3d93fb0993a776cc41f8f12d42d2ff19e1f8d3ce0c9726baca498f97f253e621

Sharing

Copy URL Twitter E-mail

General

Target

3d93fb0993a776cc41f8f12d42d2ff19e1f8d3ce0c9726baca498f97f253e621
Size

12.3MB
MD5

5f1942655fb2f94344601aac3f9428b1
SHA1

88658ce5d5ed810579adde36bf75b33117551980
SHA256

3d93fb0993a776cc41f8f12d42d2ff19e1f8d3ce0c9726baca498f97f253e621
SHA512

3c19b6fa06ee5f6a426f81a15fbe5809f0e78f74c30b0b63f8a661b7c7d448f1a8aec8eb3bfbc0dfc5448daba803decf4f008bdfb1310633f0e2b33d09adc63d
SSDEEP

196608:4GUoR4Y7pBhT8p7UtHJjTyt3pHWf8KFByPbF/WOxA2VHwCqHgo1SIIwFgPxj:zUoRD7lCUTjT2HWfHO1WIAcDDNhPxj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3d93fb0993a776cc41f8f12d42d2ff19e1f8d3ce0c9726baca498f97f253e621

Files

3d93fb0993a776cc41f8f12d42d2ff19e1f8d3ce0c9726baca498f97f253e621
.exe windows:6 windows x86

444ecd90027fb8888fe4080b008fd252

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentDirectoryW
SetLastError
GetCurrentProcessId
GetTickCount
FindFirstFileW
GetModuleHandleA
VirtualAlloc
VirtualFree
FindNextFileW
FindClose
GetFileInformationByHandle
SetFileTime
SetFilePointer
SetEndOfFile
ReadFile
GetFileSize
GetStdHandle
MoveFileExW
LoadLibraryW
GetProcAddress
FreeLibrary
GetModuleFileNameA
GetCurrentThreadId
Sleep
CreateEventW
WaitForSingleObject
SetEvent
WaitNamedPipeW
DisconnectNamedPipe
GetTempPathA
GetTempPathW
WriteFile
SetFileAttributesW
RemoveDirectoryW
GetLogicalDriveStringsW
GetFileAttributesW
GetDriveTypeW
DeleteFileW
CreateFileW
CreateFileA
FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleFileNameW
FreeResource
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WideCharToMultiByte
MultiByteToWideChar
lstrcpyW
lstrcmpiW
OpenProcess
TerminateProcess
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
GetLastError
RaiseException
CloseHandle
DecodePointer
OutputDebugStringW
OutputDebugStringA
GetModuleHandleW
CreateDirectoryW
WriteConsoleW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
SwitchToThread
GetCurrentThread
GetExitCodeThread
GetStringTypeW
FormatMessageW
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetCPInfo
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetACP
GlobalUnlock
GlobalLock
lstrlenW
ExitProcess
MulDiv
LocalFileTimeToFileTime
SystemTimeToFileTime
LocalFree
GetVersionExW
GlobalAlloc
GetLocalTime
lstrcpynW
IsDebuggerPresent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
LoadLibraryExW
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread
ResumeThread
GetModuleHandleExW
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FlushFileBuffers
GetConsoleCP
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle

user32

GetClientRect
GetWindowRect
GetCursorPos
ScreenToClient
MapWindowPoints
GetSysColor
IntersectRect
IsRectEmpty
PtInRect
GetWindowLongW
SetWindowLongW
GetParent
GetWindow
LoadImageW
MonitorFromWindow
GetMonitorInfoW
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
SetWindowRgn
MessageBoxW
UpdateWindow
IsWindowEnabled
UpdateLayeredWindow
MoveWindow
GetUpdateRect
CharPrevW
DrawTextW
FillRect
ReleaseCapture
CreatePopupMenu
DestroyMenu
EnableMenuItem
AppendMenuW
TrackPopupMenu
CreateCaret
GetCaretBlinkTime
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
EqualRect
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
wsprintfA
DrawTextA
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
SetForegroundWindow
GetKeyboardLayout
GetKeyNameTextW
MapVirtualKeyExW
SetCursor
InflateRect
UnionRect
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetWindowRgn
GetDC
OffsetRect
SetCapture
GetKeyState
GetFocus
GetActiveWindow
ShowWindow
wsprintfW
PostMessageW
PostQuitMessage
SetTimer
KillTimer
CharUpperW
SetFocus
CharNextW
IsZoomed
LoadCursorW
IsIconic
IsWindowVisible
SetWindowPos
DestroyWindow
IsWindow
CreateWindowExW
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
SetRect

advapi32

RegQueryValueExW
RegDeleteValueW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW

shell32

SHGetPathFromIDListW
CommandLineToArgvW
DragQueryFileW
SHGetSpecialFolderPathW
SHGetFolderPathW
SHBrowseForFolderW
ShellExecuteA
ShellExecuteW

ole32

OleLockRunning
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
ReleaseStgMedium
OleDuplicateData
DoDragDrop
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

VariantClear
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
SysStringByteLen
SysAllocStringByteLen
VariantInit

gdiplus

GdipSetInterpolationMode
GdipFillPath
GdipDrawPath
GdipSetSmoothingMode
GdipAlloc
GdipFree
GdipCreatePath
GdipDeletePath
GdipStartPathFigure
GdipClosePathFigure
GdipDeleteGraphics
GdipCreateFromHDC
GdipDeletePen
GdipCreatePen1
GdipSetLinePresetBlend
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipDrawImageRectI
GdipGetPropertyItem
GdipAddPathLineI
GdipAddPathArcI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreateLineBrushI
GdiplusStartup
GdiplusShutdown
GdipAddPathLine
GdipAddPathArc
GdipSetPenMode
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipCloneImage
GdipDisposeImage
GdipSetTextRenderingHint
GdipImageSelectActiveFrame
GdipDrawRectangleI
GdipFillRectangleI
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize

shlwapi

PathFileExistsW
PathRemoveBackslashW
PathRemoveFileSpecW
SHDeleteKeyW
PathIsRootW

ws2_32

gethostname
WSAStartup
gethostbyname

gdi32

Rectangle
RestoreDC
SaveDC
SelectObject
CloseEnhMetaFile
CreateEnhMetaFileW
GetEnhMetaFileHeader
PlayEnhMetaFile
GetTextMetricsW
GetObjectW
SetWindowOrgEx
CreateRoundRectRgn
CreateRectRgn
PtInRegion
CreateDIBSection
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
RemoveFontMemResourceEx
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
GetObjectA
MoveToEx
TextOutW
GdiFlush
CreatePatternBrush
GetTextExtentPointA
GetBitmapBits
SetBitmapBits
AddFontMemResourceEx
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateDIBitmap
CreateCompatibleDC
CreateSolidBrush
BitBlt
CreateCompatibleBitmap

comctl32

_TrackMouseEvent
InitCommonControlsEx
ord17

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

Sections

.text
Size: 942KB - Virtual size: 941KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 218KB - Virtual size: 218KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51.7MB - Virtual size: 51.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

444ecd90027fb8888fe4080b008fd252

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

gdiplus

shlwapi

ws2_32

gdi32

comctl32

imm32

Sections

.text Size: 942KB - Virtual size: 941KB

.rdata Size: 218KB - Virtual size: 218KB

.data Size: 17KB - Virtual size: 25KB

.rsrc Size: 51.7MB - Virtual size: 51.7MB

.reloc Size: 54KB - Virtual size: 54KB

.text
Size: 942KB - Virtual size: 941KB

.rdata
Size: 218KB - Virtual size: 218KB

.data
Size: 17KB - Virtual size: 25KB

.rsrc
Size: 51.7MB - Virtual size: 51.7MB

.reloc
Size: 54KB - Virtual size: 54KB