9a911572eed648c92b76944f09c700de58b427d320e2bf50d0bc84a610d8fcb3

Sharing

Copy URL Twitter E-mail

General

Target

9a911572eed648c92b76944f09c700de58b427d320e2bf50d0bc84a610d8fcb3
Size

3.1MB
MD5

f1a218c63d3249912fffe7cfe4f0143d
SHA1

823e2f62b6ac8dbf122a849090dd65138e5a828a
SHA256

9a911572eed648c92b76944f09c700de58b427d320e2bf50d0bc84a610d8fcb3
SHA512

3a177aea5a0ee72abca1ed7fa6e0ea1bac8dd2846fafe46882e67f9822a8709ae6ecddb7dd8a916e02c3e4869e4009ad6f78ab2529875066255acd3994a33e25
SSDEEP

49152:s41UiurYKU7f2t5ryNYgYggggMKJqYRBafsiLRUD6vWKP/huaCkLzLygIs2wQJJM:3IU7f2jryNwqDdLRUDHghHPLk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9a911572eed648c92b76944f09c700de58b427d320e2bf50d0bc84a610d8fcb3

Files

9a911572eed648c92b76944f09c700de58b427d320e2bf50d0bc84a610d8fcb3
.exe windows:5 windows x86

3ba00efef527ae48fcd1a78ac4454fc6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DecodePointer
InitializeCriticalSectionAndSpinCount
TerminateThread
GetExitCodeThread
CopyFileA
FreeResource
DeleteFileA
GetTempPathA
DeviceIoControl
GetSystemDirectoryA
GetModuleFileNameA
VirtualQuery
WaitForMultipleObjects
GetCommandLineW
GetCurrentProcessId
GetModuleHandleW
FormatMessageW
GlobalAlloc
GetVersionExW
TerminateProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
LocalFree
LocalAlloc
CreateProcessW
LoadLibraryW
lstrcmpiW
GetDriveTypeW
CreateDirectoryA
GetModuleFileNameW
GetLogicalDriveStringsW
GetEnvironmentVariableW
GetCurrentThreadId
Sleep
GetSystemTime
ConvertThreadToFiber
ConvertFiberToThread
GlobalMemoryStatus
CreateFiber
DeleteFiber
SwitchToFiber
SetConsoleMode
ReadConsoleA
RaiseException
SetEvent
CreateEventW
ResetEvent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetTickCount
lstrlenW
GetNativeSystemInfo
FreeLibrary
GetProcAddress
LoadLibraryA
VirtualFree
VirtualAlloc
IsBadReadPtr
VirtualProtect
SetLastError
MultiByteToWideChar
WideCharToMultiByte
FindResourceExW
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SizeofResource
LockResource
LoadResource
FindResourceW
WriteFile
CreateFileA
ReadFile
GetFileSize
CreateFileW
FindClose
FindNextFileW
MoveFileExW
MoveFileW
DeleteFileW
SetFileAttributesW
CreateDirectoryW
GetFileAttributesW
FindFirstFileW
GetCurrentProcess
WaitForSingleObject
CloseHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetFullPathNameW
SetConsoleCtrlHandler
FlushFileBuffers
WriteConsoleW
SetEndOfFile
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
ReadConsoleW
GetLastError
GetFileAttributesExW
SetFilePointerEx
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
GetACP
ExitProcess
MulDiv
SetFilePointer
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
VerSetConditionMask
VerifyVersionInfoW
GetLocalTime
lstrcpynW
InterlockedIncrement
InterlockedDecrement
lstrcpyW
GetModuleHandleA
IsDebuggerPresent
OutputDebugStringW
TryEnterCriticalSection
GetStringTypeW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
QueryPerformanceCounter
QueryPerformanceFrequency
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SleepEx
GetSystemDirectoryW
CompareFileTime
GetEnvironmentVariableA
GetFileType
GetStdHandle
PeekNamedPipe
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
WaitForSingleObjectEx
GetStartupInfoW
InitializeSListHead
SetCurrentDirectoryA
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
LoadLibraryExW
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
RtlUnwind
ExitThread
ResumeThread
GetModuleHandleExW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode

user32

GetFocus
GetKeyState
SetCapture
ReleaseCapture
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetClientRect
GetWindowRect
GetCursorPos
ScreenToClient
MapWindowPoints
GetSysColor
IntersectRect
UnionRect
OffsetRect
IsRectEmpty
PtInRect
GetWindowLongW
SetWindowLongW
GetParent
GetWindow
LoadImageW
MonitorFromWindow
GetMonitorInfoW
wsprintfW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
ShowWindow
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
LoadCursorW
SetCursor
InflateRect
SetWindowRgn
MessageBoxW
UpdateLayeredWindow
MoveWindow
GetWindowRgn
CharPrevW
DrawTextW
FillRect
SetRect
CreatePopupMenu
DestroyMenu
EnableMenuItem
AppendMenuW
TrackPopupMenu
CreateCaret
GetCaretBlinkTime
SetFocus
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
EqualRect
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
IsWindowEnabled
wsprintfA
DrawTextA
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
SetForegroundWindow
GetKeyboardLayout
GetKeyNameTextW
MapVirtualKeyExW
PrivateExtractIconsW
DestroyIcon
DrawIconEx
GetUserObjectInformationW
GetProcessWindowStation
CharNextW
IsIconic
IsWindowVisible
SetWindowPos
DestroyWindow
IsWindow
CreateWindowExW
PostMessageW
SendMessageW
DispatchMessageW
IsZoomed
PostQuitMessage
KillTimer
SetTimer
DefWindowProcW
UpdateWindow
GetMessageW
TranslateMessage
GetActiveWindow
HideCaret

advapi32

RegOpenKeyExW
CryptSignHashW
CryptEnumProvidersW
CryptGenRandom
CryptCreateHash
CryptDecrypt
CryptExportKey
OpenProcessToken
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
GetTokenInformation
LookupAccountSidW
RegSetValueExW
GetUserNameW
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptDestroyHash

shell32

SHGetFileInfoW
ShellExecuteA
DragQueryFileW
SHGetFolderPathW

ole32

OleUninitialize
CoInitializeEx
OleLockRunning
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
ReleaseStgMedium
OleDuplicateData
DoDragDrop
CoCreateInstance

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocString

shlwapi

PathFindFileNameA
PathRemoveFileSpecA
PathCombineW
SHDeleteKeyW
PathRemoveExtensionA
PathFileExistsA
PathFileExistsW
PathRemoveFileSpecW
PathIsDirectoryW
PathFindFileNameW

comctl32

_TrackMouseEvent
InitCommonControlsEx
ord17

gdiplus

GdipFree
GdipCreatePath
GdipDeletePath
GdipAddPathLine
ord1
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipCloneImage
GdipDisposeImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipDrawRectangleI
GdipDrawPath
GdipAlloc
GdipFillPath
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipDrawImageRectI
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdiplusShutdown
GdipFillRectangleI
GdiplusStartup
GdipSetStringFormatTrimming

imm32

ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext

ws2_32

WSAIoctl
socket
accept
htonl
listen
WSACleanup
WSASetLastError
shutdown
ioctlsocket
gethostname
WSAStartup
__WSAFDIsSet
select
getaddrinfo
freeaddrinfo
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
recvfrom
sendto
getnameinfo
gethostbyname
closesocket
recv
send
WSAGetLastError
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

psapi

EnumProcesses
GetProcessImageFileNameW

urlmon

ObtainUserAgentString

gdi32

GetBitmapBits
SetBitmapBits
GetObjectA
SetTextColor
SetStretchBltMode
StretchBlt
SetBkMode
SetBkColor
ExtSelectClipRgn
SelectClipRgn
LineTo
GetTextExtentPoint32W
GetTextExtentPointA
GetClipBox
GetCharABCWidthsW
CreateSolidBrush
CreatePatternBrush
CreatePenIndirect
CombineRgn
CreateDIBSection
PtInRegion
CreateRectRgn
CreateRoundRectRgn
SetWindowOrgEx
GetObjectW
GetTextMetricsW
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateEnhMetaFileW
CloseEnhMetaFile
SelectObject
SaveDC
RestoreDC
Rectangle
RemoveFontMemResourceEx
AddFontMemResourceEx
GdiFlush
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateDIBitmap
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
TextOutW
CreateRectRgnIndirect
MoveToEx

crypt32

CertOpenSystemStoreW
CertDuplicateCertificateContext
CertFindCertificateInStore
CertGetCertificateContextProperty
CertCloseStore
CertGetIntendedKeyUsage
CertOpenStore
CertGetEnhancedKeyUsage
CertEnumCertificatesInStore
CertFreeCertificateContext

wldap32

ord145
ord219
ord46
ord14
ord216
ord208
ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord117
ord26
ord27
ord41

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 568KB - Virtual size: 568KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 194KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3ba00efef527ae48fcd1a78ac4454fc6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

imm32

ws2_32

version

psapi

urlmon

gdi32

crypt32

wldap32

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 568KB - Virtual size: 568KB

.data Size: 47KB - Virtual size: 74KB

.rsrc Size: 194KB - Virtual size: 194KB

.reloc Size: 108KB - Virtual size: 108KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 568KB - Virtual size: 568KB

.data
Size: 47KB - Virtual size: 74KB

.rsrc
Size: 194KB - Virtual size: 194KB

.reloc
Size: 108KB - Virtual size: 108KB