fc2d6b478397a9425a4fc2e1f27263bceab03ed2d56883ba2cc323a901e28c45

Sharing

Copy URL

Twitter E-mail

General

Target

fc2d6b478397a9425a4fc2e1f27263bceab03ed2d56883ba2cc323a901e28c45
Size

4.1MB
MD5

f9a7f3334b3a641e15b514941c1d6100
SHA1

1f0df8bda57a5bff71d7b3071ec88e174e555056
SHA256

fc2d6b478397a9425a4fc2e1f27263bceab03ed2d56883ba2cc323a901e28c45
SHA512

2f7e32a14352e47e117b4841d5ccde9a23ce1ef9d205b83858675cb63b5260b8ec48d666b57dceb384b7da02a8df9b2262b76c958b31db8b03087024241cc009
SSDEEP

49152:4tba1QPAQlY6xRhZMg2wOhmXtGzqXiqkZpeON0F0wH7wMPqDVjq4Y6n7X0of0dDm:a3lYuUm9u1hc4RqL6gtFd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fc2d6b478397a9425a4fc2e1f27263bceab03ed2d56883ba2cc323a901e28c45

Files

fc2d6b478397a9425a4fc2e1f27263bceab03ed2d56883ba2cc323a901e28c45
.exe windows:6 windows x86

5c24697b51e64195d98753a0ba23d45c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FlushConsoleInputBuffer
lstrlenA
lstrcatA
GlobalMemoryStatus
ReadConsoleInputA
SetConsoleMode
GetThreadIOPendingFlag
CreateWaitableTimerW
DuplicateHandle
GetOverlappedResult
CreateNamedPipeW
SetNamedPipeHandleState
DisconnectNamedPipe
ConnectNamedPipe
ReadFile
CreateMutexW
ReleaseMutex
CopyFileW
GetCommandLineW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
K32GetProcessImageFileNameW
MoveFileExW
QueryFullProcessImageNameW
lstrcatW
lstrcpyW
LocalFree
LocalAlloc
OpenProcess
GetStartupInfoW
GetCurrentThread
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
SetStdHandle
SetConsoleCtrlHandler
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
OutputDebugStringW
GetTimeFormatW
GetDateFormatW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetModuleHandleExW
WriteFile
SetFileAttributesW
SetEndOfFile
RemoveDirectoryW
QueryDosDeviceW
GetLogicalDriveStringsW
GetFileSize
GetFileAttributesW
GetFileAttributesA
DeleteFileW
CreateFileW
CreateFileA
CreateDirectoryW
lstrlenW
lstrcpynW
LoadLibraryW
IsBadReadPtr
VirtualProtect
GetCurrentThreadId
GetCurrentProcessId
SetUnhandledExceptionFilter
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetCurrentProcess
CloseHandle
WideCharToMultiByte
lstrcmpiW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
GetExitCodeProcess
TerminateProcess
CancelWaitableTimer
SetWaitableTimer
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetLastError
RaiseException
DecodePointer
MultiByteToWideChar
ExitThread
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualAlloc
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
GetQueuedCompletionStatus
CreateIoCompletionPort
HeapCreate
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
UnlockFileEx
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
FlushViewOfFile
GetVersionExA
DeleteFileA
GetSystemInfo
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
VerifyVersionInfoA
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
VerSetConditionMask
PeekNamedPipe
GetStdHandle
GetFileType
ExpandEnvironmentStringsA
SleepEx
FormatMessageA
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetLocalTime
ResumeThread
GetTempFileNameW
GlobalFree
GlobalLock
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
WaitForMultipleObjects
Sleep
CreateEventW
WaitForSingleObject
ResetEvent
SetEvent
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
GlobalUnlock
GlobalAlloc
GetVersion
SystemTimeToFileTime
GetSystemTime
lstrcmpW
ExitProcess
MulDiv
GetACP
GetSystemWindowsDirectoryW
FreeResource
InterlockedCompareExchange
GetSystemDirectoryW
HeapAlloc
IsValidLocale
lstrcmpiA
lstrcmpA
FlushFileBuffers
IsDebuggerPresent
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
TryEnterCriticalSection
GetStringTypeW
FormatMessageW
GetCurrentDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
GetTempPathW
AreFileApisANSI
SetLastError
DeviceIoControl
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetCPInfo
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetVersionExW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetFileSizeEx
SetFilePointer
InterlockedIncrement
InterlockedDecrement
HeapDestroy

user32

DrawTextW
SetClipboardData
GetDC
BeginPaint
EndPaint
SetFocus
EmptyClipboard
CloseClipboard
OpenClipboard
BringWindowToTop
IsIconic
IsWindowVisible
GetClassNameW
GetWindowRect
GetWindowTextW
CharNextW
GetWindowLongW
EnumWindows
DestroyWindow
IsWindow
PostMessageW
SendMessageW
InvalidateRgn
GetClientRect
FillRect
SetRect
CopyRect
IsRectEmpty
EnumDisplayMonitors
IsWindowEnabled
SetForegroundWindow
SetParent
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
SetWindowPos
PostQuitMessage
LoadImageW
PtInRect
MonitorFromWindow
MsgWaitForMultipleObjectsEx
SendMessageTimeoutW
PeekMessageW
DispatchMessageW
TranslateMessage
ClientToScreen
ScreenToClient
ChangeWindowMessageFilter
UnhookWinEvent
SetWinEventHook
FindWindowW
SetActiveWindow
ShowWindow
SetWindowTextW
MonitorFromPoint
GetIconInfo
DestroyIcon
GetWindowThreadProcessId
GetWindowTextLengthW
ReleaseDC
GetForegroundWindow
MoveWindow
wsprintfW
wvsprintfW
SetCursor
LoadCursorW
GetMessageW
CreateWindowExW
IsChild
UpdateLayeredWindow
IsZoomed
GetFocus
GetKeyState
SetCapture
ReleaseCapture
GetUpdateRect
InvalidateRect
CreateCaret
GetCaretBlinkTime
SetCaretPos
MapWindowPoints
SetWindowLongW
GetParent
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
SetWindowRgn
MessageBoxW
CharPrevW
DrawIconEx
RemovePropW
HideCaret
ShowCaret
GetSysColor
GetWindowDC
GetMessagePos
GetDlgCtrlID
DrawFocusRect
CreateAcceleratorTableW
FindWindowExW
AttachThreadInput
KillTimer
SetTimer
GetMonitorInfoW
GetCursorPos
OffsetRect
UnionRect
IntersectRect
InflateRect
RealGetWindowClassW
GetWindow
GetTopWindow
GetDesktopWindow

gdi32

BitBlt
CombineRgn
CreateCompatibleBitmap
CreateFontIndirectW
RestoreDC
SaveDC
GetTextMetricsW
SetWindowOrgEx
CreateRoundRectRgn
GetDeviceCaps
GetCharABCWidthsW
GetClipBox
CreateCompatibleDC
SelectClipRgn
ExtSelectClipRgn
SetBkColor
StretchBlt
SetStretchBltMode
CreateDIBSection
SetDIBColorTable
TextOutW
ExtTextOutW
SetDIBitsToDevice
GetTextColor
GetObjectW
CreateDCW
CreateFontW
CreatePen
CreatePatternBrush
CreateRectRgn
CreateRectRgnIndirect
GetDIBits
DeleteDC
DeleteObject
GetStockObject
Rectangle
SelectObject
SetBkMode
GetTextExtentPoint32W
SetTextColor
CreateSolidBrush

advapi32

DeregisterEventSource
RegCreateKeyW
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegisterEventSourceA
ReportEventA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegGetValueW
GetTokenInformation
OpenProcessToken
RegQueryValueExW
RegNotifyChangeKeyValue
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey

shell32

ShellExecuteExW
ShellExecuteW
SHGetFolderPathW
SHGetSpecialFolderPathW
ord165
ord727
SHGetFileInfoW

ole32

CoCreateGuid
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
OleLockRunning
CoCreateInstance
CoInitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoUninitialize
OleInitialize

oleaut32

VarUI4FromStr
SysAllocString
VariantClear
SafeArrayPutElement
SafeArrayCreate
VariantInit

shlwapi

PathIsDirectoryW
StrStrIW
StrStrIA
SHSetValueA
StrCmpNIW
StrTrimA
StrCmpIW
PathFindFileNameW
SHAutoComplete
PathFileExistsW
StrToIntW
PathRemoveExtensionW
PathStripPathW
PathRemoveFileSpecW
PathFindExtensionW
PathAppendW
PathCombineW
SHCreateStreamOnFileEx
PathRemoveExtensionA
SHGetValueA

gdiplus

GdipDeletePath
GdipAddPathLineI
GdipAddPathArcI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipSetPenDashStyle
GdipCreateFromHDC
GdipDrawLineI
GdipDrawRectangleI
GdipDrawPath
GdipFillEllipseI
GdipClosePathFigure
GdipCreateTexture
GdipCreateBitmapFromStream
GdipCreateHBITMAPFromBitmap
GdipCloneBitmapAreaI
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGraphicsClear
GdipFillPath
GdipDrawImagePointsI
GdipDrawImageRectRectI
GdipAddPathArc
GdipDrawEllipseI
GdipLoadImageFromFile
GdipGetImagePixelFormat
GdipDrawImageRectI
GdipLoadImageFromStreamICM
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipCreatePath
GdipAlloc
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipCreateBitmapFromHBITMAP
GdipDrawImageRectRect
GdipGetImageEncodersSize
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipDeleteGraphics
GdipBitmapSetPixel
GdipGetImageEncoders
GdiplusShutdown
GdipSaveImageToStream
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile

msimg32

GradientFill
AlphaBlend

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

ws2_32

accept
freeaddrinfo
getaddrinfo
recvfrom
setsockopt
getsockopt
getsockname
send
connect
closesocket
bind
recv
WSASetLastError
select
__WSAFDIsSet
socket
WSAGetLastError
WSACleanup
WSAStartup
htons
ntohs
sendto
ioctlsocket
gethostname
listen
WSAIoctl
getpeername

comctl32

_TrackMouseEvent
ImageList_DrawEx
ImageList_GetIconSize
InitCommonControlsEx
ord17

crypt32

CertFindCertificateInStore
CertGetNameStringW
CryptQueryObject
CryptMsgGetParam

wldap32

ord60
ord46
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord217
ord143
ord50
ord211

iphlpapi

GetAdaptersInfo

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

wininet

InternetGetConnectedState

libssl-1_1

SSL_SESSION_free
SSL_set_session
SSL_get_peer_certificate
SSL_get_peer_cert_chain
SSL_CTX_set_verify
SSL_CTX_use_PrivateKey
SSL_CTX_use_certificate
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_check_private_key
SSL_new
SSL_free
SSL_connect
SSL_read
SSL_write
SSL_ctrl
SSL_CTX_ctrl
SSL_get_error
TLS_client_method
SSL_shutdown
SSL_alert_desc_string_long
SSL_CTX_add_client_CA
SSL_set_connect_state
SSL_get_certificate
SSL_get_privatekey
SSL_version
SSL_CTX_load_verify_locations
SSL_get_session
SSL_get_verify_result
SSL_get_client_random
SSL_SESSION_get_master_key
SSL_set_ex_data
SSL_get_ex_data
SSL_CTX_use_certificate_file
SSL_CTX_use_PrivateKey_file
SSL_set_bio
SSL_set_fd
SSL_pending
SSL_CIPHER_get_name
SSL_get_current_cipher
SSL_CTX_get_cert_store
SSL_CTX_free
SSL_CTX_new
SSL_CTX_set_cipher_list
BIO_f_ssl
SSL_get0_alpn_selected
SSL_CTX_set_alpn_protos
SSL_CTX_set_next_proto_select_cb
SSL_CTX_sess_set_new_cb
SSL_CTX_set_options
SSL_CTX_use_certificate_chain_file
SSL_CTX_set_msg_callback

libcrypto-1_1

X509_get_version
X509_get_X509_PUBKEY
X509_get0_extensions
DSA_get0_key
X509_get0_notBefore
DSA_get0_pqg
DH_get0_key
DH_get0_pqg
RSA_get0_key
EVP_PKEY_get0_DH
EVP_PKEY_get0_DSA
EVP_PKEY_get0_RSA
EVP_MD_CTX_free
EVP_MD_CTX_new
ASN1_STRING_get0_data
OpenSSL_version_num
OPENSSL_sk_pop
OPENSSL_sk_pop_free
OPENSSL_sk_value
OPENSSL_sk_num
X509_get0_notAfter

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 567KB - Virtual size: 567KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 65KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 149KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5c24697b51e64195d98753a0ba23d45c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

msimg32

version

urlmon

ws2_32

comctl32

crypt32

wldap32

iphlpapi

wintrust

wininet

libssl-1_1

libcrypto-1_1

Sections

.text Size: 3.2MB - Virtual size: 3.2MB

.rdata Size: 567KB - Virtual size: 567KB

.data Size: 65KB - Virtual size: 112KB

.rsrc Size: 93KB - Virtual size: 92KB

.reloc Size: 149KB - Virtual size: 149KB

.text
Size: 3.2MB - Virtual size: 3.2MB

.rdata
Size: 567KB - Virtual size: 567KB

.data
Size: 65KB - Virtual size: 112KB

.rsrc
Size: 93KB - Virtual size: 92KB

.reloc
Size: 149KB - Virtual size: 149KB