009ffede4d6c3a5c768f1adce901727be9d022c0815f865d3598261c8a08e3ea

Sharing

Copy URL Twitter E-mail

General

Target

009ffede4d6c3a5c768f1adce901727be9d022c0815f865d3598261c8a08e3ea
Size

4.1MB
MD5

1de7b0e60617dbc22e59fc7ece9cd0b7
SHA1

e553a6c9e87282b3da367c1e1c8226c2e252cb81
SHA256

009ffede4d6c3a5c768f1adce901727be9d022c0815f865d3598261c8a08e3ea
SHA512

c6361af6fc9998119e70a1891d268594e31cc413ff7b6a2807720a33a5edc86e4243a0ae84f355ed09d28b47cd8b04c4025ecf9a643e99ca82ac43855eed42ee
SSDEEP

98304:HvaQtbMdEbzag3pnIhknyI011KazsfvND7Tp:HSAwKza2ISnt7VfT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
009ffede4d6c3a5c768f1adce901727be9d022c0815f865d3598261c8a08e3ea

Files

009ffede4d6c3a5c768f1adce901727be9d022c0815f865d3598261c8a08e3ea
.exe windows:5 windows x86

dd8fca983b31ae70df9945159186a78e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenMutexW
CreateMutexW
GetSystemTime
LocalFree
GetModuleHandleA
CreateFileMappingW
LocalAlloc
GlobalFree
GlobalUnlock
GetTimeZoneInformation
SetTimeZoneInformation
GlobalAlloc
GetFileAttributesExA
GlobalLock
UnmapViewOfFile
MapViewOfFile
SetFilePointer
WinExec
MultiByteToWideChar
CreateSemaphoreA
FindResourceExW
SystemTimeToFileTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetSystemTimeAsFileTime
FreeResource
LockResource
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
SetEndOfFile
InitializeCriticalSectionAndSpinCount
GetCurrentDirectoryA
GetFullPathNameA
GetStringTypeW
LoadLibraryW
IsValidLocale
LoadResource
SizeofResource
FindResourceW
CreateFileA
GetFileAttributesExW
WideCharToMultiByte
CreateDirectoryW
InterlockedDecrement
Module32FirstW
GetProfileStringW
FindClose
FindNextFileW
FindFirstFileW
GetQueuedCompletionStatus
WaitForMultipleObjects
GetVersionExW
OpenFileMappingW
GetLogicalDriveStringsW
OpenProcess
lstrcpyW
CreateProcessW
GetLocalTime
Sleep
GetCurrentThreadId
GetProfileIntW
lstrlenW
WriteProfileStringW
GetComputerNameA
GetCurrentProcessId
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetPrivateProfileStringW
GetModuleHandleW
CopyFileW
SuspendThread
OpenThread
TerminateThread
ResumeThread
GetTickCount
GetPrivateProfileIntW
DeleteFileW
GetFileAttributesW
CloseHandle
ReadFile
GetFileSize
GetLastError
CreateFileW
GetModuleFileNameW
InitializeCriticalSection
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetStdHandle
SetHandleCount
FlushFileBuffers
GetConsoleCP
HeapCreate
VirtualFree
IsValidCodePage
GetOEMCP
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
GetConsoleMode
SetConsoleMode
ReadConsoleInputA
SetConsoleCtrlHandler
ReleaseMutex
SetFileTime
GetProcAddress
GetSystemDirectoryW
WaitForSingleObject
GetFileInformationByHandle
CreateIoCompletionPort
GetCurrentDirectoryW
ExitProcess
GetDriveTypeA
GetCPInfo
LCMapStringW
LCMapStringA
RtlUnwind
GetStartupInfoA
GetCommandLineA
VirtualQuery
VirtualAlloc
VirtualProtect
CreateThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapSize
HeapReAlloc
HeapAlloc
HeapDestroy
RaiseException
GetProcessHeap
HeapFree
FlushConsoleInputBuffer
GlobalMemoryStatus
QueryPerformanceCounter
FindFirstFileA
LoadLibraryA
VerSetConditionMask
VerifyVersionInfoA
ExpandEnvironmentStringsA
PeekNamedPipe
SleepEx
GetStdHandle
GetFileType
GetVersion
FormatMessageA
SetLastError
MulDiv
GetACP
InterlockedExchange
InterlockedIncrement
WriteFile
DuplicateHandle
FreeLibrary
TerminateProcess
PostQueuedCompletionStatus
SetEvent
CreateEventW
ResetEvent
GlobalMemoryStatusEx
GetSystemInfo
GetComputerNameW
OutputDebugStringW
GetCurrentProcess
GetStartupInfoW
CreatePipe
GetExitCodeProcess
CreateProcessA
GetSystemDirectoryA
GetWindowsDirectoryW
OutputDebugStringA
WritePrivateProfileStringW
DeleteCriticalSection
EnterCriticalSection
GetStringTypeA
LeaveCriticalSection

user32

CreateWindowExW
PostQuitMessage
DispatchMessageW
DefWindowProcW
GetDesktopWindow
CloseClipboard
EmptyClipboard
MonitorFromWindow
IsWindow
GetWindowLongW
SetWindowLongW
ScreenToClient
GetClientRect
GetWindowTextW
PtInRect
IntersectRect
CharNextW
FindWindowW
ShowWindow
SetWindowPos
MessageBoxW
GetSystemMetrics
SetTimer
OpenClipboard
MoveWindow
KillTimer
SetForegroundWindow
TranslateMessage
GetMessageW
EnableWindow
GetWindow
GetParent
RegisterClassW
LoadCursorW
RegisterClassExW
GetClassInfoExW
CallWindowProcW
GetPropW
SetPropW
AdjustWindowRectEx
GetMenu
ReleaseDC
DestroyWindow
EnumWindows
GetDlgCtrlID
ExitWindowsEx
GetMonitorInfoW
PostMessageW
GetDC
GetKeyState
GetFocus
MapWindowPoints
GetUpdateRect
IsRectEmpty
EndPaint
BringWindowToTop
FindWindowExW
IsIconic
IsWindowVisible
wsprintfW
SetFocus
GetCursorPos
CreatePopupMenu
AppendMenuW
TrackPopupMenu
SetWindowRgn
ClientToScreen
SendMessageW
RegisterWindowMessageW
LoadIconW
SetClipboardData
GetWindowThreadProcessId
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW
SetWindowTextW
GetWindowTextLengthW
GetGUIThreadInfo
GetWindowRect
DestroyIcon
BeginPaint
GetActiveWindow
UnionRect
InvalidateRect
SetCapture
ReleaseCapture
OffsetRect
wvsprintfW
CreateAcceleratorTableW
InvalidateRgn
GetCaretBlinkTime
GetSysColor
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
CreateCaret
SetRect
CharPrevW
DrawTextW
FillRect
SetCursor

gdi32

BitBlt
CreatePatternBrush
GetDeviceCaps
GetObjectA
GdiFlush
PatBlt
DeleteDC
CreateDIBSection
SetPixel
CreateCompatibleDC
GetObjectW
MoveToEx
LineTo
SelectObject
CreatePenIndirect
DeleteObject
CreateRoundRectRgn
CreatePen
CreateFontIndirectW
GetStockObject
SetWindowOrgEx
Rectangle
RestoreDC
SaveDC
CreateCompatibleBitmap
RemoveFontMemResourceEx
GetTextMetricsW
SelectClipRgn
CombineRgn
CreateRectRgnIndirect
GetClipBox
StretchBlt
SetStretchBltMode
CreateSolidBrush
RoundRect
SetTextColor
SetBkMode
TextOutW
GetTextExtentPoint32W
GetCharABCWidthsW
SetBkColor
ExtSelectClipRgn

comdlg32

GetOpenFileNameW

advapi32

StartServiceA
ReportEventA
DeregisterEventSource
RegOpenKeyExW
RegDeleteValueW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegQueryValueExW
OpenProcessToken
RegSetValueExW
RegFlushKey
ControlService
OpenSCManagerA
QueryServiceStatusEx
QueryServiceStatus
RegisterEventSourceA
RegCreateKeyExW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
OpenServiceA
CreateServiceW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegEnumKeyExW
RegQueryInfoKeyW

shell32

SHGetSpecialFolderPathW
Shell_NotifyIconW
ShellExecuteA
ShellExecuteExW
SHFileOperationW
SHGetPathFromIDListW
ShellExecuteW

ole32

CLSIDFromString
CLSIDFromProgID
OleLockRunning
CreateStreamOnHGlobal
CoTaskMemFree
CoCreateInstance
CoUninitialize
OleUninitialize
OleInitialize
CoInitialize

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString

iphlpapi

GetIpAddrTable
GetAdaptersAddresses
GetAdaptersInfo
GetIfTable
CreateIpForwardEntry
DeleteIpForwardEntry
GetIpForwardTable
SendARP

gdiplus

GdipSetCompositingQuality
GdipSetPixelOffsetMode
GdipDrawString
GdipDrawImage
GdipDeleteFontFamily
GdipDeleteStringFormat
GdipDeleteFont
GdipGetPathGradientPointCount
GdipSetPathGradientSurroundColorsWithCount
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetPageUnit
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipCreatePath
GdipDeletePath
GdipAddPathLineI
GdipAddPathArcI
GdipCreateLineBrushFromRect
GdipDeleteBrush
GdipFree
GdipAlloc
GdipCloneBrush
GdipSetLinePresetBlend
GdipSetLineWrapMode
GdipCreateRegionPath
GdipDeleteRegion
GdipFillRegion
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipDrawImageRectRectI
GdipCreateTexture
GdipCreateBitmapFromHBITMAP
GdipDeletePen
GdipDrawCurve
GdipCreatePen1
GdiplusStartup
GdiplusShutdown
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipSaveImageToFile
GdipGraphicsClear
GdipCreateTexture2I
GdipDrawImageRectI
GdipCreatePathGradientFromPath
GdipCreateRegionRect
GdipCombineRegionRegion
GdipCreateSolidFill
GdipSetPathGradientCenterColor
GdipSetPathGradientFocusScales
GdipCreateLineBrushI
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipCreateStringFormat
GdipSetTextRenderingHint
GdipCreateFontFromDC
GdipDrawImageI
GdipSetPenEndCap
GdipCreateFontFromLogfontA
GdipSetPenStartCap
GdipCreatePen2
GdipFillRectangleI
GdipDrawLine
GdipDrawImageRect
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipSetSolidFillColor
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipGetFamily

ws2_32

WSAAddressToStringW
shutdown
WSAStartup
send
gethostbyname
__WSAFDIsSet
getservbyname
recv
WSACleanup
setsockopt
WSASend
WSASendTo
inet_addr
WSARecvFrom
getsockname
WSARecv
socket
WSAIoctl
bind
listen
WSASocketW
WSAGetLastError
closesocket
inet_ntoa
htons
WSAStringToAddressA
WSAAddressToStringA
htonl
accept
getaddrinfo
freeaddrinfo
getsockopt
ntohs
select
WSASetLastError
WSACloseEvent
recvfrom
WSAEnumNetworkEvents
WSAEventSelect
sendto
WSACreateEvent
WSAWaitForMultipleEvents
getpeername
ioctlsocket
gethostname
connect

wldap32

ord200
ord79
ord33
ord301
ord27
ord41
ord32
ord35
ord143
ord30
ord26
ord50
ord60
ord211
ord22
ord46

proxysdk

DeleteVpn
InitDriverFirst
InitDriver
GetTdxNumber
DriverIsRun
InsertDropPort
InsertProcessForPot
AddPidFromProcess
CreateVpn
SetLoadingFlow
FNInsertBlackProcesName
ProcessMd5AndSign
GetUdpRemoteIp
GetTcpRemoteIp
GetFlowData
GetRegedit
IsPcLowConfig
IsBlackProcessUser
IsVirtualMachineNow
DeleteRuleAll

acmanage

StopACProcess
QueryACFlow
StartACProcess

crypt32

CertFindCertificateInStore
CryptMsgClose
CryptQueryObject
CertFreeCertificateContext
CryptMsgGetParam
CertCloseStore
CertAddCertificateContextToStore
CertOpenStore
CertCreateCertificateContext
CertGetNameStringW
CryptStringToBinaryA

shlwapi

PathIsDirectoryW
wnsprintfW
PathFindExtensionW
SHDeleteKeyW

version

GetFileVersionInfoSizeW
VerQueryValueW
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
GetFileVersionInfoW

nfapi

?nf_init@nfapi@@YA?AW4_NF_STATUS@@PBDPAVNF_EventHandler@1@@Z
?nf_addRule@nfapi@@YA?AW4_NF_STATUS@@PAU_NF_RULE@1@H@Z
?nf_udpPostReceive@nfapi@@YA?AW4_NF_STATUS@@_KPBEPBDHPAU_NF_UDP_OPTIONS@1@@Z
?nf_getProcessNameW@nfapi@@YAHKPA_WK@Z
?nf_tcpPostReceive@nfapi@@YA?AW4_NF_STATUS@@_KPBDH@Z
?nf_tcpPostSend@nfapi@@YA?AW4_NF_STATUS@@_KPBDH@Z
?nf_registerDriver@nfapi@@YA?AW4_NF_STATUS@@PBD@Z
?nf_udpPostSend@nfapi@@YA?AW4_NF_STATUS@@_KPBEPBDHPAU_NF_UDP_OPTIONS@1@@Z
?nf_free@nfapi@@YAXXZ

nfsrvapi

?nf_srv_unRegisterDriver@nfsrvapi@@YA?AW4_NF_STATUS@@PBD@Z
?nf_srv_tcpSetProxy@nfsrvapi@@YA?AW4_NF_STATUS@@_KW4SRV_PROXY_TYPE@1@PBDH22@Z
?nf_srv_tcpPostReceive@nfsrvapi@@YA?AW4_NF_STATUS@@_KPBDH@Z
?nf_srv_tcpPostSend@nfsrvapi@@YA?AW4_NF_STATUS@@_KPBDH@Z
?nf_srv_deleteRules@nfsrvapi@@YA?AW4_NF_STATUS@@XZ
?nf_srv_addRule@nfsrvapi@@YA?AW4_NF_STATUS@@PAU_NF_SRV_RULE@1@H@Z
?nf_srv_init@nfsrvapi@@YA?AW4_NF_STATUS@@PBDPAVNF_EventHandler@nfapi@@PAU_NF_SRV_OPTIONS@1@@Z
?nf_srv_getUDPRemoteAddress@nfsrvapi@@YA?AW4_NF_STATUS@@_KPAEH@Z
?nf_srv_udpSetProxy@nfsrvapi@@YA?AW4_NF_STATUS@@_KW4SRV_PROXY_TYPE@1@PBDH22@Z
?nf_srv_udpPostReceive@nfsrvapi@@YA?AW4_NF_STATUS@@_KPBEPBDHPAU_NF_UDP_OPTIONS@nfapi@@@Z
?nf_srv_udpPostSend@nfsrvapi@@YA?AW4_NF_STATUS@@_KPBEPBDHPAU_NF_UDP_OPTIONS@nfapi@@@Z
?nf_srv_free@nfsrvapi@@YAXXZ

psapi

GetModuleFileNameExW

comctl32

_TrackMouseEvent
ord17

imm32

ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
ImmSetCompositionFontW

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 678KB - Virtual size: 677KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 17B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 154KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dd8fca983b31ae70df9945159186a78e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

iphlpapi

gdiplus

ws2_32

wldap32

proxysdk

acmanage

crypt32

shlwapi

version

nfapi

nfsrvapi

psapi

comctl32

imm32

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.rdata Size: 678KB - Virtual size: 677KB

.data Size: 55KB - Virtual size: 78KB

.tls Size: 512B - Virtual size: 17B

.rsrc Size: 70KB - Virtual size: 69KB

.reloc Size: 154KB - Virtual size: 153KB

.text
Size: 3.1MB - Virtual size: 3.1MB

.rdata
Size: 678KB - Virtual size: 677KB

.data
Size: 55KB - Virtual size: 78KB

.tls
Size: 512B - Virtual size: 17B

.rsrc
Size: 70KB - Virtual size: 69KB

.reloc
Size: 154KB - Virtual size: 153KB