5ba0905627012dd9f34391336411204f5e34ae98350e42e5b7526680e7dd747e

Sharing

Copy URL Twitter E-mail

General

Target

5ba0905627012dd9f34391336411204f5e34ae98350e42e5b7526680e7dd747e
Size

1.5MB
MD5

e79063c74a7aae78df409a9d685b9e4f
SHA1

3d7372c29625fbdac78aa1da38dc386e0d4c2855
SHA256

5ba0905627012dd9f34391336411204f5e34ae98350e42e5b7526680e7dd747e
SHA512

379d29e581278513ff38349d3b4d71f5e56d0b46584a162274745c089adcafef1d9dfc9f9ec817968a98f4bf71c95ef65a8929aade39f21e58a0c58f077b9621
SSDEEP

6144:OmuGC/1gYIRozogSXrrv9/HnAF/pUitUjaKv25aHcfqH/ispUG6hjQdcGZMIgMF9:O2ZYIRo+XmF/YM/fqH/9pbdOpukVROm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ba0905627012dd9f34391336411204f5e34ae98350e42e5b7526680e7dd747e

Files

5ba0905627012dd9f34391336411204f5e34ae98350e42e5b7526680e7dd747e
.exe windows:5 windows x86

7c92d0f4ee45938613afd5e727418b0f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

vDbgPrintExWithPrefix

advapi32

GetUserNameW
RegCloseKey
RegCreateKeyExW
RegCreateKeyW
RegDeleteValueW
RegEnumValueW
RegOpenKeyExW
RegOpenKeyW
RegQueryInfoKeyW
RegQueryValueExW

browseui

ord106
ord107

comctl32

CreatePropertySheetPageW
ord328
ord329
ord385
ord334
ImageList_Create
ImageList_Destroy
ImageList_GetIconSize
ImageList_LoadImageW
ImageList_Remove
ImageList_ReplaceIcon
ImageList_SetIconSize
InitCommonControls
PropertySheetW

kernel32

CloseHandle
CreateEventW
CreateMutexW
CreateProcessW
CreateSemaphoreA
CreateThread
DeleteCriticalSection
DeleteFileW
DuplicateHandle
EnterCriticalSection
ExitProcess
ExpandEnvironmentStringsW
FindClose
FindFirstFileW
FindNextFileW
FindResourceW
FlushInstructionCache
GetBinaryTypeW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeProcess
GetLastError
GetLocalTime
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetSystemTimeAsFileTime
GetTickCount
GetTimeFormatW
GetUserDefaultLangID
GetWindowsDirectoryW
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LoadResource
LocalAlloc
LocalFree
LocalReAlloc
LockResource
MapViewOfFile
OpenEventW
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
RaiseException
ReleaseMutex
ReleaseSemaphore
SetCurrentDirectoryW
SetEvent
SetLastError
SetProcessShutdownParameters
SetUnhandledExceptionFilter
SizeofResource
Sleep
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject

msvcrt

__dllonexit
__lconv_init
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_beginthreadex
_cexit
_fmode
_fpreset
_initterm
_iob
_lock
_onexit
_unlock
_vsnprintf
_vsnwprintf
_wcmdln
abort
bsearch
calloc
exit
fprintf
fputc
fputs
free
fwrite
malloc
memcmp
memcpy
memmove
realloc
signal
sprintf
strchr
strcmp
strcpy
strcspn
strlen
strncmp
strrchr
vfprintf
vsprintf
wcschr
wcscmp
wcscpy
wcslen
wcsncpy
_write

ole32

CLSIDFromString
CoCreateInstance
OleInitialize
OleLoadFromStream
OleUninitialize

oleaut32

SysAllocString
SysFreeString

shell32

ord60
ord660
ILClone
ILFindLastID
ILFree
ILRemoveLastID
IsUserAnAdmin
ord54
ord181
ord61
SHCloneSpecialIDList
ord723
ord91
SHFindFiles
SHFree
SHGetDesktopFolder
SHGetFolderPathW
SHGetPathFromIDListA
SHGetSpecialFolderPathW
SHRestricted
ShellExecuteExW
ShellExecuteW
Shell_MergeMenus

shlwapi

ord164
ord172
ord173
ord174
SHGetValueW
ord279
SHOpenRegStreamW
SHSetValueW
ord165
wnsprintfW

uxtheme

CloseThemeData
DrawThemeBackground
DrawThemeParentBackground
GetThemeColor
GetThemeFont
GetThemeMargins
GetThemePartSize
IsAppThemed
IsThemeActive
IsThemeBackgroundPartiallyTransparent
OpenThemeData
SetWindowTheme

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

gdi32

CreateFontIndirectW
CreateRectRgnIndirect
DeleteObject
GetObjectW
GetStockObject
GetTextExtentPointW
Rectangle
SelectObject
SetBkMode
SetTextColor
TextOutW

user32

AppendMenuW
BeginDeferWindowPos
BeginPaint
CallWindowProcW
CascadeWindows
CheckDlgButton
CheckMenuItem
ChildWindowFromPoint
ChildWindowFromPointEx
ClientToScreen
CreatePopupMenu
CreateWindowExW
DefWindowProcW
DeferWindowPos
DeleteMenu
DestroyMenu
DestroyWindow
DialogBoxParamW
DispatchMessageW
EnableMenuItem
EnableWindow
EndDeferWindowPos
EndDialog
EndPaint
EnumWindows
EqualRect
FindWindowW
GetAncestor
GetClassLongW
GetClassNameW
GetClientRect
GetCursorPos
GetDC
GetDesktopWindow
GetDlgItem
GetForegroundWindow
GetKeyState
GetLastActivePopup
GetMenuItemCount
GetMenuItemInfoW
GetMessageW
GetMonitorInfoW
GetParent
GetShellWindow
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMenu
GetSystemMetrics
GetWindow
GetWindowDC
GetWindowInfo
GetWindowLongW
GetWindowRect
GetWindowThreadProcessId
InflateRect
InternalGetWindowText
IntersectRect
InvalidateRect
IsChild
IsDlgButtonChecked
IsIconic
IsRectEmpty
IsWindow
IsWindowEnabled
IsWindowVisible
KillTimer
LoadBitmapW
LoadCursorW
LoadIconW
LoadImageW
LoadMenuW
LoadStringW
MapWindowPoints
MessageBoxW
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
MsgWaitForMultipleObjects
OffsetRect
PeekMessageW
PostMessageW
PostQuitMessage
PostThreadMessageW
PtInRect
RegisterClassExW
RegisterHotKey
RegisterWindowMessageW
ReleaseDC
RemoveMenu
ScreenToClient
SendMessageCallbackW
SendMessageTimeoutW
SendMessageW
SendNotifyMessageW
SetFocus
SetForegroundWindow
SetMenuItemInfoW
SetTimer
SetWindowLongW
SetWindowPos
SetWindowRgn
SetWindowTextW
ShowWindow
ShowWindowAsync
SwitchToThisWindow
SystemParametersInfoW
TileWindows
TrackPopupMenuEx
TranslateMessage

Sections

.text
Size: 192KB - Virtual size: 191KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 1024B - Virtual size: 580B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1015KB - Virtual size: 1015KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rossym
Size: 289KB - Virtual size: 289KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7c92d0f4ee45938613afd5e727418b0f

Headers

File Characteristics

Imports

ntdll

advapi32

browseui

comctl32

kernel32

msvcrt

ole32

oleaut32

shell32

shlwapi

uxtheme

version

gdi32

user32

Sections

.text Size: 192KB - Virtual size: 191KB

.data Size: 20KB - Virtual size: 19KB

.rdata Size: 39KB - Virtual size: 39KB

/4 Size: 1024B - Virtual size: 580B

.bss Size: - Virtual size: 5KB

.idata Size: 10KB - Virtual size: 9KB

.CRT Size: 512B - Virtual size: 52B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 1015KB - Virtual size: 1015KB

.rossym Size: 289KB - Virtual size: 289KB

.text
Size: 192KB - Virtual size: 191KB

.data
Size: 20KB - Virtual size: 19KB

.rdata
Size: 39KB - Virtual size: 39KB

/4
Size: 1024B - Virtual size: 580B

.bss
Size: - Virtual size: 5KB

.idata
Size: 10KB - Virtual size: 9KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 1015KB - Virtual size: 1015KB

.rossym
Size: 289KB - Virtual size: 289KB