941e27a7e1f63dc1b960c57c0c72f3a08d39f58bca25d9ca5a5dc65c429a76b2

Sharing

Copy URL Twitter E-mail

General

Target

941e27a7e1f63dc1b960c57c0c72f3a08d39f58bca25d9ca5a5dc65c429a76b2
Size

6.2MB
MD5

c9355c52add585043125311d45b5761b
SHA1

85b29e8e2140e662157843871f4e883c3e320560
SHA256

941e27a7e1f63dc1b960c57c0c72f3a08d39f58bca25d9ca5a5dc65c429a76b2
SHA512

e198a9293c42d392afbbf55290afb55d8b9b8b4df87376e280461b9a5a77467be15da1b2421a300fa41330846722fedf8d751c15441f96f95594b81b6cbd58ea
SSDEEP

98304:kSg+obsHsyFntsKhTdvPtS2WYjmhASaZhbba8YTxP30mIl1vSJCagBI0:kSvhsyFnt9dv1Sua2shZ+1/aN0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
941e27a7e1f63dc1b960c57c0c72f3a08d39f58bca25d9ca5a5dc65c429a76b2

Files

941e27a7e1f63dc1b960c57c0c72f3a08d39f58bca25d9ca5a5dc65c429a76b2
.exe windows:6 windows x64

1f5ab1f358adbedf15335146e80aeb77

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ole32

OleInitialize
OleUninitialize
CoUninitialize
CoInitialize
IIDFromString
StringFromGUID2
CoCreateGuid
OleRun
OleSetContainedObject
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc

shell32

SHBrowseForFolderA
SHGetPathFromIDListA
SHGetFolderLocation
SHGetFolderPathA
FindExecutableA
SHGetFolderPathW
CommandLineToArgvW

wininet

InternetCrackUrlA
HttpQueryInfoA
HttpOpenRequestA
InternetErrorDlg
InternetOpenA
InternetCloseHandle
HttpSendRequestA
InternetReadFile
InternetConnectA

user32

EnumWindows
GetMessageA
DispatchMessageA
DefWindowProcA
CreateWindowExA
TranslateMessage
GetWindowLongPtrA
PostQuitMessage
PostMessageA
IsWindowUnicode
PeekMessageA
MsgWaitForMultipleObjectsEx
DispatchMessageW
GetMessageW
MessageBoxA
LoadStringA
CharNextA
wsprintfA
ReleaseDC
GetParent
GetClassInfoExW
EnableMenuItem
GetDesktopWindow
GetClientRect
SendMessageA
ShowWindow
RegisterClassExW
GetWindowLongPtrW
SetWindowLongPtrA
RegisterClassExA
GetAncestor
GetWindowThreadProcessId
GetFocus
IsChild
SetFocus
SetRect
DefWindowProcW
GetSystemMenu
AdjustWindowRectEx
GetWindowRect
LoadCursorA
DestroyWindow
GetDC
SetWindowPos
SetWindowLongPtrW
CreateWindowExW
SetWindowTextW

comctl32

InitCommonControlsEx

kernel32

VirtualAlloc
GetSystemInfo
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
GetFileType
GetCPInfo
GetLocaleInfoW
VirtualQuery
FreeLibraryAndExitThread
EncodePointer
GetModuleHandleW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
GetStringTypeW
GetModuleFileNameW
WriteConsoleW
GetConsoleCP
GetConsoleMode
CreateThread
VirtualProtect
LCMapStringW
GetStdHandle
ExitThread
RtlCaptureContext
CreateDirectoryW
GetDriveTypeW
GetFileInformationByHandle
SystemTimeToTzSpecificLocalTime
GetFullPathNameW
SetStdHandle
CompareStringW
DeleteFileW
IsValidLocale
GetModuleFileNameA
SizeofResource
GetCommandLineW
LoadLibraryExA
InitializeCriticalSectionAndSpinCount
FindResourceA
lstrcmpA
GetModuleHandleA
GetCommandLineA
MultiByteToWideChar
GetLastError
SetDllDirectoryA
RaiseException
IsDBCSLeadByte
LoadResource
DecodePointer
GetProcAddress
DeleteCriticalSection
FreeLibrary
EnumSystemLocalesW
lstrcmpiA
Process32First
WriteFile
lstrlenA
lstrcatA
CreateToolhelp32Snapshot
GetTempPathA
CreateFileA
GetSystemDirectoryA
LockResource
DeleteFileA
Process32Next
lstrcpyA
CloseHandle
FindResourceW
lstrcpynA
CreateDirectoryA
LocalFree
ReadFile
MulDiv
LocalAlloc
GetCurrentThreadId
FormatMessageA
Sleep
GetUserDefaultLCID
SetEvent
CreateEventA
FileTimeToSystemTime
SetEndOfFile
SetFilePointerEx
FindFirstFileA
SetLastError
GetDriveTypeA
FindNextFileA
FindClose
GetFileAttributesA
MoveFileExA
SetFileAttributesA
RemoveDirectoryA
GetTickCount
WaitForSingleObject
OpenMutexA
LoadLibraryExW
TerminateProcess
GetLocaleInfoA
OpenProcess
GetWindowsDirectoryA
ExitProcess
GetCurrentProcess
GetModuleHandleExW
GetNativeSystemInfo
GetSystemWow64DirectoryA
FormatMessageW
GetLocalTime
GetCurrentProcessId
GetSystemDefaultUILanguage
GetThreadLocale
GetUserDefaultUILanguage
QueryPerformanceFrequency
QueryPerformanceCounter
RtlUnwind
FlushViewOfFile
CreateFileMappingA
OpenFileMappingA
MapViewOfFile
GetExitCodeThread
OpenThread
SetHandleInformation
CreatePipe
PeekNamedPipe
CreateProcessA
GetExitCodeProcess
GetModuleHandleExA
LoadLibraryW
CreateMutexA
ReleaseMutex
CreateFileW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
IsDebuggerPresent
OutputDebugStringW
HeapAlloc
HeapSize
HeapReAlloc
HeapFree
GetFileSizeEx
FlushFileBuffers
ReadConsoleW
GetCurrentDirectoryW
GetTimeZoneInformation
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
WideCharToMultiByte
UnmapViewOfFile

advapi32

GetTokenInformation
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
RegQueryValueExA
RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegEnumKeyExA
OpenProcessToken
CopySid
ConvertStringSecurityDescriptorToSecurityDescriptorA
ConvertSidToStringSidA
ConvertStringSecurityDescriptorToSecurityDescriptorW

oleaut32

GetErrorInfo
SysStringByteLen
VariantInit
SysAllocString
VariantCopy
VariantChangeType
VariantClear
VarUI4FromStr
SysFreeString
SysAllocStringLen

shlwapi

PathIsDirectoryEmptyA
ord12
PathAppendA

gdi32

GetDeviceCaps

iphlpapi

GetAdaptersAddresses

crypt32

CryptProtectData
CryptStringToBinaryA
CryptBinaryToStringA
CryptUnprotectData

version

VerQueryValueW
GetFileVersionInfoSizeA
GetFileVersionInfoA

msi

ord91
ord160
ord31
ord168
ord117
ord137
ord189
ord67
ord8
ord158
ord159
ord115
ord141
ord44
ord204
ord87

Sections

.text
Size: 849KB - Virtual size: 848KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 359KB - Virtual size: 358KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 79.1MB - Virtual size: 79.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1f5ab1f358adbedf15335146e80aeb77

Headers

DLL Characteristics

File Characteristics

Imports

ole32

shell32

wininet

user32

comctl32

kernel32

advapi32

oleaut32

shlwapi

gdi32

iphlpapi

crypt32

version

msi

Sections

.text Size: 849KB - Virtual size: 848KB

.rdata Size: 359KB - Virtual size: 358KB

.data Size: 16KB - Virtual size: 25KB

.pdata Size: 36KB - Virtual size: 35KB

.rsrc Size: 79.1MB - Virtual size: 79.1MB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 849KB - Virtual size: 848KB

.rdata
Size: 359KB - Virtual size: 358KB

.data
Size: 16KB - Virtual size: 25KB

.pdata
Size: 36KB - Virtual size: 35KB

.rsrc
Size: 79.1MB - Virtual size: 79.1MB

.reloc
Size: 6KB - Virtual size: 5KB