0c4361eccafe632281701737d868914c574d297d2cb4918b85429c89fafd6d89

Sharing

Copy URL Twitter E-mail

General

Target

0c4361eccafe632281701737d868914c574d297d2cb4918b85429c89fafd6d89
Size

1.6MB
MD5

fbb409ec3b82ea3971b159ec157e82a8
SHA1

6b8d20d0f4475b30f68fa754eddddbe2aa195674
SHA256

0c4361eccafe632281701737d868914c574d297d2cb4918b85429c89fafd6d89
SHA512

cd051b128026d250d58ad3e242e364e52079e71f47c2f20f5a93d5d065acb233dbc2eb4368490bb9c2e084b7a37d28ea8f13dfec54f085ca7ac0bbfdaef34e27
SSDEEP

12288:7BCDLCqgA49rIM/fqH/9pb9IqiZlbaL96rE6hxkQoCtKlIe/:7ADLCO4fq79Iqihrolh/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c4361eccafe632281701737d868914c574d297d2cb4918b85429c89fafd6d89

Files

0c4361eccafe632281701737d868914c574d297d2cb4918b85429c89fafd6d89
.exe windows:5 windows x86

b76f7afe72cf144571041a45dbdfd2ab

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

vDbgPrintExWithPrefix

advapi32

GetUserNameW
RegCloseKey
RegCreateKeyExW
RegCreateKeyW
RegDeleteValueW
RegEnumValueW
RegOpenKeyExW
RegOpenKeyW
RegQueryInfoKeyW
RegQueryValueExW

browseui

ord106
ord107

comctl32

CreatePropertySheetPageW
ord328
ord329
ord385
ord334
ImageList_Create
ImageList_Destroy
ImageList_GetIconSize
ImageList_LoadImageW
ImageList_Remove
ImageList_ReplaceIcon
ImageList_SetIconSize
InitCommonControls
PropertySheetW

kernel32

CloseHandle
CreateEventW
CreateMutexW
CreateProcessW
CreateSemaphoreW
CreateThread
DeleteCriticalSection
DeleteFileW
DuplicateHandle
EnterCriticalSection
ExpandEnvironmentStringsW
FindClose
FindFirstFileW
FindNextFileW
FindResourceW
FlushInstructionCache
FreeLibrary
GetBinaryTypeW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeProcess
GetLastError
GetLocalTime
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetSystemTimeAsFileTime
GetTickCount
GetTimeFormatW
GetUserDefaultLangID
GetWindowsDirectoryW
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
LoadResource
LocalAlloc
LocalFree
LocalReAlloc
LockResource
MapViewOfFile
MulDiv
OpenEventW
OpenProcess
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReleaseMutex
ReleaseSemaphore
SetCurrentDirectoryW
SetEvent
SetLastError
SetProcessShutdownParameters
SetUnhandledExceptionFilter
SizeofResource
Sleep
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WriteFile

msvcrt

__dllonexit
__lconv_init
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_beginthreadex
_cexit
_exit
_fpreset
_initterm
_iob
_itoa
_itow
_lock
_onexit
_snprintf
_snwprintf
_unlock
_vsnprintf
_vsnwprintf
_wcmdln
abort
bsearch
calloc
exit
free
fwrite
malloc
memcmp
memmove
memset
raise
realloc
signal
sprintf
strcat
strchr
strcmp
strcpy
strcspn
strncmp
strrchr
vfprintf
vsprintf
wcscat
wcschr
wcscmp
wcscpy
wcslen
wcsncpy

ole32

CLSIDFromString
CoCreateInstance
OleInitialize
OleLoadFromStream
OleUninitialize

oleaut32

SysAllocString
SysFreeString

shell32

ord60
ord660
ILClone
ILFindLastID
ILFree
ILRemoveLastID
IsUserAnAdmin
ord54
ord181
ord61
SHCloneSpecialIDList
ord723
ord91
SHFindFiles
SHFree
SHGetDesktopFolder
SHGetFolderPathW
SHGetPathFromIDListA
SHGetSpecialFolderPathW
SHRestricted
ShellExecuteExW
ShellExecuteW
Shell_MergeMenus

shlwapi

ord164
ord172
ord173
ord174
SHGetValueW
ord279
SHOpenRegStreamW
SHSetValueW
ord165
wnsprintfW

uxtheme

CloseThemeData
DrawThemeBackground
DrawThemeParentBackground
GetThemeColor
GetThemeFont
GetThemeMargins
GetThemePartSize
IsAppThemed
IsThemeActive
IsThemeBackgroundPartiallyTransparent
OpenThemeData
SetWindowTheme

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

gdi32

CreateFontIndirectW
CreateRectRgnIndirect
CreateSolidBrush
DeleteObject
GetObjectW
GetStockObject
GetTextExtentPointW
Rectangle
SelectObject
SetBkMode
SetTextColor
TextOutW

user32

AppendMenuW
BeginDeferWindowPos
BeginPaint
CallWindowProcW
CascadeWindows
CheckDlgButton
CheckMenuItem
ChildWindowFromPoint
ChildWindowFromPointEx
ClientToScreen
CreatePopupMenu
CreateWindowExW
DefWindowProcW
DeferWindowPos
DeleteMenu
DestroyMenu
DestroyWindow
DialogBoxParamW
DispatchMessageW
DrawFrameControl
EnableMenuItem
EnableWindow
EndDeferWindowPos
EndDialog
EndPaint
EnumWindows
EqualRect
FillRect
FindWindowW
GetAncestor
GetClassLongW
GetClassNameW
GetClientRect
GetCursorPos
GetDC
GetDCEx
GetDesktopWindow
GetDlgItem
GetForegroundWindow
GetKeyState
GetLastActivePopup
GetMenuItemCount
GetMenuItemInfoW
GetMessageTime
GetMessageW
GetMonitorInfoW
GetParent
GetShellWindow
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMenu
GetSystemMetrics
GetWindow
GetWindowDC
GetWindowInfo
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowThreadProcessId
InflateRect
InternalGetWindowText
IntersectRect
InvalidateRect
IsChild
IsDlgButtonChecked
IsIconic
IsRectEmpty
IsWindow
IsWindowEnabled
IsWindowVisible
KillTimer
LoadBitmapW
LoadCursorW
LoadIconW
LoadImageW
LoadMenuW
LoadStringW
MapWindowPoints
MessageBoxW
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
MsgWaitForMultipleObjects
OffsetRect
PeekMessageW
PostMessageW
PostQuitMessage
PostThreadMessageW
PtInRect
RegisterClassExW
RegisterHotKey
RegisterWindowMessageW
ReleaseDC
RemoveMenu
ScreenToClient
SendMessageCallbackW
SendMessageTimeoutW
SendMessageW
SendNotifyMessageW
SetFocus
SetForegroundWindow
SetMenuItemInfoW
SetTimer
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowRgn
SetWindowTextW
ShowWindow
ShowWindowAsync
SwitchToThisWindow
SystemParametersInfoW
TileWindows
TrackPopupMenuEx
TranslateMessage

Sections

.text
Size: 234KB - Virtual size: 234KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ATL
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rossym
Size: 332KB - Virtual size: 332KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b76f7afe72cf144571041a45dbdfd2ab

Headers

File Characteristics

Imports

ntdll

advapi32

browseui

comctl32

kernel32

msvcrt

ole32

oleaut32

shell32

shlwapi

uxtheme

version

gdi32

user32

Sections

.text Size: 234KB - Virtual size: 234KB

.data Size: 2KB - Virtual size: 1KB

ATL Size: 512B - Virtual size: 8B

.rdata Size: 46KB - Virtual size: 46KB

.bss Size: - Virtual size: 5KB

.idata Size: 10KB - Virtual size: 10KB

.CRT Size: 512B - Virtual size: 52B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 1.0MB - Virtual size: 1.0MB

.rossym Size: 332KB - Virtual size: 332KB

.text
Size: 234KB - Virtual size: 234KB

.data
Size: 2KB - Virtual size: 1KB

ATL
Size: 512B - Virtual size: 8B

.rdata
Size: 46KB - Virtual size: 46KB

.bss
Size: - Virtual size: 5KB

.idata
Size: 10KB - Virtual size: 10KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

.rossym
Size: 332KB - Virtual size: 332KB