8042941edbaf1644fd727f77f2bff8c6125b23760318d115fd0bc16d93646863

Sharing

Copy URL

Twitter E-mail

General

Target

8042941edbaf1644fd727f77f2bff8c6125b23760318d115fd0bc16d93646863
Size

10.6MB
MD5

af0078be7e1336cc3281094012de0498
SHA1

5348835b1284890af004fe369b696a1b930e5045
SHA256

8042941edbaf1644fd727f77f2bff8c6125b23760318d115fd0bc16d93646863
SHA512

d4ef210360f7de9928c74e9f6f5a7a81d4e0fee6b1b297dabb29b7d4cd307fa6adf1190113964356d47d6b657605eb246e60b2161330014eb200268355a6ce25
SSDEEP

196608:lhS8Dx9mWAcZLAxN1wdgg6UC31gfwxkFOvdxP/83krQGyhcY1hxdCkr:l/eWhAL1wdgT364xs33Fhxd7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8042941edbaf1644fd727f77f2bff8c6125b23760318d115fd0bc16d93646863

Files

8042941edbaf1644fd727f77f2bff8c6125b23760318d115fd0bc16d93646863
.exe windows:5 windows x86

b539648c8f09381aede7b86274d835b9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFindFileNameW
StrStrIW
PathFileExistsW
ord176
PathRemoveBackslashW
SHDeleteKeyW
SHDeleteValueW
PathRemoveFileSpecW

gdiplus

GdipDrawImageRectI
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStream
GdipDrawPieI
GdipFillPieI
GdipDrawEllipseI
GdipFillEllipseI
GdipDrawArcI
GdipDrawLineI
GdipSetClipRegion
GdipDeleteRegion
GdipCreateRegionPath
GdipSetPathGradientPresetBlend
GdipCreatePathGradientFromPath
GdiplusShutdown
GdiplusStartup
GdipCreateFromHWND
GdipMeasureString
GdipSetPenWidth
GdipDrawRectangleI
GdipFillRectangleI
GdipSetPenColor
GdipDrawString
GdipSetSolidFillColor
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeleteFont
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipDrawPath
GdipFillPath
GdipDeletePen
GdipCreatePen1
GdipCloneBrush
GdipAlloc
GdipFree
GdipDeleteBrush
GdipCreateSolidFill
GdipAddPathPath
GdipAddPathRectangleI
GdipAddPathLineI
GdipAddPathArcI
GdipDeletePath
GdipCreatePath
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageRectRectI

rpcrt4

UuidToStringW
UuidCreateSequential
RpcStringFreeW
UuidCreate

wininet

InternetCloseHandle
InternetSetOptionW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
HttpQueryInfoW
InternetReadFile
InternetOpenW

kernel32

FlushViewOfFile
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
HeapValidate
UnmapViewOfFile
UnlockFileEx
GetFullPathNameA
LockFile
GetDiskFreeSpaceW
GetFullPathNameW
HeapCreate
AreFileApisANSI
SetEndOfFile
WriteConsoleW
GetConsoleCP
FlushFileBuffers
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
HeapReAlloc
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
ReadConsoleW
GetConsoleMode
GetFileType
HeapAlloc
HeapFree
SetLastError
EncodePointer
GetCurrentThreadId
GetACP
GetStdHandle
ExitProcess
GetModuleHandleExW
ExitThread
RtlUnwind
GetLastError
LoadLibraryW
FreeLibrary
CreateFileW
GetFileSizeEx
CloseHandle
GlobalAlloc
GlobalLock
GlobalFree
ReadFile
GlobalUnlock
WideCharToMultiByte
GetTickCount
GetFileAttributesW
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
TerminateProcess
Process32NextW
WaitForSingleObject
LocalFree
GetModuleFileNameW
MoveFileExW
RemoveDirectoryW
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
WritePrivateProfileStringW
TryEnterCriticalSection
MultiByteToWideChar
CreateThread
VerSetConditionMask
VerifyVersionInfoW
OutputDebugStringA
GetVersionExA
CopyFileW
SetFilePointerEx
WriteFile
SetFileTime
SetFileAttributesW
GetCommandLineW
GetExitCodeThread
TerminateThread
GetDiskFreeSpaceExW
CreateFileA
SetFilePointer
GetFileSize
InterlockedExchangeAdd
CreateEventW
InterlockedExchange
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
ReleaseSemaphore
InterlockedIncrement
GetModuleHandleW
ResetEvent
InitializeCriticalSection
CreateSemaphoreW
DeleteCriticalSection
SetEvent
GetLocalTime
GetFileAttributesExW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetSystemTime
GetCurrentProcessId
GetCompressedFileSizeW
CreateMutexW
ReleaseMutex
InterlockedCompareExchange
Sleep
RaiseException
GetProcAddress
DecodePointer
InitializeCriticalSectionAndSpinCount
GetSystemDirectoryW
InterlockedDecrement
DeviceIoControl
LoadLibraryA
GetStringTypeW
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
DuplicateHandle
VirtualFree
VirtualProtect
VirtualAlloc
GetVersionExW
LoadLibraryExW
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
GetCurrentThread
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
OutputDebugStringW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
GetCPInfo
GetLocaleInfoW
FormatMessageA
LCMapStringW
CompareStringW
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
DeleteFileA
GetSystemInfo
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
SystemTimeToFileTime
CreateFileMappingW
SwitchToThread
MapViewOfFile
CreateDirectoryW
TlsAlloc
GetTempPathW

user32

RegisterClassExW
GetWindowRect
CreateWindowExW
SetWindowLongW
DestroyWindow
DefWindowProcW
SetWindowRgn
SetWindowPos
ShowWindow
IsWindowVisible
GetWindowDC
ReleaseDC
UpdateLayeredWindow
SetWindowTextW
SendMessageW
PostMessageW
LoadCursorW
SetCursor
InvalidateRect
SetTimer
KillTimer
IsWindow
GetWindowTextW
UnregisterClassW
MsgWaitForMultipleObjects
PeekMessageW
RegisterClassW
EnableWindow
EndPaint
BeginPaint
PostQuitMessage
LoadIconW
SetForegroundWindow
IsIconic
FindWindowW
LoadStringW
MessageBoxW
GetSystemMetrics
GetActiveWindow
DispatchMessageW
TranslateMessage
GetMessageW
SetClipboardData
CloseClipboard
EmptyClipboard
OpenClipboard
GetDC
GetWindowLongW

gdi32

GetStockObject
CreateRoundRectRgn
GetDeviceCaps
SetPixel
DeleteObject
SelectObject
DeleteDC
CreateCompatibleBitmap
CreateCompatibleDC

advapi32

RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegOpenKeyExA
RegEnumKeyExA
RegQueryValueExA
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom

shell32

ShellExecuteW
SHFileOperationW
ord165
CommandLineToArgvW
ShellExecuteExW
SHGetSpecialFolderPathW

ole32

CoInitializeEx
CoInitializeSecurity
CoInitialize
CoSetProxyBlanket
CoTaskMemFree
CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

winhttp

WinHttpCloseHandle
WinHttpOpen
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpSendRequest
WinHttpSetStatusCallback
WinHttpOpenRequest
WinHttpConnect
WinHttpCrackUrl
WinHttpReadData
WinHttpQueryHeaders

netapi32

NetApiBufferFree
Netbios
NetWkstaTransportEnum

crypt32

CryptStringToBinaryW
CryptBinaryToStringW

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 258KB - Virtual size: 258KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 355KB - Virtual size: 354KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b539648c8f09381aede7b86274d835b9

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

gdiplus

rpcrt4

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

winhttp

netapi32

crypt32

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 258KB - Virtual size: 258KB

.data Size: 28KB - Virtual size: 48KB

.rsrc Size: 355KB - Virtual size: 354KB

.reloc Size: 66KB - Virtual size: 65KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 258KB - Virtual size: 258KB

.data
Size: 28KB - Virtual size: 48KB

.rsrc
Size: 355KB - Virtual size: 354KB

.reloc
Size: 66KB - Virtual size: 65KB