f9a230d7638d564942c8b17e12941fa8ca1721432fe7e4fa7d5267627e2083aa

Sharing

Copy URL Twitter E-mail

General

Target

f9a230d7638d564942c8b17e12941fa8ca1721432fe7e4fa7d5267627e2083aa
Size

4.2MB
MD5

d6a937cefe6eb903c6a486afbb72b34b
SHA1

e1e4901a91173bb29a3d5b4ce40f424504ef6cf2
SHA256

f9a230d7638d564942c8b17e12941fa8ca1721432fe7e4fa7d5267627e2083aa
SHA512

bbc45bbe8f5ff3b18fa21d715bb3d5182cd062fa1b93d797f1e675452a461323e8536a2bec2ab75bf3ffbad285533e003e024141e9781d5fb2f1fbff1af0cbd6
SSDEEP

98304:5b+/IhTlryKzHnQxit7w+yr1qRHfo8ZaVba5t5w9:RvdDH15yr8lCBa5t5k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9a230d7638d564942c8b17e12941fa8ca1721432fe7e4fa7d5267627e2083aa

Files

f9a230d7638d564942c8b17e12941fa8ca1721432fe7e4fa7d5267627e2083aa
.exe windows:5 windows x86

0d46c792fb2d3ba4acab709ace859468

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenMutexW
CreateMutexW
GetSystemTime
LocalFree
GetModuleHandleA
Module32FirstW
CreateFileMappingW
LocalAlloc
GlobalFree
GlobalUnlock
GetTimeZoneInformation
SetTimeZoneInformation
GlobalAlloc
GlobalLock
UnmapViewOfFile
MapViewOfFile
SetFilePointer
WinExec
MultiByteToWideChar
CreateSemaphoreA
SystemTimeToFileTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetSystemTimeAsFileTime
FreeResource
LockResource
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
SetEndOfFile
InitializeCriticalSectionAndSpinCount
GetCurrentDirectoryA
GetFullPathNameA
GetVersionExW
GetStringTypeA
IsValidLocale
LoadResource
SizeofResource
FindResourceW
CreateFileA
GetFileAttributesExW
WideCharToMultiByte
CreateDirectoryW
InterlockedDecrement
GetProfileStringW
FindClose
FindNextFileW
FindFirstFileW
GetLogicalDriveStringsW
WaitForMultipleObjects
CreateIoCompletionPort
SetEvent
OpenFileMappingW
OpenProcess
lstrcpyW
CreateProcessW
InterlockedIncrement
GetLocalTime
GetCurrentThreadId
Sleep
GetProfileIntW
lstrlenW
WriteProfileStringW
GetComputerNameA
GetCurrentProcessId
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetPrivateProfileStringW
GetModuleHandleW
CopyFileW
GetTickCount
GetPrivateProfileIntW
DeleteFileW
GetFileAttributesW
ReadFile
GetFileSize
GetLastError
CreateFileW
GetModuleFileNameW
CloseHandle
TerminateThread
ResumeThread
SuspendThread
OpenThread
WritePrivateProfileStringW
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetStdHandle
SetHandleCount
FlushFileBuffers
GetConsoleCP
HeapCreate
VirtualFree
IsValidCodePage
GetOEMCP
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
GetConsoleMode
SetConsoleMode
ReadConsoleInputA
SetConsoleCtrlHandler
ReleaseMutex
LoadLibraryW
GetProcAddress
GetSystemDirectoryW
GetFileInformationByHandle
GetCurrentDirectoryW
WriteFile
SetFileTime
ExitProcess
GetDriveTypeA
GetCPInfo
LCMapStringW
LCMapStringA
RtlUnwind
GetStartupInfoA
GetCommandLineA
VirtualAlloc
CreateThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapSize
HeapReAlloc
HeapAlloc
HeapDestroy
RaiseException
GetProcessHeap
HeapFree
FlushConsoleInputBuffer
GlobalMemoryStatus
QueryPerformanceCounter
FindFirstFileA
LoadLibraryA
VerSetConditionMask
VerifyVersionInfoA
ExpandEnvironmentStringsA
PeekNamedPipe
SleepEx
GetStdHandle
GetFileType
GetVersion
FormatMessageA
SetLastError
MulDiv
GetACP
InterlockedExchange
DuplicateHandle
FreeLibrary
PostQueuedCompletionStatus
TerminateProcess
GetQueuedCompletionStatus
CreateEventW
ResetEvent
GlobalMemoryStatusEx
GetSystemInfo
GetComputerNameW
OutputDebugStringW
GetCurrentProcess
GetStartupInfoW
CreatePipe
GetExitCodeProcess
CreateProcessA
GetSystemDirectoryA
OutputDebugStringA
GetWindowsDirectoryW
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetStringTypeW
InitializeCriticalSection

user32

CreateWindowExW
PostQuitMessage
DefWindowProcW
GetWindowTextW
EnumWindows
DispatchMessageW
TranslateMessage
GetMessageW
EnableWindow
GetDesktopWindow
CloseClipboard
GetWindowLongW
SetWindowLongW
ScreenToClient
GetDlgCtrlID
PostMessageW
PtInRect
IntersectRect
CharNextW
FindWindowW
ShowWindow
SetWindowPos
MessageBoxW
GetSystemMetrics
SetTimer
EmptyClipboard
MoveWindow
KillTimer
SetForegroundWindow
GetWindow
GetParent
RegisterClassW
LoadCursorW
RegisterClassExW
GetClassInfoExW
CallWindowProcW
GetPropW
SetPropW
AdjustWindowRectEx
GetMenu
ReleaseDC
DestroyWindow
GetDC
GetKeyState
GetFocus
ExitWindowsEx
GetMonitorInfoW
SetClipboardData
OpenClipboard
GetClientRect
MapWindowPoints
GetUpdateRect
IsRectEmpty
EndPaint
BeginPaint
GetActiveWindow
UnionRect
BringWindowToTop
FindWindowExW
IsIconic
IsWindowVisible
wsprintfW
SetFocus
GetCursorPos
CreatePopupMenu
AppendMenuW
TrackPopupMenu
SetWindowRgn
ClientToScreen
SendMessageW
RegisterWindowMessageW
LoadIconW
DestroyIcon
GetWindowThreadProcessId
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW
SetWindowTextW
GetWindowTextLengthW
GetGUIThreadInfo
MonitorFromWindow
GetWindowRect
InvalidateRect
SetCapture
ReleaseCapture
SetCursor
OffsetRect
wvsprintfW
CreateAcceleratorTableW
InvalidateRgn
GetCaretBlinkTime
GetSysColor
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
CreateCaret
SetRect
CharPrevW
DrawTextW
FillRect
IsWindow

gdi32

BitBlt
CreatePatternBrush
GetDeviceCaps
GetObjectA
GdiFlush
DeleteDC
CreateDIBSection
CreateCompatibleDC
GetObjectW
MoveToEx
LineTo
SelectObject
CreatePenIndirect
DeleteObject
CreateRoundRectRgn
CreatePen
CreateFontIndirectW
GetStockObject
SetWindowOrgEx
Rectangle
RestoreDC
SaveDC
CreateCompatibleBitmap
AddFontMemResourceEx
GetTextMetricsW
SelectClipRgn
CombineRgn
CreateRectRgnIndirect
GetClipBox
StretchBlt
SetStretchBltMode
CreateSolidBrush
RoundRect
SetTextColor
SetBkMode
TextOutW
GetTextExtentPoint32W
GetCharABCWidthsW
SetBkColor
ExtSelectClipRgn

comdlg32

GetOpenFileNameW

advapi32

StartServiceA
ReportEventA
DeregisterEventSource
RegOpenKeyExW
RegDeleteValueW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegQueryValueExW
OpenProcessToken
RegSetValueExW
RegFlushKey
ControlService
OpenSCManagerA
QueryServiceStatusEx
QueryServiceStatus
RegisterEventSourceA
RegCreateKeyExW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
OpenServiceA
CreateServiceW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegEnumKeyExW
RegQueryInfoKeyW

shell32

ShellExecuteA
ShellExecuteExW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
ShellExecuteW
Shell_NotifyIconW

ole32

CLSIDFromString
OleInitialize
OleUninitialize
CoUninitialize
CoCreateInstance
CLSIDFromProgID
OleLockRunning
CreateStreamOnHGlobal
CoTaskMemFree
CoInitialize

oleaut32

SysFreeString
VariantClear
SysAllocString
VariantInit

iphlpapi

GetIpAddrTable
GetAdaptersAddresses
GetAdaptersInfo
GetIfTable
CreateIpForwardEntry
DeleteIpForwardEntry
GetIpForwardTable
SendARP

gdiplus

GdipSetSolidFillColor
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdipDrawImageRect
GdipDrawLine
GdipFillRectangleI
GdipCreatePen2
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetPageUnit
GdipCreatePath
GdipDeletePath
GdipAddPathArcI
GdipAddPathLineI
GdipCreateRegionRect
GdipDeleteRegion
GdipCreateRegionPath
GdipCombineRegionRegion
GdipCreatePathGradientFromPath
GdipDeleteBrush
GdipFree
GdipAlloc
GdipCloneBrush
GdipSetPathGradientCenterColor
GdipSetPathGradientSurroundColorsWithCount
GdipGetPathGradientPointCount
GdipSetPathGradientFocusScales
GdipFillRegion
GdipCreateLineBrushFromRectI
GdipSetLinePresetBlend
GdipSetSmoothingMode
GdipSetInterpolationMode
GdipCreatePen1
GdipDeletePen
GdipDrawPath
GdipDrawCurve
GdiplusStartup
GdiplusShutdown
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectRectI
GdipDrawImageRectI
GdipDeleteStringFormat
GdipDrawString
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipCreateStringFormat
GdipSetTextRenderingHint
GdipCreateSolidFill
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFontFamily
GdipDrawImage
GdipGraphicsClear
GdipSetPixelOffsetMode
GdipSetCompositingQuality
GdipCreateLineBrushI
GdipGetFamily
GdipDrawImageI
GdipSetPenEndCap
GdipSetPenStartCap
GdipDeleteFont

ws2_32

WSAAddressToStringA
WSAStartup
send
gethostbyname
__WSAFDIsSet
getservbyname
WSAAddressToStringW
shutdown
setsockopt
WSASend
WSASendTo
WSARecvFrom
WSACleanup
WSARecv
socket
WSAIoctl
bind
listen
WSASocketW
WSAGetLastError
closesocket
inet_ntoa
htons
WSAStringToAddressA
htonl
accept
getaddrinfo
freeaddrinfo
getsockopt
ntohs
getsockname
WSASetLastError
WSACloseEvent
recvfrom
WSAEnumNetworkEvents
recv
sendto
WSACreateEvent
WSAWaitForMultipleEvents
getpeername
ioctlsocket
gethostname
connect
select
inet_addr
WSAEventSelect

wldap32

ord301
ord27
ord41
ord46
ord33
ord79
ord35
ord32
ord200
ord30
ord26
ord50
ord60
ord143
ord211
ord22

proxysdk

SetLoadingFlow
FNInsertBlackProcesName
ProcessMd5AndSign
GetUdpRemoteIp
CreateVpn
GetFlowData
GetRegedit
IsPcLowConfig
IsBlackProcessUser
IsVirtualMachineNow
AddPidFromProcess
InsertProcessForPot
InsertDropPort
DriverIsRun
GetTdxNumber
DeleteRuleAll
DeleteVpn
InitDriverFirst
InitDriver
GetTcpRemoteIp

acmanage

StopACProcess
QueryACFlow
StartACProcess

crypt32

CertFindCertificateInStore
CryptMsgClose
CryptQueryObject
CertFreeCertificateContext
CryptMsgGetParam
CertCloseStore
CertAddCertificateContextToStore
CertOpenStore
CertCreateCertificateContext
CertGetNameStringW
CryptStringToBinaryA

shlwapi

wnsprintfW
PathIsDirectoryW

version

GetFileVersionInfoW
VerQueryValueW
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
GetFileVersionInfoSizeW

nfapi

?nf_init@nfapi@@YA?AW4_NF_STATUS@@PBDPAVNF_EventHandler@1@@Z
?nf_free@nfapi@@YAXXZ
?nf_udpPostReceive@nfapi@@YA?AW4_NF_STATUS@@_KPBEPBDHPAU_NF_UDP_OPTIONS@1@@Z
?nf_getProcessNameW@nfapi@@YAHKPA_WK@Z
?nf_tcpPostReceive@nfapi@@YA?AW4_NF_STATUS@@_KPBDH@Z
?nf_tcpPostSend@nfapi@@YA?AW4_NF_STATUS@@_KPBDH@Z
?nf_udpPostSend@nfapi@@YA?AW4_NF_STATUS@@_KPBEPBDHPAU_NF_UDP_OPTIONS@1@@Z
?nf_registerDriver@nfapi@@YA?AW4_NF_STATUS@@PBD@Z
?nf_addRule@nfapi@@YA?AW4_NF_STATUS@@PAU_NF_RULE@1@H@Z

nfsrvapi

?nf_srv_tcpPostReceive@nfsrvapi@@YA?AW4_NF_STATUS@@_KPBDH@Z
?nf_srv_tcpSetProxy@nfsrvapi@@YA?AW4_NF_STATUS@@_KW4SRV_PROXY_TYPE@1@PBDH22@Z
?nf_srv_getUDPRemoteAddress@nfsrvapi@@YA?AW4_NF_STATUS@@_KPAEH@Z
?nf_srv_udpSetProxy@nfsrvapi@@YA?AW4_NF_STATUS@@_KW4SRV_PROXY_TYPE@1@PBDH22@Z
?nf_srv_udpPostReceive@nfsrvapi@@YA?AW4_NF_STATUS@@_KPBEPBDHPAU_NF_UDP_OPTIONS@nfapi@@@Z
?nf_srv_udpPostSend@nfsrvapi@@YA?AW4_NF_STATUS@@_KPBEPBDHPAU_NF_UDP_OPTIONS@nfapi@@@Z
?nf_srv_free@nfsrvapi@@YAXXZ
?nf_srv_unRegisterDriver@nfsrvapi@@YA?AW4_NF_STATUS@@PBD@Z
?nf_srv_init@nfsrvapi@@YA?AW4_NF_STATUS@@PBDPAVNF_EventHandler@nfapi@@PAU_NF_SRV_OPTIONS@1@@Z
?nf_srv_addRule@nfsrvapi@@YA?AW4_NF_STATUS@@PAU_NF_SRV_RULE@1@H@Z
?nf_srv_deleteRules@nfsrvapi@@YA?AW4_NF_STATUS@@XZ
?nf_srv_tcpPostSend@nfsrvapi@@YA?AW4_NF_STATUS@@_KPBDH@Z

psapi

GetModuleFileNameExW

comctl32

_TrackMouseEvent
ord17

imm32

ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
ImmSetCompositionFontW

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 698KB - Virtual size: 697KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 17B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 157KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0d46c792fb2d3ba4acab709ace859468

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

iphlpapi

gdiplus

ws2_32

wldap32

proxysdk

acmanage

crypt32

shlwapi

version

nfapi

nfsrvapi

psapi

comctl32

imm32

Sections

.text Size: 3.2MB - Virtual size: 3.2MB

.rdata Size: 698KB - Virtual size: 697KB

.data Size: 55KB - Virtual size: 78KB

.tls Size: 512B - Virtual size: 17B

.rsrc Size: 69KB - Virtual size: 68KB

.reloc Size: 157KB - Virtual size: 157KB

.text
Size: 3.2MB - Virtual size: 3.2MB

.rdata
Size: 698KB - Virtual size: 697KB

.data
Size: 55KB - Virtual size: 78KB

.tls
Size: 512B - Virtual size: 17B

.rsrc
Size: 69KB - Virtual size: 68KB

.reloc
Size: 157KB - Virtual size: 157KB