a1d92e3663dd09dc5a6c0d0a08cd43e43df2f5f200452c527c37c3ae2ed74cbc

Sharing

Copy URL Twitter E-mail

General

Target

a1d92e3663dd09dc5a6c0d0a08cd43e43df2f5f200452c527c37c3ae2ed74cbc
Size

14.1MB
MD5

b08e74cdef888f9a3d2dbfb6adac793d
SHA1

77c045efd3e0922cae6bb8a1597bd6d36b835bb4
SHA256

a1d92e3663dd09dc5a6c0d0a08cd43e43df2f5f200452c527c37c3ae2ed74cbc
SHA512

48e437e4b3b826a53779bd1d3f829d0596a3b929d9b8e60698e345a6fc2c0b2f8e63a65a9fb8f657461de55909fe1e97c9faf0a2d743f51cc9bc78b43401e606
SSDEEP

393216:MpAVd9nbnMdZi8iidNRlg2D8iAIRSFDduDk:H4g8jrVAIRSF4A

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a1d92e3663dd09dc5a6c0d0a08cd43e43df2f5f200452c527c37c3ae2ed74cbc

Files

a1d92e3663dd09dc5a6c0d0a08cd43e43df2f5f200452c527c37c3ae2ed74cbc
.exe windows:5 windows x86

b4bc8c6c9646a661ae7006314c37a6d6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32NextW
OpenProcess
GetModuleFileNameA
GetPrivateProfileStringA
CreateToolhelp32Snapshot
OpenMutexW
IsBadReadPtr
CopyFileW
GetTempPathW
LoadLibraryExW
lstrcmpiW
SetUnhandledExceptionFilter
GetCurrentProcessId
VirtualProtect
GetCommandLineA
CreateThread
InterlockedDecrement
InterlockedIncrement
PeekNamedPipe
CreatePipe
GetTickCount
SetHandleInformation
ReadFile
WriteFile
TerminateProcess
QueryPerformanceFrequency
MoveFileW
CreateDirectoryW
GetStartupInfoW
CreateProcessW
GetModuleHandleW
GetCurrentProcess
Process32FirstW
ReleaseSemaphore
SetLastError
OpenFileMappingW
WideCharToMultiByte
CreateFileMappingW
CreateEventW
UnmapViewOfFile
CreateFileA
lstrcmpiA
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindFirstFileExW
WriteConsoleW
ReadConsoleW
MapViewOfFile
Sleep
WaitForSingleObject
SetEvent
FindNextFileW
FindFirstFileW
DeleteFileW
GetFileAttributesW
SetFileAttributesW
RemoveDirectoryW
GetSystemDirectoryW
FindClose
WritePrivateProfileStringW
GetPrivateProfileStringW
MultiByteToWideChar
GetCommandLineW
CreateMutexW
CloseHandle
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetCurrentThreadId
GetModuleFileNameW
LoadLibraryW
SizeofResource
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
SetEndOfFile
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetACP
GetStdHandle
ExitProcess
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileType
GetFileAttributesExW
GetModuleHandleExW
ExitThread
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
RaiseException
GetProcessHeap
HeapSize
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetProcAddress
FreeLibrary
CreateTimerQueue
lstrcmpA
DeviceIoControl
GetSystemWindowsDirectoryW
FreeResource
LockResource
DecodePointer
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
GetStringTypeW
FormatMessageW
TryEnterCriticalSection
DuplicateHandle
WaitForSingleObjectEx
SwitchToThread
GetCurrentThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
QueryPerformanceCounter
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
GetFileSizeEx
CreateFileW
FlushFileBuffers
LocalFree
ReleaseMutex
UnhandledExceptionFilter
GlobalAlloc
GlobalLock
GlobalUnlock
GetDiskFreeSpaceExW
GlobalFree
InterlockedExchangeAdd
WaitNamedPipeW
InitializeCriticalSectionEx
WaitForMultipleObjectsEx
CreateSemaphoreW
InterlockedCompareExchange
GetVersionExW
VirtualQuery
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
GetSystemInfo
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
GlobalFree
GetProcAddress
LocalAlloc
LocalFree
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle

user32

LoadIconW
SetParent
SetClassLongW
SetWindowTextW
IsIconic
SetWindowPos
PostQuitMessage
MonitorFromWindow
ExitWindowsEx
CharNextW
DispatchMessageW
TranslateMessage
wsprintfW
GetSystemMetrics
SystemParametersInfoW
CopyRect
UnionRect
EqualRect
PtInRect
DrawFocusRect
SetCursor
ShowWindow
PeekMessageW
GetMessageW
WaitForInputIdle
SendNotifyMessageW
RegisterWindowMessageW
LoadCursorW
GetParent
SetWindowLongW
GetWindowLongW
OffsetRect
ScreenToClient
GetClientRect
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
KillTimer
SetTimer
ReleaseCapture
SetCapture
GetAsyncKeyState
DestroyWindow
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
PostMessageW
SendMessageW
FindWindowW
SendMessageTimeoutW
UnregisterClassW
GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation

gdi32

DeleteObject
RestoreDC
SaveDC
CreateDIBSection
GetObjectW
GetDeviceCaps
SetBkColor
ExtTextOutW
CreateCompatibleDC
DeleteDC
CreateCompatibleBitmap
SetViewportOrgEx
RectVisible
OffsetViewportOrgEx
CreateFontW
SelectObject
EnumFontFamiliesW
BitBlt

advapi32

RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegSetValueExW
RegQueryInfoKeyW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegGetValueW
GetTokenInformation

shell32

SHGetSpecialFolderPathW
ShellExecuteW
ShellExecuteExW

ole32

CoUninitialize
CoCreateInstance
StringFromGUID2
CreateStreamOnHGlobal
CoCreateGuid
CoInitialize
CLSIDFromString
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

VarUI4FromStr
SysFreeString

shlwapi

PathFindFileNameW
PathIsRelativeW
PathCombineW
StrStrIW
PathFileExistsW
PathRemoveFileSpecW
PathAppendW
StrStrIA
StrCmpIW
StrCmpNIW
StrTrimA
SHGetValueA
SHSetValueA
PathUnquoteSpacesW
PathIsDirectoryW
PathAppendA
PathFileExistsA
PathRemoveFileSpecA
SHGetValueW

comctl32

InitCommonControlsEx
_TrackMouseEvent

gdiplus

GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipSetStringFormatTrimming
GdiplusStartup
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCreateStringFormat
GdipMeasureString
GdipDrawString
GdipAlloc
GdipFree
GdipDeleteBrush
GdipCreateSolidFill
GdipCreateFont
GdipGetImageWidth
GdipGetImageHeight
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetTextRenderingHint
GdipFillRectangleI
GdipDrawImageRectRect
GdipDrawImageRectRectI
GdipCreateFontFamilyFromName
GdipDeleteFontFamily

urlmon

URLDownloadToFileW
URLDownloadToCacheFileW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

crypt32

CertGetNameStringW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

wtsapi32

WTSSendMessageW

Sections

.text
Size: 952KB - Virtual size: 952KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 216KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.upx0
Size: 5.0MB - Virtual size: 5.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.upx1
Size: 7.0MB - Virtual size: 7.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 965KB - Virtual size: 965KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.l1
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b4bc8c6c9646a661ae7006314c37a6d6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

urlmon

version

crypt32

wintrust

wininet

iphlpapi

wtsapi32

Sections

.text Size: 952KB - Virtual size: 952KB

.rdata Size: 216KB - Virtual size: 216KB

.data Size: 36KB - Virtual size: 36KB

.upx0 Size: 5.0MB - Virtual size: 5.0MB

.upx1 Size: 7.0MB - Virtual size: 7.0MB

.reloc Size: 4KB - Virtual size: 4KB

.rsrc Size: 965KB - Virtual size: 965KB

.l1 Size: 18KB - Virtual size: 18KB

.text
Size: 952KB - Virtual size: 952KB

.rdata
Size: 216KB - Virtual size: 216KB

.data
Size: 36KB - Virtual size: 36KB

.upx0
Size: 5.0MB - Virtual size: 5.0MB

.upx1
Size: 7.0MB - Virtual size: 7.0MB

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 965KB - Virtual size: 965KB

.l1
Size: 18KB - Virtual size: 18KB