fa562e5a1d38ec881601e71db662b1c60b89c1512bfeedbe4ddd66473d2e5431

Sharing

Copy URL

Twitter E-mail

General

Target

fa562e5a1d38ec881601e71db662b1c60b89c1512bfeedbe4ddd66473d2e5431
Size

3.8MB
MD5

d1e9a6dca4015fae1d54eada16beeeec
SHA1

913c73021049d99a656230540debbe472785b1ce
SHA256

fa562e5a1d38ec881601e71db662b1c60b89c1512bfeedbe4ddd66473d2e5431
SHA512

281a50d276ab8c8fbd8245a68545f166a7c91a65071313440811837c260d4e898699e91c6d6b2e0cfab3cc55e98cab30725ed85aa35e16764cc773d02f8955b5
SSDEEP

49152:InmZh2Dsow/LE5vQRcu9V4ZPzwFI/wOifnzH:I6h2Do4RPYtH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa562e5a1d38ec881601e71db662b1c60b89c1512bfeedbe4ddd66473d2e5431

Files

fa562e5a1d38ec881601e71db662b1c60b89c1512bfeedbe4ddd66473d2e5431
.exe windows:6 windows x86

157c83e1a1bbc0ed52d7ae0e076389dd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

magnification

MagSetWindowSource
MagUninitialize
MagSetWindowTransform
MagInitialize

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification

kernel32

Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
lstrcmpiW
OpenProcess
FreeLibrary
lstrcpynW
SetFileAttributesW
GetLastError
GetFileAttributesW
FindFirstFileW
FindClose
CreateMutexW
ReleaseMutex
InterlockedIncrement
InterlockedDecrement
SetEndOfFile
HeapSize
ReadConsoleW
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
HeapFree
HeapAlloc
FindNextFileW
WriteConsoleW
GetModuleHandleExW
GetFileType
GetStdHandle
GetCommandLineA
GetLocalTime
RtlUnwind
RaiseException
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
WaitForSingleObjectEx
GetCPInfo
GetLocaleInfoW
LCMapStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
GetProcAddress
GetModuleHandleW
IsWow64Process
GetThreadPriority
SetThreadPriority
GetCurrentThread
GetCurrentProcess
OpenEventW
ResetEvent
lstrcatW
CreateProcessW
ExitThread
CreateThread
CreateEventW
WaitForSingleObject
SetEvent
CloseHandle
lstrlenW
QueryPerformanceFrequency
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
Sleep
lstrcpyW
lstrcmpW
GetSystemDirectoryW
WriteFile
SetFilePointer
ReadFile
ExitProcess
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DecodePointer
EncodePointer
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
QueryFullProcessImageNameW
MapViewOfFileEx
GlobalAlloc
GlobalFree
CreateFileMappingW
GetSystemInfo
UnmapViewOfFile
K32GetModuleFileNameExW
K32EnumProcessModules
OpenThread
GetCommandLineW
GetModuleHandleA
GetVersionExW
GetUserDefaultUILanguage
QueryPerformanceCounter
MulDiv
LoadLibraryW
FormatMessageW
GetCurrentThreadId
GetCurrentProcessId
VerifyVersionInfoW
LoadLibraryExW
GetModuleFileNameW
SetLastError
OutputDebugStringW
GetFullPathNameW
ExpandEnvironmentStringsW
VerSetConditionMask
LocalFree
CreateFileW
LocalAlloc
GlobalLock
GlobalUnlock
FreeResource
GetTickCount
GetSystemWindowsDirectoryW
CopyFileW
GetFileSize

user32

GetPhysicalCursorPos
ClientToScreen
PtInRect
SendMessageTimeoutW
IsWindowVisible
EnumWindows
SetWinEventHook
UnhookWinEvent
SetWindowPos
GetWindowPlacement
SetWindowPlacement
IsIconic
IntersectRect
GetClientRect
DefWindowProcW
RegisterClassW
CreateWindowExW
ShowWindow
SetLayeredWindowAttributes
BeginPaint
EndPaint
InvalidateRect
InflateRect
SetWindowLongW
LoadCursorW
SystemParametersInfoW
GetParent
GetWindowRect
PostMessageW
GetWindow
GetClassLongW
GetWindowLongW
IsDlgButtonChecked
CheckDlgButton
GetLayeredWindowAttributes
DestroyWindow
FindWindowW
GetAsyncKeyState
GetMessageW
TranslateMessage
IsWindowEnabled
GetDlgItem
SendMessageW
wsprintfW
EnumDisplayMonitors
CopyRect
UnionRect
CloseDesktop
CharUpperW
UnhookWindowsHookEx
SetWindowsHookExW
PostThreadMessageW
CheckMenuRadioItem
GetSysColorBrush
InsertMenuItemW
TrackPopupMenu
CreatePopupMenu
OffsetRect
IsRectEmpty
GetMonitorInfoW
MonitorFromRect
DestroyIcon
ReleaseDC
GetDC
IsWindow
GetWindowThreadProcessId
FindWindowExW
EqualRect
WaitForInputIdle
SetRectEmpty
MsgWaitForMultipleObjects
RegisterDeviceNotificationW
PeekMessageW
LoadIconW
UpdateWindow
GetMenuItemInfoW
AppendMenuW
CheckMenuItem
CreateMenu
SetMenu
GetSystemMetrics
RegisterClassExW
WindowFromPoint
OpenInputDesktop
GetActiveWindow
UnregisterHotKey
RegisterHotKey
GetDesktopWindow
SetCursorPos
DialogBoxParamW
CreateDialogParamW
IsZoomed
MoveWindow
ShowWindowAsync
GetCursorPos
GetWindowTextW
SetForegroundWindow
GetForegroundWindow
KillTimer
SetTimer
UnregisterClassW
PostQuitMessage
DispatchMessageW
MessageBoxW
CharLowerW
GetSysColor
LoadImageW
ValidateRect
GetClassNameW
DrawIconEx
GetAncestor
MonitorFromPoint
SetProcessDPIAware
LoadStringW
DisplayConfigGetDeviceInfo
EnumDisplayDevicesW
EnumDisplaySettingsW
EnumDisplaySettingsExW
RegisterWindowMessageW

gdi32

SetBrushOrgEx
StrokeAndFillPath
EndPath
BeginPath
GetDIBits
CreatePen
BitBlt
GetDeviceCaps
CreateCompatibleBitmap
CreateFontIndirectW
DeleteObject
GetStockObject
GetTextExtentPoint32W
LineTo
RoundRect
SelectObject
SetDCBrushColor
SetDCPenColor
SetBkMode
SetTextColor
MoveToEx
TextOutW
CreateCompatibleDC
DeleteDC
StretchBlt
GetObjectW
CreateSolidBrush
SetStretchBltMode

advapi32

RegOpenCurrentUser
GetUserNameW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
SetEntriesInAclW
RegQueryInfoKeyW
RegQueryValueExW
RegEnumKeyExW
RegEnumKeyW
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
RegOpenKeyW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCopyTreeW
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
RegSetValueExW
SetSecurityDescriptorDacl

shell32

SHCreateShellItemArrayFromShellItem
ExtractIconExW
SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHGetFolderPathW
ShellExecuteW
ExtractIconW
Shell_NotifyIconW
CommandLineToArgvW
SHCreateItemFromParsingName

ole32

StringFromGUID2
CoCreateInstance
CoInitialize
CLSIDFromString
CreateStreamOnHGlobal
CoUninitialize

oleaut32

SysAllocString
SysFreeString
OleLoadPicture

shlwapi

StrRStrIW
ord487
SHCopyKeyW
StrStrIW
SHDeleteKeyW

gdiplus

GdipStartPathFigure
GdipClosePathFigure
GdipAddPathArcI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawPath
GdipFillPath
GdiplusStartup
GdiplusShutdown
GdipDeletePath
GdipCreatePath
GdipLoadImageFromFile
GdipDisposeImage
GdipCloneImage
GdipSetSmoothingMode
GdipDrawArcI
GdipDrawRectangleI
GdipFillRectangleI
GdipDrawImageRect
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipFree
GdipAlloc
GdipSetPenWidth
GdipCreatePen2
GdipCreateBitmapFromHICON

dwmapi

DwmGetWindowAttribute
DwmIsCompositionEnabled

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

Sections

.text
Size: 510KB - Virtual size: 509KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 592KB - Virtual size: 596KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

157c83e1a1bbc0ed52d7ae0e076389dd

Headers

DLL Characteristics

File Characteristics

Imports

magnification

wtsapi32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

dwmapi

version

api-ms-win-core-winrt-string-l1-1-0

Sections

.text Size: 510KB - Virtual size: 509KB

.rdata Size: 130KB - Virtual size: 129KB

.data Size: 10KB - Virtual size: 24KB

.rsrc Size: 2.6MB - Virtual size: 2.6MB

.reloc Size: 592KB - Virtual size: 596KB

.text
Size: 510KB - Virtual size: 509KB

.rdata
Size: 130KB - Virtual size: 129KB

.data
Size: 10KB - Virtual size: 24KB

.rsrc
Size: 2.6MB - Virtual size: 2.6MB

.reloc
Size: 592KB - Virtual size: 596KB