5f6a22e0968e089474e7db3a34068a3fa64fdaa4df9736f3be2fa937861d4367

Sharing

Copy URL

Twitter E-mail

General

Target

5f6a22e0968e089474e7db3a34068a3fa64fdaa4df9736f3be2fa937861d4367
Size

3.8MB
MD5

5077acf03725fe87aeafb7972b08a30a
SHA1

16a0bc4390115df314996ce76b070ba0e282e8de
SHA256

5f6a22e0968e089474e7db3a34068a3fa64fdaa4df9736f3be2fa937861d4367
SHA512

f0f6ef94383f22038ca6b61be12007bc6b7016c010687a55f0524a75258b4dce0fa02e463a6a74406173b4877c4bde3affc9c5a31692bd00dfe677ad36092101
SSDEEP

98304:qAVrKGBA8o30zMg7l5+b8CQ98+tQpWmHmBOk0cDc9tye5mgdVELm:qAeGBA8o30zMgDzmGux5mgdOLm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5f6a22e0968e089474e7db3a34068a3fa64fdaa4df9736f3be2fa937861d4367

Files

5f6a22e0968e089474e7db3a34068a3fa64fdaa4df9736f3be2fa937861d4367
.exe windows:6 windows x86

7d3bc685e83ee5f9e9cc7099ce586cbf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

socket
bind
listen
accept
send
recv
select
closesocket
WSACleanup
getsockname
connect
__WSAFDIsSet
ioctlsocket
setsockopt
freeaddrinfo
getaddrinfo
htonl
gethostbyname
inet_ntoa
WSAGetLastError
inet_addr
gethostbyaddr
ntohs
WSAStartup
htons

wpcap

pcap_open_live
pcap_loop
pcap_sendpacket
pcap_close
pcap_geterr
pcap_setfilter
pcap_compile
pcap_breakloop

crypt32

CertFindCertificateInStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

kernel32

GlobalFlags
GetLocaleInfoW
GetUserDefaultUILanguage
VirtualProtect
lstrcpyW
GetCurrentDirectoryW
FindResourceExW
GetWindowsDirectoryW
GetTempPathW
GetProfileIntW
SearchPathW
GlobalAddAtomW
GetTempFileNameW
GetUserDefaultLCID
UnhandledExceptionFilter
IsProcessorFeaturePresent
WaitForSingleObjectEx
InitializeSListHead
IsDebuggerPresent
WriteConsoleW
EncodePointer
SetEnvironmentVariableW
GlobalGetAtomNameW
GlobalHandle
GetEnvironmentStringsW
GlobalFindAtomW
lstrcmpW
GlobalDeleteAtom
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetConsoleOutputCP
SetFilePointerEx
EnumSystemLocalesW
IsValidLocale
LCMapStringW
GetTimeFormatW
GetDateFormatW
VirtualQuery
VirtualAlloc
HeapQueryInformation
SetStdHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
GetFileInformationByHandle
SetConsoleCtrlHandler
GetCommandLineA
RtlUnwind
GetCPInfo
GetStringTypeW
LCMapStringEx
GetSystemDirectoryW
FreeEnvironmentStringsW
SizeofResource
LockResource
LoadResource
FindResourceW
ResumeThread
Sleep
GetTickCount
lstrlenW
GlobalReAlloc
CompareStringW
GetFileSizeEx
GetFileAttributesExW
GetFileAttributesW
GetModuleHandleA
OutputDebugStringA
UnlockFile
SetFilePointer
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
FlushFileBuffers
SetErrorMode
SystemTimeToTzSpecificLocalTime
FileTimeToLocalFileTime
lstrcmpA
SuspendThread
SetThreadPriority
MulDiv
GlobalLock
GlobalUnlock
GlobalSize
GetSystemTime
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
GetEnvironmentVariableW
FindNextFileW
LoadLibraryA
ConvertThreadToFiber
ConvertFiberToThread
GetSystemTimeAsFileTime
CreateFiber
DeleteFiber
SwitchToFiber
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
GetFileType
GetStdHandle
GetComputerNameA
CreateFileA
OpenFileMappingW
UnmapViewOfFile
MapViewOfFile
ResetEvent
InitializeCriticalSectionEx
GetTimeZoneInformation
GetSystemPowerStatus
CompareFileTime
lstrcmpiW
GetModuleHandleExW
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
ExitProcess
SetUnhandledExceptionFilter
OutputDebugStringW
GetFileSize
LocalAlloc
FileTimeToSystemTime
SystemTimeToFileTime
GetFileTime
CopyFileW
WideCharToMultiByte
GetLastError
QueryPerformanceFrequency
LocalReAlloc
GetModuleFileNameW
RemoveDirectoryW
CreateDirectoryW
GetLogicalDrives
DuplicateHandle
PeekNamedPipe
CreateProcessW
GetStartupInfoW
CreatePipe
TerminateProcess
GetExitCodeProcess
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetDiskFreeSpaceExW
GetDriveTypeW
LoadLibraryW
LoadLibraryExW
GetComputerNameW
WTSGetActiveConsoleSessionId
DeviceIoControl
GetSystemInfo
GetCurrentProcess
GetVersionExW
VerifyVersionInfoW
VerSetConditionMask
FormatMessageW
LocalFree
DeleteFileA
MoveFileA
GetLocalTime
GetModuleFileNameA
GetCurrentThreadId
WinExec
GetProcessHeap
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
HeapFree
FindClose
FindFirstFileW
GetCurrentProcessId
GetModuleHandleW
GetCommandLineW
FreeLibrary
GetProcAddress
lstrlenA
MoveFileExW
MoveFileW
DeleteFileW
MultiByteToWideChar
WaitForMultipleObjects
ReleaseMutex
SetEvent
CreateMutexW
CreateEventW
ReadFile
WriteFile
TerminateThread
WaitForSingleObject
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetLogicalDriveStringsW
GlobalFree
CloseHandle
CreateFileW
GlobalAlloc
QueryPerformanceCounter

user32

GetComboBoxInfo
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
TranslateAcceleratorW
LoadAcceleratorsW
MonitorFromPoint
UpdateLayeredWindow
UnionRect
DrawIcon
FrameRect
CopyIcon
SetCursorPos
BringWindowToTop
GetSystemMenu
IsZoomed
DrawFrameControl
DrawEdge
SetParent
SetWindowRgn
SetClassLongW
DrawStateW
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
EnumDisplayMonitors
SetLayeredWindowAttributes
LoadMenuW
GetKeyNameTextW
MapVirtualKeyW
GetMenuDefaultItem
CreatePopupMenu
NotifyWinEvent
InvertRect
HideCaret
EnableScrollBar
MessageBeep
GetIconInfo
DrawIconEx
IsRectEmpty
DrawFocusRect
WindowFromPoint
ReleaseCapture
SetCapture
GetNextDlgGroupItem
KillTimer
SetTimer
DeleteMenu
SetCursor
ShowOwnedPopups
LoadImageW
InvalidateRect
TrackMouseEvent
MapDialogRect
GetAsyncKeyState
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
PostQuitMessage
OffsetRect
SetRectEmpty
SendDlgItemMessageA
CopyImage
SystemParametersInfoW
GetMenuItemInfoW
DestroyMenu
DestroyIcon
RealChildWindowFromPoint
GetDesktopWindow
IntersectRect
InflateRect
IsDialogMessageW
SetWindowTextW
UnregisterDeviceNotification
RegisterDeviceNotificationW
FindWindowA
PostThreadMessageW
SubtractRect
CheckDlgButton
MoveWindow
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
LoadIconW
GetWindow
GetTopWindow
GetClassNameW
GetClassLongW
SetWindowLongW
PtInRect
EqualRect
CopyRect
MapWindowPoints
AdjustWindowRectEx
GetWindowRect
GetClientRect
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
UpdateWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
SetFocus
GetDlgCtrlID
GetDlgItem
IsIconic
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
DestroyWindow
IsChild
IsMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetFocus
GetWindowTextLengthW
GetWindowTextW
LoadCursorW
GetSysColorBrush
FillRect
WaitMessage
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
SetRect
LockWindowUpdate
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuW
RegisterClipboardFormatW
CharUpperBuffW
IsClipboardFormatAvailable
GetUpdateRect
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
SendMessageW
MessageBoxW
IsWindow
PostMessageW
GetProcessWindowStation
CreateMenu
TranslateMDISysAccel
GetWindowRgn
DestroyCursor
GetUserObjectInformationW
GetMenuStringW
ScreenToClient
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuW
AppendMenuW
RemoveMenu
UnhookWindowsHookEx
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
IsWindowVisible
GetActiveWindow
GetKeyState
ValidateRect
GetCursorPos
SetWindowsHookExW
CallNextHookEx
CharUpperW
GetSystemMetrics
EnableWindow
IsWindowEnabled
GetWindowLongW
GetParent
GetWindowThreadProcessId
GetLastActivePopup
DrawTextW
DrawTextExW
GrayStringW
TabbedTextOutW
GetDC
GetWindowDC
ReleaseDC
BeginPaint
EndPaint
ClientToScreen
GetSysColor

gdi32

DPtoLP
GetTextExtentPoint32W
GetTextMetricsW
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
GetBkColor
CreateCompatibleBitmap
CreateDIBitmap
GetTextCharsetInfo
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
PatBlt
CreateRoundRectRgn
LPtoDP
Rectangle
GetRgnBox
OffsetRgn
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetTextFaceW
CreateRectRgnIndirect
CreateFontIndirectW
CombineRgn
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
ExtTextOutW
TextOutW
MoveToEx
GetObjectW
SetTextAlign
SetTextColor
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetBkMode
SetBkColor
SelectPalette
SelectObject
ExtSelectClipRgn
SelectClipRgn
EnumFontFamiliesW
CopyMetaFileW
CreateDCW
GetDeviceCaps
BitBlt
CreateBitmap
CreateCompatibleDC
CreateHatchBrush
CreatePen
CreatePatternBrush
CreateRectRgn
CreateSolidBrush
DeleteDC
DeleteObject
Escape
ExcludeClipRect
GetClipBox
GetObjectType
GetPixel
GetStockObject
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
PtVisible
RectVisible
RestoreDC
SetRectRgn
Polyline
SaveDC

msimg32

TransparentBlt
AlphaBlend

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
RegQueryInfoKeyW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
UnlockServiceDatabase
DeleteService
CreateServiceW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
LookupAccountNameW
CreateProcessAsUserW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
GetUserNameW
RegQueryValueExW
RegEnumKeyExW
OpenSCManagerW
CloseServiceHandle
OpenServiceW

shell32

SHGetSpecialFolderPathW
ShellExecuteW
SHGetFileInfoW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHAppBarMessage
SHBrowseForFolderW
DragFinish
DragQueryFileW

shlwapi

PathIsUNCW
PathFindExtensionW
PathRemoveFileSpecW
StrFormatKBSizeW
PathStripToRootW
PathFindFileNameW

uxtheme

GetThemeSysColor
GetThemePartSize
OpenThemeData
DrawThemeBackground
CloseThemeData
DrawThemeParentBackground
GetThemeColor
GetCurrentThemeName
GetWindowTheme
IsAppThemed
IsThemeBackgroundPartiallyTransparent
DrawThemeText

ole32

OleLockRunning
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
CreateStreamOnHGlobal
CoInitializeEx
CoDisconnectObject
ReleaseStgMedium
OleDuplicateData
CoCreateGuid
CoInitialize
CoTaskMemFree
CoTaskMemAlloc
CoInitializeSecurity
CoUninitialize
RevokeDragDrop
CoCreateInstance
CoSetProxyBlanket

oleaut32

VariantClear
VariantInit
LoadTypeLi
SysAllocStringLen
SysStringLen
SysAllocString
VariantCopy
VariantChangeType
VarBstrFromDate
VarUdateFromDate
SystemTimeToVariantTime
SysFreeString
VariantTimeToSystemTime

winmm

PlaySoundW

wininet

InternetCloseHandle

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

wsock32

WSASetLastError

bcrypt

BCryptGenRandom

gdiplus

GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipCreateFromHDC
GdipDeleteGraphics
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipSetInterpolationMode
GdipDrawImageI
GdipGetImagePixelFormat
GdipCreateBitmapFromHBITMAP
GdipDrawImageRectI
GdipGetImagePalette

oleacc

CreateStdAccessibleObject
LresultFromObject
AccessibleObjectFromWindow

imm32

ImmGetOpenStatus
ImmGetContext
ImmReleaseContext

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 785KB - Virtual size: 785KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 199KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7d3bc685e83ee5f9e9cc7099ce586cbf

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wpcap

crypt32

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

winmm

wininet

wtsapi32

wsock32

bcrypt

gdiplus

oleacc

imm32

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

.rdata Size: 785KB - Virtual size: 785KB

.data Size: 39KB - Virtual size: 88KB

.rsrc Size: 12KB - Virtual size: 12KB

.reloc Size: 199KB - Virtual size: 199KB

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 785KB - Virtual size: 785KB

.data
Size: 39KB - Virtual size: 88KB

.rsrc
Size: 12KB - Virtual size: 12KB

.reloc
Size: 199KB - Virtual size: 199KB