1a5587f003271e769368907a07e275c59b44b52af337a17b4bb15406b14abf7a

Sharing

Copy URL Twitter E-mail

General

Target

1a5587f003271e769368907a07e275c59b44b52af337a17b4bb15406b14abf7a
Size

745KB
MD5

170d303fe01c5362ec21c8371aa669c3
SHA1

a99132df47aa6d57ed2268a654de06a7d5209294
SHA256

1a5587f003271e769368907a07e275c59b44b52af337a17b4bb15406b14abf7a
SHA512

09bfd496c227e0ccc69d3aaf1103c14ca8592f7b25da32274e900f1d31417888d7a77bde7e48a65139446f636a716f6cc8b85ded072321cedbc222f3cc50dfde
SSDEEP

12288:wP75va4ecCWb1JD/EXwcOjk0CaS4wvDhRVecWF6d0iw1qWAAU3vYWgFKHMksE0gn:wP75v7ecCWbTD/O7Ojk0CaS4wvDjVecN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a5587f003271e769368907a07e275c59b44b52af337a17b4bb15406b14abf7a

Files

1a5587f003271e769368907a07e275c59b44b52af337a17b4bb15406b14abf7a
.exe windows:4 windows x86

dc23987b45ff3a30123346da814b9150

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedDecrement
lstrcmpiW
LoadLibraryExW
GetCommandLineW
GetFileAttributesW
RemoveDirectoryW
WriteFile
GetCurrentProcessId
InterlockedCompareExchange
GetTempPathW
InterlockedIncrement
CreateThread
WaitForMultipleObjects
ResetEvent
SetEvent
OutputDebugStringW
FormatMessageA
ExpandEnvironmentStringsA
SleepEx
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetThreadLocale
GetLocaleInfoA
GetACP
GetVersionExA
CopyFileW
MoveFileW
Sleep
GetWindowsDirectoryW
GlobalFree
DeleteCriticalSection
GetSystemDirectoryW
GlobalUnlock
GetComputerNameA
MoveFileExW
GlobalAlloc
GetExitCodeProcess
GetLocalTime
GlobalLock
GetDiskFreeSpaceExW
CreateMutexW
GetTickCount
FindFirstFileW
GetModuleHandleW
lstrlenW
SetLastError
ReadFile
CreateFileW
GetVersionExW
FreeResource
LeaveCriticalSection
WaitForSingleObject
TerminateProcess
LockResource
FindResourceExW
GetCurrentProcess
DeleteFileW
InterlockedExchange
WideCharToMultiByte
GetPrivateProfileIntW
RaiseException
FreeLibrary
EnterCriticalSection
GetLastError
GetProcAddress
LoadLibraryW
GetFileSize
lstrlenA
CloseHandle
FindClose
FlushInstructionCache
InitializeCriticalSection
FindResourceW
CreateProcessW
SizeofResource
GetModuleFileNameW
LoadResource
MultiByteToWideChar
CreateDirectoryW
GetCurrentThreadId
GetPrivateProfileStringW
CreateEventW

user32

RegisterClassExW
IsWindowEnabled
GetMenuItemCount
GetClientRect
GetDesktopWindow
GetActiveWindow
SetActiveWindow
SetWindowLongW
GetMenuItemInfoW
IsWindow
GetClassInfoExW
LoadCursorW
GetWindowThreadProcessId
GetMenuStringW
InvalidateRect
CreateWindowExW
GetParent
GetWindowLongW
GetDC
PostMessageW
SystemParametersInfoW
DestroyWindow
UnregisterClassA
GetForegroundWindow
SetTimer
IsWindowVisible
ClientToScreen
IsRectEmpty
DestroyIcon
IntersectRect
PostThreadMessageW
DrawIconEx
EqualRect
DrawFrameControl
LoadIconW
AttachThreadInput
EnableWindow
CopyRect
GetWindowRect
FindWindowW
SendMessageW
DefWindowProcW
MapWindowPoints
SetWindowPos
ReleaseDC
SetForegroundWindow
RegisterWindowMessageW
GetWindow
MoveWindow
CreatePopupMenu
DestroyMenu
InflateRect
LoadImageW
LoadBitmapW
TranslateMessage
SetFocus
BeginPaint
GetFocus
MonitorFromWindow
DispatchMessageW
EndPaint
IsChild
PeekMessageW
GetMessageW
GetDlgItem
SetRectEmpty
CallWindowProcW
GetMonitorInfoW
GetCursorPos
SetCapture
UpdateLayeredWindow
SetCursor
IsDialogMessageW
DrawTextW
ShowWindow
ReleaseCapture
GetDlgCtrlID
SetRect
PtInRect
ScreenToClient
GetNextDlgTabItem
CharNextW
OffsetRect
KillTimer

gdi32

RestoreDC
CreateRectRgn
Rectangle
SetStretchBltMode
CreatePen
GetObjectW
CombineRgn
GetCurrentObject
RectInRegion
GetTextColor
SetBkMode
CreateRectRgnIndirect
BitBlt
CreateFontIndirectW
ExtSelectClipRgn
SetViewportOrgEx
GetViewportOrgEx
TextOutW
RoundRect
GetTextExtentPoint32W
OffsetRgn
LineTo
MoveToEx
GetClipRgn
ExtTextOutW
CreateDIBSection
CreateBitmap
GetStockObject
SetTextColor
SaveDC
SelectObject
StretchBlt
SetBkColor
CreateCompatibleDC
CreateCompatibleBitmap
SelectClipRgn
DeleteDC
DeleteObject
CreateRoundRectRgn
GetDeviceCaps

advapi32

RegDeleteValueW
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

shell32

Shell_NotifyIconW
SHGetSpecialFolderPathW
ord680
SHBindToParent
ord155
SHParseDisplayName
SHGetDesktopFolder
ShellExecuteW

ole32

CoInitialize
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoCreateGuid
CreateStreamOnHGlobal

oleaut32

VarUI4FromStr

shlwapi

StrToIntW
PathAddBackslashW
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
PathIsDirectoryW
StrToIntA
PathFindFileNameW

comctl32

_TrackMouseEvent

msimg32

AlphaBlend

msvcp80

?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEX_NI@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

gdiplus

GdipCreateStringFormat
GdipSetStringFormatTrimming
GdipDeleteBrush
GdipCreatePen1
GdipGetFontCollectionFamilyList
GdipDeletePen
GdipGetFontCollectionFamilyCount
GdipDeleteStringFormat
GdipSetStringFormatFlags
GdipGetImageGraphicsContext
GdipSetImageAttributesColorMatrix
GdipDrawImageRectI
GdipAlloc
GdipGetImageHeight
GdiplusStartup
GdipCloneBrush
GdipCreateSolidFill
GdipDrawImageRectRect
GdipDisposeImageAttributes
GdipLoadImageFromStream
GdipCloneImage
GdipCreateBitmapFromStream
GdipCreateHBITMAPFromBitmap
GdipDrawImagePointsRectI
GdiplusShutdown
GdipDeleteGraphics
GdipCreateBitmapFromScan0
GdipGraphicsClear
GdipGetImagePixelFormat
GdipGetImageWidth
GdipSetInterpolationMode
GdipDisposeImage
GdipDeleteFontFamily
GdipCloneBitmapArea
GdipImageRotateFlip
GdipCreateImageAttributes
GdipLoadImageFromFile
GdipDrawImageRectRectI
GdipFree
GdipCreateFromHDC
GdipDeletePrivateFontCollection
GdipDeleteFont
GdipPrivateAddFontFile
GdipCreateFontFromLogfontW
GdipMeasureString
GdipSetStringFormatLineAlign
GdipDrawLinesI
GdipTranslateWorldTransform
GdipGetFontSize
GdipSetPenEndCap
GdipCreateLineBrushFromRectWithAngleI
GdipAddPathStringI
GdipDrawRectangleI
GdipAddPathPieI
GdipSetPenStartCap
GdipGetFamily
GdipSetPixelOffsetMode
GdipFillPath
GdipCreatePath
GdipSetPenDashStyle
GdipDrawLine
GdipSetCompositingQuality
GdipAddPathRectangleI
GdipDrawImageI
GdipClosePathFigure
GdipDeletePath
GdipSetSmoothingMode
GdipDrawPath
GdipSetClipPath
GdipAddPathArcI
GdipSetPenMode
GdipResetWorldTransform
GdipFillRectangle
GdipRotateWorldTransform
GdipFillRectangleI
GdipNewPrivateFontCollection
GdipDrawString
GdipCreateFont
GdipSetTextRenderingHint
GdipSetStringFormatAlign
GdipCloneFontFamily

msvcr80

memset
__CxxFrameHandler3
_strdup
_stat64
_beginthreadex
_gmtime64
__sys_nerr
strerror
getenv
memchr
_errno
isdigit
fputs
qsort
fopen
fgets
_strtoi64
strrchr
strncpy
isxdigit
strtol
sscanf
strstr
strtoul
__iob_func
realloc
_stricmp
_controlfp_s
_invoke_watson
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_cexit
__wgetmainargs
_amsg_exit
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
floor
ceil
__RTDynamicCast
_mktime64
_localtime64_s
_time32
_wfindnext64i32
wcstok
_wfindfirst64i32
_findclose
_wstat32
fputws
fwrite
__argc
__argv
__wargv
_exit
iswspace
wcspbrk
_wtoi
isalpha
tolower
isalnum
strchr
isspace
strncmp
fputc
fprintf
fread
fseek
_vsnprintf_s
memmove
wcsncpy_s
wcschr
_mbschr
abs
atoi
_wcsupr_s
wcscmp
rand
labs
fwprintf
memcmp
_wcsicmp
_time64
_wfopen
malloc
sprintf
wcscpy
_waccess
srand
fflush
strcmp
fclose
strcpy_s
??_V@YAXPAX@Z
_vscprintf
strlen
??0exception@std@@QAE@ABV01@@Z
memcpy_s
_vscwprintf
vswprintf_s
??0exception@std@@QAE@ABQBD@Z
_wcslwr_s
??0exception@std@@QAE@XZ
_wtof
??1exception@std@@UAE@XZ
_purecall
wcscspn
?what@exception@std@@UBEPBDXZ
_recalloc
wcsspn
free
_invalid_parameter_noinfo
_mbsicmp
memmove_s
wcsstr
_mbscmp
vsprintf_s
swprintf_s
memcpy
wcsrchr
wcslen
_CxxThrowException
calloc
??2@YAPAXI@Z
??3@YAXPAX@Z

ws2_32

ioctlsocket
select
__WSAFDIsSet
freeaddrinfo
WSASetLastError
socket
connect
setsockopt
getpeername
getsockopt
htons
bind
ntohs
getsockname
send
recv
WSAGetLastError
closesocket
WSAStartup
WSACleanup
getaddrinfo

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

Sections

.text
Size: 396KB - Virtual size: 394KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 104KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 216KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

dc23987b45ff3a30123346da814b9150

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

msvcp80

gdiplus

msvcr80

ws2_32

version

Sections

.text Size: 396KB - Virtual size: 394KB

.rdata Size: 104KB - Virtual size: 101KB

.data Size: 12KB - Virtual size: 11KB

.rsrc Size: 216KB - Virtual size: 216KB

.text
Size: 396KB - Virtual size: 394KB

.rdata
Size: 104KB - Virtual size: 101KB

.data
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 216KB - Virtual size: 216KB