a72dfaae5425c0d121265a9fb77341741587071486887b68f2d8c4ecf6645141

Sharing

Copy URL Twitter E-mail

General

Target

a72dfaae5425c0d121265a9fb77341741587071486887b68f2d8c4ecf6645141
Size

6.1MB
MD5

46d438510b2b477739d192b3a53ee878
SHA1

b06ac98a56f82f5949ecbf94b25adf4d0303257f
SHA256

a72dfaae5425c0d121265a9fb77341741587071486887b68f2d8c4ecf6645141
SHA512

8fa9022400c2b4fdff91142d28482f82c2db444474a36a030322715dfed724a1e9c34b1817bdda9040f1be754271b8f1bfc53dfc22f4d51d3e8205a5126aee64
SSDEEP

98304:X6dE+r7+7IWzR16MoIw1fEOAWrzxm1hEV9pw0clIuU:X6P4zHO1MOAWrNK29pw03

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a72dfaae5425c0d121265a9fb77341741587071486887b68f2d8c4ecf6645141

Files

a72dfaae5425c0d121265a9fb77341741587071486887b68f2d8c4ecf6645141
.exe windows:5 windows x86

13f135d1f77d09843895ec6e9e468085

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLongPathNameW
OpenProcess
SetEndOfFile
GetDiskFreeSpaceExW
SetFileAttributesW
DeleteFileW
MoveFileExW
GetVolumeInformationW
GetFileAttributesExW
GetCurrentProcess
OpenThread
lstrcmpA
lstrcmpiW
GetModuleHandleExW
GlobalSize
GlobalLock
GlobalUnlock
SystemTimeToFileTime
GetModuleHandleA
GetVersionExW
GetBinaryTypeW
ProcessIdToSessionId
InterlockedIncrement
GetCommandLineW
GetFileInformationByHandle
GetStdHandle
SetFileTime
GetCurrentDirectoryW
CreateDirectoryW
GetFileAttributesW
GlobalMemoryStatus
GetProcessAffinityMask
IsProcessorFeaturePresent
ReleaseSemaphore
GetLocalTime
GetFileSizeEx
FindClose
LocalFree
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
MapViewOfFile
GetCurrentThreadId
LoadLibraryW
CreateFileMappingW
UnmapViewOfFile
InterlockedCompareExchange
GetPrivateProfileStringW
GetPrivateProfileIntW
FindResourceExW
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetConsoleCP
FlushFileBuffers
ReadConsoleW
GetConsoleMode
GetTimeZoneInformation
GlobalAlloc
GetFileType
ExitProcess
ExitThread
RtlUnwind
InterlockedDecrement
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
DuplicateHandle
FindResourceW
OutputDebugStringW
SetFilePointer
WriteFile
SizeofResource
LoadResource
GetProcessHeap
HeapSize
HeapDestroy
LockResource
CreateProcessW
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcessId
WideCharToMultiByte
MultiByteToWideChar
GetTimeFormatW
GetDateFormatW
SetThreadAffinityMask
LoadLibraryExW
GetProcAddress
GetModuleHandleW
FreeLibrary
VirtualFree
VirtualProtect
VirtualAlloc
GetSystemDirectoryW
GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo
GetThreadTimes
TerminateProcess
CreateSemaphoreW
Sleep
CreateEventW
CreateMutexW
WaitForSingleObjectEx
WaitForSingleObject
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
FreeLibraryAndExitThread
GetCurrentThread
UnregisterWait
RegisterWaitForSingleObject
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
GetSystemWindowsDirectoryW
FreeResource
lstrcmpiA
InitializeSListHead
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetEnvironmentVariableW
GetACP
MulDiv
VerSetConditionMask
VerifyVersionInfoW
ReleaseMutex
HeapWalk
HeapUnlock
HeapLock
CreateFileA
LocalFileTimeToFileTime
LCMapStringW
CompareStringW
FormatMessageW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
QueryPerformanceFrequency
QueryPerformanceCounter
GetCPInfo
TryEnterCriticalSection
GetStringTypeW
IsDebuggerPresent
GlobalFree
SetFilePointerEx
LeaveCriticalSection
EnterCriticalSection
DeviceIoControl
HeapFree
HeapReAlloc
HeapAlloc
SetErrorMode
SetLastError
GetLastError
RaiseException
CloseHandle
ReadFile
FindNextFileW
FindFirstFileW
CreateFileW

user32

IsWindow
DestroyWindow
ShowWindow
GetWindowLongW
SetWindowLongW
AttachThreadInput
IsIconic
BringWindowToTop
SetActiveWindow
GetForegroundWindow
SetForegroundWindow
FindWindowW
GetWindowThreadProcessId
GetDesktopWindow
DrawTextW
SetClipboardData
EmptyClipboard
GetAsyncKeyState
GetSysColor
ClientToScreen
SetCursor
IntersectRect
UnionRect
EqualRect
MonitorFromPoint
PtInRect
OffsetRect
IsZoomed
GetCursorPos
GetKeyState
ScreenToClient
SetWindowRgn
UpdateLayeredWindow
IsRectEmpty
GetUpdateRect
MoveWindow
EndPaint
BeginPaint
InvalidateRect
ReleaseCapture
SetCapture
GetFocus
GetDC
CallWindowProcW
RegisterClassW
LoadCursorW
ReleaseDC
SetWindowPos
IsWindowVisible
OpenClipboard
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
SetWindowTextW
CharNextW
EnableWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
PostMessageW
SetFocus
GetMonitorInfoW
MonitorFromWindow
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
CharUpperW
SendMessageW
PostQuitMessage
SetTimer
KillTimer
GetSystemMetrics
GetClientRect
GetWindowRect
MapWindowPoints
GetParent
GetWindow
LoadImageW

advapi32

RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
RegSetValueExW
RegOpenKeyW
CloseServiceHandle
RegQueryInfoKeyW
RegEnumKeyExW
ConvertSidToStringSidW
GetUserNameW
GetTokenInformation
OpenProcessToken
RegEnumKeyExA
OpenSCManagerW
EnumServicesStatusW

shell32

ord165
CommandLineToArgvW
SHGetSpecialFolderPathW
SHBrowseForFolderW
ShellExecuteW
SHGetFolderPathW
SHGetPathFromIDListW

ole32

CoUninitialize
CoInitializeEx
CoCreateInstance
CreateStreamOnHGlobal
CoTaskMemFree
CoInitialize
CoTaskMemRealloc
OleInitialize
OleUninitialize
CoCreateGuid
CoTaskMemAlloc

oleaut32

SysAllocString
VariantClear
SysFreeString
VarUI4FromStr
SysStringLen
SysAllocStringLen

shlwapi

PathIsRelativeW
SHSetValueW
PathRemoveExtensionW
StrStrIA
SHGetValueA
SHSetValueA
PathRemoveBackslashW
PathIsPrefixW
PathIsDirectoryW
PathFileExistsW
PathAppendW
PathCombineW
PathFindFileNameW
StrCmpIW
StrCmpNIW
StrStrIW
PathRemoveFileSpecW
SHGetValueW
PathCanonicalizeW
StrTrimA
PathAddBackslashW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

psapi

GetModuleFileNameExW

comctl32

InitCommonControlsEx
ord17
_TrackMouseEvent

winmm

timeKillEvent
timeSetEvent

gdiplus

GdipGetPropertyItem
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetPixelOffsetMode
GdipCreatePath
GdipDeletePath
GdipAddPathPath
GdipImageSelectActiveFrame
GdipDeleteBrush
GdipCloneBrush
GdipSetPathGradientPresetBlend
GdipSetPathGradientWrapMode
GdipAlloc
GdipDeleteRegion
GdipSetPathGradientFocusScales
GdiplusStartup
GdipFillRegion
GdipCloneImage
GdipCreatePathGradientFromPath
GdipGetPropertyItemSize
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateBitmapFromScan0
GdipCreatePen1
GdipDeletePen
GdipDrawArc
GdipCreateLineBrushFromRect
GdipSetLineBlend
GdipCreatePen2
GdipCreateMatrix
GdipDeleteMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipSetWorldTransform
GdipDrawImageRect
GdipImageRotateFlip
GdiplusShutdown
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromStream
GdipCreateRegionPath
GdipLoadImageFromFile
GdipMeasureString
GdipFillEllipse
GdipDrawEllipse
GdipDrawString
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipCloneStringFormat
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawPath
GdipDrawRectangleI
GdipDrawLineI
GdipCreateLineBrushFromRectI
GdipFillPath
GdipCreateSolidFill
GdipDrawImageRectRectI
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipFree
GdipClosePathFigure
ord1
GdipAddPathLine
GdipAddPathEllipse
GdipAddPathRectangle
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipDisposeImage
GdipGetWorldTransform

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

msimg32

AlphaBlend

iphlpapi

GetAdaptersInfo

wininet

HttpOpenRequestW
HttpSendRequestW
InternetConnectW
InternetCloseHandle
InternetCrackUrlW
InternetOpenW
InternetSetOptionW
HttpQueryInfoW

gdi32

DeleteObject
CreateRoundRectRgn
BitBlt
GetStockObject
CreateFontIndirectW
GetDeviceCaps
GetWindowOrgEx
CreateRectRgnIndirect
SaveDC
ExtSelectClipRgn
RestoreDC
CreateDIBSection
CreateCompatibleDC
SelectObject
DeleteDC
SetWindowOrgEx
SetStretchBltMode
StretchBlt
SetTextColor
SetBkColor
SetBkMode
GetObjectA
GetObjectW

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 262KB - Virtual size: 261KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16.4MB - Virtual size: 16.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

13f135d1f77d09843895ec6e9e468085

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

psapi

comctl32

winmm

gdiplus

imm32

msimg32

iphlpapi

wininet

gdi32

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 262KB - Virtual size: 261KB

.data Size: 42KB - Virtual size: 70KB

.rsrc Size: 16.4MB - Virtual size: 16.4MB

.reloc Size: 70KB - Virtual size: 69KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 262KB - Virtual size: 261KB

.data
Size: 42KB - Virtual size: 70KB

.rsrc
Size: 16.4MB - Virtual size: 16.4MB

.reloc
Size: 70KB - Virtual size: 69KB