5da8920a5712f80ad400acbbd9994024f9607321859fdd9c7b37378309e65872

Sharing

Copy URL Twitter E-mail

General

Target

5da8920a5712f80ad400acbbd9994024f9607321859fdd9c7b37378309e65872
Size

2.6MB
MD5

fd386fb3a7fc090afa15984e07161360
SHA1

ad7d2cfb25d5db7bb237ee97b9d3f27d247fe3fa
SHA256

5da8920a5712f80ad400acbbd9994024f9607321859fdd9c7b37378309e65872
SHA512

fd28628d5fd942403eb1e16c73640bc9bd1e55ea5eb1c7a1a4c6db848ee3258788155411b57655beaf6d8f1cab4d2e940fa8488b82833719aaa365581432a0c4
SSDEEP

49152:IBeQam462lXLuctieSb4xPqOwxYgOiiQu8Be0dVbzmIiQ65op5H5qE+oWIXZ:aeb2gXLxi/4NO+gtA8eCVmIaA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5da8920a5712f80ad400acbbd9994024f9607321859fdd9c7b37378309e65872

Files

5da8920a5712f80ad400acbbd9994024f9607321859fdd9c7b37378309e65872
.exe windows:5 windows x86

b8ce7a56164bd360b485ff00cdc8f805

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalFileTimeToFileTime
GetCurrentDirectoryW
GetFileAttributesW
lstrlenW
GetACP
ExitProcess
MulDiv
lstrcpynW
InterlockedIncrement
InterlockedDecrement
SetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SleepEx
FormatMessageA
FreeLibrary
WaitForMultipleObjects
GetFileType
GetStdHandle
PeekNamedPipe
ExpandEnvironmentStringsA
VerSetConditionMask
LoadLibraryA
GetModuleHandleA
VerifyVersionInfoA
MoveFileW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetFullPathNameW
SetStdHandle
GetTimeZoneInformation
FreeResource
GetUserDefaultLCID
SetFilePointer
FlushFileBuffers
GetConsoleCP
ReadConsoleW
GetConsoleMode
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
SetFilePointerEx
FreeLibraryAndExitThread
ExitThread
GetModuleHandleExW
LoadLibraryExW
RtlUnwind
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
ResetEvent
SetEvent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetFileTime
CreateMutexW
CopyFileW
IsBadCodePtr
SetEndOfFile
CreateEventW
EnumSystemLocalesW
FormatMessageW
SetFileAttributesA
WritePrivateProfileStringA
WriteConsoleW
SizeofResource
HeapFree
InitializeCriticalSectionAndSpinCount
OutputDebugStringW
GetTempPathA
OutputDebugStringA
DeleteFileA
GetTickCount
SystemTimeToFileTime
GetCurrentProcessId
GetLocalTime
GetExitCodeProcess
GlobalUnlock
lstrcmpiW
CreateDirectoryA
lstrcpyW
GetFileSize
GlobalLock
SetCurrentDirectoryW
CreateThread
LoadLibraryW
CloseHandle
Process32FirstW
DeleteFileW
GlobalAlloc
lstrcatW
GetSystemDirectoryA
GetCurrentThread
Process32NextW
GetDiskFreeSpaceA
Sleep
CreateToolhelp32Snapshot
OpenProcess
CreateFileW
WaitForSingleObject
FindClose
GetTempPathW
GetEnvironmentVariableW
SetThreadPriority
GetProcessId
GetModuleFileNameW
RemoveDirectoryW
TerminateProcess
GetShortPathNameW
+�x��ĉ��)͊��˸/�
GetCurrentProcess
FindNextFileW
SetPriorityClass
FindFirstFileW
ReadFile
CreateDirectoryW
WideCharToMultiByte
GetComputerNameW
LocalFree
GetSystemDirectoryW
GetVolumeInformationW
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
GetProcAddress
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
HeapSize
LoadResource
FindResourceExW
RaiseException
HeapReAlloc
LockResource
GetLastError
i� N�r�ދ��+�x��ĉ��)͊��˸/�
IsValidLocale
LoadLibraryA
GetProcAddress
GetLastError
FreeLibrary
InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleW
TerminateProcess
GetCurrentProcess
DeleteCriticalSection
LoadLibraryW
CreateEventW
CompareStringW
SetLastError
GetModuleHandleA
VirtualProtect
GetTickCount
EnterCriticalSection
LeaveCriticalSection
VirtualFree
VirtualAlloc
WriteProcessMemory
CreateToolhelp32Snapshot
GetCurrentProcessId
GetCurrentThreadId
Thread32First
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
GetSystemInfo
LoadResource
i� N�r�ދ��+�x��ĉ��)͊��˸/�
WideCharToMultiByte
FindResourceExW
FindResourceExA
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
HeapAlloc
HeapFree
HeapDestroy
HeapCreate
GetSystemTime
GetLocalTime
SystemTimeToFileTime
CompareFileTime
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
+�x��ĉ��)͊��˸/�
GetStdHandle
GetModuleFileNameA
RaiseException
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
RtlUnwind
HeapSize
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
VirtualQuery
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

SetCaretPos
ShowCaret
HideCaret
GetCaretBlinkTime
CreateCaret
TrackPopupMenu
AppendMenuW
EnableMenuItem
DestroyMenu
CreatePopupMenu
SetRect
FillRect
DrawTextW
CharPrevW
GetWindowRgn
ClientToScreen
IsWindowEnabled
UpdateWindow
EqualRect
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
wsprintfA
DrawTextA
DefWindowProcW
LoadCursorW
GetKeyboardLayout
wsprintfW
CharLowerA
SendMessageW
PostMessageW
PostQuitMessage
UpdateLayeredWindow
SetWindowRgn
GetKeyNameTextW
CreateAcceleratorTableW
SetForegroundWindow
InvalidateRgn
GetGUIThreadInfo
GetCaretPos
GetPropW
CallWindowProcW
SetTimer
MessageBoxW
IsZoomed
MoveWindow
ShowWindow
GetWindowRect
LoadIconW
GetMessageW
TranslateMessage
DispatchMessageW
CreateWindowExW
IsWindow
DestroyWindow
SetWindowPos
IsWindowVisible
IsIconic
CharNextW
SetFocus
GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
KillTimer
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetClientRect
GetCursorPos
ScreenToClient
MapWindowPoints
GetSysColor
IntersectRect
UnionRect
OffsetRect
IsRectEmpty
PtInRect
GetWindowLongW
SetWindowLongW
GetParent
GetWindow
LoadImageW
MonitorFromWindow
GetMonitorInfoW
SetCursor
InflateRect
MapVirtualKeyExW
SetPropW
EnableWindow
GetClassInfoExW
RegisterClassExW
RegisterClassW
MessageBoxW
CharUpperBuffW

gdi32

RemoveFontMemResourceEx
AddFontMemResourceEx
GetStockObject
GetDeviceCaps
SelectObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateDIBitmap
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
CloseEnhMetaFile
CreateEnhMetaFileW
GetEnhMetaFileHeader
PlayEnhMetaFile
GetTextMetricsW
GetObjectW
SetWindowOrgEx
CreateRoundRectRgn
CreateRectRgn
PtInRegion
Rectangle
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
SelectClipRgn
ExtSelectClipRgn
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
GetObjectA
MoveToEx
TextOutW
GdiFlush
CreatePatternBrush
GetTextExtentPointA
GetBitmapBits
SetBitmapBits
RestoreDC
CreateDIBSection
SaveDC
DeleteObject
SetBkColor

advapi32

RegQueryValueExW
RegCloseKey
LookupAccountNameW
CryptGetHashParam
ConvertSidToStringSidW
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptAcquireContextA
RegDeleteKeyW
RegEnumKeyExW
RegFlushKey
RegCreateKeyExW
RegSetValueExW
CryptDestroyHash
CryptReleaseContext
RegQueryInfoKeyA
RegQueryValueExA
RegOpenKeyExA
OpenProcessToken
GetTokenInformation
CryptAcquireContextW
CryptCreateHash
CryptHashData
RegOpenKeyExW

shell32

SHGetFolderPathA
ShellExecuteExW
SHGetSpecialFolderPathW
ord190
DragQueryFileW
ShellExecuteW
SHGetFolderPathW

ole32

CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
ReleaseStgMedium
OleLockRunning
DoDragDrop
CoUninitialize
OleDuplicateData
CoCreateInstance
CoCreateGuid
CoInitialize

oleaut32

VariantInit
VariantClear
SysAllocString
SysFreeString

shlwapi

PathRemoveExtensionW
PathFileExistsW
PathFileExistsA

comctl32

InitCommonControlsEx
_TrackMouseEvent
ord17

gdiplus

GdipDrawImageRectI
GdipGetPropertyItem
GdipGetPropertyItemSize
�/�
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipGetImageWidth
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipFillPath
GdipFillRectangleI
GdipDrawPath
GdipDrawRectangleI
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipSetPenMode
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
ord1
GdipAddPathLine
GdipDeletePath
GdipCreatePath
GdipFree
GdipAlloc
GdiplusShutdown
GdiplusStartup
GdipImageGetFrameCount

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow

wldap32

ord33
ord35
ord79
ord32
ord200
ord301
ord27
ord143
ord30
ord26
ord46
ord211
ord60
ord50
ord41
ord22

ws2_32

WSACreateEvent
ntohl
WSACleanup
gethostbyname
gethostname
WSAGetLastError
__WSAFDIsSet
select
WSASetLastError
recv
send
bind
closesocket
connect
getpeername
getsockname
getsockopt
setsockopt
WSAIoctl
getaddrinfo
freeaddrinfo
accept
listen
ioctlsocket
WSAStartup
inet_addr
WSAEventSelect
socket
ntohs
WSAWaitForMultipleEvents
recvfrom
WSAEnumNetworkEvents
htons
sendto

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses

psapi

EnumDeviceDrivers
GetDeviceDriverBaseNameA

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 294KB - Virtual size: 294KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndw0
Size: 867KB - Virtual size: 866KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndw1
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 188KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b8ce7a56164bd360b485ff00cdc8f805

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

imm32

wldap32

ws2_32

iphlpapi

psapi

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 294KB - Virtual size: 294KB

.data Size: 9KB - Virtual size: 15KB

.ndw0 Size: 867KB - Virtual size: 866KB

.ndw1 Size: 58KB - Virtual size: 58KB

.reloc Size: 61KB - Virtual size: 60KB

.rsrc Size: 188KB - Virtual size: 188KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 294KB - Virtual size: 294KB

.data
Size: 9KB - Virtual size: 15KB

.ndw0
Size: 867KB - Virtual size: 866KB

.ndw1
Size: 58KB - Virtual size: 58KB

.reloc
Size: 61KB - Virtual size: 60KB

.rsrc
Size: 188KB - Virtual size: 188KB