ffe2c886a1ec9b3d0b06c3ebff59f05964979289fdf7b895405d714e2a6d9582

Sharing

Copy URL

Twitter E-mail

General

Target

ffe2c886a1ec9b3d0b06c3ebff59f05964979289fdf7b895405d714e2a6d9582
Size

5.5MB
MD5

39f98875d1f2fbb2fb286f4d09a3c035
SHA1

a5a5af946a4d3cf82f58a9f89309b6c5aacd72f5
SHA256

ffe2c886a1ec9b3d0b06c3ebff59f05964979289fdf7b895405d714e2a6d9582
SHA512

053087a851f2bfcbb112890ebaec5d407f575dd3fcd25be816013814cb199743a0eea42df0968bfbad8be9b0337702ae5df82504942067086a7059641f44668d
SSDEEP

98304:FR46AZv8SMen5//j7x/yXBzF6coFkpn5SOLBR/Iia5Dm8Hglo354Fqi1lPXZtFLd:f46AZv8SMen5//j7x/yO+jBJo354FqiX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffe2c886a1ec9b3d0b06c3ebff59f05964979289fdf7b895405d714e2a6d9582

Files

ffe2c886a1ec9b3d0b06c3ebff59f05964979289fdf7b895405d714e2a6d9582
.exe windows:6 windows x86

a77b253787402dfb9759a2153af607cc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wldap32

ord27
ord127
ord167
ord46
ord219
ord117
ord41
ord208
ord216
ord26
ord79
ord133
ord147
ord301
ord14
ord145
ord142

ws2_32

ntohs
getsockopt
WSACloseEvent
getsockname
getpeername
WSACreateEvent
WSAEnumNetworkEvents
sendto
WSAGetLastError
WSAStartup
inet_addr
htons
gethostbyaddr
getnameinfo
recvfrom
accept
listen
WSASetLastError
WSAIoctl
gethostname
bind
setsockopt
htonl
gethostbyname
recv
send
__WSAFDIsSet
select
connect
ioctlsocket
inet_ntoa
freeaddrinfo
getaddrinfo
socket
closesocket
WSACleanup
WSAEventSelect

crypt32

CertFreeCertificateContext
CertFindCertificateInStore
CertOpenStore
CertGetCertificateContextProperty
CertCloseStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW

kernel32

GlobalLock
MulDiv
OutputDebugStringA
EncodePointer
GlobalDeleteAtom
lstrcmpW
GlobalAddAtomW
GlobalFindAtomW
CompareStringW
lstrcmpA
GetCurrentThread
lstrcpyW
SetThreadPriority
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
FlushFileBuffers
GetFileSize
GetFullPathNameW
GetVolumeInformationW
LockFile
SetEndOfFile
SetFilePointer
UnlockFile
lstrcmpiW
MoveFileW
FileTimeToLocalFileTime
SystemTimeToTzSpecificLocalTime
GetFileAttributesW
GetFileAttributesExW
GetFileSizeEx
GlobalReAlloc
GlobalHandle
LocalAlloc
SwitchToFiber
GlobalGetAtomNameW
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GlobalFlags
VirtualProtect
SetErrorMode
GetCurrentDirectoryW
GetTempPathW
FindResourceExW
GetWindowsDirectoryW
SearchPathW
GetProfileIntW
GetTempFileNameW
GetUserDefaultLCID
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
EnumSystemLocalesW
IsValidLocale
LCMapStringW
GetTimeFormatW
GetDateFormatW
GetConsoleOutputCP
VirtualAlloc
HeapQueryInformation
SetStdHandle
SetConsoleCtrlHandler
SetFilePointerEx
FreeLibraryAndExitThread
ExitThread
CreateThread
GetFileInformationByHandle
GetDriveTypeW
GetCommandLineW
GetCommandLineA
RtlUnwind
GetCPInfo
GetStringTypeW
LCMapStringEx
TlsFree
InitializeCriticalSectionAndSpinCount
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
GetEnvironmentVariableW
GetModuleHandleA
GetFileType
GetStdHandle
GetEnvironmentVariableA
GetSystemTimeAsFileTime
WaitForSingleObjectEx
SetLastError
GetSystemDirectoryW
GetComputerNameA
CreateFileA
WaitForMultipleObjects
SetEvent
GlobalSize
CreateEventW
ResumeThread
FileTimeToSystemTime
SystemTimeToFileTime
GetModuleHandleExW
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
ExitProcess
SetUnhandledExceptionFilter
GetTimeZoneInformation
GetSystemPowerStatus
CompareFileTime
GetFileTime
SleepEx
CreateDirectoryW
FindClose
FindFirstFileW
GetLogicalDrives
GetUserDefaultLangID
VirtualQuery
OpenFileMappingW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
WriteFile
DuplicateHandle
WaitForSingleObject
ReadFile
OutputDebugStringW
GetSystemTime
FindNextFileW
PeekNamedPipe
CreateProcessW
GetStartupInfoW
CreatePipe
TerminateProcess
GetExitCodeProcess
OpenProcess
CreateMutexW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
LoadLibraryA
LoadLibraryW
LoadLibraryExW
GetComputerNameW
WTSGetActiveConsoleSessionId
GetTickCount
CloseHandle
DeviceIoControl
CreateFileW
GlobalFree
GlobalAlloc
GetSystemInfo
GetCurrentProcess
GetVersionExW
VerifyVersionInfoW
VerSetConditionMask
FormatMessageW
LocalFree
DeleteFileA
MoveFileA
GetLocalTime
GetModuleFileNameA
IsSystemResumeAutomatic
WideCharToMultiByte
lstrlenW
lstrlenA
GetSystemDefaultLangID
Sleep
GetTickCount64
DeleteFileW
GetModuleFileNameW
GetModuleHandleW
MoveFileExW
CopyFileW
GetCurrentProcessId
FreeLibrary
GetProcAddress
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
TlsGetValue
TlsSetValue
TlsAlloc
GetCurrentThreadId
InitializeCriticalSection
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
HeapFree
ConvertThreadToFiber
ConvertFiberToThread
GlobalUnlock
CreateFiber
ResetEvent
DeleteFiber
LocalReAlloc

user32

ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
TranslateAcceleratorW
LoadImageW
DestroyIcon
PostThreadMessageW
SetClassLongW
LockWindowUpdate
BringWindowToTop
SetParent
SetRect
SetCursorPos
CopyAcceleratorTableW
DestroyAcceleratorTable
CreateAcceleratorTableW
LoadAcceleratorsW
MapVirtualKeyW
GetKeyboardState
GetKeyboardLayout
ToUnicodeEx
DrawIconEx
DrawFocusRect
DrawFrameControl
DrawEdge
MonitorFromPoint
UnionRect
EnableScrollBar
UpdateLayeredWindow
IsRectEmpty
SetMenuDefaultItem
GetMenuDefaultItem
CreatePopupMenu
NotifyWinEvent
MessageBeep
SetWindowRgn
GetSystemMenu
LoadMenuW
IsZoomed
TrackMouseEvent
IntersectRect
KillTimer
SetTimer
DeleteMenu
WindowFromPoint
ReleaseCapture
SetCapture
WaitMessage
MapDialogRect
GetAsyncKeyState
RealChildWindowFromPoint
OffsetRect
SendDlgItemMessageA
CopyImage
InflateRect
DestroyMenu
CharUpperW
InvalidateRect
DrawStateW
SetCursor
ShowOwnedPopups
TranslateMessage
GetMessageW
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
IsDialogMessageW
CheckDlgButton
MoveWindow
ShowWindow
RegisterClipboardFormatW
EnumDisplayMonitors
SystemParametersInfoW
LoadCursorW
OpenClipboard
GetSysColorBrush
SetLayeredWindowAttributes
GetCursorPos
FillRect
ClientToScreen
ReleaseDC
GetWindowDC
GetDC
TabbedTextOutW
DrawTextExW
DrawTextW
GetWindowThreadProcessId
GetDesktopWindow
IsWindowEnabled
GetActiveWindow
GetNextDlgTabItem
DestroyCursor
CreateDialogIndirectParamW
PostQuitMessage
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
CallNextHookEx
SetWindowsHookExW
GetWindow
GetLastActivePopup
CloseClipboard
SetClipboardData
EmptyClipboard
CharUpperBuffW
GetTopWindow
GetClassNameW
GetParent
GetClassLongW
PtInRect
EqualRect
CopyRect
GetSysColor
MapWindowPoints
ScreenToClient
AdjustWindowRectEx
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
ValidateRect
EndPaint
BeginPaint
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
UpdateWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
GetKeyState
GetFocus
SetFocus
GetDlgItem
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
DestroyWindow
IsChild
IsMenu
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
GetMessageTime
GetMessagePos
PeekMessageW
DispatchMessageW
RegisterWindowMessageW
ModifyMenuW
CopyIcon
FrameRect
GetDoubleClickTime
GetIconInfo
IsCharLowerW
GetKeyNameTextW
MapVirtualKeyExW
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
IsClipboardFormatAvailable
GetUpdateRect
SubtractRect
CreateMenu
GetNextDlgGroupItem
HideCaret
SetRectEmpty
UnhookWindowsHookEx
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringW
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
SetMenuItemInfoW
GetMenuItemInfoW
GetMenuItemCount
SetWindowTextW
GetDlgCtrlID
FindWindowW
FindWindowA
EnableWindow
GetWindowLongW
DrawIcon
GetClientRect
GetSystemMetrics
IsIconic
SendMessageW
LoadIconW
PostMessageW
SetWindowLongW
CreateWindowExW
IsWindow
DefWindowProcW
UnregisterClassW
InvertRect
GetWindowRgn
EndDialog
GetComboBoxInfo
GrayStringW

gdi32

MoveToEx
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateCompatibleBitmap
CreateDIBitmap
CreateFontIndirectW
CreateRectRgnIndirect
GetTextCharsetInfo
GetTextMetricsW
GetTextExtentPoint32W
CombineRgn
PatBlt
SetRectRgn
DPtoLP
CreateRoundRectRgn
CreateDIBSection
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
Polyline
EnumFontFamiliesExW
RealizePalette
SetPixel
StretchBlt
SetDIBColorTable
GetRgnBox
OffsetRgn
Rectangle
RoundRect
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
LPtoDP
ExtFloodFill
SetPaletteEntries
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
GetWindowOrgEx
GetViewportOrgEx
SetPixelV
GetTextFaceW
SetTextAlign
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetBkMode
SelectPalette
SelectObject
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
DeleteObject
CreateSolidBrush
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateCompatibleDC
CreateBitmap
BitBlt
GetObjectW
SetTextColor
SetBkColor
GetDeviceCaps
CreateDCW
CopyMetaFileW
EnumFontFamiliesW
GetBkColor
DeleteDC

msimg32

AlphaBlend
TransparentBlt

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegCloseKey
RegEnumValueW
RegQueryValueW
RegEnumKeyW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegSetValueExW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
GetUserNameW
RegDeleteValueW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW

shell32

DragFinish
SHGetSpecialFolderPathW
SHGetFileInfoW
SHBrowseForFolderW
SHAppBarMessage
SHGetDesktopFolder
SHGetPathFromIDListW
ShellExecuteW
SHGetSpecialFolderLocation
DragQueryFileW

shlwapi

PathFindExtensionW
PathFindFileNameW
PathStripToRootW
StrFormatKBSizeW
PathRemoveFileSpecW
PathIsUNCW

uxtheme

DrawThemeBackground
GetThemeColor
CloseThemeData
GetThemeSysColor
GetWindowTheme
IsThemeBackgroundPartiallyTransparent
OpenThemeData
DrawThemeText
IsAppThemed
DrawThemeParentBackground
GetCurrentThemeName
GetThemePartSize

ole32

OleFlushClipboard
OleIsCurrentClipboard
CoInitialize
CoInitializeSecurity
CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoTaskMemAlloc
CoTaskMemFree
OleDuplicateData
ReleaseStgMedium
CoCreateGuid
CoFreeUnusedLibraries
OleUninitialize
CoDisconnectObject
CoRevokeClassObject
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
CoInitializeEx
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
CreateStreamOnHGlobal
DoDragDrop

oleaut32

VariantTimeToSystemTime
SysFreeString
VariantInit
VariantClear
SysAllocString
VarBstrFromDate
VariantCopy
VarUdateFromDate
LoadTypeLi
SysStringLen
VariantChangeType
SysAllocStringLen
SystemTimeToVariantTime

gdiplus

GdipFree
GdiplusStartup
GdipAlloc
GdiplusShutdown
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipDeleteGraphics
GdipCloneImage
GdipDrawImageRectI
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDrawImageI
GdipSetInterpolationMode

winmm

PlaySoundW

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory
WTSRegisterSessionNotification

bcrypt

BCryptGenRandom

oleacc

CreateStdAccessibleObject
LresultFromObject
AccessibleObjectFromWindow

imm32

ImmGetContext
ImmReleaseContext
ImmGetOpenStatus

wsock32

shutdown

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 840KB - Virtual size: 840KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 214KB - Virtual size: 214KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a77b253787402dfb9759a2153af607cc

Headers

DLL Characteristics

File Characteristics

Imports

wldap32

ws2_32

crypt32

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

gdiplus

winmm

wtsapi32

bcrypt

oleacc

imm32

wsock32

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.rdata Size: 840KB - Virtual size: 840KB

.data Size: 40KB - Virtual size: 90KB

.rsrc Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 214KB - Virtual size: 214KB

.text
Size: 3.1MB - Virtual size: 3.1MB

.rdata
Size: 840KB - Virtual size: 840KB

.data
Size: 40KB - Virtual size: 90KB

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 214KB - Virtual size: 214KB