259a5815c68f4eedea90682b0959b785d98c65f75372c656fc44cac0ab5f73c1

Sharing

Copy URL Twitter E-mail

General

Target

259a5815c68f4eedea90682b0959b785d98c65f75372c656fc44cac0ab5f73c1
Size

3.3MB
MD5

b240c3c2bb32cdf9e5f1e6b4c0356fb2
SHA1

359541d69b99de5648b16cc2aa2e4e7eebf2883c
SHA256

259a5815c68f4eedea90682b0959b785d98c65f75372c656fc44cac0ab5f73c1
SHA512

825033f708cd72cd7270fb99009ee37134809c4c1746e8b33e03f42ac2e129dd9217c21b595383e35595c50c1d6886f161844b91edfd011a967b03ccf4223932
SSDEEP

49152:9GfL0OkBpEnuVnNgzM9NUv1Tqu3Skm9g18rsjJx:dBOufgzM9vLKurcJx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
259a5815c68f4eedea90682b0959b785d98c65f75372c656fc44cac0ab5f73c1

Files

259a5815c68f4eedea90682b0959b785d98c65f75372c656fc44cac0ab5f73c1
.exe windows:6 windows x86

35491d7b14ca9f251619d0ba4e940107

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegOpenKeyExW
RegGetValueW
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA

ws2_32

sendto
gethostbyname
recvfrom
freeaddrinfo
getaddrinfo
WSAIoctl
socket
setsockopt
WSAStartup
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
accept
listen
recv
WSASetLastError
ioctlsocket
gethostname
send
htonl
ntohl
select
__WSAFDIsSet
WSAGetLastError
WSACleanup
bind

crypt32

CertFreeCertificateContext

wldap32

ord60
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord45
ord46
ord211
ord143

normaliz

IdnToAscii

kernel32

GetCommandLineW
CreateFileA
ReadFile
WriteFile
GetTempPathA
OutputDebugStringW
DecodePointer
CloseHandle
RaiseException
GetLastError
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeW
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
Sleep
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessA
OpenProcess
FindResourceExW
GetModuleFileNameA
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetStdHandle
GetFileAttributesA
GetCurrentThreadId
GetDynamicTimeZoneInformation
WriteConsoleA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetCurrentProcess
GetModuleHandleW
GetProcAddress
lstrcpyW
lstrcatW
AreFileApisANSI
SetLastError
FormatMessageA
FreeLibrary
GetTickCount64
EnterCriticalSection
LeaveCriticalSection
SleepEx
VerSetConditionMask
GetSystemDirectoryA
LockResource
LoadLibraryA
VerifyVersionInfoA
WaitForSingleObjectEx
GetFileType
PeekNamedPipe
WaitForMultipleObjects
ExpandEnvironmentStringsA
GetACP
MultiByteToWideChar
CreateFileW
GetFileSize
GetTickCount
LoadLibraryW
GlobalUnlock
GlobalLock
lstrlenW
GlobalAlloc
MulDiv
ExitProcess
CreateDirectoryW
GetFileAttributesW
LocalFileTimeToFileTime
SetFilePointer
SetFileTime
SystemTimeToFileTime
LocalFree
FormatMessageW
InitializeCriticalSectionAndSpinCount
GetVersionExW
GetLocalTime
lstrcmpiW
lstrcpynW
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
GetCPInfo
QueryPerformanceCounter
TryEnterCriticalSection
GetExitCodeThread
GetCurrentThread
SwitchToThread
DuplicateHandle
CreateHardLinkW
CopyFileW
SetFilePointerEx
SetEndOfFile
GetFileInformationByHandle
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
FindClose
WideCharToMultiByte
GetModuleFileNameW
FindResourceW
GetCurrentDirectoryW
LoadResource
FreeResource
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
SizeofResource
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
LoadLibraryExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
GetModuleHandleExW
WriteConsoleW
ExitThread
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
SetEnvironmentVariableW
RemoveDirectoryW
MoveFileExW
DeleteFileW
GetConsoleMode
ReadConsoleW
GetConsoleCP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetFileSizeEx
GetTimeZoneInformation
SetStdHandle
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleHandleA

user32

TrackPopupMenu
AppendMenuW
EnableMenuItem
DestroyMenu
CreatePopupMenu
GetWindowRgn
MoveWindow
UpdateLayeredWindow
IsWindowEnabled
SetWindowRgn
SetRect
FillRect
DrawTextW
CreateCaret
GetPropW
ClientToScreen
GetSystemMetrics
EnableWindow
ShowWindow
GetClassInfoExW
RegisterClassExW
RegisterClassW
CallWindowProcW
DefWindowProcW
UpdateWindow
GetMonitorInfoW
GetCaretBlinkTime
HideCaret
SetCaretPos
CharPrevW
GetCaretPos
EqualRect
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
MapVirtualKeyExW
SetForegroundWindow
wsprintfA
ShowCaret
LoadIconW
wsprintfW
PostQuitMessage
DrawTextA
CreateAcceleratorTableW
InvalidateRgn
SetPropW
GetGUIThreadInfo
MonitorFromWindow
LoadImageW
GetWindow
GetParent
SetWindowPos
MessageBoxW
SetCursor
InflateRect
UnionRect
OffsetRect
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
PostMessageW
CreateWindowExW
IsWindow
DestroyWindow
IsWindowVisible
IsIconic
IsZoomed
CharNextW
SetFocus
GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
SetTimer
KillTimer
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetClientRect
GetWindowRect
GetCursorPos
ScreenToClient
MapWindowPoints
GetSysColor
IntersectRect
GetKeyboardLayout
GetKeyNameTextW
IsRectEmpty
PtInRect
GetWindowLongW
SetWindowLongW

gdi32

GetEnhMetaFileHeader
PlayEnhMetaFile
SelectObject
GetTextMetricsW
CreateEnhMetaFileW
SetWindowOrgEx
AddFontMemResourceEx
GetStockObject
GetDeviceCaps
GetObjectW
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
CreateRoundRectRgn
CreateSolidBrush
GetCharABCWidthsW
SaveDC
GetTextExtentPoint32W
LineTo
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
CreateDIBSection
GetObjectA
MoveToEx
TextOutW
GdiFlush
CreateRectRgn
PtInRegion
CreatePatternBrush
GetTextExtentPointA
CreateDIBitmap
CreateCompatibleDC
BitBlt
CloseEnhMetaFile
GetBitmapBits
SetBitmapBits
RestoreDC
Rectangle
GetClipBox
RemoveFontMemResourceEx
CreateCompatibleBitmap

shell32

CommandLineToArgvW
ShellExecuteW
ShellExecuteA
DragQueryFileW

ole32

CreateStreamOnHGlobal
ReleaseStgMedium
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
OleDuplicateData
DoDragDrop
OleLockRunning

oleaut32

VariantInit
SysFreeString
SysAllocString
VariantClear

comctl32

ord17
_TrackMouseEvent
InitCommonControlsEx

gdiplus

GdipAddPathArcI
GdipAddPathLineI
GdipClosePathFigure
GdipDeleteBrush
GdipDeletePath
GdipCreatePath
GdipFree
GdipAlloc
GdipCreateSolidFill
GdipGetImageWidth
GdipCreateLineBrushI
GdipSetLinePresetBlend
GdipCreatePen1
GdipDeletePen
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawPath
GdipFillPath
GdiplusStartup
GdiplusShutdown
GdipAddPathLine
GdipAddPathArc
GdipSetPenMode
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipCloneImage
GdipDisposeImage
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipDrawRectangleI
GdipFillRectangleI
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipCloneBrush
GdipSetStringFormatTrimming
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipDrawImageRectI
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipStartPathFigure
GdipImageGetFrameDimensionsList

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

netapi32

Netbios

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 331KB - Virtual size: 331KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

35491d7b14ca9f251619d0ba4e940107

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

ws2_32

crypt32

wldap32

normaliz

kernel32

user32

gdi32

shell32

ole32

oleaut32

comctl32

gdiplus

imm32

netapi32

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 331KB - Virtual size: 331KB

.data Size: 22KB - Virtual size: 34KB

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.reloc Size: 78KB - Virtual size: 78KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 331KB - Virtual size: 331KB

.data
Size: 22KB - Virtual size: 34KB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

.reloc
Size: 78KB - Virtual size: 78KB