80937c4690e27c27bd793dc9e2265392c9b52a74ec2211a6a6e1a7e89048ec34

Sharing

Copy URL Twitter E-mail

General

Target

80937c4690e27c27bd793dc9e2265392c9b52a74ec2211a6a6e1a7e89048ec34
Size

12.8MB
MD5

d5e94f141cbfdfb71f11d38ecd45f137
SHA1

599b51a47d6ab83b5ed6074f5c35c404742cbef6
SHA256

80937c4690e27c27bd793dc9e2265392c9b52a74ec2211a6a6e1a7e89048ec34
SHA512

985e29958c9c8f9dd9bf18cec17e2ec73073a2774a3be99ecbf572885afd0ac49241354a0b78a4cae652c1b9a1b96a83c1904b9973282e215e1920af5b538022
SSDEEP

196608:96OXQ/NVhbVZRglAwTrabqQwc+P0MIA3xANc5ITDj3ulrFLOyomFHKnP:QUSRbVZRglAo+5wbICKP3mF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
80937c4690e27c27bd793dc9e2265392c9b52a74ec2211a6a6e1a7e89048ec34

Files

80937c4690e27c27bd793dc9e2265392c9b52a74ec2211a6a6e1a7e89048ec34
.exe windows:6 windows x86

419e0a8148c719f1468597d71bf2d056

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DecodePointer
InitializeCriticalSectionEx
LoadLibraryW
GetProcAddress
CreateMutexW
OpenProcess
TerminateProcess
GetModuleHandleW
OpenMutexW
SetVolumeMountPointW
SetFileAttributesW
GlobalMemoryStatusEx
DeleteVolumeMountPointW
GetCurrentThread
SetThreadPriority
WaitForMultipleObjectsEx
CancelIoEx
CreateWaitableTimerW
GetQueuedCompletionStatus
SetWaitableTimer
CreateIoCompletionPort
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
SetStdHandle
CreatePipe
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
HeapSize
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
ExitProcess
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetModuleHandleExW
SleepEx
ExitThread
CreateThread
LoadLibraryExW
QueueUserAPC
TerminateThread
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateEventW
HeapFree
GetProcessHeap
HeapAlloc
SetLocalTime
GetTickCount
ReleaseSemaphore
WaitForSingleObject
GetLastError
SetLastError
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemTimeAsFileTime
WaitForSingleObjectEx
CreateEventA
PostQueuedCompletionStatus
SetEvent
GetSystemInfo
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
AreFileApisANSI
CopyFileExW
GetFullPathNameW
GetFileTime
GetFileAttributesExW
DeleteFileW
CreateWaitableTimerA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread
OpenEventA
ResetEvent
GetCPInfo
CompareStringEx
SleepConditionVariableSRW
WakeAllConditionVariable
LCMapStringEx
EncodePointer
GetLocaleInfoEx
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetStringTypeW
FreeUserPhysicalPages
MapUserPhysicalPages
AllocateUserPhysicalPages
VirtualFree
VirtualAlloc
VirtualUnlock
VirtualLock
FileTimeToSystemTime
GetFileInformationByHandle
SystemTimeToFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
lstrcpynW
SetFilePointer
SearchPathW
lstrcmpW
SetProcessWorkingSetSize
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
SetThreadUILanguage
SetThreadLocale
GetUserDefaultLangID
GetUserDefaultUILanguage
CloseHandle
LocalFree
WideCharToMultiByte
FormatMessageW
FreeLibraryAndExitThread
FormatMessageA
SetThreadAffinityMask
WTSGetActiveConsoleSessionId
GetEnvironmentVariableW
GetExitCodeProcess
GetSystemTimes
SetPriorityClass
SetProcessPriorityBoost
GetPriorityClass
lstrlenW
lstrcatW
lstrcpyW
GetDiskFreeSpaceExW
QueryDosDeviceW
GetVolumePathNamesForVolumeNameW
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
GetComputerNameExW
SetFileTime
SetFilePointerEx
IsDebuggerPresent
OutputDebugStringW
RaiseException
GetACP
MultiByteToWideChar
GetModuleHandleA
FindFirstFileW
FindNextFileW
GetFileAttributesW
CreateDirectoryW
GetModuleFileNameW
FindClose
CreateFileW
FreeLibrary
DeviceIoControl
RtlCaptureStackBackTrace
GetCurrentProcessId
GetCurrentProcess
SetUnhandledExceptionFilter
GetCurrentThreadId
CreateSemaphoreA
DuplicateHandle
Sleep
CreateFileA
CreateFileMappingA
GetFileType
FlushFileBuffers
SwitchToThread
UnmapViewOfFile
MapViewOfFileEx
FlushViewOfFile
MoveFileExW
ReadFile
WriteFile
GetFileSizeEx
GetSystemDirectoryW
GetTempPathW
RemoveDirectoryW
SetEndOfFile
GetVersionExW
GetProductInfo
CreateProcessW
GetStdHandle
SetConsoleCtrlHandler
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetWindowsDirectoryW
GetTempFileNameW
ExpandEnvironmentStringsW
FindResourceW
LoadResource
LockResource
SizeofResource
FreeResource
GetLogicalDriveStringsW
GetDriveTypeW
GetVolumeNameForVolumeMountPointW

user32

PostMessageW
GetLastActivePopup
SetForegroundWindow
RegisterClassExW
EnumWindows
GetPropW
GetSystemMetrics
SetWindowLongW
SetPropW
DestroyWindow
IsWindowVisible
GetTopWindow
CreateWindowExW
LockSetForegroundWindow
ShowWindow
GetClientRect
InvalidateRect
UpdateWindow
GetMessageW
IsDialogMessageW
TranslateMessage
DispatchMessageW
RegisterWindowMessageW
GetWindowLongW
DefWindowProcW
BeginPaint
GetDC
DrawTextW
ReleaseDC
EndPaint
PostQuitMessage
SendMessageW
UnregisterDeviceNotification
LoadStringW
SetWindowPos
LoadIconW
SendMessageTimeoutW
CallNextHookEx
GetAsyncKeyState
GetKeyState
SystemParametersInfoW
GetDlgItemTextW
EndDialog
EnumChildWindows
EnableWindow
SendDlgItemMessageW
UnhookWindowsHookEx
SetWindowsHookExW
SetDlgItemTextW
CreateDialogParamW
GetCursorPos
DialogBoxParamW
GetLastInputInfo
MessageBoxA
MessageBoxW
GetDlgItem
GetWindow
FindWindowW
RegisterDeviceNotificationW
IsChild
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetWindowRect
GetParent
DestroyMenu
TrackPopupMenuEx
DeleteMenu
OpenWindowStationW
SetProcessWindowStation
OpenDesktopW
SetThreadDesktop
CloseDesktop
CloseWindowStation
ExitWindowsEx
GetWindowThreadProcessId
EnumDisplayDevicesW
EnumDisplaySettingsW
ChangeDisplaySettingsExW
MonitorFromWindow
GetDesktopWindow
FindWindowExW
LoadKeyboardLayoutW
ActivateKeyboardLayout
UnloadKeyboardLayout
keybd_event
GetDisplayConfigBufferSizes
QueryDisplayConfig
DisplayConfigGetDeviceInfo
DisplayConfigSetDeviceInfo
CharNextW
IsCharAlphaNumericW
CharUpperW
wsprintfW
LoadMenuW
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuStringW
ModifyMenuW

gdi32

CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
GetDeviceCaps
GetObjectW
GetStockObject
CreateFontIndirectW
SetTextColor
SetBkColor
SetBkMode
DeleteObject
GetTextMetricsW
BitBlt
DeleteDC

advapi32

OpenProcessToken
FreeSid
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus
QueryServiceStatus
RegDeleteValueW
RegCreateKeyW
RegOpenKeyW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
DuplicateTokenEx
SetTokenInformation
ImpersonateSelf
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
RegEnumKeyW
RegSetValueExA
RegLoadKeyW
RegUnLoadKeyW
AllocateAndInitializeSid
RegDeleteKeyW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegCreateKeyExW
EnumDependentServicesW
QueryServiceConfigW
DeleteService
RegQueryValueExW
CheckTokenMembership
CreateProcessAsUserW
OpenSCManagerW
CloseServiceHandle
OpenServiceW
CreateServiceW
ChangeServiceConfigW
StartServiceW
ControlService

shell32

Shell_NotifyIconW
ShellExecuteExW
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoInitialize
CoSetProxyBlanket
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoInitializeSecurity
CoInitializeEx
CreateStreamOnHGlobal

ws2_32

freeaddrinfo
WSAStartup
WSACleanup
htonl
WSASetLastError
WSAGetLastError
closesocket
ioctlsocket
listen
WSASend
WSASocketW
setsockopt
WSAAddressToStringW
ntohl
ntohs
htons
bind
inet_addr
shutdown
WSAStringToAddressW
gethostname
getsockopt
getpeername
getsockname
inet_ntoa
WSAIoctl
__WSAFDIsSet
select
WSARecv
accept
connect
WSARecvFrom
WSASendTo
getaddrinfo

mswsock

AcceptEx
GetAcceptExSockaddrs

setupapi

SetupDefaultQueueCallbackW
SetupInstallFromInfSectionW
SetupInitDefaultQueueCallback
SetupInstallServicesFromInfSectionW
SetupTermDefaultQueueCallback
SetupDiCallClassInstaller
SetupDiSetDeviceRegistryPropertyW
SetupDiCreateDeviceInfoW
SetupDiCreateDeviceInfoList
SetupDiGetINFClassW
SetupGetSourceFileLocationW
SetupGetTargetPathW
SetupGetStringFieldW
SetupGetIntField
SetupFindNextLine
SetupGetFieldCount
SetupFindFirstLineW
SetupEnumInfSectionsW
SetupCloseInfFile
SetupQueryInfFileInformationW
SetupGetInfInformationW
SetupOpenInfFileW
CM_Reenumerate_DevNode
CM_Locate_DevNodeW
CM_Get_Sibling
CM_Get_Child
CM_Get_Device_IDW
CM_Get_DevNode_Status
SetupDiDestroyDriverInfoList
SetupDiGetDriverInfoDetailW
SetupDiEnumDriverInfoW
SetupDiBuildDriverInfoList
SetupDiGetDeviceInstanceIdW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
InstallHinfSectionW

netapi32

NetJoinDomain

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses
GetIfTable

mprapi

MprConfigServerConnect
MprConfigServerDisconnect
MprConfigGetFriendlyName

dbgeng

DebugCreate

mpr

WNetAddConnection2W
WNetCancelConnection2W

dxva2

SetMonitorBrightness
GetNumberOfPhysicalMonitorsFromHMONITOR
GetMonitorBrightness
GetPhysicalMonitorsFromHMONITOR

psapi

GetModuleFileNameExW
GetProcessImageFileNameW
EnumProcessModules

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock
GetAllUsersProfileDirectoryW
GetProfilesDirectoryW

wtsapi32

WTSQueryUserToken

newdev

UpdateDriverForPlugAndPlayDevicesW

winspool.drv

ord204
EnumPrintersW
ord203

oleaut32

SysFreeString
VariantCopy
SysAllocString
VariantInit
VarBstrCmp
VariantChangeType
VariantClear
OleLoadPicture

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 469KB - Virtual size: 469KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 104KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9.7MB - Virtual size: 9.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

419e0a8148c719f1468597d71bf2d056

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

ws2_32

mswsock

setupapi

netapi32

iphlpapi

mprapi

dbgeng

mpr

dxva2

psapi

userenv

wtsapi32

newdev

winspool.drv

oleaut32

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rdata Size: 469KB - Virtual size: 469KB

.data Size: 104KB - Virtual size: 187KB

.rsrc Size: 9.7MB - Virtual size: 9.7MB

.reloc Size: 121KB - Virtual size: 121KB

.text
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 469KB - Virtual size: 469KB

.data
Size: 104KB - Virtual size: 187KB

.rsrc
Size: 9.7MB - Virtual size: 9.7MB

.reloc
Size: 121KB - Virtual size: 121KB