46d20fa82c936c5784f86106838697ab79a1f6dc243ae6721b42f0da467eaf52

Sharing

Copy URL Twitter E-mail

General

Target

46d20fa82c936c5784f86106838697ab79a1f6dc243ae6721b42f0da467eaf52
Size

4.1MB
MD5

2112360f64fc1673da60f8a75d4935b7
SHA1

47285d8372ca733ead51821a91c53b5e4c53c21b
SHA256

46d20fa82c936c5784f86106838697ab79a1f6dc243ae6721b42f0da467eaf52
SHA512

e636e367ab657c8733fd4d8b88a4e14179ae20038d4f99a467df3a1637a1eac2c3a533e215ad8bd871b462fd5b958286c7dd2f740d71e303d437a91e2e7e4e93
SSDEEP

49152:IrikU8U73UvGfoPHfDsUcBqbizSKjGdsmyK9hci7GrSI/8wjIC5F:IrirYPHfDszqGmSKIHSI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
46d20fa82c936c5784f86106838697ab79a1f6dc243ae6721b42f0da467eaf52

Files

46d20fa82c936c5784f86106838697ab79a1f6dc243ae6721b42f0da467eaf52
.exe windows:6 windows x64

6527ba1a9bd228adfc615c9d8b65347d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
LoadLibraryA
GetProcAddress
CreateDirectoryW
GetCurrentProcess
GetUserDefaultUILanguage
GetTimeZoneInformation
GetTickCount64
LoadLibraryW
SetCurrentDirectoryW
GetModuleHandleW
CopyFileW
QueryFullProcessImageNameW
GetComputerNameA
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
InitializeCriticalSection
LeaveCriticalSection
LockFile
GetCurrentDirectoryW
ReadConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetConsoleCtrlHandler
GetConsoleMode
GetConsoleOutputCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
OutputDebugStringA
FlsFree
FlsSetValue
FlsGetValue
GetFileSize
GetCurrentThread
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
SetStdHandle
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
InterlockedFlushSList
InterlockedPushEntrySList
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetFileSizeEx
VerifyVersionInfoW
VerSetConditionMask
SleepEx
WaitForMultipleObjects
PeekNamedPipe
GetFileType
GetStdHandle
GetEnvironmentVariableA
MoveFileExA
SetLastError
GetModuleHandleA
FreeLibrary
GetSystemDirectoryA
QueryPerformanceFrequency
TerminateProcess
InitializeSListHead
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetCPInfo
CompareStringEx
GetStringTypeW
LCMapStringEx
GetLocaleInfoEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
DeleteCriticalSection
LockFileEx
LocalFree
CreateFileMappingA
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
GetSystemInfo
CloseHandle
HeapReAlloc
DeleteFileW
DeleteFileA
GetVersionExA
WaitForSingleObjectEx
CreateFileA
OutputDebugStringW
FlushViewOfFile
GetFileAttributesExW
GetFileAttributesA
GetLastError
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetVersionExW
GetCurrentThreadId
GetFileAttributesW
CreateFileW
FlsAlloc
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
EnterCriticalSection
HeapFree
HeapCreate
TryEnterCriticalSection
ReadFile
AreFileApisANSI
WaitForSingleObject
GetDateFormatW
WriteConsoleW
RtlUnwind

user32

SetWindowPlacement
SetWindowPos
SetWindowRgn
SetWindowTextW
SetWindowsHookExW
ShowCaret
ShowCursor
ShowWindow
SystemParametersInfoA
SystemParametersInfoW
ToUnicodeEx
TrackMouseEvent
TrackPopupMenu
TranslateMessage
UnhookWinEvent
UnhookWindowsHookEx
UnloadKeyboardLayout
UnregisterClassW
UnregisterDeviceNotification
UnregisterPowerSettingNotification
UpdateLayeredWindow
SetWindowLongW
ValidateRect
WaitForInputIdle
WindowFromPoint
wsprintfW
DialogBoxParamW
TranslateAcceleratorW
SwitchToThisWindow
LoadAcceleratorsW
EndDialog
SetWindowLongPtrW
RemovePropW
ReleaseDC
ReleaseCapture
RegisterWindowMessageW
RegisterTouchWindow
RegisterRawInputDevices
RegisterPowerSettingNotification
RegisterDeviceNotificationW
RegisterClipboardFormatW
RegisterClassW
RegisterClassExW
RedrawWindow
ReplyMessage
SetTimer
SetThreadDesktop
SetSysColors
SetRectEmpty
SetRect
SetPropW
SetParent
SetMenuItemInfoW
SetKeyboardState
SetGestureConfig
SetForegroundWindow
SetFocus
SetCursorPos
SetCursor
SetClassLongPtrW
SetClassLongA
SetCaretPos
SetCapture
SendNotifyMessageW
SendMessageW
SendMessageTimeoutW
SendInput
UpdateWindow
ScreenToClient
BeginPaint
ActivateKeyboardLayout
AdjustWindowRectEx
AnimateWindow
BringWindowToTop
CallNextHookEx
CallWindowProcW
CharLowerW
ClientToScreen
CloseClipboard
CloseDesktop
CloseGestureInfoHandle
CloseTouchInputHandle
CreateCaret
CreateIconIndirect
CreateWindowExW
DefWindowProcW
DestroyCaret
DestroyIcon
DestroyWindow
DispatchMessageW
DrawEdge
DrawFocusRect
DrawFrameControl
EnableWindow
EndPaint
EnumChildWindows
EnumDisplayDevicesW
EnumDisplayMonitors
EnumDisplaySettingsExW
EnumDisplaySettingsW
EnumThreadWindows
EnumWindows
EqualRect
FillRect
FindWindowExW
QueryDisplayConfig
PtInRect
PrintWindow
PostQuitMessage
PostMessageW
PeekMessageW
OpenInputDesktop
OpenClipboard
NotifyWinEvent
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MonitorFromWindow
MonitorFromPoint
MessageBoxW
MessageBeep
MapWindowPoints
MapVirtualKeyExW
FindWindowW
FlashWindowEx
FrameRect
GetActiveWindow
GetAncestor
GetCapture
LoadStringW
LoadKeyboardLayoutA
LoadImageW
LoadIconW
LoadCursorW
KillTimer
IsWindowVisible
IsWindowEnabled
IsWindow
IsRectEmpty
IsIconic
IsClipboardFormatAvailable
InvalidateRect
IntersectRect
InflateRect
InSendMessageEx
InSendMessage
GetCaretBlinkTime
GetClassInfoW
GetWindowThreadProcessId
GetWindowTextW
GetWindowTextLengthW
GetWindowRgn
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindowLongPtrW
GetWindowDC
GetWindow
GetUserObjectInformationW
GetUpdateRect
GetTouchInputInfo
GetTopWindow
GetThreadDesktop
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetRawInputDeviceList
GetRawInputDeviceInfoW
GetRawInputDeviceInfoA
GetRawInputData
GetQueueStatus
GetPropW
GetParent
GetMonitorInfoW
GetMessageW
GetMessageTime
GetMessagePos
GetMessageExtraInfo
GetMenu
GetLayeredWindowAttributes
GetLastInputInfo
GetKeyboardState
GetKeyboardLayoutNameW
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetIconInfo
GetGestureInfo
GetGUIThreadInfo
GetForegroundWindow
GetFocus
GetDoubleClickTime
GetDlgItem
GetDisplayConfigBufferSizes
GetDC
GetCursorPos
GetCursorInfo
GetClipboardData
GetClientRect
GetClassNameW
GetClassLongPtrW
SetWinEventHook

comdlg32

ChooseColorW
PrintDlgExW

advapi32

CryptEncrypt
RegQueryValueExW
RegOpenKeyExW
CheckTokenMembership
FreeSid
RegSetValueExW
RegCreateKeyExW
AllocateAndInitializeSid
RegCloseKey
CryptImportKey
CryptDestroyKey
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash

shell32

ShellExecuteW
ShellExecuteExW
SetCurrentProcessExplicitAppUserModelID
SHQueryUserNotificationState
SHParseDisplayName
SHOpenWithDialog
SHOpenFolderAndSelectItems
SHGetStockIconInfo
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
SHGetSpecialFolderLocation
SHGetPropertyStoreForWindow
SHGetPathFromIDListW
SHGetKnownFolderPath
SHGetFolderPathW
SHGetFileInfoW
SHCreateItemFromParsingName
SHChangeNotify
SHAppBarMessage
SHAddToRecentDocs
DragQueryFileW
CommandLineToArgvW
GetCurrentProcessExplicitAppUserModelID
Shell_NotifyIconW

ws2_32

getsockopt
gethostname
ioctlsocket
getpeername
sendto
recvfrom
freeaddrinfo
getaddrinfo
recv
listen
htonl
getsockname
connect
bind
accept
select
__WSAFDIsSet
socket
htons
WSAIoctl
setsockopt
WSACleanup
WSAStartup
WSASetLastError
ntohs
WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSASetEvent
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertOpenStore

version

GetFileVersionInfoW
GetFileVersionInfoSizeW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

imm32

ImmAssociateContextEx
ImmGetCompositionFontW
ImmGetCompositionStringA
ImmGetCompositionStringW
ImmGetContext
ImmGetDefaultIMEWnd
ImmGetIMEFileNameW
ImmGetOpenStatus
ImmGetProperty
ImmNotifyIME
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionFontW
ImmSetCompositionWindow
ImmSetOpenStatus
ImmGetDescriptionW

bcrypt

BCryptGenRandom

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 331KB - Virtual size: 330KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 580KB - Virtual size: 591KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6527ba1a9bd228adfc615c9d8b65347d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

comdlg32

advapi32

shell32

ws2_32

crypt32

version

wintrust

imm32

bcrypt

Sections

.text Size: 3.0MB - Virtual size: 3.0MB

.rdata Size: 331KB - Virtual size: 330KB

.data Size: 580KB - Virtual size: 591KB

.pdata Size: 113KB - Virtual size: 113KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 30KB - Virtual size: 30KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 3.0MB - Virtual size: 3.0MB

.rdata
Size: 331KB - Virtual size: 330KB

.data
Size: 580KB - Virtual size: 591KB

.pdata
Size: 113KB - Virtual size: 113KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 30KB - Virtual size: 30KB

.reloc
Size: 8KB - Virtual size: 7KB