2087eaa6af101fd43a24e9753a2f012f81cc5939089ba92b2a80b4b8a91669d0

Sharing

Copy URL Twitter E-mail

General

Target

2087eaa6af101fd43a24e9753a2f012f81cc5939089ba92b2a80b4b8a91669d0
Size

994KB
MD5

074b696c22913f36fbbca8f528dfd9eb
SHA1

c6b9f76d42b99a3cdb251fb9f8a94152b509a9d0
SHA256

2087eaa6af101fd43a24e9753a2f012f81cc5939089ba92b2a80b4b8a91669d0
SHA512

3c216f73cfabb679486e00b19ba40f996e6d88e8a9d5cf505be08b188981b6d260a6a32ac43324f325f9b66c5e4bf49b6b501c776868d347473d2f43e26c2b25
SSDEEP

24576:JrOhd9NJtVOEHIePt3tOE1ptzyCvDtzAQacJcxnTjGWuv+6Kr/r:UNjOEHIePt3tOE1ptzyCvDtzAFcJoTjx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2087eaa6af101fd43a24e9753a2f012f81cc5939089ba92b2a80b4b8a91669d0

Files

2087eaa6af101fd43a24e9753a2f012f81cc5939089ba92b2a80b4b8a91669d0
.exe windows:5 windows x86

0a555fa7fed02028ccaab384026043bf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
GetCurrentDirectoryA
GetDriveTypeA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
HeapDestroy
HeapCreate
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
SetUnhandledExceptionFilter
VirtualQuery
GetSystemInfo
HeapSize
ExitProcess
CreateThread
ExitThread
HeapReAlloc
GetUserDefaultUILanguage
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
OutputDebugStringW
ProcessIdToSessionId
IsWow64Process
GetEnvironmentVariableW
GetTimeFormatW
GetDateFormatW
GetTempFileNameW
GetTempPathW
GetProcessHeap
RaiseException
RtlUnwind
HeapAlloc
HeapFree
GetStartupInfoW
GetFileTime
GetFileSizeEx
GetTickCount
SetErrorMode
GetCurrentProcess
DuplicateHandle
UnlockFile
LockFile
GlobalFlags
SystemTimeToFileTime
GetThreadLocale
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
InterlockedIncrement
lstrlenA
GetModuleHandleA
VirtualProtect
GetCurrentProcessId
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
LoadLibraryExW
CompareStringA
InterlockedExchange
SuspendThread
SetEvent
ResumeThread
SetThreadPriority
FreeResource
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetVersionExW
CompareStringW
LoadLibraryA
lstrcmpW
GetVersionExA
FileTimeToLocalFileTime
FileTimeToSystemTime
SetLastError
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageW
MulDiv
GetFullPathNameW
GetFileAttributesExW
RemoveDirectoryW
GetVersion
InterlockedDecrement
CreatePipe
CreateEventW
FreeLibrary
GetLongPathNameW
GetShortPathNameW
LoadLibraryW
LocalAlloc
GetWindowsDirectoryW
SetEndOfFile
GetWindowsDirectoryA
LeaveCriticalSection
EnterCriticalSection
GetLocalTime
DeleteCriticalSection
InitializeCriticalSection
GetCurrentThreadId
WideCharToMultiByte
WritePrivateProfileStringW
GetPrivateProfileStringW
MultiByteToWideChar
lstrcpynW
WinExec
GetCommandLineW
CreateMutexW
FindResourceExW
GetPrivateProfileIntW
lstrcpynA
lstrcmpiA
DefineDosDeviceW
SetFilePointer
GetModuleFileNameW
GetLogicalDrives
Sleep
FlushFileBuffers
GetModuleHandleW
GetProcAddress
GetDiskFreeSpaceExW
WriteFile
SetFileAttributesW
GetExitCodeProcess
CreateProcessW
CreateDirectoryW
LocalFree
DeleteFileW
GetDriveTypeW
WaitForSingleObject
CopyFileW
MoveFileExW
lstrcpyW
GetSystemDirectoryW
DeviceIoControl
GetVolumeInformationW
GetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
ReadFile
GetFileSize
CreateFileW
VirtualFree
VirtualAlloc
CloseHandle
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
SizeofResource
GlobalMemoryStatusEx
lstrlenW
GetLastError
MoveFileW
lstrcmpiW
FindResourceW
LoadResource
LockResource

user32

GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
SetActiveWindow
GetLastActivePopup
GetForegroundWindow
GetWindowTextW
GetWindowTextLengthW
SetFocus
IsWindow
GetFocus
RemovePropW
GetPropW
SetPropW
GetClassNameW
GetClassLongW
CallNextHookEx
GetCapture
IsChild
WinHelpW
SendDlgItemMessageA
SendDlgItemMessageW
RegisterWindowMessageW
ValidateRect
GetCursorPos
GetActiveWindow
TranslateMessage
GetMessageW
EndDialog
GetNextDlgTabItem
IsWindowEnabled
CreateDialogIndirectParamW
GetDesktopWindow
GetDC
ReleaseDC
GetKeyNameTextW
MapVirtualKeyW
CheckDlgButton
CheckRadioButton
PostMessageW
SendMessageW
FindWindowW
EnableWindow
wsprintfW
SetDlgItemTextW
UnhookWindowsHookEx
SetWindowsHookExW
MessageBoxW
GetParent
SetTimer
LoadBitmapW
LoadIconW
GetSystemMetrics
SetWindowPos
KillTimer
GetSubMenu
GetMenuItemCount
GetMenuItemID
ExitWindowsEx
SendMessageTimeoutW
GetMenuState
GetWindow
GetWindowRect
GetWindowPlacement
IsIconic
SystemParametersInfoA
IsDlgButtonChecked
IsDialogMessageW
SetWindowTextW
MoveWindow
ShowWindow
CheckMenuItem
EnableMenuItem
ModifyMenuW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
PostQuitMessage
GetWindowThreadProcessId
MapDialogRect
SetWindowContextHelpId
GetAsyncKeyState
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
ClientToScreen
GetWindowDC
BeginPaint
EndPaint
SetCursor
GetSysColorBrush
LoadCursorW
DestroyMenu
CharNextW
CopyAcceleratorTableW
IsRectEmpty
SetRect
IntersectRect
OffsetRect
InvalidateRect
InvalidateRgn
SetCapture
ReleaseCapture
GetNextDlgGroupItem
MessageBeep
CharUpperW
UnregisterClassW
RegisterClipboardFormatW
SetWindowLongW
GetWindowLongW
GetMenu
GetKeyState
SetMenu
SetForegroundWindow
IsWindowVisible
UpdateWindow
GetClientRect
PtInRect
CopyRect
CallWindowProcW
DefWindowProcW
GetDlgCtrlID
EqualRect
ScreenToClient
AdjustWindowRectEx
GetSysColor
RegisterClassW
GetClassInfoW
PostThreadMessageW
GetClassInfoExW
CreateWindowExW
DispatchMessageW

gdi32

GetMapMode
GetTextColor
GetRgnBox
EnumFontFamiliesExW
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
OffsetViewportOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetViewportOrgEx
GetStockObject
DeleteDC
ExtSelectClipRgn
SetViewportExtEx
SetMapMode
GetDeviceCaps
GetClipBox
SetBkColor
GetObjectW
CreateRectRgnIndirect
CreateBitmap
SaveDC
RestoreDC
GetBkColor
SetTextColor

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

IsTextUnicode
CryptGenRandom
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ConvertSidToStringSidW
LookupAccountNameW
SetFileSecurityW
GetFileSecurityW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ChangeServiceConfigW
QueryServiceStatus
RegQueryValueW
RegOpenKeyW
RegEnumKeyW
CryptDecrypt
CryptEncrypt
CryptReleaseContext
CryptExportKey
CryptGenKey
CryptImportKey
CryptAcquireContextW
CryptDestroyKey
DeleteService
StartServiceW
CreateServiceW
RegLoadKeyW
RegUnLoadKeyW
GetUserNameW
RegDeleteValueW
CloseServiceHandle
ControlService
OpenServiceW
OpenSCManagerW
RegDeleteKeyW
FreeSid
SetEntriesInAclW
SetNamedSecurityInfoW
AllocateAndInitializeSid
RegSaveKeyW
RegSaveKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW

shell32

ShellExecuteW
SHGetSpecialFolderPathW
SHGetFileInfoW
ord66
SHGetFolderLocation
SHBrowseForFolderW
SHCreateDirectoryExW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ord155

comctl32

InitCommonControlsEx

shlwapi

PathFindExtensionW
PathFindFileNameW
PathIsDirectoryW
PathFileExistsW
StrCmpIW
StrCmpNIW
SHDeleteKeyW
StrStrIA
StrStrIW
PathStripToRootW
PathIsUNCW
StrCmpNW
StrFormatByteSizeW
StrRChrW
StrChrW
StrToIntW

oledlg

OleUIBusyW

ole32

CLSIDFromString
CLSIDFromProgID
CoGetClassObject
CoTaskMemFree
CoTaskMemAlloc
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CoCreateGuid
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleFlushClipboard
CoRegisterMessageFilter
OleIsCurrentClipboard

oleaut32

SysAllocString
SysFreeString
VariantClear
SysStringLen
SysAllocStringLen
VariantChangeType
VariantInit
VariantCopy
OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy

userenv

GetProfilesDirectoryW

setupapi

SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiGetDeviceInstanceIdW
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiCallClassInstaller
SetupDiGetINFClassW
SetupDiCreateDeviceInfoList
SetupDiCreateDeviceInfoW
SetupDiGetClassDescriptionExW
SetupDiSetDeviceRegistryPropertyW

imagehlp

ImageEnumerateCertificates
ImageGetCertificateData

cryptui

CryptUIWizImport

crypt32

CertFindCertificateInStore
CryptDecodeObjectEx
CertOpenStore
CryptImportPublicKeyInfo
CryptBinaryToStringA
CryptStringToBinaryA
CertCloseStore
CryptStringToBinaryW

ws2_32

closesocket
recv
send
connect
gethostbyname
inet_addr
htons
socket
WSAStartup
WSACleanup

netapi32

NetApiBufferFree
NetUserEnum

wintrust

WinVerifyTrust

wininet

InternetReadFile
HttpQueryInfoW
HttpSendRequestW
InternetOpenW
HttpOpenRequestW
InternetConnectW
InternetCloseHandle

Sections

.text
Size: 537KB - Virtual size: 537KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 218KB - Virtual size: 217KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0a555fa7fed02028ccaab384026043bf

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

userenv

setupapi

imagehlp

cryptui

crypt32

ws2_32

netapi32

wintrust

wininet

Sections

.text Size: 537KB - Virtual size: 537KB

.rdata Size: 162KB - Virtual size: 162KB

.data Size: 16KB - Virtual size: 115KB

.rsrc Size: 218KB - Virtual size: 217KB

.reloc Size: 59KB - Virtual size: 59KB

.text
Size: 537KB - Virtual size: 537KB

.rdata
Size: 162KB - Virtual size: 162KB

.data
Size: 16KB - Virtual size: 115KB

.rsrc
Size: 218KB - Virtual size: 217KB

.reloc
Size: 59KB - Virtual size: 59KB