aaade162fd65053f1170907886cffb489428058b9f3ee913bd1ef865ddcec6eb

Sharing

Copy URL

Twitter E-mail

General

Target

aaade162fd65053f1170907886cffb489428058b9f3ee913bd1ef865ddcec6eb
Size

4.1MB
MD5

e0f58183b030cbf819a69eb5bee8128c
SHA1

c67c78f938dcbcce9bb5ce6b8c919f5dbd57024a
SHA256

aaade162fd65053f1170907886cffb489428058b9f3ee913bd1ef865ddcec6eb
SHA512

f575973d48f25a071328e9b393641f38c912f38ff8d6683d5bd5e11615781048632d6d635d766e6177f52d295de2d7ce02e5b8b05615028aab9d7b0b655bcfd4
SSDEEP

98304:JLpG51KRpT8HDzmZP3+1Y2XwIM6GQhH8aODxmpRnizuOOVkUkDRy:JLpG51KRpT8HDzmMB85uOOVNkDw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aaade162fd65053f1170907886cffb489428058b9f3ee913bd1ef865ddcec6eb

Files

aaade162fd65053f1170907886cffb489428058b9f3ee913bd1ef865ddcec6eb
.dll windows:6 windows x86

7dc9a18552a12d44cee66c4540204266

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

encryption

DecryptV2
EncryptV2

crypt32

CertOpenStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore

kernel32

GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
MoveFileExW
GetConsoleOutputCP
SetFilePointerEx
EnumSystemLocalesW
IsValidLocale
LCMapStringW
GetTimeFormatW
GetDateFormatW
VirtualQuery
VirtualAlloc
HeapQueryInformation
SetStdHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
GetFileInformationByHandle
GetDriveTypeW
SetConsoleCtrlHandler
ExitProcess
GetCommandLineW
GetCommandLineA
InterlockedFlushSList
RtlUnwind
GetCPInfo
GetStringTypeW
LCMapStringEx
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
OutputDebugStringW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
InitializeSListHead
GetEnvironmentStringsW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
SizeofResource
LockResource
LoadResource
FindResourceW
GetProcAddress
FreeLibrary
MultiByteToWideChar
DeleteFileW
lstrlenW
lstrlenA
GetLastError
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
CopyFileW
Sleep
WaitForSingleObject
ResumeThread
MoveFileW
CreateDirectoryW
CreateEventW
CloseHandle
SetEvent
HeapFree
InitializeCriticalSectionAndSpinCount
HeapSize
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
GetProcessHeap
LocalFree
FormatMessageW
VerSetConditionMask
VerifyVersionInfoW
GetVersionExW
GetModuleHandleW
GetCurrentProcess
GetSystemInfo
WinExec
GlobalAlloc
GlobalFree
CreateFileW
DeviceIoControl
GetTickCount
WTSGetActiveConsoleSessionId
GetComputerNameW
LoadLibraryExW
LoadLibraryW
GetModuleFileNameW
GetCurrentThreadId
GetCurrentProcessId
GetModuleFileNameA
GetLocalTime
MoveFileA
DeleteFileA
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
GetExitCodeProcess
TerminateProcess
CreatePipe
GetStartupInfoW
CreateProcessW
PeekNamedPipe
ReadFile
DuplicateHandle
WriteFile
CreateFileA
GetComputerNameA
GetPrivateProfileStringW
GetSystemPowerStatus
GetTimeZoneInformation
GetLogicalDrives
FindFirstFileW
FindClose
GetFileTime
TerminateThread
GetExitCodeThread
WaitForMultipleObjects
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
InitializeCriticalSectionEx
SystemTimeToFileTime
FileTimeToSystemTime
ResetEvent
GetStdHandle
GetFileType
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
SwitchToFiber
DeleteFiber
CreateFiber
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryA
FindNextFileW
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetSystemTime
GlobalSize
GlobalUnlock
GlobalLock
MulDiv
lstrcmpA
SetThreadPriority
SuspendThread
FileTimeToLocalFileTime
SystemTimeToTzSpecificLocalTime
OutputDebugStringA
GetCurrentThread
GetModuleHandleA
GlobalDeleteAtom
lstrcmpW
GetPrivateProfileIntW
WritePrivateProfileStringW
GlobalAddAtomW
FlushFileBuffers
GetFileSize
GetFullPathNameW
GetVolumeInformationW
LockFile
SetEndOfFile
SetFilePointer
UnlockFile
lstrcmpiW
GetFileAttributesW
GetFileAttributesExW
GetFileSizeEx
LocalAlloc
GlobalReAlloc
GlobalHandle
LocalReAlloc
SetErrorMode
CompareStringW
GlobalGetAtomNameW
EncodePointer
GetSystemDirectoryW
GlobalFindAtomW
GetCurrentDirectoryW
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultLCID
GetTempFileNameW
SearchPathW
GetProfileIntW
GetTempPathW
GetWindowsDirectoryW
FindResourceExW
lstrcpyW
VirtualProtect
GlobalFlags
GetUserDefaultUILanguage

user32

OffsetRect
SetRectEmpty
SendDlgItemMessageA
GetMenuItemInfoW
DestroyMenu
IntersectRect
InflateRect
DestroyIcon
InvalidateRect
KillTimer
SetTimer
RealChildWindowFromPoint
DeleteMenu
SystemParametersInfoW
CopyImage
IsDialogMessageW
SetWindowTextW
CheckDlgButton
MoveWindow
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
LoadIconW
GetWindow
GetTopWindow
GetClassNameW
DrawFrameControl
IsZoomed
GetSystemMenu
BringWindowToTop
SetCursorPos
CopyIcon
UnregisterClassW
FindWindowA
GetClassLongW
SetWindowLongW
PtInRect
EqualRect
CopyRect
MapWindowPoints
AdjustWindowRectEx
GetWindowRect
GetClientRect
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
UpdateWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
SetFocus
GetDlgCtrlID
GetDlgItem
FrameRect
EndDialog
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
EnumDisplayMonitors
SetWindowPos
DestroyWindow
IsChild
IsMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
LoadCursorW
GetSysColorBrush
GetDesktopWindow
FillRect
GetSysColor
ScreenToClient
ClientToScreen
GetNextDlgTabItem
GetAsyncKeyState
MapDialogRect
TrackMouseEvent
LoadImageW
GetNextDlgGroupItem
SetCapture
ReleaseCapture
WindowFromPoint
DrawFocusRect
IsRectEmpty
DrawIconEx
GetIconInfo
MessageBeep
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
CreatePopupMenu
GetMenuDefaultItem
MapVirtualKeyW
GetKeyNameTextW
LoadMenuW
SendMessageW
GetSystemMetrics
IsWindow
PostMessageW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
GetMenuStringW
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuW
AppendMenuW
RemoveMenu
UnhookWindowsHookEx
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
IsWindowVisible
GetActiveWindow
GetKeyState
ValidateRect
GetCursorPos
SetWindowsHookExW
CallNextHookEx
PostQuitMessage
GetFocus
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
GetParent
LoadBitmapW
ShowOwnedPopups
SetCursor
EnableWindow
IsWindowEnabled
GetWindowLongW
GetWindowThreadProcessId
GetLastActivePopup
CharUpperW
DrawTextW
DrawTextExW
GrayStringW
DrawIcon
UnionRect
UpdateLayeredWindow
MonitorFromPoint
CreateDialogIndirectParamW
EndDeferWindowPos
TabbedTextOutW
GetDC
GetWindowDC
ReleaseDC
BeginPaint
EndPaint
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateW
SetLayeredWindowAttributes
SetClassLongW
SetWindowRgn
SetParent
GetWindowPlacement
DrawEdge
LoadAcceleratorsW
TranslateAcceleratorW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
GetComboBoxInfo
PostThreadMessageW
WaitMessage
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
SetRect
LockWindowUpdate
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuW
RegisterClipboardFormatW
CharUpperBuffW
IsClipboardFormatAvailable
GetUpdateRect
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
SubtractRect
CreateMenu
GetWindowRgn
DestroyCursor
IsIconic

gdi32

GetTextFaceW
GetViewportOrgEx
GetWindowOrgEx
SetPixelV
SetPaletteEntries
ExtFloodFill
PtInRegion
GetBoundsRect
FrameRgn
FillRgn
RoundRect
OffsetRgn
GetRgnBox
Rectangle
LPtoDP
CreateRoundRectRgn
Polyline
Polygon
CreatePolygonRgn
GetTextColor
Ellipse
CreateEllipticRgn
SetDIBColorTable
CreateDIBSection
StretchBlt
SetPixel
GetTextCharsetInfo
CreateDIBitmap
CreateCompatibleBitmap
GetBkColor
RealizePalette
GetSystemPaletteEntries
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
EnumFontFamiliesExW
GetTextMetricsW
GetTextExtentPoint32W
DPtoLP
SetRectRgn
PatBlt
CreateRectRgnIndirect
CreateFontIndirectW
CombineRgn
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
ExtTextOutW
TextOutW
MoveToEx
GetObjectW
SetTextAlign
SetTextColor
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetBkMode
SetBkColor
SelectPalette
SelectObject
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
DeleteObject
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateCompatibleDC
BitBlt
CreateBitmap
GetDeviceCaps
CreateDCW
CopyMetaFileW
EnumFontFamiliesW

msimg32

AlphaBlend
TransparentBlt

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

SetFileSecurityW
CloseServiceHandle
RegCloseKey
RegOpenKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegQueryInfoKeyW
OpenSCManagerW
SetSecurityDescriptorDacl
AddAccessAllowedAce
LookupAccountNameW
InitializeAcl
InitializeSecurityDescriptor
LookupAccountSidW
GetTokenInformation
OpenProcessToken
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
GetUserNameW
RegQueryValueExW
RegEnumKeyExW

shell32

SHGetSpecialFolderPathW
SHGetFileInfoW
ShellExecuteW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
DragQueryFileW
DragFinish
SHAppBarMessage
SHBrowseForFolderW

shlwapi

PathFindFileNameW
PathIsUNCW
PathFindExtensionW
UrlUnescapeW
PathRemoveFileSpecW
StrFormatKBSizeW
PathStripToRootW

uxtheme

OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
GetWindowTheme
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor
GetThemePartSize
DrawThemeText
DrawThemeParentBackground

ole32

OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
OleLockRunning
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
IsAccelerator
CreateStreamOnHGlobal
CoDisconnectObject
CoCreateGuid
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
CoUninitialize
CoInitializeSecurity
CoInitialize

oleaut32

VariantInit
VariantClear
SysFreeString
SysAllocString
VarUdateFromDate
SystemTimeToVariantTime
VariantTimeToSystemTime
LoadTypeLi
SysStringLen
VariantCopy
VariantChangeType
VarBstrFromDate
SysAllocStringLen

winmm

PlaySoundW

ws2_32

WSASocketW
gethostbyaddr
getsockname
sendto
recvfrom
accept
bind
ntohs
htonl
WSAGetLastError
recv
send
__WSAFDIsSet
select
connect
ioctlsocket
freeaddrinfo
getaddrinfo
inet_addr
WSASetLastError
listen
inet_ntoa
socket
WSAStartup
gethostbyname
WSACleanup
setsockopt
closesocket
htons

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

sensapi

IsNetworkAlive

bcrypt

BCryptGenRandom

gdiplus

GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipSetInterpolationMode
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc
GdiplusShutdown
GdipGetImagePalette
GdipCreateBitmapFromStream
GdipDrawImageRectI
GdipGetImagePaletteSize
GdiplusStartup

wininet

InternetWriteFile
InternetSetFilePointer
InternetReadFile
HttpQueryInfoW
InternetCloseHandle
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetSetOptionW
InternetSetStatusCallbackW
InternetOpenW
InternetQueryDataAvailable
InternetQueryOptionW
InternetOpenUrlW
InternetGetLastResponseInfoW

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

Exports

Exports

GetSCMInstance
InitLog

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 815KB - Virtual size: 815KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 51KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 209KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7dc9a18552a12d44cee66c4540204266

Headers

DLL Characteristics

File Characteristics

Imports

encryption

crypt32

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

winmm

ws2_32

wtsapi32

sensapi

bcrypt

gdiplus

wininet

oleacc

imm32

Exports

Exports

Sections

.text Size: 3.0MB - Virtual size: 3.0MB

.rdata Size: 815KB - Virtual size: 815KB

.data Size: 51KB - Virtual size: 98KB

.rsrc Size: 16KB - Virtual size: 16KB

.reloc Size: 209KB - Virtual size: 208KB

.text
Size: 3.0MB - Virtual size: 3.0MB

.rdata
Size: 815KB - Virtual size: 815KB

.data
Size: 51KB - Virtual size: 98KB

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 209KB - Virtual size: 208KB