77b18955790d96c92b15714b8c35dd7e5dbb882e9edd184bce38a88d71f7ced4

Sharing

Copy URL Twitter E-mail

General

Target

77b18955790d96c92b15714b8c35dd7e5dbb882e9edd184bce38a88d71f7ced4
Size

1.7MB
MD5

62dd064582f537744d83f5a989511ab1
SHA1

6ba840353dc3161b5cbd8f66ff37664b0a16dcee
SHA256

77b18955790d96c92b15714b8c35dd7e5dbb882e9edd184bce38a88d71f7ced4
SHA512

15872536596c60977b2e9764a23410f8395688435631102c8b21e7fef20f34e650d4725dccb92d2fefe9ba1f0a68482821914bff9b93dac73abda50de63bd070
SSDEEP

24576:YY/0wMPheItAEe85E8mHA55nmzpH1u6VAX1mCFPoa+mfNukP2jdTyJojrMqEm/:d0wMPh3tbhmH45nm1QFKldTcojr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
77b18955790d96c92b15714b8c35dd7e5dbb882e9edd184bce38a88d71f7ced4

Files

77b18955790d96c92b15714b8c35dd7e5dbb882e9edd184bce38a88d71f7ced4
.exe windows:4 windows x86

f968e2d307013e8c666e9d68700f2476

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

netapi32

DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation

wininet

InternetSetOptionA

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

mpr

WNetGetUniversalNameW

kernel32

HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
SetHandleCount
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetStringTypeA
HeapDestroy
IsBadReadPtr
IsBadCodePtr
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetLocaleInfoW
InterlockedExchange
GetProfileStringA
GetEnvironmentVariableA
GetStringTypeW
CloseHandle
CreateThread
GetPrivateProfileStringA
GetModuleFileNameA
OpenProcess
GetVersionExA
GetVersion
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
lstrlenW
GetCPInfo
LockResource
LoadResource
FindResourceA
lstrcmpiA
LocalFree
DisconnectNamedPipe
FlushFileBuffers
ReadFile
ConnectNamedPipe
GetLastError
CreateNamedPipeA
LocalAlloc
FreeLibrary
CreateProcessA
CreateMutexA
CreateFileA
GetCurrentProcess
ResumeThread
GetSystemDefaultLCID
lstrcatA
lstrcpyA
WaitForSingleObject
Sleep
GetTickCount
WritePrivateProfileStringA
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
WriteFile
GetFileSize
EnterCriticalSection
LeaveCriticalSection
TerminateThread
GetExitCodeThread
CopyFileA
MoveFileA
DeleteFileA
FindClose
FindNextFileA
FindFirstFileA
CreateDirectoryA
GetLongPathNameA
TerminateProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
OutputDebugStringA
FormatMessageA
GlobalUnlock
GlobalLock
GlobalAlloc
GetProcAddress
LoadLibraryA
ProcessIdToSessionId
InterlockedDecrement
InterlockedIncrement
SetFileTime
SystemTimeToFileTime
GetSystemTime
GetExitCodeProcess
ExpandEnvironmentStringsA
GetLocalTime
SuspendThread
HeapAlloc
GetProcessHeap
GetFileAttributesA
lstrcmpA
GetCurrentDirectoryA
RemoveDirectoryA
SetFileAttributesA
CreateFileW
GetModuleHandleA
SetEndOfFile
SetFilePointer
GetComputerNameA
GetComputerNameW
Process32NextW
Process32FirstW
DeviceIoControl
QueryDosDeviceW
GetFileAttributesW
WinExec
HeapFree
QueryDosDeviceA
DefineDosDeviceA
GetDriveTypeA
SetEvent
ReadDirectoryChangesW
CreateEventA
SetLastError
MulDiv
lstrcpynA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
SetThreadPriority
GetCurrentThread
GlobalFree
FileTimeToSystemTime
FileTimeToLocalFileTime
DuplicateHandle
LockFile
UnlockFile
GetVolumeInformationA
GetFullPathNameA
GetThreadLocale
GetFileTime
GlobalFlags
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
GetProcessVersion
GetOEMCP
SizeofResource
FindResourceExA
SetErrorMode
RtlUnwind
RaiseException
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetStartupInfoA
GetCommandLineA
ExitProcess
ExitThread
GetACP
SetStdHandle
GetFileType
HeapSize
HeapReAlloc

user32

SetWindowsHookExA
UnregisterClassA
HideCaret
ShowCaret
ExcludeUpdateRgn
DefDlgProcA
IsWindowUnicode
GetLastInputInfo
PostThreadMessageA
SetTimer
KillTimer
PostQuitMessage
GetAsyncKeyState
LoadIconA
IsIconic
DrawIcon
GetWindowDC
GetSystemMenu
SetForegroundWindow
RegisterWindowMessageA
FrameRect
LoadImageA
GetIconInfo
CreateIconIndirect
DrawStateA
OffsetRect
GetClientRect
InflateRect
DrawFocusRect
GetWindowRect
ClientToScreen
WindowFromPoint
GetActiveWindow
InvalidateRect
SetCursor
GetParent
GetNextDlgTabItem
CreateWindowExA
SendMessageA
GetWindowLongA
DestroyCursor
EnableWindow
GrayStringA
TabbedTextOutA
GetSubMenu
LoadBitmapA
GetSysColorBrush
GetMenuStringA
CreateMenu
CreatePopupMenu
GetMenuItemID
GetMenuState
ModifyMenuA
GetMenuItemCount
AppendMenuA
GetSystemMetrics
CallNextHookEx
GetWindow
wsprintfA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetWindowTextW
DestroyMenu
ScreenToClient
BeginPaint
EndPaint
IntersectRect
GetDesktopWindow
GetDC
DrawTextA
ReleaseDC
GetWindowPlacement
DestroyIcon
RemovePropA
GetSysColor
CopyRect
FillRect
DrawEdge
SetRect
GetMenuItemInfoA
DestroyWindow
GetKeyState
PostMessageA
MapDialogRect
GetDlgCtrlID
GetWindowTextLengthA
GetDlgItem
TrackPopupMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
IsChild
GetTopWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
SetScrollInfo
GetScrollInfo
ScrollWindow
IsWindowVisible
DeferWindowPos
EqualRect
AdjustWindowRectEx
SetFocus
IsWindow
SetActiveWindow
GetFocus
DispatchMessageA
PeekMessageA
MapWindowPoints
SendDlgItemMessageA
UpdateWindow
GetCursorPos
ValidateRect
TranslateMessage
GetMessageA
SetRectEmpty
PtInRect
SetDlgItemTextA
IsDialogMessageA
SetWindowTextA
MoveWindow
ShowWindow
IsWindowEnabled
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadStringA
SetWindowContextHelpId
SetParent
MessageBeep
GetNextDlgGroupItem
CopyAcceleratorTableA
CharNextA
SetCapture
LockWindowUpdate
GetDCEx
LoadCursorA
GetClassNameA
CharUpperA
FindWindowA
SetWindowPos
SetWindowLongA
GetForegroundWindow
GetLastActivePopup
GetMessagePos
ReleaseCapture
GetMessageTime
DrawIconEx
DefWindowProcA
EndDialog
CallWindowProcA
GetPropA
UnhookWindowsHookEx
SetPropA
SystemParametersInfoA
GetClassLongA
MessageBoxA
GetWindowTextA
GetWindowThreadProcessId
CreateDialogIndirectParamA
RegisterClipboardFormatA
IsMenu

gdi32

SetDIBitsToDevice
GetTextExtentPointA
GetDeviceCaps
EnumFontFamiliesExA
GetBkColor
GetTextColor
LPtoDP
GetCharWidthA
StretchDIBits
DPtoLP
CombineRgn
SetRectRgn
GetMapMode
CreatePatternBrush
GetWindowExtEx
GetViewportExtEx
ExtSelectClipRgn
CreateRectRgn
LineTo
MoveToEx
IntersectClipRect
ExcludeClipRect
SelectClipRgn
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetStretchBltMode
SetBkMode
RestoreDC
SaveDC
CreateRectRgnIndirect
GetTextMetricsA
CreateFontA
CreateBitmap
SetBkColor
SetTextColor
GetStockObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
PatBlt
GetObjectA
GetPixel
SetPixel
CreateDIBSection
SelectObject
DeleteObject
DeleteDC
Ellipse
GetTextExtentPoint32A
GetTextExtentPoint32W
CreateCompatibleBitmap
BitBlt
CreateCompatibleDC
CreateFontIndirectA
CreateSolidBrush
CreatePen
GetBkMode
CreateDIBitmap

comdlg32

GetFileTitleA
GetOpenFileNameA
GetSaveFileNameA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
LookupAccountSidA
IsValidSid
RegOpenKeyExA
RegQueryValueExA
GetNamedSecurityInfoA
GetTokenInformation
OpenProcessToken
GetUserNameA
RegQueryValueA
RegDeleteValueA
RegOpenKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
RegDeleteKeyA
RegEnumKeyExA
RegQueryInfoKeyA
RegCreateKeyExA
RegSetValueA
RegSetValueExA
RegSaveKeyA
RegRestoreKeyA
RevertToSelf
ImpersonateLoggedOnUser
CreateProcessAsUserA
StartServiceA
LookupAccountSidW
ControlService
OpenSCManagerA
OpenServiceA
CloseServiceHandle
RegCloseKey
ConvertStringSidToSidA
SetEntriesInAclA
SetNamedSecurityInfoA
ConvertSidToStringSidA
CryptAcquireContextW
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptGetHashParam
DuplicateTokenEx
SetTokenInformation

shell32

ExtractIconA
SHFileOperationA
ShellExecuteExA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc
SHGetFolderPathA
Shell_NotifyIconA
SHGetSpecialFolderPathA
ShellExecuteA
SHChangeNotify

comctl32

ImageList_Draw
ImageList_GetImageCount
ImageList_GetIcon
ImageList_AddMasked
ImageList_ReplaceIcon
_TrackMouseEvent
ImageList_Remove
ImageList_Destroy
ImageList_Create
ord17
PropertySheetA
DestroyPropertySheetPage
CreatePropertySheetPageA

oledlg

ord8

ole32

CoRevokeClassObject
CoRegisterMessageFilter
CoTaskMemAlloc
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CLSIDFromString
CLSIDFromProgID
CoInitialize
CoInitializeEx
CoUninitialize
CoCreateInstance
OleFlushClipboard
OleIsCurrentClipboard
CoTaskMemFree

olepro32

ord253

oleaut32

SysFreeString
SysStringLen
SysAllocString
VariantClear
SysAllocStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
VariantCopy
SysAllocStringByteLen
VariantChangeType
VariantTimeToSystemTime

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

activeds

ord3

shlwapi

SHDeleteKeyA
PathIsDirectoryA

log4cplus

?sleep@helpers@log4cplus@@YAXKK@Z
??0Logger@log4cplus@@QAE@ABV01@@Z
?doConfigure@PropertyConfigurator@log4cplus@@SAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVHierarchy@2@@Z
?getDefaultHierarchy@Logger@log4cplus@@SAAAVHierarchy@2@XZ
?forcedLog@Logger@log4cplus@@QAEXHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBDH@Z
??1Logger@log4cplus@@UAE@XZ
?getInstance@Logger@log4cplus@@SA?AV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?isEnabledFor@Logger@log4cplus@@QBE_NH@Z

winmm

PlaySoundA

wsock32

bind
closesocket
accept
recv
WSACleanup
WSAStartup
socket
htons
ioctlsocket
listen

psapi

GetModuleFileNameExW
GetProcessImageFileNameW
GetProcessMemoryInfo

globalhookdll

ord1
ord2

rpcrt4

RpcStringFreeW
UuidCreateSequential
RpcStringFreeA
UuidToStringA
UuidToStringW

iphlpapi

GetAdaptersInfo

libcurl

curl_easy_init
curl_slist_append
curl_easy_perform
curl_formfree
curl_easy_setopt
curl_slist_free_all
curl_easy_cleanup
curl_easy_getinfo
curl_easy_strerror
curl_formadd

msvcrt

fread
printf
ungetwc
fgetwc
free
malloc
floor
?set_new_handler@@YAP6AXXZP6AXXZ@Z
__RTDynamicCast
_strlwr
_rmdir
_chdir
strtod
_snprintf
abort
getenv
sscanf
_iob
fprintf
exit
isprint
fwrite
_CIfmod
_setjmp3
longjmp
_CIpow
sprintf
strncpy
fscanf
fgets
getc
fputc
fflush
ftell
fseek
fopen
fclose

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 180KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 324KB - Virtual size: 321KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f968e2d307013e8c666e9d68700f2476

Headers

File Characteristics

Imports

netapi32

wininet

version

userenv

mpr

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

setupapi

activeds

shlwapi

log4cplus

winmm

wsock32

psapi

globalhookdll

rpcrt4

iphlpapi

libcurl

msvcrt

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 180KB - Virtual size: 178KB

.data Size: 72KB - Virtual size: 99KB

.rsrc Size: 324KB - Virtual size: 321KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 180KB - Virtual size: 178KB

.data
Size: 72KB - Virtual size: 99KB

.rsrc
Size: 324KB - Virtual size: 321KB