6882ba4701dcea3d485df06234ad65d7d4a9c982fdedfff2277552e5064da801

Sharing

Copy URL Twitter E-mail

General

Target

6882ba4701dcea3d485df06234ad65d7d4a9c982fdedfff2277552e5064da801
Size

4.8MB
MD5

4f15164045e8909e55333100adbe9670
SHA1

b4e68da9601bf41cbe20bfb18f9c7a871392e35a
SHA256

6882ba4701dcea3d485df06234ad65d7d4a9c982fdedfff2277552e5064da801
SHA512

8113677beef1e9b98637785cc1b0dc15c371ba75f13ed2ef55211c8b4855dfd39f9ec27309be7147565ca82d436a23888dca9404044c105c030b2890139494f1
SSDEEP

98304:Z+Sc5qOzQocPfFYfu0BgagR/IJ/Ft8E2z1XTl5+b:UAOzFcPUgagmK3Yb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6882ba4701dcea3d485df06234ad65d7d4a9c982fdedfff2277552e5064da801

Files

6882ba4701dcea3d485df06234ad65d7d4a9c982fdedfff2277552e5064da801
.exe windows:6 windows x86

12bab79b7a37cdd8c3d53dc33bc9f6c8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

getservbyname
WSASetLastError
recv
send
getservbyport
closesocket
connect
setsockopt
socket
shutdown
gethostbyaddr
inet_ntoa
inet_addr
WSAGetLastError
WSACleanup
WSAStartup
gethostbyname
getsockopt
ioctlsocket
htons
ntohs
ntohl
htonl

wininet

HttpQueryInfoA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetSetOptionW
InternetQueryOptionW
InternetConnectA
InternetOpenA
InternetReadFile
InternetCloseHandle

wtsapi32

WTSEnumerateProcessesW
WTSFreeMemory

kernel32

GetSystemTimeAsFileTime
GetVersionExW
FreeLibrary
GetProcAddress
LoadLibraryA
LoadLibraryW
LocalFree
FormatMessageA
FormatMessageW
GetCommandLineW
DecodePointer
RaiseException
SetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionAndSpinCount
SetEvent
WaitForSingleObject
CreateMutexW
CreateEventW
CreateThread
GetCurrentThreadId
FindResourceExW
GetModuleFileNameW
GetModuleHandleW
LoadLibraryExW
LoadResource
LockResource
SizeofResource
FindResourceW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalHandle
GlobalFree
MulDiv
lstrcmpW
lstrcmpiW
lstrcpyW
CopyFileA
GetThreadLocale
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
VerSetConditionMask
lstrlenW
VerifyVersionInfoW
GetLocaleInfoA
CompareStringW
ResetEvent
OpenProcess
InitializeCriticalSectionEx
GetTempFileNameW
GetPrivateProfileStringA
TerminateProcess
GetPrivateProfileIntW
GetTimeZoneInformation
GetSystemInfo
CreateSemaphoreA
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentProcess
ExitProcess
SetConsoleCtrlHandler
QueryPerformanceFrequency
GetStdHandle
GetFileType
OutputDebugStringW
GetModuleHandleExW
VirtualAlloc
VirtualProtect
VirtualFree
GetEnvironmentVariableW
GetACP
GetSystemDirectoryA
FindClose
FindFirstFileW
FindNextFileW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetCurrentProcessId
Sleep
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
QueryPerformanceCounter
GetStringTypeW
InitOnceExecuteOnce
EncodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
WaitForSingleObjectEx
InitializeSListHead
GetLastError
GetTempPathA
AreFileApisANSI
GetTempPathW
UnlockFileEx
UnlockFile
IsDebuggerPresent
GetStartupInfoW
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
LoadLibraryExA
RtlUnwind
VirtualQuery
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
SetStdHandle
FindFirstFileExW
WriteConsoleW
SetFilePointerEx
SetEndOfFile
LockFileEx
LockFile
GetFullPathNameA
GetFullPathNameW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceW
GetDiskFreeSpaceA
FlushFileBuffers
DeleteFileW
DeleteFileA
CreateFileA
FileTimeToSystemTime
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetTickCount
GetLocalTime
GetFileSize
GetFileInformationByHandle
WideCharToMultiByte
MultiByteToWideChar
SystemTimeToFileTime
CloseHandle
WriteFile
SetFileTime
SetFilePointer
ReadFile
LocalFileTimeToFileTime
GetFileAttributesW
CreateFileW
CreateDirectoryW
GetCurrentDirectoryW
GetSystemTime
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileSizeEx
MoveFileExW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetCommandLineA
ReleaseSemaphore
GetConsoleOutputCP

user32

CallNextHookEx
IsDialogMessageW
SetRect
DispatchMessageA
PeekMessageA
GetProcessWindowStation
GetUserObjectInformationW
GetSystemMetrics
IsWindowEnabled
GetCapture
GetDlgCtrlID
CreateDialogParamW
DrawFrameControl
LoadBitmapW
MapWindowPoints
MessageBeep
GetScrollPos
LockWindowUpdate
DeleteMenu
ModifyMenuW
EnableMenuItem
EnableWindow
KillTimer
SetTimer
MsgWaitForMultipleObjects
SetDlgItemTextW
DialogBoxParamW
ShowWindow
PeekMessageW
GetKeyboardLayout
PostMessageW
IsWindowVisible
EnumChildWindows
IsRectEmpty
GetWindowRect
GetClassNameA
IsIconic
EmptyClipboard
SetClipboardData
CloseClipboard
SetWindowsHookExW
SendMessageTimeoutW
GetMonitorInfoW
DrawTextW
MapDialogRect
LoadCursorW
GetWindow
GetClassNameW
GetParent
SetWindowLongW
GetWindowLongW
FillRect
GetSysColor
ScreenToClient
ClientToScreen
GetCursorPos
MessageBoxA
SetWindowContextHelpId
GetClientRect
GetWindowTextLengthW
GetWindowTextW
RedrawWindow
GetDlgItemInt
SetDlgItemInt
AdjustWindowRectEx
GetMenu
EnumDisplaySettingsW
UnhookWindowsHookEx
GetWindowThreadProcessId
EnumWindows
InvalidateRgn
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
SetForegroundWindow
TrackPopupMenu
GetSubMenu
DestroyMenu
LoadMenuW
DestroyAcceleratorTable
CreateAcceleratorTableW
ReleaseCapture
SetCapture
GetFocus
GetActiveWindow
SetFocus
CharNextW
CharLowerBuffW
MessageBoxW
CreateDialogIndirectParamW
BringWindowToTop
MonitorFromWindow
SystemParametersInfoW
LoadImageA
PtInRect
OffsetRect
InflateRect
CopyRect
SetRectEmpty
FrameRect
DrawFocusRect
GetSysColorBrush
SetCursor
UpdateWindow
OpenClipboard
DrawStateW
CharUpperW
SendDlgItemMessageW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
SetWindowPos
SetMenuDefaultItem
AppendMenuW
MonitorFromPoint
MoveWindow
DestroyWindow
IsChild
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
CallWindowProcW
DefWindowProcW
PostThreadMessageW
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
RegisterWindowMessageW
GetDesktopWindow
wsprintfW
CreatePopupMenu
SetWindowTextW

gdi32

CreateDIBSection
StretchBlt
SetTextColor
SetBkMode
GetDIBColorTable
CreateFontIndirectW
GetObjectW
SelectObject
GetStockObject
GetDeviceCaps
GetTextExtentPoint32W
DeleteObject
DeleteDC
CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
SetDIBColorTable
BitBlt

advapi32

CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
CryptGenRandom
CryptReleaseContext
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
LookupAccountSidW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
OpenProcessToken
RegCreateKeyExA
DeregisterEventSource
CryptExportKey

shell32

Shell_NotifyIconW
ShellExecuteW
ShellExecuteExA
SHGetFolderLocation
SHGetPathFromIDListW
SHGetPathFromIDListA

ole32

CoGetClassObject
CoRegisterClassObject
CoRevokeClassObject
CoResumeClassObjects
CoAddRefServerProcess
CoReleaseServerProcess
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoInitialize
OleInitialize
OleUninitialize
CreateStreamOnHGlobal
OleLockRunning
CoUninitialize

oleaut32

VariantInit
SysAllocStringLen
VarBstrCmp
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
UnRegisterTypeLi
RegisterTypeLi
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
VariantClear
SysFreeString
SysStringLen
SysAllocString

shlwapi

PathFileExistsW

comctl32

_TrackMouseEvent
ImageList_Create
ImageList_AddMasked
ImageList_LoadImageW

msimg32

AlphaBlend
TransparentBlt

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

gdiplus

GdipDeleteGraphics
GdipDrawImageI
GdiplusShutdown
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdiplusStartup
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipFree
GdipCreateBitmapFromFile
GdipAlloc
GdipCloneImage
GdipBitmapUnlockBits

crypt32

CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertOpenStore
CertGetCertificateContextProperty
CertCloseStore

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 688KB - Virtual size: 688KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 812KB - Virtual size: 812KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

12bab79b7a37cdd8c3d53dc33bc9f6c8

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wininet

wtsapi32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

version

gdiplus

crypt32

Sections

.text Size: 3.2MB - Virtual size: 3.2MB

.rdata Size: 688KB - Virtual size: 688KB

.data Size: 24KB - Virtual size: 114KB

.rsrc Size: 812KB - Virtual size: 812KB

.reloc Size: 125KB - Virtual size: 125KB

.text
Size: 3.2MB - Virtual size: 3.2MB

.rdata
Size: 688KB - Virtual size: 688KB

.data
Size: 24KB - Virtual size: 114KB

.rsrc
Size: 812KB - Virtual size: 812KB

.reloc
Size: 125KB - Virtual size: 125KB