f46956648da066ca09e9fb5a54e5f1de02bcb8898592deb48cb2619b79e2abf0

Sharing

Copy URL Twitter E-mail

General

Target

f46956648da066ca09e9fb5a54e5f1de02bcb8898592deb48cb2619b79e2abf0
Size

4.8MB
MD5

f3c341f506a54fac4ffd770aff17af3b
SHA1

af3493d197e91442275e9c1936519c976d1e5104
SHA256

f46956648da066ca09e9fb5a54e5f1de02bcb8898592deb48cb2619b79e2abf0
SHA512

390051923ea9e61a0d44270f3669bdf3232a8480e7d39657f92729b95facf28a1ccd8571e449f0bb678034d203d1f73c61ef7e7ad3acbd562854ce3767a94abe
SSDEEP

98304:RF2ouyrhLrvZhAPP7eBoURpZf9YX+QZiCvKl7WNhbOp1S7sjXqnmd3g:2Vyr3hUeJc1QWNhKpM7sjX3d3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f46956648da066ca09e9fb5a54e5f1de02bcb8898592deb48cb2619b79e2abf0

Files

f46956648da066ca09e9fb5a54e5f1de02bcb8898592deb48cb2619b79e2abf0
.dll windows:5 windows x86

940a833b815224dd8d1c555cf9d4aad2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

socket
connect
freeaddrinfo
getaddrinfo
sendto
closesocket
accept
listen
__WSAFDIsSet
select
ioctlsocket
gethostname
shutdown
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
send
recv
recvfrom
WSASetLastError
WSAStartup
WSACleanup
WSAGetLastError

advapi32

GetUserNameW
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
LookupAccountSidW
GetTokenInformation
AdjustTokenPrivileges
RegQueryValueW
LookupPrivilegeValueW
OpenProcessToken
StartServiceW
ControlService
QueryServiceStatus
RegisterEventSourceA
ReportEventA
DeregisterEventSource
QueryServiceConfig2W
RegEnumKeyW
QueryServiceConfigW
RegSaveKeyW
EnumServicesStatusW
RegEnumKeyExW
LookupAccountNameW
CloseServiceHandle
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegOpenKeyW
RegCreateKeyW
OpenSCManagerW
OpenServiceW
GetSidSubAuthority

shlwapi

PathFileExistsW
StrCmpIW
StrStrW
StrCmpW
ord437
StrStrIW
PathFindFileNameW
PathFindExtensionW
PathFileExistsA
PathRemoveFileSpecW
PathCombineW
SHGetValueW
PathIsDirectoryW
PathIsUNCW
PathStripToRootW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

kernel32

FlushFileBuffers
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetTempPathW
GetTempFileNameW
LocalFree
lstrcmpA
DeleteFileA
MoveFileExA
FormatMessageA
DeleteCriticalSection
SleepEx
PeekNamedPipe
CreatePipe
GetStdHandle
LoadLibraryA
ExpandEnvironmentStringsA
GetCurrentThreadId
GetModuleHandleA
GetVersion
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
FindFirstFileA
SystemTimeToFileTime
GetSystemTime
FlushConsoleInputBuffer
GlobalUnlock
GlobalLock
GetVersionExA
CompareStringW
LoadLibraryW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
MulDiv
FormatMessageW
GlobalSize
InterlockedDecrement
InterlockedExchange
CompareStringA
EnumResourceLanguagesW
ConvertDefaultLocale
GetCurrentThread
SetThreadPriority
ResumeThread
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
InterlockedIncrement
GlobalGetAtomNameW
lstrcpyW
GetCurrentDirectoryW
WritePrivateProfileStringW
LockFile
UnlockFile
DuplicateHandle
GetVolumeInformationW
GetFullPathNameW
GetFileAttributesW
GetProfileIntW
SearchPathW
GetFileTime
VirtualProtect
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
CreateThread
WriteConsoleW
GetCommandLineA
GetFileInformationByHandle
GetDriveTypeA
CreateFileA
ExitProcess
SetConsoleCtrlHandler
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
RtlUnwind
RaiseException
HeapSize
VirtualAlloc
VirtualQuery
SetStdHandle
GetConsoleCP
SetHandleCount
GetStartupInfoA
HeapCreate
HeapDestroy
SetEndOfFile
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
LCMapStringW
GetModuleFileNameA
LCMapStringA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFullPathNameA
GetCurrentDirectoryA
GetProcessHeap
WriteConsoleA
GetConsoleOutputCP
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetEnvironmentVariableA
lstrlenW
lstrlenA
MultiByteToWideChar
GetPrivateProfileStringW
GetFileSizeEx
GetComputerNameExW
GetVersionExW
FreeResource
WaitForMultipleObjects
GetFileAttributesExW
GetDiskFreeSpaceW
GetLogicalDriveStringsW
GetSystemDirectoryW
LocalAlloc
SystemTimeToTzSpecificLocalTime
lstrcmpW
GetModuleFileNameW
FileTimeToSystemTime
FileTimeToLocalFileTime
ReadProcessMemory
GetCurrentProcess
GetModuleHandleW
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetDiskFreeSpaceExW
GlobalMemoryStatusEx
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
FindClose
FindNextFileW
RemoveDirectoryW
FindFirstFileW
DeleteFileW
CloseHandle
WriteFile
SetFilePointer
ReadFile
GetFileSize
CopyFileW
GetEnvironmentVariableW
CreateDirectoryW
FindResourceW
LoadResource
LockResource
SizeofResource
GetUserDefaultLCID
GetLocaleInfoW
WideCharToMultiByte
GlobalFree
GlobalAlloc
LoadLibraryExW
GetProcAddress
FreeLibrary
GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo
TerminateProcess
GetProcessTimes
Sleep
InitializeCriticalSectionAndSpinCount
HeapFree
HeapReAlloc
HeapAlloc
SetErrorMode
SetLastError
GetLastError
CreateFileW
MoveFileExW
FindResourceExW
VirtualFree
GetStartupInfoW
GetFileType

user32

CreateMenu
IsClipboardFormatAvailable
GetUpdateRect
GetDoubleClickTime
GetIconInfo
IsCharLowerW
MapVirtualKeyExW
SubtractRect
DestroyCursor
GetNextDlgGroupItem
MapDialogRect
DrawIcon
GetWindowRgn
GetMessageW
TranslateMessage
ValidateRect
PostQuitMessage
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetWindowThreadProcessId
InvalidateRect
FillRect
DrawStateW
SystemParametersInfoW
DestroyMenu
GetMenuItemInfoW
InflateRect
MapVirtualKeyW
GetKeyNameTextW
GetMenuStringW
AppendMenuW
InsertMenuW
RemoveMenu
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
GetMenuState
CheckMenuItem
MoveWindow
SetWindowTextW
IsDialogMessageW
IsDlgButtonChecked
CheckDlgButton
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
TranslateMDISysAccel
DispatchMessageW
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
UpdateWindow
GetMenuItemID
GetMenuItemCount
MessageBoxW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
CopyRect
GetMenu
SetWindowLongW
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetWindowLongW
GetDlgItem
IsWindowEnabled
GetParent
GetNextDlgTabItem
EndDialog
GetDC
ReleaseDC
MessageBoxA
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
LoadBitmapW
EnableMenuItem
LoadIconW
GetSystemMetrics
PostMessageW
ShowWindow
SetTimer
KillTimer
GetSubMenu
LoadMenuW
GetCursorPos
GetClientRect
IsWindowVisible
SendMessageW
EnableWindow
DrawMenuBar
DefMDIChildProcW
DefFrameProcW
WaitMessage
PostThreadMessageW
CharUpperBuffW
CopyIcon
FrameRect
RegisterClipboardFormatW
EmptyClipboard
CloseClipboard
SetClipboardData
LoadImageW
CopyImage
OpenClipboard
LockWindowUpdate
SetCursorPos
CreateAcceleratorTableW
GetKeyboardState
GetKeyboardLayout
ToUnicodeEx
CopyAcceleratorTableW
DrawFocusRect
DrawFrameControl
DrawEdge
DrawIconEx
SetClassLongW
DestroyAcceleratorTable
SetParent
SetRect
UnpackDDElParam
ReuseDDElParam
LoadAcceleratorsW
InsertMenuItemW
BringWindowToTop
TranslateAcceleratorW
DestroyIcon
GetMenuDefaultItem
SetMenuDefaultItem
CreatePopupMenu
IsMenu
UpdateLayeredWindow
EnableScrollBar
UnionRect
IsRectEmpty
CharUpperW
IsZoomed
GetAsyncKeyState
NotifyWinEvent
MessageBeep
ReleaseCapture
WindowFromPoint
SetCapture
RedrawWindow
SetWindowRgn
GetSystemMenu
DeleteMenu
SetRectEmpty
LoadCursorW
GetSysColorBrush
UnregisterClassW
ShowOwnedPopups
GetLastActivePopup
SetCursor
PtInRect

gdi32

SetBkColor
SetTextColor
GetClipBox
CreateBitmap
CopyMetaFileW
CreateRectRgnIndirect
PatBlt
CreateFontIndirectW
CreateCompatibleDC
BitBlt
ExtTextOutW
GetTextExtentPoint32W
CreateSolidBrush
GetStockObject
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetMapMode
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
SetTextAlign
GetObjectW
TextOutW
RectVisible
PtVisible
GetDCOrgEx
GetDeviceCaps
CreateCompatibleBitmap
GetPixel
SelectClipRgn
DeleteObject
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
SelectPalette
GetObjectType
CreatePen
CreateHatchBrush
GetTextMetricsW
SetRectRgn
CombineRgn
DPtoLP
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
CreateRoundRectRgn
CreateDIBSection
GetBkColor
CreatePolygonRgn
GetTextColor
CreateEllipticRgn
Polyline
Ellipse
Polygon
GetViewportExtEx
OffsetRgn
GetRgnBox
SetDIBColorTable
RealizePalette
StretchBlt
SetPixel
Rectangle
RoundRect
CreatePalette
GetPaletteEntries
ExtFloodFill
SetPaletteEntries
GetWindowOrgEx
GetViewportOrgEx
LPtoDP
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
GetNearestPaletteIndex
GetSystemPaletteEntries
EnumFontFamiliesExW
GetTextFaceW
SetPixelV
CreateRectRgn
GetWindowExtEx

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

shell32

SHGetSpecialFolderPathW
ShellExecuteW
SHAppBarMessage
SHGetFileInfoW
DragFinish
DragQueryFileW
SHGetPathFromIDListW
SHBrowseForFolderW

comctl32

ImageList_GetIconSize

ole32

ReleaseStgMedium
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid
OleDuplicateData
CoCreateInstance
CreateStreamOnHGlobal
DoDragDrop
CoUninitialize
CoInitializeEx
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleLockRunning
StringFromGUID2
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleGetClipboard

oleaut32

SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantInit
VariantChangeType
VariantClear

gdiplus

GdipCloneImage
GdipDrawImageI
GdipGetImageGraphicsContext
GdiplusShutdown
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipGetImagePixelFormat

dbghelp

MiniDumpWriteDump

setupapi

SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDescriptionW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
CM_Enumerate_Classes
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstanceIdW
CM_Get_DevNode_Status

crypt32

CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CryptQueryObject
CryptMsgGetParam
CertFindCertificateInStore
CryptDecodeObject

imm32

ImmGetOpenStatus
ImmReleaseContext
ImmGetContext

winmm

PlaySoundW

Exports

Exports

UIModuleClose
UIModuleCreate
UIModuleExecute
UIModuleGetCount
UIModuleGetInfo
UIModuleInit
UIModuleNotify
UIModuleStart
UIModuleStop
libssh2_banner_set
libssh2_base64_decode
libssh2_channel_close
libssh2_channel_direct_tcpip_ex
libssh2_channel_eof
libssh2_channel_flush_ex
libssh2_channel_forward_accept
libssh2_channel_forward_cancel
libssh2_channel_forward_listen_ex
libssh2_channel_free
libssh2_channel_get_exit_signal
libssh2_channel_get_exit_status
libssh2_channel_handle_extended_data
libssh2_channel_handle_extended_data2
libssh2_channel_open_ex
libssh2_channel_process_startup
libssh2_channel_read_ex
libssh2_channel_receive_window_adjust
libssh2_channel_receive_window_adjust2
libssh2_channel_request_pty_ex
libssh2_channel_request_pty_size_ex
libssh2_channel_send_eof
libssh2_channel_set_blocking
libssh2_channel_setenv_ex
libssh2_channel_wait_closed
libssh2_channel_wait_eof
libssh2_channel_window_read_ex
libssh2_channel_window_write_ex
libssh2_channel_write_ex
libssh2_channel_x11_req_ex
libssh2_exit
libssh2_free
libssh2_hostkey_hash
libssh2_init
libssh2_keepalive_config
libssh2_keepalive_send
libssh2_knownhost_add
libssh2_knownhost_addc
libssh2_knownhost_check
libssh2_knownhost_checkp
libssh2_knownhost_del
libssh2_knownhost_free
libssh2_knownhost_get
libssh2_knownhost_init
libssh2_knownhost_readfile
libssh2_knownhost_readline
libssh2_knownhost_writefile
libssh2_knownhost_writeline
libssh2_poll
libssh2_poll_channel_read
libssh2_scp_recv
libssh2_scp_send64
libssh2_scp_send_ex
libssh2_session_abstract
libssh2_session_banner_get
libssh2_session_banner_set
libssh2_session_block_directions
libssh2_session_callback_set
libssh2_session_disconnect_ex
libssh2_session_flag
libssh2_session_free
libssh2_session_get_blocking
libssh2_session_get_timeout
libssh2_session_handshake
libssh2_session_hostkey
libssh2_session_init_ex
libssh2_session_last_errno
libssh2_session_last_error
libssh2_session_method_pref
libssh2_session_methods
libssh2_session_set_blocking
libssh2_session_set_timeout
libssh2_session_startup
libssh2_session_supported_algs
libssh2_sftp_close_handle
libssh2_sftp_fstat_ex
libssh2_sftp_fstatvfs
libssh2_sftp_get_channel
libssh2_sftp_init
libssh2_sftp_last_error
libssh2_sftp_mkdir_ex
libssh2_sftp_open_ex
libssh2_sftp_read
libssh2_sftp_readdir_ex
libssh2_sftp_rename_ex
libssh2_sftp_rmdir_ex
libssh2_sftp_seek
libssh2_sftp_seek64
libssh2_sftp_shutdown
libssh2_sftp_stat_ex
libssh2_sftp_statvfs
libssh2_sftp_symlink_ex
libssh2_sftp_tell
libssh2_sftp_tell64
libssh2_sftp_unlink_ex
libssh2_sftp_write
libssh2_trace
libssh2_trace_sethandler
libssh2_userauth_authenticated
libssh2_userauth_hostbased_fromfile_ex
libssh2_userauth_keyboard_interactive_ex
libssh2_userauth_list
libssh2_userauth_password_ex
libssh2_userauth_publickey
libssh2_userauth_publickey_fromfile_ex

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 641KB - Virtual size: 641KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 59KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 21B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 214KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

940a833b815224dd8d1c555cf9d4aad2

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

advapi32

shlwapi

version

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

shell32

comctl32

ole32

oleaut32

gdiplus

dbghelp

setupapi

crypt32

imm32

winmm

Exports

Exports

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 641KB - Virtual size: 641KB

.data Size: 59KB - Virtual size: 96KB

.tls Size: 512B - Virtual size: 21B

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.reloc Size: 214KB - Virtual size: 213KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 641KB - Virtual size: 641KB

.data
Size: 59KB - Virtual size: 96KB

.tls
Size: 512B - Virtual size: 21B

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

.reloc
Size: 214KB - Virtual size: 213KB