c19c73d0aaeff16339d6df086e9428bba9a08c47108a85b1fea5cebb98714701

Sharing

Copy URL Twitter E-mail

General

Target

c19c73d0aaeff16339d6df086e9428bba9a08c47108a85b1fea5cebb98714701
Size

4.0MB
MD5

08c6a58c63d68f87bc61b0e962e19e3f
SHA1

bfb471e3b3641b3c7755e53bbac15f7e829a5b86
SHA256

c19c73d0aaeff16339d6df086e9428bba9a08c47108a85b1fea5cebb98714701
SHA512

ba41c06552dbf13c3525229aed0e3904fdbc49a6b4a386fdeab5d25d1177473d5c61ed23ac0249ed48e90199772ec8cad22e6c365c66db4b3072502638427b44
SSDEEP

49152:B24vJ+621o4N6IbjCKb1qZL88PRPyk0CjTne53HDGqtVYghL+/KXTrveRLxD:B22J+y4Nvbjd1qq8yfHDJYgj/vYD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c19c73d0aaeff16339d6df086e9428bba9a08c47108a85b1fea5cebb98714701

Files

c19c73d0aaeff16339d6df086e9428bba9a08c47108a85b1fea5cebb98714701
.exe windows:5 windows x86

6b6b8ce22b749da1ba7e758df02dd0d2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindResourceW
WriteFile
SizeofResource
LoadResource
LockResource
SetCurrentDirectoryW
MulDiv
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetModuleHandleW
GetLastError
GetCurrentProcessId
GetCurrentDirectoryW
FreeLibraryAndExitThread
ExitThread
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
ExpandEnvironmentStringsW
GetTempPathW
WaitForMultipleObjects
GetSystemDirectoryA
SleepEx
ResetEvent
SetEvent
lstrlenA
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
GetFileSizeEx
GetFileInformationByHandle
InterlockedCompareExchange
CreateEventW
LocalFree
LocalAlloc
WideCharToMultiByte
OutputDebugStringA
Sleep
InterlockedDecrement
InterlockedIncrement
CreateFileW
WritePrivateProfileStringW
DeleteFileW
GlobalAlloc
GlobalLock
GlobalUnlock
PeekNamedPipe
MultiByteToWideChar
GetModuleFileNameW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GlobalFree
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
DecodePointer
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetSystemInfo
FormatMessageW
GetVersionExW
GetPrivateProfileStringW
FindClose
CreateDirectoryW
FindFirstFileW
FindNextFileW
MoveFileExW
FileTimeToSystemTime
ReleaseMutex
CreateMutexW
GetTickCount
AreFileApisANSI
FlushInstructionCache
HeapCreate
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FreeResource
GetFullPathNameW
GetLocalTime
GetVersionExA
GetSystemTime
GetModuleHandleA
EncodePointer
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetACP
GetStringTypeW
CompareStringW
LCMapStringW
GetFileType
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
OutputDebugStringW
WaitForSingleObjectEx
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
FlushFileBuffers
WriteConsoleW
SetEndOfFile
ReadFile
GetFileSize
CreateThread
QueryDosDeviceW
GetWindowsDirectoryW
LoadLibraryW
GetLogicalDriveStringsW
lstrcmpiW
CloseHandle
OpenProcess
LoadLibraryA
lstrlenW
SetLastError
GetProcessHeap
HeapFree
HeapAlloc
VirtualFree
VirtualAlloc
GetProcAddress
IsProcessorFeaturePresent
FreeLibrary

user32

GetCursorPos
ScreenToClient
GetClassNameW
DestroyIcon
LoadBitmapW
CreateIconFromResource
LoadImageW
CharNextW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
ClientToScreen
SetRect
EnableMenuItem
GetSysColor
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetSystemMetrics
IsWindowVisible
DrawTextW
SystemParametersInfoA
CharLowerBuffW
MapVirtualKeyA
UpdateLayeredWindow
IsMenu
IsWindowEnabled
CreatePopupMenu
DestroyMenu
GetMenuItemCount
AppendMenuW
TrackPopupMenu
GetMenuInfo
SetMenuInfo
GetMenuItemInfoW
SetMenuContextHelpId
InvalidateRect
GetWindowRect
GetClientRect
GetActiveWindow
GetDlgItem
CreateWindowExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
GetWindowLongW
GetFocus
SetFocus
PtInRect
EqualRect
IsRectEmpty
UnionRect
CopyRect
SetCursor
KillTimer
SetTimer
DestroyWindow
DestroyCursor
LoadCursorW
IntersectRect
LoadStringW
GetKeyState
UnregisterClassW
GetIconInfo
DrawIconEx
OffsetRect
InflateRect
ReleaseDC
GetDC
SendMessageW
ShowWindow
SetWindowPos
SetWindowTextW
IsWindow
EndPaint
BeginPaint
UpdateWindow
ReleaseCapture
SetForegroundWindow
FindWindowW
SetCapture
GetCapture
IsZoomed
IsIconic
SetLayeredWindowAttributes
AnimateWindow
PostQuitMessage
PostMessageW
TrackMouseEvent
MonitorFromWindow
GetMonitorInfoW
GetWindow
GetParent
SetWindowLongW
SystemParametersInfoW
MapWindowPoints

advapi32

RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
ImpersonateLoggedOnUser
RevertToSelf
DuplicateTokenEx
CreateProcessAsUserW
LookupAccountSidW
SetSecurityDescriptorDacl
OpenProcessToken
GetTokenInformation
SetTokenInformation
InitializeSecurityDescriptor

shell32

SHGetPathFromIDListW
SHGetFolderPathW
SHGetSpecialFolderPathW
SHBrowseForFolderW
ShellExecuteW

ole32

OleLockRunning
CLSIDFromString
CoCreateGuid
CLSIDFromProgID
CreateBindCtx
OleInitialize
OleUninitialize
CreateStreamOnHGlobal
CoCreateInstance

shlwapi

PathFileExistsW
StrToIntExW

psapi

EnumProcessModules
GetModuleFileNameExW
EnumProcesses
GetProcessImageFileNameW

crypt32

CryptMsgClose
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CryptMsgGetParam

gdiplus

GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipCreateBitmapFromStream
GdipGetImageEncoders
GdipCreateBitmapFromScan0
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipDrawImageI
GdipBitmapLockBits
GdipCreateBitmapFromFile
GdipGetImageEncodersSize
GdipDrawImageRectI
GdipGraphicsClear
GdipSaveImageToFile

imm32

ImmAssociateContext
ImmGetContext
ImmDestroyContext
ImmCreateContext
ImmReleaseContext

gdi32

GetStockObject
Rectangle
SetViewportOrgEx
GetObjectW
CreateFontIndirectW
SetBkMode
GetViewportOrgEx
StretchBlt
CreateSolidBrush
GetCurrentObject
EnumFontFamiliesExW
GetCharABCWidthsW
GetFontData
GetGlyphOutlineW
GetOutlineTextMetricsW
GetFontUnicodeRanges
GetGlyphIndicesW
GetTextExtentPointI
AddFontMemResourceEx
RemoveFontMemResourceEx
SetTextColor
DeleteDC
DeleteObject
ExtCreateRegion
IntersectClipRect
SelectClipRgn
SelectObject
SetGraphicsMode
SetWorldTransform
GetDeviceCaps
CreateBitmap
EnumFontsW
BitBlt
CreateDIBSection
CreateCompatibleDC
GdiFlush
GetTextFaceW
ExtTextOutW
GetTextMetricsW
SetTextAlign

oleaut32

SysAllocString
SysFreeString

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

ws2_32

ntohs
setsockopt
WSASetLastError
htonl
inet_addr
inet_ntoa
gethostbyaddr
gethostbyname
getservbyport
htons
__WSAFDIsSet
select
recvfrom
sendto
accept
listen
ioctlsocket
gethostname
getsockopt
getsockname
getpeername
connect
recv
bind
socket
closesocket
WSAGetLastError
send
getservbyname
WSAStartup
WSACleanup

usp10

ScriptShape
ScriptFreeCache
ScriptItemize

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 470KB - Virtual size: 469KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 59KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 376B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17.7MB - Virtual size: 17.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6b6b8ce22b749da1ba7e758df02dd0d2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

psapi

crypt32

gdiplus

imm32

gdi32

oleaut32

userenv

ws2_32

usp10

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 470KB - Virtual size: 469KB

.data Size: 59KB - Virtual size: 157KB

.gfids Size: 512B - Virtual size: 376B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 17.7MB - Virtual size: 17.7MB

.reloc Size: 122KB - Virtual size: 121KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 470KB - Virtual size: 469KB

.data
Size: 59KB - Virtual size: 157KB

.gfids
Size: 512B - Virtual size: 376B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 17.7MB - Virtual size: 17.7MB

.reloc
Size: 122KB - Virtual size: 121KB