1af58873c29ec7fe6759b985c67f6f7d085480edd9f031448f9049cec4a46933

Sharing

Copy URL Twitter E-mail

General

Target

1af58873c29ec7fe6759b985c67f6f7d085480edd9f031448f9049cec4a46933
Size

12.6MB
MD5

e6bba7a97625e4c79a548ccec516c578
SHA1

49c757c20c9ba5b74da0e236ccd677b5a573093e
SHA256

1af58873c29ec7fe6759b985c67f6f7d085480edd9f031448f9049cec4a46933
SHA512

5695565ec849a23231047a53e834e167b5e8ed9bcddedf9acbe1199f122db0d76be077f61a0d477e167f303463b00b763598f1b62d55edccfe08be60843b3631
SSDEEP

196608:5Fxmj0rGz6pUwrpIgcT0XWoGcW/SYKB6Fls9aYxT3VvLAlFxfgG+dmf:rkYrGz6pPrL7GoRWfe6TIxZkFxMm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1af58873c29ec7fe6759b985c67f6f7d085480edd9f031448f9049cec4a46933

Files

1af58873c29ec7fe6759b985c67f6f7d085480edd9f031448f9049cec4a46933
.exe windows:5 windows x86

9ff82bbfd1b001a6136044199675fd09

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenMutexW
IsBadReadPtr
CopyFileW
GetTempPathW
LoadLibraryExW
lstrcmpiW
SetUnhandledExceptionFilter
GetCurrentProcessId
VirtualProtect
GetCommandLineA
FindNextFileW
FindFirstFileW
FindClose
CreateThread
InterlockedDecrement
InterlockedIncrement
CreateProcessW
PeekNamedPipe
CreatePipe
GetTickCount
SetHandleInformation
ReadFile
WriteFile
Sleep
TerminateProcess
QueryPerformanceFrequency
GetSystemDirectoryW
GetSystemWindowsDirectoryW
FreeResource
InterlockedCompareExchange
CreateFileA
lstrcmpiA
lstrcmpA
DeviceIoControl
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetModuleHandleW
GetCurrentProcess
MoveFileW
DeleteFileW
CreateDirectoryW
WideCharToMultiByte
GetPrivateProfileStringA
SetLastError
WaitForSingleObject
GetCurrentThreadId
OpenFileMappingW
UnmapViewOfFile
MapViewOfFile
WritePrivateProfileStringW
GetPrivateProfileStringW
MultiByteToWideChar
GetCommandLineW
CreateMutexW
CloseHandle
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetModuleFileNameW
LoadLibraryW
SizeofResource
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindFirstFileExW
WriteConsoleW
ReadConsoleW
SetEndOfFile
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetACP
GetStdHandle
ExitProcess
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileType
GetFileAttributesExW
GetModuleHandleExW
ExitThread
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
ReleaseSemaphore
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
RaiseException
GetProcessHeap
HeapSize
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetProcAddress
FreeLibrary
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
InterlockedExchangeAdd
LockResource
DecodePointer
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
GetStringTypeW
FormatMessageW
DuplicateHandle
WaitForSingleObjectEx
SwitchToThread
GetCurrentThread
TryEnterCriticalSection
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
QueryPerformanceCounter
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
CreateFileMappingW
GetFileSizeEx
CreateFileW
FlushFileBuffers
LocalFree
ReleaseMutex
UnhandledExceptionFilter
SetEvent
GetStartupInfoW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetVersionExW
VirtualQuery
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
GetSystemInfo
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
GlobalFree
GetProcAddress
LocalAlloc
LocalFree
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle

user32

UnregisterClassW
SendMessageTimeoutW
SetParent
SetWindowTextW
IsIconic
SetWindowPos
PostQuitMessage
MonitorFromWindow
ExitWindowsEx
CharNextW
DispatchMessageW
TranslateMessage
wsprintfW
GetSystemMetrics
SystemParametersInfoW
CopyRect
UnionRect
EqualRect
PtInRect
SetCursor
DrawFocusRect
ShowWindow
SendNotifyMessageW
RegisterWindowMessageW
PeekMessageW
GetMessageW
WaitForInputIdle
LoadCursorW
GetParent
SetWindowLongW
GetWindowLongW
OffsetRect
ScreenToClient
GetWindowRect
GetClientRect
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
KillTimer
SetTimer
ReleaseCapture
SetCapture
GetAsyncKeyState
DestroyWindow
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
PostMessageW
SendMessageW
FindWindowW
GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation

gdi32

DeleteObject
RestoreDC
SaveDC
CreateDIBSection
BitBlt
GetDeviceCaps
SetBkColor
ExtTextOutW
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
SetViewportOrgEx
CreateFontW
EnumFontFamiliesW
RectVisible
OffsetViewportOrgEx
SelectObject
GetObjectW

advapi32

RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegSetValueExW
RegQueryInfoKeyW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegGetValueW
GetTokenInformation

shell32

ShellExecuteExW
SHGetSpecialFolderPathW
ShellExecuteW

ole32

CoUninitialize
CoCreateInstance
StringFromGUID2
CoCreateGuid
CoTaskMemAlloc
CoInitialize
CreateStreamOnHGlobal
CLSIDFromString
CoTaskMemFree
CoTaskMemRealloc

oleaut32

LoadTypeLi
SysStringLen
LoadRegTypeLi
VarUI4FromStr
DispCallFunc
VariantClear
VariantInit
SysFreeString
GetErrorInfo

shlwapi

PathFileExistsW
PathRemoveFileSpecW
PathAppendW
PathIsRelativeW
StrStrIA
StrStrIW
PathUnquoteSpacesW
PathIsDirectoryW
SHGetValueW
PathAppendA
PathFileExistsA
PathRemoveFileSpecA
PathFindFileNameW
StrCmpIW
SHGetValueA
SHSetValueA
StrCmpNIW
StrTrimA
PathCombineW

urlmon

URLDownloadToFileW
URLDownloadToCacheFileW

gdiplus

GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdiplusStartup
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCreateStringFormat
GdipMeasureString
GdipDrawString
GdipSetStringFormatAlign
GdipGetImageHeight
GdipCreateFont
GdipAlloc
GdipFree
GdipDeleteBrush
GdipCreateSolidFill
GdipDeleteFontFamily
GdipGetImageWidth
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetTextRenderingHint
GdipFillRectangleI
GdipDrawImageRectRect
GdipDrawImageRectRectI
GdipCreateFontFamilyFromName

comctl32

InitCommonControlsEx
_TrackMouseEvent

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

crypt32

CertGetNameStringW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

wtsapi32

WTSSendMessageW

Sections

.text
Size: 828KB - Virtual size: 828KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.upx0
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.upx1
Size: 6.5MB - Virtual size: 6.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 588KB - Virtual size: 588KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.l1
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9ff82bbfd1b001a6136044199675fd09

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

urlmon

gdiplus

comctl32

version

crypt32

wintrust

wininet

iphlpapi

wtsapi32

Sections

.text Size: 828KB - Virtual size: 828KB

.rdata Size: 192KB - Virtual size: 192KB

.data Size: 36KB - Virtual size: 36KB

.upx0 Size: 4.5MB - Virtual size: 4.5MB

.upx1 Size: 6.5MB - Virtual size: 6.5MB

.reloc Size: 4KB - Virtual size: 4KB

.rsrc Size: 588KB - Virtual size: 588KB

.l1 Size: 18KB - Virtual size: 18KB

.text
Size: 828KB - Virtual size: 828KB

.rdata
Size: 192KB - Virtual size: 192KB

.data
Size: 36KB - Virtual size: 36KB

.upx0
Size: 4.5MB - Virtual size: 4.5MB

.upx1
Size: 6.5MB - Virtual size: 6.5MB

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 588KB - Virtual size: 588KB

.l1
Size: 18KB - Virtual size: 18KB