be253d07456d515de37cd49404cccd8864409008fc74598aecb3387331c88a94

Sharing

Copy URL

Twitter E-mail

General

Target

be253d07456d515de37cd49404cccd8864409008fc74598aecb3387331c88a94
Size

14.6MB
MD5

deb2006e00121c781063c278d95157a6
SHA1

29bd201897609aef875be29e0bc725fe69fb9fa5
SHA256

be253d07456d515de37cd49404cccd8864409008fc74598aecb3387331c88a94
SHA512

e66f70a9d4df488a34a28d40e1d4994237dffcf8f49eef4334c180169ea65233f98d759772e66684eafa20b059ed4dc7cbc9351b7cd092b80cb7d3e9a48edfab
SSDEEP

393216:tFqTFwY5a2RlouiwvF2mCcnTZCF5rNnghayJm57l04ObcZ:ihzat3wN28Fi55gkyA7O4OAZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be253d07456d515de37cd49404cccd8864409008fc74598aecb3387331c88a94

Files

be253d07456d515de37cd49404cccd8864409008fc74598aecb3387331c88a94
.exe windows:6 windows x64

72f9f9f178a8ca1ae08d859c95c8e6a8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

imm32

ImmGetVirtualKey
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmNotifyIME
ImmGetOpenStatus
ImmGetCompositionStringW
ImmAssociateContextEx
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmGetDefaultIMEWnd

oleaut32

SafeArrayPutElement
SysFreeString
SysAllocStringLen
SafeArrayCreateVector
SysAllocString
VariantClear

shlwapi

StrRChrW
SHGetValueW
PathFindFileNameW
SHSetValueW
PathRemoveFileSpecW
PathFindExtensionW
PathAddBackslashW
StrCmpIW
PathFileExistsW
PathAppendW

rpcrt4

UuidCreate
RpcStringFreeA
UuidToStringA

gdi32

GetRegionData
GdiFlush
CreateFontIndirectW
EnumFontFamiliesExW
GetFontData
GetStockObject
GetDIBits
AddFontResourceExW
RemoveFontResourceExW
BitBlt
GetObjectW
GetBitmapBits
SwapBuffers
GetPixelFormat
DescribePixelFormat
SetPixelFormat
ChoosePixelFormat
CreateBitmap
SelectObject
DeleteDC
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
GetDeviceCaps
SelectClipRgn
OffsetRgn
CreateRectRgn
CombineRgn
CreateDIBSection
DeleteObject
CreateRoundRectRgn
AddFontMemResourceEx
RemoveFontMemResourceEx
GetTextMetricsW
GetTextFaceW
GetCharABCWidthsW
GetCharABCWidthsFloatW
GetGlyphOutlineW
GetOutlineTextMetricsW
GetTextExtentPoint32W
GetCharABCWidthsI
SetBkMode
SetGraphicsMode
SetTextColor
SetTextAlign
SetWorldTransform
ExtTextOutW

dwmapi

DwmIsCompositionEnabled
DwmEnableBlurBehindWindow

comdlg32

GetOpenFileNameW

ws2_32

freeaddrinfo
WSAConnect
WSAHtonl
WSAIoctl
WSANtohl
WSANtohs
WSARecv
WSARecvFrom
WSASend
inet_addr
ntohl
closesocket
connect
htons
inet_ntoa
recv
send
setsockopt
socket
getnameinfo
getaddrinfo
WSAAccept
recvfrom
shutdown
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAAsyncSelect
WSACleanup
WSAStartup
gethostname
WSASocketW
WSASendTo
ioctlsocket
select
WSAGetLastError
htonl
inet_ntop
__WSAFDIsSet
bind
sendto
inet_pton
WSASetLastError

ole32

RegisterDragDrop
CoLockObjectExternal
StringFromGUID2
CoCreateGuid
CoInitializeEx
CoUninitialize
OleGetClipboard
OleFlushClipboard
CoGetMalloc
ReleaseStgMedium
CoTaskMemFree
DoDragDrop
CoCreateInstance
CoInitialize
OleSetClipboard
OleInitialize
OleUninitialize
OleIsCurrentClipboard
RevokeDragDrop

advapi32

CryptEnumProvidersA
CryptSignHashA
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
SystemFunction036
OpenProcessToken
AccessCheck
CryptAcquireContextA
RegNotifyChangeKeyValue
ReportEventA
RegisterEventSourceA
DeregisterEventSource
AllocateAndInitializeSid
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
QueryServiceStatus
StartServiceW
CreateServiceW
RegSetValueExW
RegQueryInfoKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
BuildTrusteeWithSidW
GetNamedSecurityInfoW
GetEffectiveRightsFromAclW
LookupAccountSidW
MapGenericMask
GetTokenInformation
GetLengthSid
FreeSid
DuplicateToken
CopySid

user32

ScreenToClient
AdjustWindowRectEx
MoveWindow
SetWindowTextW
InvalidateRect
GetUpdateRect
IsZoomed
SetCursor
ChangeWindowMessageFilterEx
RealGetWindowClassW
GetWindowTextW
CloseTouchInputHandle
GetTouchInputInfo
GetAsyncKeyState
GetMessageExtraInfo
TrackMouseEvent
GetClipboardFormatNameW
GetCursorInfo
GetIconInfo
CreateIconIndirect
CreateCursor
LoadCursorW
GetCursor
SetCursorPos
EnumDisplayDevicesW
RegisterClassW
TrackPopupMenuEx
GetMenu
MapVirtualKeyW
ToUnicode
ToAscii
GetKeyboardState
PeekMessageW
FindWindowA
SetCaretPos
ShowCaret
DestroyCaret
CreateCaret
IsWindowEnabled
RegisterWindowMessageW
GetKeyboardLayout
RegisterClipboardFormatW
IsIconic
SetClipboardViewer
IsHungAppWindow
LoadIconW
GetSysColor
EnumDisplayMonitors
SetMenuItemInfoW
GetMenuItemInfoW
TrackPopupMenu
RemoveMenu
EndPaint
AppendMenuW
InsertMenuW
DestroyMenu
CreatePopupMenu
CreateMenu
DrawMenuBar
SetMenu
LoadImageW
GetSysColorBrush
ChildWindowFromPointEx
GetCursorPos
GetClientRect
GetFocus
RegisterClassExW
GetClassInfoW
GetKeyboardLayoutList
GetAncestor
MonitorFromPoint
BeginPaint
ReleaseDC
SetWindowLongW
MonitorFromWindow
GetMonitorInfoW
UnregisterClassW
GetKeyState
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
UnregisterDeviceNotification
RegisterDeviceNotificationW
PostThreadMessageW
CharNextExA
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
KillTimer
SetTimer
MsgWaitForMultipleObjectsEx
GetQueueStatus
DispatchMessageW
TranslateMessage
wsprintfW
IsWindow
ShowWindow
SetFocus
SetForegroundWindow
SetWindowPos
IsWindowVisible
EnumWindows
GetWindowThreadProcessId
GetWindow
GetDoubleClickTime
MessageBeep
GetCaretBlinkTime
GetDesktopWindow
SystemParametersInfoW
UpdateLayeredWindowIndirect
SendMessageW
PostMessageW
AttachThreadInput
CreateWindowExW
IsChild
DestroyWindow
UpdateLayeredWindow
SetLayeredWindowAttributes
FlashWindowEx
DefWindowProcW
GetWindowLongW
GetDC
ClientToScreen
GetForegroundWindow
EnableMenuItem
GetSystemMenu
ReleaseCapture
SetCapture
GetCapture
IsTouchWindow
GetWindowRect
SetWindowRgn
ModifyMenuW
DestroyIcon
DestroyCursor
SetParent
GetParent
SetWindowLongPtrW
GetWindowLongPtrW
GetSystemMetrics
UnregisterTouchWindow
RegisterTouchWindow
SetWindowPlacement
DrawIconEx
MessageBoxW
ChangeClipboardChain
GetWindowPlacement

kernel32

RtlPcToFileHeader
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
DefineDosDeviceW
QueryDosDeviceW
SetConsoleTextAttribute
GetDiskFreeSpaceExW
CreateTimerQueue
SignalObjectAndWait
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
RtlUnwindEx
ExitThread
WriteFileEx
SleepEx
CancelIoEx
PeekNamedPipe
ReadFileEx
GetUserGeoID
GetGeoInfoW
GetTimeZoneInformation
GetModuleHandleExW
FindFirstFileExW
FindNextChangeNotification
FindFirstChangeNotificationW
FindCloseChangeNotification
SetFilePointerEx
GetFileType
RegisterWaitForSingleObject
UnregisterWaitEx
GetProcessId
GetExitCodeProcess
CreateNamedPipeW
ConnectNamedPipe
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStdHandle
GetFileInformationByHandleEx
TzSpecificLocalTimeToSystemTime
MoveFileExW
MoveFileW
DeviceIoControl
GetVolumePathNamesForVolumeNameW
GetLogicalDrives
ExitProcess
CreateDirectoryW
GetStartupInfoW
LCMapStringW
CompareStringW
QueryPerformanceFrequency
GetUserPreferredUILanguages
GetUserDefaultLCID
GetCurrencyFormatW
GetTimeFormatW
GetDateFormatW
GetSystemDirectoryW
IsProcessorFeaturePresent
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread
TerminateThread
GetThreadPriority
SetThreadPriority
GetCurrentThread
CreateThread
SwitchToThread
DuplicateHandle
GetCommandLineW
CompareStringEx
SetHandleInformation
GlobalFree
GetConsoleWindow
GetLongPathNameW
FindClose
FindFirstFileW
DecodePointer
RaiseException
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
FileTimeToSystemTime
MultiByteToWideChar
WideCharToMultiByte
OutputDebugStringW
CloseHandle
SetEvent
WaitForSingleObject
CreateEventW
WaitForMultipleObjects
lstrlenW
GetComputerNameW
CreateFileW
ReadFile
SetFilePointer
GetCPInfo
FreeLibrary
FreeResource
LoadLibraryExW
LoadResource
LockResource
SizeofResource
FindResourceW
EnumResourceNamesW
GetProcAddress
LoadLibraryW
lstrlenA
lstrcpynW
ResetEvent
FindNextFileW
DeleteFileW
GetPrivateProfileIntW
GetPrivateProfileStringW
CopyFileW
GetPrivateProfileSectionNamesW
GetFileAttributesW
SetEndOfFile
SetFileAttributesW
GetLocalTime
lstrcpyW
GetPrivateProfileIntA
GetPrivateProfileStringA
GetPrivateProfileSectionW
GetFileSize
CreateProcessW
GetTickCount64
GetModuleFileNameW
LoadLibraryA
GetACP
GetCurrentProcess
TerminateProcess
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
lstrcatW
Sleep
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetFileSizeEx
GetFileTime
SetFileTime
GetOverlappedResult
GetTickCount
lstrcmpiW
WritePrivateProfileStringW
RemoveDirectoryW
GetDiskFreeSpaceA
GetLogicalDriveStringsA
GetCurrentThreadId
GetModuleHandleW
LocalFree
FormatMessageW
WTSGetActiveConsoleSessionId
SetErrorMode
ExpandEnvironmentStringsW
CheckRemoteDebuggerPresent
OpenProcess
GlobalAlloc
GlobalUnlock
GlobalLock
GetLocaleInfoW
GlobalSize
GetCurrentProcessId
CreateFileA
GetDriveTypeW
GetVolumeInformationW
GetUserDefaultLangID
lstrcmpW
SetLastError
GetCurrentDirectoryW
FlushFileBuffers
QueryPerformanceCounter
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
LockFileEx
UnlockFile
HeapCompact
GetSystemInfo
DeleteFileA
WaitForSingleObjectEx
FlushViewOfFile
SetEnvironmentVariableW
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
SystemTimeToTzSpecificLocalTime
GetCommandLineA
SetStdHandle
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
IsValidLocale
EnumSystemLocalesW
IsValidCodePage
GetOEMCP
SetConsoleCtrlHandler
WriteConsoleW
GlobalMemoryStatus
FlushConsoleInputBuffer
ReleaseMutex
VirtualQuery
RtlUnwind
GetFileAttributesExW
GetFileAttributesA
GetTempPathA
HeapValidate
CreateMutexW
GetTempPathW
UnlockFileEx
GetFullPathNameA
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
GetFullPathNameW
HeapCreate
TryEnterCriticalSection
AreFileApisANSI
GetConsoleCP
SetConsoleMode
InitializeCriticalSectionAndSpinCount
EncodePointer
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
GetExitCodeThread
WriteFile
ReadConsoleInputW
GetStringTypeW
GetFileInformationByHandle
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

shell32

SHGetMalloc
SHGetPathFromIDListW
SHChangeNotify
SHGetKnownFolderIDList
SHBrowseForFolderW
Shell_NotifyIconW
Shell_NotifyIconGetRect
SHCreateItemFromIDList
ord727
SHGetStockIconInfo
SHGetKnownFolderPath
CommandLineToArgvW
SHGetFileInfoW
ShellExecuteW
ord165
SHFileOperationW
SHCreateItemFromParsingName

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

uxtheme

GetThemeColor
GetThemeInt
GetThemeEnumValue
GetThemeMargins
GetThemePropertyOrigin
OpenThemeData
ord47
GetThemeBackgroundRegion
IsThemeBackgroundPartiallyTransparent
GetThemeBool
SetWindowTheme
IsThemeActive
IsAppThemed
GetThemePartSize
GetThemeTransitionDuration
GetCurrentThemeName
CloseThemeData

iphlpapi

ConvertInterfaceIndexToLuid
ConvertInterfaceLuidToIndex
ConvertInterfaceLuidToNameW
GetAdaptersAddresses
ConvertInterfaceNameToLuidW
SendARP
GetPerAdapterInfo
GetAdaptersInfo

crypt32

CertGetCertificateContextProperty
CertGetCertificateChain
CertFreeCertificateContext
CertCreateCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertFreeCertificateChain
CertOpenStore

wsock32

listen
getsockname
getpeername
getsockopt

netapi32

NetShareEnum
NetApiBufferFree

userenv

GetUserProfileDirectoryW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

winmm

timeKillEvent
timeSetEvent

kcommon64

ord703
ord805
ord306
ord901
ord902
ord802
ord104
ord303
ord202
ord204
ord3
ord508
ord201
ord507
ord503
ord505
ord903
ord101
ord1102
ord203
ord8
ord6
ord301
ord801
ord1101
ord302
ord1103
ord1107
ord1111
ord1113
ord102
ord103
ord1109
ord1112
ord506
ord803
ord2

setupapi

SetupOpenInfFileW
SetupGetStringFieldW
SetupFindFirstLineW
SetupFindNextMatchLineW
SetupCloseInfFile
SetupGetFieldCount
SetupGetLineCountW
SetupGetLineTextW
SetupGetLineByIndexW

winhttp

WinHttpSetTimeouts
WinHttpReceiveResponse
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpen
WinHttpSendRequest
WinHttpQueryDataAvailable
WinHttpCrackUrl
WinHttpConnect
WinHttpCloseHandle
WinHttpOpenRequest

Sections

.text
Size: - Virtual size: 19.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 8.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 493KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 865KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmetad
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gxfg
Size: - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gehcont
Size: - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

./p~
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.f:#
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Sz|
Size: 14.5MB - Virtual size: 14.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

72f9f9f178a8ca1ae08d859c95c8e6a8

Headers

DLL Characteristics

File Characteristics

Imports

imm32

oleaut32

shlwapi

rpcrt4

gdi32

dwmapi

comdlg32

ws2_32

ole32

advapi32

user32

kernel32

shell32

wtsapi32

uxtheme

iphlpapi

crypt32

wsock32

netapi32

userenv

version

winmm

kcommon64

setupapi

winhttp

Sections

.text Size: - Virtual size: 19.1MB

.rdata Size: - Virtual size: 8.7MB

.data Size: - Virtual size: 493KB

.pdata Size: - Virtual size: 865KB

.qtmetad Size: - Virtual size: 1KB

_RDATA Size: - Virtual size: 528B

.gxfg Size: - Virtual size: 14KB

.gehcont Size: - Virtual size: 28B

./p~ Size: - Virtual size: 1.3MB

.f:# Size: 7KB - Virtual size: 6KB

.Sz| Size: 14.5MB - Virtual size: 14.5MB

.reloc Size: 512B - Virtual size: 200B

.rsrc Size: 45KB - Virtual size: 45KB

.text
Size: - Virtual size: 19.1MB

.rdata
Size: - Virtual size: 8.7MB

.data
Size: - Virtual size: 493KB

.pdata
Size: - Virtual size: 865KB

.qtmetad
Size: - Virtual size: 1KB

_RDATA
Size: - Virtual size: 528B

.gxfg
Size: - Virtual size: 14KB

.gehcont
Size: - Virtual size: 28B

./p~
Size: - Virtual size: 1.3MB

.f:#
Size: 7KB - Virtual size: 6KB

.Sz|
Size: 14.5MB - Virtual size: 14.5MB

.reloc
Size: 512B - Virtual size: 200B

.rsrc
Size: 45KB - Virtual size: 45KB