9b5efda09214fb84c1f32ffdea783296b65d1ae53cd2e2eddd909effbe2f6387

Sharing

Copy URL Twitter E-mail

General

Target

9b5efda09214fb84c1f32ffdea783296b65d1ae53cd2e2eddd909effbe2f6387
Size

4.1MB
MD5

3a3dd3b53305d6059738aee960e98f01
SHA1

1f103b920d344a8be5058e69b6b80288d904b978
SHA256

9b5efda09214fb84c1f32ffdea783296b65d1ae53cd2e2eddd909effbe2f6387
SHA512

57358ff9d369e8829c1da2717634606494dd4f5c5c749da56dc7cda75317d718f523b5e10778f120a1c523782ffc4325d7e149ae9fdc54f80d148e8761392706
SSDEEP

49152:Q490+W2HH3XvWp2242VFq1X0MAqvjKSqyMrrA5ASJfZbTw15CGWKHnpyqQW+Kg3Q:f3t3XYL2rQc/h9CHgqQ5Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9b5efda09214fb84c1f32ffdea783296b65d1ae53cd2e2eddd909effbe2f6387

Files

9b5efda09214fb84c1f32ffdea783296b65d1ae53cd2e2eddd909effbe2f6387
.exe windows:6 windows x86

a48f498cc02f76a7fdba5b1e85ae8df1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalMemoryStatus
lstrcatA
lstrlenA
FlushConsoleInputBuffer
ReadConsoleInputA
SetConsoleMode
GetThreadIOPendingFlag
CreateWaitableTimerW
DuplicateHandle
GetOverlappedResult
CreateNamedPipeW
SetNamedPipeHandleState
DisconnectNamedPipe
ConnectNamedPipe
CreateMutexW
ReleaseMutex
CopyFileW
GetCommandLineW
K32GetProcessImageFileNameW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
MoveFileExW
QueryFullProcessImageNameW
lstrcatW
lstrcpyW
LocalFree
LocalAlloc
OpenProcess
GetStartupInfoW
GetCurrentThread
OutputDebugStringW
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
SetStdHandle
SetConsoleCtrlHandler
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetTempPathW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetModuleHandleExW
ExitThread
WriteFile
SetFileAttributesW
SetEndOfFile
RemoveDirectoryW
ReadFile
QueryDosDeviceW
GetLogicalDriveStringsW
GetFileSize
GetFileAttributesW
GetFileAttributesA
DeleteFileW
CreateFileW
CreateFileA
CreateDirectoryW
lstrlenW
lstrcpynW
LoadLibraryW
IsBadReadPtr
VirtualProtect
GetCurrentThreadId
GetCurrentProcessId
SetUnhandledExceptionFilter
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetCurrentProcess
CloseHandle
WideCharToMultiByte
lstrcmpiW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
GetExitCodeProcess
TerminateProcess
CancelWaitableTimer
SetWaitableTimer
QueryPerformanceFrequency
QueryPerformanceCounter
MultiByteToWideChar
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
WaitForMultipleObjects
Sleep
CreateEventW
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualAlloc
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
GetQueuedCompletionStatus
CreateIoCompletionPort
HeapCreate
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
UnlockFileEx
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
FlushViewOfFile
GetVersionExA
DeleteFileA
GetSystemInfo
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
VerifyVersionInfoA
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
VerSetConditionMask
PeekNamedPipe
GetStdHandle
GetFileType
ExpandEnvironmentStringsA
SleepEx
FormatMessageA
GetSystemWindowsDirectoryW
InterlockedCompareExchange
GetSystemDirectoryW
lstrcmpiA
lstrcmpA
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetLocalTime
ResumeThread
WaitForSingleObject
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
GetTempFileNameW
GlobalFree
GlobalLock
EnterCriticalSection
InitializeCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
GlobalUnlock
GlobalAlloc
GetVersion
SystemTimeToFileTime
GetSystemTime
lstrcmpW
FreeResource
ExitProcess
MulDiv
GetACP
FlushFileBuffers
RaiseException
GetDateFormatW
InterlockedDecrement
InterlockedIncrement
SetFilePointer
GetFileSizeEx
IsDebuggerPresent
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
TryEnterCriticalSection
FormatMessageW
GetStringTypeW
GetCurrentDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
AreFileApisANSI
SetLastError
DeviceIoControl
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetCPInfo
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetVersionExW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
DecodePointer

user32

DrawTextW
SetForegroundWindow
GetDC
EmptyClipboard
EndPaint
InvalidateRgn
GetClientRect
FillRect
SetFocus
SetClipboardData
CloseClipboard
OpenClipboard
CharNextW
IsIconic
LoadImageW
GetClassNameW
GetWindowRect
GetWindowTextW
GetWindowLongW
EnumWindows
IsWindowVisible
DestroyWindow
IsWindow
PostMessageW
SendMessageW
SetRect
CopyRect
IsRectEmpty
EnumDisplayMonitors
IsWindowEnabled
PtInRect
GetDesktopWindow
GetTopWindow
GetWindow
BeginPaint
SetParent
SetWindowPos
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
PostQuitMessage
BringWindowToTop
RealGetWindowClassW
MonitorFromWindow
MsgWaitForMultipleObjectsEx
SendMessageTimeoutW
PeekMessageW
DispatchMessageW
TranslateMessage
ClientToScreen
ScreenToClient
ChangeWindowMessageFilter
UnhookWinEvent
SetWinEventHook
FindWindowW
SetActiveWindow
ShowWindow
SetWindowTextW
MonitorFromPoint
GetIconInfo
DestroyIcon
GetWindowThreadProcessId
GetWindowTextLengthW
ReleaseDC
GetForegroundWindow
MoveWindow
AttachThreadInput
wsprintfW
wvsprintfW
SetCursor
LoadCursorW
GetMessageW
CreateWindowExW
IsChild
UpdateLayeredWindow
IsZoomed
GetFocus
GetKeyState
SetCapture
ReleaseCapture
GetUpdateRect
InvalidateRect
CreateCaret
GetCaretBlinkTime
SetCaretPos
MapWindowPoints
SetWindowLongW
GetParent
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
SetWindowRgn
MessageBoxW
CharPrevW
DrawIconEx
RemovePropW
HideCaret
ShowCaret
GetSysColor
GetWindowDC
GetMessagePos
GetDlgCtrlID
DrawFocusRect
CreateAcceleratorTableW
FindWindowExW
KillTimer
SetTimer
GetMonitorInfoW
GetCursorPos
OffsetRect
UnionRect
IntersectRect
InflateRect

gdi32

CombineRgn
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontIndirectW
RestoreDC
SaveDC
GetTextMetricsW
SetWindowOrgEx
CreateRoundRectRgn
GetDeviceCaps
GetCharABCWidthsW
CreateDCW
GetTextExtentPoint32W
SelectClipRgn
ExtSelectClipRgn
SetBkColor
StretchBlt
SetStretchBltMode
SetDIBColorTable
TextOutW
ExtTextOutW
SetDIBitsToDevice
GetTextColor
GetObjectW
CreateFontW
CreatePen
CreatePatternBrush
CreateRectRgn
CreateRectRgnIndirect
CreateSolidBrush
CreateDIBSection
DeleteObject
GetStockObject
Rectangle
SelectObject
SetBkMode
SetTextColor
GetClipBox
GetDIBits
DeleteDC

advapi32

DeregisterEventSource
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCreateKeyW
RegisterEventSourceA
ReportEventA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegGetValueW
GetTokenInformation
OpenProcessToken
RegQueryValueExW
RegNotifyChangeKeyValue
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey

shell32

SHGetFileInfoW
ShellExecuteW
SHGetFolderPathW
SHGetSpecialFolderPathW
ord165
ShellExecuteExW
ord727

ole32

CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
OleLockRunning
CoCreateInstance
CoCreateGuid
CoUninitialize
OleInitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoInitialize

oleaut32

VarUI4FromStr
SysAllocString
VariantClear
VariantInit
SafeArrayPutElement
SafeArrayCreate

shlwapi

SHAutoComplete
PathFindFileNameW
PathIsDirectoryW
StrStrIW
StrStrIA
SHGetValueA
SHSetValueA
StrCmpNIW
StrTrimA
StrCmpIW
PathFileExistsW
StrToIntW
PathRemoveExtensionW
PathStripPathW
PathRemoveFileSpecW
PathFindExtensionW
PathAppendW
PathCombineW
SHCreateStreamOnFileEx
PathRemoveExtensionA

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

urlmon

URLDownloadToFileW
URLDownloadToCacheFileW

gdiplus

GdipDrawImageRectRect
GdipCreatePath
GdipDeletePath
GdipAddPathLineI
GdipAddPathArcI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipSetPenDashStyle
GdipCreateFromHDC
GdipDrawLineI
GdipDrawRectangleI
GdipDrawPath
GdipFillEllipseI
GdipClosePathFigure
GdipCreateTexture
GdipCreateBitmapFromStream
GdipCreateHBITMAPFromBitmap
GdipCloneBitmapAreaI
GdipCreateBitmapFromHBITMAP
GdipBitmapUnlockBits
GdipGraphicsClear
GdipFillPath
GdipDrawImagePointsI
GdipDrawImageRectRectI
GdipAddPathArc
GdipDrawEllipseI
GdipLoadImageFromFile
GdipGetImagePixelFormat
GdipDrawImageRectI
GdipLoadImageFromStreamICM
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipDeleteGraphics
GdipBitmapSetPixel
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipBitmapLockBits
GdipGetImageHeight
GdipGetImageWidth
GdipAlloc
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusShutdown
GdipGetImageGraphicsContext
GdipSaveImageToStream
GdipSaveImageToFile

ws2_32

accept
freeaddrinfo
getaddrinfo
recvfrom
setsockopt
getsockopt
getsockname
getpeername
recv
closesocket
bind
send
WSASetLastError
select
__WSAFDIsSet
socket
WSAGetLastError
WSACleanup
WSAStartup
sendto
ioctlsocket
htons
ntohs
gethostname
listen
WSAIoctl
connect

comctl32

_TrackMouseEvent
ImageList_DrawEx
ImageList_GetIconSize
InitCommonControlsEx
ord17

msimg32

GradientFill
AlphaBlend

crypt32

CertFindCertificateInStore
CertGetNameStringW
CryptQueryObject
CryptMsgGetParam

wldap32

ord46
ord143
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord211
ord60
ord50
ord217

iphlpapi

GetAdaptersInfo

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

wininet

InternetGetConnectedState

libssl-1_1

SSL_SESSION_free
SSL_set_session
SSL_get_peer_certificate
SSL_get_peer_cert_chain
SSL_CTX_set_verify
SSL_CTX_use_PrivateKey
SSL_CTX_use_certificate
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_check_private_key
SSL_new
SSL_free
SSL_connect
SSL_read
SSL_write
SSL_ctrl
SSL_CTX_ctrl
SSL_get_error
TLS_client_method
SSL_shutdown
SSL_alert_desc_string_long
SSL_CTX_add_client_CA
SSL_set_connect_state
SSL_get_certificate
SSL_get_privatekey
SSL_version
SSL_CTX_load_verify_locations
SSL_get_session
SSL_get_verify_result
SSL_get_client_random
SSL_SESSION_get_master_key
SSL_set_ex_data
SSL_get_ex_data
SSL_CTX_use_certificate_file
SSL_CTX_use_PrivateKey_file
SSL_set_bio
SSL_set_fd
SSL_pending
SSL_CIPHER_get_name
SSL_get_current_cipher
SSL_CTX_get_cert_store
SSL_CTX_free
SSL_CTX_new
SSL_CTX_set_cipher_list
BIO_f_ssl
SSL_get0_alpn_selected
SSL_CTX_set_alpn_protos
SSL_CTX_set_next_proto_select_cb
SSL_CTX_sess_set_new_cb
SSL_CTX_set_msg_callback
SSL_CTX_use_certificate_chain_file
SSL_CTX_set_options

libcrypto-1_1

X509_get_version
X509_get0_extensions
X509_get_X509_PUBKEY
X509_get0_notBefore
DSA_get0_key
DSA_get0_pqg
DH_get0_key
DH_get0_pqg
RSA_get0_key
EVP_PKEY_get0_DH
EVP_PKEY_get0_DSA
EVP_PKEY_get0_RSA
EVP_MD_CTX_free
EVP_MD_CTX_new
ASN1_STRING_get0_data
OpenSSL_version_num
OPENSSL_sk_pop
OPENSSL_sk_pop_free
OPENSSL_sk_value
OPENSSL_sk_num
X509_get0_notAfter

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 568KB - Virtual size: 567KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 65KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 149KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a48f498cc02f76a7fdba5b1e85ae8df1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

urlmon

gdiplus

ws2_32

comctl32

msimg32

crypt32

wldap32

iphlpapi

wintrust

wininet

libssl-1_1

libcrypto-1_1

Sections

.text Size: 3.2MB - Virtual size: 3.2MB

.rdata Size: 568KB - Virtual size: 567KB

.data Size: 65KB - Virtual size: 110KB

.rsrc Size: 93KB - Virtual size: 92KB

.reloc Size: 149KB - Virtual size: 149KB

.text
Size: 3.2MB - Virtual size: 3.2MB

.rdata
Size: 568KB - Virtual size: 567KB

.data
Size: 65KB - Virtual size: 110KB

.rsrc
Size: 93KB - Virtual size: 92KB

.reloc
Size: 149KB - Virtual size: 149KB