharNextW
LoadStringW
UnregisterClassW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
SendMessageW
PostMessageW
DefWindowProcW
IsWindow
DestroyWindow
GetMonitorInfoW
GetForegroundWindow
GetWindowDC
UpdateLayeredWindow
EndDialog
CopyRect
SetRect
GetUpdateRect
ReleaseDC
SetForegroundWindow
MonitorFromWindow
SystemParametersInfoW
IsDialogMessageW
LoadImageW
LoadCursorW
GetWindow
GetWindowThreadProcessId
GetParent
GetDesktopWindow
GetWindowLongW
PtInRect
OffsetRect
InflateRect
FillRect
DrawFocusRect
GetSysColor
MapWindowPoints
ClientToScreen
SetCursor
AdjustWindowRectEx
GetWindowRect
GetClientRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
RedrawWindow
InvalidateRect
SetWindowRgn
EndPaint
BeginPaint
GetDC
ShowWindow

gdi32

OffsetViewportOrgEx
GetBitmapBits
CreatePatternBrush
CreateFontW
CreateDIBPatternBrushPt
GetDeviceCaps
PatBlt
CreateDCW
SetViewportOrgEx
GetObjectW
CreateDIBSection
SetTextColor
SetBkMode
SelectObject
GetStockObject
GetCurrentObject
DeleteDC
CreateSolidBrush
CreateRectRgnIndirect
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
CombineRgn
BitBlt
DeleteObject

advapi32

SetNamedSecurityInfoW
CopySid
RegEnumKeyW
RegSetKeySecurity
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegOpenKeyExA
RegEnumKeyExA
RegQueryValueExA
RegQueryValueExW
RegCreateKeyW
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegGetKeySecurity
GetNamedSecurityInfoW
SetEntriesInAclW
EqualSid
GetAce
LookupAccountNameW
SetSecurityInfo
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
GetSecurityInfo

shell32

SHGetPathFromIDListW
SHChangeNotify
SHGetSpecialFolderLocation
SHGetMalloc
SHFileOperationW
ShellExecuteW
CommandLineToArgvW
SHGetSpecialFolderPathW
ord165
SHLoadNonloadedIconOverlayIdentifiers
SHAppBarMessage
SHFreeNameMappings
SHGetFileInfoW
SHBrowseForFolderW

ole32

CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemRealloc
CoTaskMemFree
CLSIDFromProgID
CreateStreamOnHGlobal
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
OleInitialize
CoCreateGuid
CoTaskMemAlloc
OleUninitialize

oleaut32

VariantCopy
VariantClear
SysFreeString
SysAllocString
VarUI4FromStr
OleLoadPicture
VariantInit
SysAllocStringByteLen

shlwapi

PathCombineW
SHGetValueW
StrStrIW
PathIsPrefixW
PathRemoveFileSpecW
PathAddBackslashW
PathIsRootW
PathRemoveBackslashW
SHDeleteKeyW
SHSetValueW
ord176
StrCmpW
PathIsSameRootW
PathGetDriveNumberW
PathFindExtensionW
PathSkipRootW
PathStripPathW
StrToIntExW
SHGetValueA
PathFileExistsW
SHSetValueA
PathIsURLW
PathIsDirectoryW
PathMatchSpecW

comctl32

ImageList_Remove
ImageList_Duplicate
ImageList_Add
ImageList_Create
_TrackMouseEvent
ImageList_GetIconSize
ImageList_Draw
ImageList_Destroy
InitCommonControlsEx

msimg32

AlphaBlend

gdiplus

GdipAlloc
GdipFree
GdiplusShutdown
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromScan0
GdipDisposeImage
GdipCloneImage

setupapi

SetupIterateCabinetW

urlmon

URLDownloadToFileW
ObtainUserAgentString

wintrust

WTHelperProvDataFromStateData
CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust

crypt32

CertGetNameStringW

netapi32

Netbios

wininet

InternetOpenW
FtpGetFileSize
HttpQueryInfoW
HttpSendRequestExW
HttpOpenRequestW
InternetSetOptionA
InternetConnectW
InternetSetStatusCallbackW
InternetReadFile
InternetReadFileExA
FtpOpenFileW
HttpEndRequestW
InternetWriteFile
FtpCommandW
InternetGetLastResponseInfoW
InternetSetOptionW
InternetQueryOptionW
InternetCrackUrlW
CreateUrlCacheEntryW
GetUrlCacheEntryInfoW
CommitUrlCacheEntryW
InternetCloseHandle
InternetOpenUrlW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

psapi

EnumProcessModules
GetModuleFileNameExW
GetModuleBaseNameW
GetProcessMemoryInfo
EnumProcesses

comdlg32

GetSaveFileNameW
GetOpenFileNameW

Sections

.text
Size: 593KB - Virtual size: 593KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 82.2MB - Virtual size: 82.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cc2d20e3a2e2d6ea9213c43ebb0a5e7a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

setupapi

urlmon

wintrust

crypt32

netapi32

wininet

version

psapi

comdlg32

Sections

.text Size: 593KB - Virtual size: 593KB

.rdata Size: 123KB - Virtual size: 122KB

.data Size: 17KB - Virtual size: 37KB

.rsrc Size: 82.2MB - Virtual size: 82.2MB

.reloc Size: 27KB - Virtual size: 26KB

.text
Size: 593KB - Virtual size: 593KB

.rdata
Size: 123KB - Virtual size: 122KB

.data
Size: 17KB - Virtual size: 37KB

.rsrc
Size: 82.2MB - Virtual size: 82.2MB

.reloc
Size: 27KB - Virtual size: 26KB