0ffe52d9f021427f411fee93ae0def9b14866231140697240b4985df91c75fcc

Sharing

Copy URL Twitter E-mail

General

Target

0ffe52d9f021427f411fee93ae0def9b14866231140697240b4985df91c75fcc
Size

2.5MB
MD5

1b4a3e9159366becf462e47ef5d5a331
SHA1

91ce651ea36dd034fe1317841d1d786ab686008e
SHA256

0ffe52d9f021427f411fee93ae0def9b14866231140697240b4985df91c75fcc
SHA512

7e74b1fbd57fa023319114f6a5e5c653a8822c3d0cb9dfad67b898bbbbea63ac25547d92954fe10d7be5be036b3679df1c0bfb91fc979cd026968df96856fbb1
SSDEEP

24576:NaXBaT6Fj4FPhL5aodtxoReuYt+k45Ug65fxaPX8r0BI/TNwV0pIvEDh8VF6w68O:NGHFjucodboEfJdpr8cxTwQ756eIM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ffe52d9f021427f411fee93ae0def9b14866231140697240b4985df91c75fcc

Files

0ffe52d9f021427f411fee93ae0def9b14866231140697240b4985df91c75fcc
.exe windows:4 windows x86

d704525acf326289c45079f9c5d6690d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

FindWindowExA
GetDesktopWindow
GetWindow
IsWindowVisible
GetWindowTextA
GetClassNameA
GetWindowThreadProcessId
GetWindowTextLengthA
PostMessageA
CallWindowProcA
GetCursorPos
OpenClipboard
GetForegroundWindow
ClientToScreen
GetWindowLongA
SetWindowLongA
SetLayeredWindowAttributes
SetCursorPos
EnumDisplaySettingsA
UnhookWindowsHookEx
keybd_event
GetWindowRect
CharUpperA
FindWindowA
GetDlgItem
SetCapture
MapVirtualKeyA
AttachThreadInput
SetActiveWindow
GetGUIThreadInfo
ExitWindowsEx
mouse_event
GetParent
IsWindow
GetPropA
RemovePropA
DestroyWindow
SetPropA
CreateWindowExA
ShowWindow
IsZoomed
IsIconic
MoveWindow
GetDC
UpdateLayeredWindow
ReleaseDC
DefWindowProcA
ReleaseCapture
SetWindowsHookExA
CallNextHookEx
FlashWindowEx
EnableWindow
GetClientRect
GetWindowInfo
EnumWindows
SendInput
MsgWaitForMultipleObjects
ShowCursor
SendMessageTimeoutA
CreateWindowStationA
SetParent
UpdateWindow
SetTimer
GetFocus
GetKeyState
SetForegroundWindow
GetAncestor
SetWindowTextA
GetNextDlgTabItem
SetFocus
InvalidateRect
KillTimer
GetActiveWindow
GetDoubleClickTime
CharLowerA
wvsprintfA
SwapMouseButton
ChangeDisplaySettingsA
OpenIcon
EnumThreadWindows
ClipCursor
GetAsyncKeyState
GetKeyboardState
LoadCursorFromFileA
SetClassLongA
WindowFromPoint
ShowWindowAsync
SetWindowPos
GetDlgCtrlID
GetCaretPos
FlashWindow
PrintWindow
RegisterWindowMessageA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
PostThreadMessageA
UnloadKeyboardLayout
GetKeyboardLayoutList
SystemParametersInfoA
GetKeyboardLayout
ActivateKeyboardLayout
GetKeyboardLayoutNameA
LoadKeyboardLayoutA
MessageBoxA
wsprintfA
CloseClipboard
GetClipboardData
PostQuitMessage
SetClipboardData
EmptyClipboard
GetSystemMetrics
SetCursor
EndDialog
CreateDialogIndirectParamA
DestroyMenu
LoadStringA
GetSysColorBrush
LoadCursorA
LoadIconA
MapWindowPoints
GetSysColor
AdjustWindowRectEx
CopyRect
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetSubMenu
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
RegisterClipboardFormatA
GetMenuItemID
GetClassLongA
GetMessageTime
GetMessagePos
GetWindowPlacement
UnregisterClassA
ValidateRect
PtInRect
GetMenuItemCount
TabbedTextOutA
DrawTextA
GrayStringA
GetLastActivePopup
EnumChildWindows
SendDlgItemMessageA
IsDialogMessageA
SendMessageA
IsWindowEnabled
ShowWindow
IsWindowEnabled
TranslateAcceleratorA
GetKeyState
CopyAcceleratorTableA
PostQuitMessage
IsZoomed
GetClassInfoA
DefWindowProcA
GetSystemMenu
DeleteMenu
GetMenu
SetMenu
PeekMessageA
IsIconic
SetFocus
GetActiveWindow
GetWindow
DestroyAcceleratorTable
SetWindowRgn
GetMessagePos
ScreenToClient
ChildWindowFromPointEx
CopyRect
LoadBitmapA
WinHelpA
KillTimer
SetTimer
ReleaseCapture
GetCapture
SetCapture
GetScrollRange
SetScrollRange
SetScrollPos
SetRect
InflateRect
IntersectRect
DestroyIcon
PtInRect
OffsetRect
IsWindowVisible
EnableWindow
RedrawWindow
GetWindowLongA
SetWindowLongA
GetSysColor
SetActiveWindow
SetCursorPos
LoadCursorA
SetCursor
GetDC
FillRect
IsRectEmpty
ReleaseDC
IsChild
DestroyMenu
SetForegroundWindow
GetWindowRect
EqualRect
UpdateWindow
ValidateRect
InvalidateRect
GetClientRect
GetFocus
GetParent
SystemParametersInfoA
PostMessageA
IsWindow
SetParent
DestroyCursor
SendMessageA
SetWindowPos
MessageBoxA
GetCursorPos
GetSystemMetrics
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
wsprintfA
WaitForInputIdle
LoadImageA
EnumDisplaySettingsA
ClientToScreen
GetWindowTextA
GetWindowTextLengthA
CharUpperA
GetWindowDC
BeginPaint
EndPaint
UnregisterClassA
TabbedTextOutA
DrawTextA
GrayStringA
GetDlgItem
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetNextDlgTabItem
GetWindowPlacement
RegisterWindowMessageA
GetForegroundWindow
GetLastActivePopup
GetMessageTime
RemovePropA
CallWindowProcA
GetPropA
UnhookWindowsHookEx
SetPropA
GetClassLongA
CallNextHookEx
SetWindowsHookExA
CreateWindowExA
GetMenuItemID
GetMenuItemCount
RegisterClassA
GetScrollPos
AdjustWindowRectEx
MapWindowPoints
SendDlgItemMessageA
ScrollWindowEx
IsDialogMessageA
SetWindowTextA
MoveWindow
CheckMenuItem
SetMenuItemBitmaps
GetMenuState
GetMenuCheckMarkDimensions
GetClassNameA
GetDesktopWindow
LoadStringA
GetSysColorBrush
EnableMenuItem
GetSubMenu
GetDlgCtrlID
CreateAcceleratorTableA
CreateMenu
ModifyMenuA
AppendMenuA
CreatePopupMenu
DrawIconEx
CreateIconFromResource
CreateIconFromResourceEx
RegisterClipboardFormatA
SetRectEmpty
DispatchMessageA
GetMessageA
WindowFromPoint
DrawFocusRect
DrawEdge
DrawFrameControl
TranslateMessage
LoadIconA
GetTopWindow

kernel32

lstrcpyn
CreateRemoteThread
GetExitCodeThread
GetModuleHandleA
GetCurrentThread
lstrlenA
LCMapStringA
SetFilePointer
SetEndOfFile
FormatMessageA
TlsSetValue
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
TerminateThread
RtlFillMemory
SuspendThread
SetThreadContext
TerminateProcess
Thread32First
GetVersion
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetFileType
GetStdHandle
SetHandleCount
GetACP
HeapSize
RaiseException
LCMapStringW
IsBadWritePtr
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
RtlUnwind
GetProcAddress
GetOEMCP
GetCPInfo
IsBadCodePtr
SetStdHandle
FlushFileBuffers
GetProcessVersion
FindResourceA
LoadResource
LockResource
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
SetLastError
GlobalFlags
MulDiv
lstrcpyA
LoadLibraryA
GetCurrentThreadId
Module32Next
GetShortPathNameA
CreateEventA
IsDebuggerPresent
DeleteFileA
LocalFree
WideCharToMultiByte
RtlMoveMemory
LocalAlloc
CloseHandle
Module32First
CreateToolhelp32Snapshot
lstrcmpA
GlobalDeleteAtom
TlsAlloc
GlobalReAlloc
GetLastError
CreateThread
GetTimeFormatA
GetDateFormatA
OpenEventA
GetProcessTimes
InitializeCriticalSection
CopyFileA
WaitForSingleObject
ResumeThread
GetCurrentProcessId
SetWaitableTimer
CreateWaitableTimerA
WriteProcessMemory
lstrcatA
lstrcmpiA
SetErrorMode
TlsGetValue
LocalReAlloc
FreeLibrary
WritePrivateProfileStringA
GetCurrentDirectoryA
SetLocalTime
SetFileAttributesA
RemoveDirectoryA
GetFileAttributesA
Thread32Next
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetProcessWorkingSetSize
VirtualProtectEx
CreateDirectoryA
FindClose
FindFirstFileA
FindNextFileA
GetStartupInfoA
GetTickCount
GetFileSize
GetUserDefaultLCID
IsBadReadPtr
HeapReAlloc
ExitProcess
VirtualFree
VirtualAlloc
lstrcpynA
IsDBCSLeadByteEx
InterlockedIncrement
InterlockedDecrement
GetLongPathNameA
WriteFile
DebugActiveProcess
HeapFree
GlobalFree
GlobalSize
GlobalUnlock
GlobalLock
GlobalAlloc
GetExitCodeProcess
ReadFile
PeekNamedPipe
CreateProcessA
CreatePipe
GetComputerNameA
GetVersionExA
DeviceIoControl
CreateFileA
VirtualQueryEx
GetVolumeInformationA
MultiByteToWideChar
Process32Next
Sleep
Process32First
OpenThread
HeapAlloc
GetProcessHeap
GetCurrentProcess
MoveFileA
GetTempPathA
GetSystemDirectoryA
GlobalHandle
TlsFree
GetWindowsDirectoryA
ReadProcessMemory
VirtualAllocEx
GetModuleFileNameA
GetCommandLineA
OpenProcess
FileTimeToSystemTime
GetLocalTime
VirtualFreeEx
UnmapViewOfFile
GetThreadTimes
ReleaseSemaphore
ResumeThread
CreateSemaphoreA
CreateMutexA
SetStdHandle
IsBadCodePtr
IsBadReadPtr
CompareStringW
CompareStringA
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
IsBadWritePtr
VirtualAlloc
LCMapStringW
LCMapStringA
SetEnvironmentVariableA
EnterCriticalSection
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetACP
HeapSize
TerminateProcess
RaiseException
GetLocalTime
GetSystemTime
GetTimeZoneInformation
RtlUnwind
GetStartupInfoA
GetOEMCP
GetCPInfo
GetProcessVersion
SetErrorMode
GlobalFlags
GetCurrentThread
GetFileTime
GetFileSize
TlsGetValue
LocalReAlloc
TlsSetValue
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
lstrcmpA
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpiA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
GetCurrentProcess
DuplicateHandle
lstrcpynA
SetLastError
FileTimeToLocalFileTime
FileTimeToSystemTime
LocalFree
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
GetProfileStringA
CloseHandle
WaitForSingleObject
CreateProcessA
GetTickCount
GetCommandLineA
MulDiv
GetProcAddress
ReleaseMutex
TerminateThread
SuspendThread
GetModuleHandleA
GetVolumeInformationA
SetCurrentDirectoryA
DeleteFileA
GetFileAttributesA
FindClose
FindFirstFileA
GlobalUnlock
GlobalLock
GlobalAlloc
Sleep
CreateEventA
CreateThread
WritePrivateProfileStringA
GetVersionExA
GetLastError
LoadLibraryA
FreeLibrary
GetFullPathNameA
WideCharToMultiByte
MultiByteToWideChar
HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree
GlobalReAlloc
FindNextFileA
lstrcpyA
WinExec
lstrlenA
lstrcatA
InitializeCriticalSection
DeleteCriticalSection
GlobalFree
GlobalSize
ExitProcess
GetCurrentThreadId
GetModuleFileNameA
ReadFile
LockResource
LoadResource
FindResourceA
SetEvent
CreateFileA
WaitForMultipleObjects
WriteFile

ole32

OleInitialize
OleUninitialize
CLSIDFromString
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
OleRun
CoUninitialize
CoInitialize

shell32

ShellExecuteA
SHGetFileInfoA
SHChangeNotify
SHFileOperationA
SHBrowseForFolderA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetSpecialFolderPathA
Shell_NotifyIconA
ShellExecuteA

shlwapi

PathFindExtensionA
PathIsDirectoryA
PathIsDirectoryEmptyA
PathIsSystemFolderA
PathRenameExtensionA
PathRemoveBlanksA
PathMakeSystemFolderA
PathUnmakeSystemFolderA
PathFileExistsA
PathFindFileNameA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

gdi32

GetDeviceCaps
SetBkColor
GetStockObject
RestoreDC
SaveDC
CreateCompatibleDC
CreateDIBSection
SelectObject
DeleteObject
DeleteDC
CreateRectRgn
GetTextExtentPointA
CreateFontIndirectA
SetBkMode
SetTextColor
TextOutA
GetPixel
CreateCompatibleBitmap
GetObjectA
Escape
SetMapMode
RectVisible
PtVisible
CreateBitmap
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
ExtTextOutA
CreateEllipticRgn
CreateRoundRectRgn
GetTextMetricsA
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetViewportExtEx
ExtSelectClipRgn
LineTo
MoveToEx
ExcludeClipRect
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
GetTextColor
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
PathToRegion
EndPath
BeginPath
GetWindowOrgEx
GetViewportOrgEx
GetWindowExtEx
GetDIBits
RealizePalette
SelectPalette
StretchBlt
CreatePalette
GetSystemPaletteEntries
CreateDIBitmap
DeleteObject
SelectClipRgn
CreatePolygonRgn
GetClipRgn
SetStretchBltMode
CreateRectRgnIndirect
SetBkColor
GetBkMode
GetBkColor
GetROP2
GetStretchBltMode
GetPolyFillMode
CreateCompatibleBitmap
CreateDCA
CreateFontIndirectA
EndPage
EndDoc
DeleteDC
StartDocA
StartPage
BitBlt
CreateCompatibleDC
Ellipse
Rectangle
LPtoDP
DPtoLP
GetCurrentObject
RoundRect
GetTextExtentPoint32A
GetDeviceCaps
CreateBitmap
SelectObject
GetObjectA
CreatePen
PatBlt
CombineRgn
CreateRectRgn
FillRgn
CreateSolidBrush
SetTextColor
GetStockObject

gdiplus

GdipCreateFromHDC
GdiplusStartup
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawPath
GdipResetClip
GdipDeletePen
GdipDeletePath
GdipSetClipHrgn
GdipCreatePen1
GdipDrawRectangle

wininet

HttpSendRequestA
InternetCloseHandle
InternetTimeToSystemTime
InternetSetCookieA
HttpQueryInfoA
InternetReadFile
InternetTimeFromSystemTime
HttpOpenRequestA
InternetOpenA
InternetConnectA

oleaut32

VariantTimeToSystemTime
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantInit
VariantChangeType
SystemTimeToVariantTime
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
VarR8FromCy
VarR8FromBool
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
SysFreeString
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi

dbghelp

MakeSureDirectoryPathExists

advapi32

RegSetValueExA
LookupPrivilegeValueA
RegCreateKeyExA
RegCreateKeyA
RegCloseKey
RegDeleteKeyA
RegOpenKeyA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
GetUserNameA
LookupAccountSidA
RegQueryValueExA
OpenProcessToken
RegOpenKeyExA
RegDeleteValueA
RegEnumValueA
RegFlushKey
AdjustTokenPrivileges
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueA
RegCreateKeyExA

comdlg32

GetFileTitleA
GetSaveFileNameA
GetOpenFileNameA
ChooseColorA
GetFileTitleA

psapi

GetModuleFileNameExA

winhttp

WinHttpTimeFromSystemTime
WinHttpTimeToSystemTime

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter
ClosePrinter
DocumentPropertiesA
OpenPrinterA

comctl32

ord17
ImageList_Destroy
ord17

oledlg

ord8

winmm

midiStreamRestart
midiStreamClose
midiOutReset
midiStreamStop
midiStreamOut
midiOutPrepareHeader
midiStreamProperty
midiStreamOpen
midiOutUnprepareHeader
waveOutOpen
waveOutGetNumDevs
waveOutClose
waveOutReset
waveOutPause
waveOutWrite
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutRestart

ws2_32

inet_ntoa
WSACleanup
closesocket
WSAAsyncSelect
recvfrom
ioctlsocket
recv
getpeername
accept
ntohl

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 184KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 444KB - Virtual size: 596KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d704525acf326289c45079f9c5d6690d

Headers

File Characteristics

Imports

user32

kernel32

ole32

shell32

shlwapi

version

gdi32

gdiplus

wininet

oleaut32

dbghelp

advapi32

comdlg32

psapi

winhttp

winspool.drv

comctl32

oledlg

winmm

ws2_32

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 184KB - Virtual size: 182KB

.data Size: 444KB - Virtual size: 596KB

.rsrc Size: 24KB - Virtual size: 22KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 184KB - Virtual size: 182KB

.data
Size: 444KB - Virtual size: 596KB

.rsrc
Size: 24KB - Virtual size: 22KB