ebf2e7237bc839a0553aa468f4ec272cac92e835d4b15d4f7703bb00697967c6

Sharing

Copy URL Twitter E-mail

General

Target

ebf2e7237bc839a0553aa468f4ec272cac92e835d4b15d4f7703bb00697967c6
Size

916KB
MD5

f8111fe8ccc93d522887fcc9e0798925
SHA1

dd402775d50528acddaccb6641faf65d261d8c14
SHA256

ebf2e7237bc839a0553aa468f4ec272cac92e835d4b15d4f7703bb00697967c6
SHA512

f7a3c08f1714e147e7c08c9a25711076cfc2a370d0d6af366398d23bb2bfee1ac12695576f4d44174087d820f41d56ead8c70492a6e7f39223cfcd35fe202f64
SSDEEP

24576:FeXME3itaCr+6iVYW+661/Pgch+62eDzoqou+xd82cl:AOVaExuJ8N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ebf2e7237bc839a0553aa468f4ec272cac92e835d4b15d4f7703bb00697967c6

Files

ebf2e7237bc839a0553aa468f4ec272cac92e835d4b15d4f7703bb00697967c6
.exe windows:4 windows x86

4813f6ac6884cb446bfc30215a4dbf24

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitThread
ResumeThread
CreateThread
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcAddress
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetVersionExA
GetOEMCP
CreateSemaphoreW
CloseHandle
GetModuleFileNameW
GetModuleHandleW
LoadLibraryExW
FreeLibrary
lstrcmpiW
GetLocalTime
SystemTimeToFileTime
GetThreadTimes
GetProcessWorkingSetSize
GetProcessTimes
GlobalMemoryStatus
SetEndOfFile
DeleteFileA
LocalFree
_lread
VirtualLock
GetDiskFreeSpaceA
FindClose
DefineDosDeviceA
FindFirstFileA
VirtualUnlock
FormatMessageW
GetLogicalDrives
_lwrite
_llseek
GetFileTime
GetVolumePathNameA
SetFileTime
SetFilePointerEx
InterlockedDecrement
InterlockedIncrement
GetLastError
lstrlenW
DeleteCriticalSection
InitializeCriticalSection
lstrcpynW
GlobalAlloc
GlobalLock
GetDiskFreeSpaceExA
CreatePipe
DeviceIoControl
SetFileAttributesA
GetSystemDirectoryA
ReadFile
CreateProcessA
GetFileAttributesA
GetVolumeInformationA
GetDriveTypeA
SetVolumeLabelA
GlobalUnlock
FreeResource
SetLastError
GetCurrentThreadId
GlobalFree
GetCurrentProcess
FlushInstructionCache
FindResourceW
LoadResource
LockResource
SizeofResource
LeaveCriticalSection
EnterCriticalSection
RaiseException
WideCharToMultiByte
MultiByteToWideChar
FindResourceExA
FindResourceA
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
SetFilePointer
GetCPInfo
GetStartupInfoW
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThread
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep

user32

SystemParametersInfoW
AdjustWindowRectEx
IsWindow
SetWindowRgn
IsDialogMessageW
GetDlgItem
SetFocus
EnableWindow
IsWindowEnabled
KillTimer
SetTimer
ShowWindow
GetClientRect
GetWindowRect
SetWindowPos
MoveWindow
GetMenu
SetWindowTextW
GetWindowLongW
CreateWindowExW
SetWindowLongW
MapWindowPoints
GetWindow
GetParent
UnregisterClassA
SetDlgItemInt
GetDlgItemInt
DialogBoxParamW
EndDialog
MessageBoxW
FindWindowW
IsIconic
GetLastActivePopup
GetSysColor
FillRect
GetSysColorBrush
EndPaint
BeginPaint
CharNextW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
GetCursorPos
CreatePopupMenu
InsertMenuW
SetForegroundWindow
TrackPopupMenu
DestroyMenu
GetSystemMetrics
LoadImageW
DestroyIcon
SetCursor
IsWindowVisible
DestroyCursor
LoadCursorW
GetWindowTextLengthW
GetWindowTextW
MessageBeep
SetDlgItemTextW
CreateDialogParamW
GetDC
UpdateLayeredWindow
RegisterDeviceNotificationA
wsprintfW
SendMessageA
LoadCursorA
SendMessageTimeoutA
wsprintfA
GetKeyState
GetOpenClipboardWindow
GetMessagePos
GetMessageTime
GetClipboardOwner
GetClipboardViewer
UnhookWindowsHookEx
GetActiveWindow
GetCaretPos
GetDesktopWindow
SetWindowsHookExA
GetInputState
GetQueueStatus
GetProcessWindowStation
CallNextHookEx
GetFocus
PtInRect
ReleaseCapture
CallWindowProcW
GetCapture
GetDlgCtrlID
SetCapture
InvalidateRect
UpdateWindow
ClientToScreen
EnumChildWindows
DefWindowProcW
PostQuitMessage
SendMessageW
DestroyWindow
CopyRect

advapi32

DeleteService
CryptGenRandom
CryptAcquireContextA
CryptReleaseContext
ControlService
OpenSCManagerA
QueryServiceStatus
RegOpenKeyExA
StartServiceA
CreateServiceA
CloseServiceHandle
OpenServiceA
RegOpenKeyA
RegQueryValueExA
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW

ole32

CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoGetObject
StringFromGUID2
CoTaskMemAlloc
CreateStreamOnHGlobal

shell32

ShellExecuteW
SHChangeNotify
Shell_NotifyIconW
ord680
ShellExecuteA

oleaut32

VarUI4FromStr
SysAllocStringLen
SysFreeString

comctl32

_TrackMouseEvent
InitCommonControlsEx
ord17

gdi32

SelectObject
DeleteObject
CreateDIBSection
CreateRectRgn
CreateCompatibleDC
DeleteDC
SetTextColor
TextOutW
SetTextAlign
GetStockObject
CombineRgn

gdiplus

GdiplusShutdown
GdiplusStartup
GdipDrawImageRectRect
GdipCloneImage
GdipCloneBrush
GdipCreateFont
GdipDrawImageRectRectI
GdipDrawString
GdipFree
GdipAlloc
GdipDeleteBrush
GdipCreateStringFormat
GdipDeleteStringFormat
GdipDeleteGraphics
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipDeleteFont
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromResource
GdipCreateSolidFill
GdipCreateFromHDC
GdipSetSmoothingMode

shlwapi

PathFileExistsA

Sections

.text
Size: 284KB - Virtual size: 282KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 516KB - Virtual size: 516KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4813f6ac6884cb446bfc30215a4dbf24

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

shell32

oleaut32

comctl32

gdi32

gdiplus

shlwapi

Sections

.text Size: 284KB - Virtual size: 282KB

.rdata Size: 80KB - Virtual size: 77KB

.data Size: 32KB - Virtual size: 98KB

.rsrc Size: 516KB - Virtual size: 516KB

.text
Size: 284KB - Virtual size: 282KB

.rdata
Size: 80KB - Virtual size: 77KB

.data
Size: 32KB - Virtual size: 98KB

.rsrc
Size: 516KB - Virtual size: 516KB