Copy of !Winterz Ext Aim[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Copy of !Winterz Ext Aim.exe
Size

1.1MB
MD5

025a869fc310a75b43865432ea28b84f
SHA1

f9d0186cf38a36d59d35624f31cc96e217225de7
SHA256

43f8466f8db1ac139086ae957a4484fddb2b54c3837a400bd4717921f0ec26ef
SHA512

5e7abd4b1836667302a79e24bbbb15fb443f5f1cbc6a0ff7283d08f8f3d8084e19423e64ced12bfe51fcd19dbc7b8de2bf1a8be10fb91ba4ec116ed71f245391
SSDEEP

24576:VYvStvDdqOt9TnBVGxBXe3uI//E4JPij/gce:VYKtvpHCLoXDPiN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Copy of !Winterz Ext Aim.exe

Files

Copy of !Winterz Ext Aim.exe
.exe windows:6 windows x64

e67166c1cfd1333d3807ce3c0a6f5260

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

xinput1_3

ord2

opencv_world452

??1Net@dnn4_v20210301@dnn@cv@@QEAA@XZ
?getLayerNames@Net@dnn4_v20210301@dnn@cv@@QEBA?AV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@XZ
?forward@Net@dnn4_v20210301@dnn@cv@@QEAAXAEBV_OutputArray@4@AEBV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z
?haveOpenCL@ocl@cv@@YA_NXZ
?setPreferableTarget@Net@dnn4_v20210301@dnn@cv@@QEAAXH@Z
?setInput@Net@dnn4_v20210301@dnn@cv@@QEAAXAEBV_InputArray@4@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@NAEBV?$Scalar_@N@4@@Z
?getUnconnectedOutLayers@Net@dnn4_v20210301@dnn@cv@@QEBA?AV?$vector@HV?$allocator@H@std@@@std@@XZ
?noArray@cv@@YAAEBV_InputOutputArray@1@XZ
?NMSBoxes@dnn4_v20210301@dnn@cv@@YAXAEBV?$vector@V?$Rect_@H@cv@@V?$allocator@V?$Rect_@H@cv@@@std@@@std@@AEBV?$vector@MV?$allocator@M@std@@@5@MMAEAV?$vector@HV?$allocator@H@std@@@5@MH@Z
??0Mat@cv@@QEAA@HHHPEAX_K@Z
??0Mat@cv@@QEAA@AEBV01@@Z
??0Mat@cv@@QEAA@XZ
??1Mat@cv@@QEAA@XZ
??4Mat@cv@@QEAAAEAV01@$$QEAV01@@Z
?useOpenCL@ocl@cv@@YA_NXZ
?getCudaEnabledDeviceCount@cuda@cv@@YAHXZ
?minMaxLoc@cv@@YAXAEBV_InputArray@1@PEAN1PEAV?$Point_@H@1@20@Z
??0Net@dnn4_v20210301@dnn@cv@@QEAA@XZ
?readNetFromDarknet@dnn4_v20210301@dnn@cv@@YA?AVNet@123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?blobFromImage@dnn4_v20210301@dnn@cv@@YAXAEBV_InputArray@3@AEBV_OutputArray@3@NAEBV?$Size_@H@3@AEBV?$Scalar_@N@3@_N4H@Z
??0Mat@cv@@QEAA@AEBV01@AEBVRange@1@1@Z
?setUseOpenCL@ocl@cv@@YAX_N@Z
?setPreferableBackend@Net@dnn4_v20210301@dnn@cv@@QEAAXH@Z

kernel32

InitializeCriticalSectionEx
DeleteCriticalSection
VirtualProtect
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleHandleW
QueryFullProcessImageNameW
SetLastError
FormatMessageA
LocalFree
EnterCriticalSection
LeaveCriticalSection
SleepEx
GetSystemDirectoryA
GetTickCount
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
CreateFileA
GetFileSizeEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetProcessHeap
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetLocaleInfoEx
FindClose
GetConsoleWindow
GetCurrentProcessId
CreateThread
CloseHandle
GetLastError
K32GetModuleFileNameExA
CreateMutexA
GetStdHandle
HeapSize
HeapFree
WakeAllConditionVariable
HeapReAlloc
OutputDebugStringW
GetFileInformationByHandleEx
GetCurrentProcess
SetConsoleTitleA
SetConsoleTextAttribute
GetModuleFileNameA
Sleep
QueryPerformanceCounter
FreeLibrary
VerSetConditionMask
CreateFileW
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
HeapAlloc
HeapDestroy
VerifyVersionInfoA
AreFileApisANSI
GetFileAttributesExW
FindFirstFileW

user32

GetClientRect
SetCursor
SetCapture
GetForegroundWindow
TrackMouseEvent
IsChild
ClientToScreen
ScreenToClient
LoadCursorA
GetAsyncKeyState
SendInput
GetSystemMetrics
SetForegroundWindow
GetCapture
SetCursorPos
GetCursorPos
ReleaseCapture
UpdateWindow
RegisterClassExA
PostQuitMessage
UnregisterClassA
PeekMessageA
LoadIconA
GetWindowDC
TranslateMessage
SetFocus
OpenClipboard
CloseClipboard
CreateWindowExA
DefWindowProcA
MessageBoxA
SetWindowTextA
GetWindowTextA
SetWindowLongA
ShowWindow
GetDesktopWindow
GetClassNameA
SetWindowPos
DestroyWindow
GetWindowRect
DispatchMessageA
GetWindow
EmptyClipboard
GetClipboardData
SetClipboardData
FindWindowA

gdi32

CreateCompatibleDC
GetDIBits
DeleteDC
DeleteObject
SelectObject
CreateCompatibleBitmap
BitBlt

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

dwmapi

DwmExtendFrameIntoClientArea

msvcp140

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?setf@ios_base@std@@QEAAHHH@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
_Xtime_get_ticks
_Query_perf_counter
_Thrd_sleep
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Query_perf_frequency
?good@ios_base@std@@QEBA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ

d3d9

Direct3DCreate9Ex

normaliz

IdnToAscii

wldap32

ord60
ord45
ord50
ord41
ord26
ord27
ord46
ord217
ord211
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord143
ord22

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx

ws2_32

closesocket
ntohl
gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
WSAGetLastError
send
recv
socket

rpcrt4

UuidToStringA
UuidCreate
RpcStringFreeA

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate
strstr
__C_specific_handler
strchr
__std_exception_destroy
_CxxThrowException
memchr
memcmp
memcpy
memmove
__current_exception_context
__current_exception
strrchr
memset
__std_exception_copy

api-ms-win-crt-stdio-l1-1-0

_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
fgets
_pclose
_popen
__p__commode
_set_fmode
__acrt_iob_func
_read
fgetc
__stdio_common_vsprintf_s
_write
fflush
fopen
fputs
fclose
feof
fputc
_close
fseek
_get_stream_buffer_pointers
_lseeki64
fwrite
_wfopen
__stdio_common_vsprintf
fread
_open
__stdio_common_vsscanf
ftell

api-ms-win-crt-string-l1-1-0

strcpy_s
strpbrk
tolower
strncpy
strcmp
isupper
strspn
strcspn
_strdup
strncmp

api-ms-win-crt-utility-l1-1-0

rand
qsort

api-ms-win-crt-heap-l1-1-0

_callnewh
calloc
malloc
free
realloc
_set_new_mode

api-ms-win-crt-convert-l1-1-0

atof
strtoll
strtol
strtoull
atoi
strtoul
strtod

api-ms-win-crt-time-l1-1-0

strftime
_localtime64_s
_time64
_gmtime64

api-ms-win-crt-runtime-l1-1-0

terminate
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_beginthreadex
_crt_atexit
_getpid
_cexit
exit
_seh_filter_exe
_set_app_type
_get_initial_narrow_environment
_resetstkoflw
_initterm
_invalid_parameter_noinfo
_initterm_e
__sys_nerr
strerror
_exit
__p___argc
_errno
__p___argv
_c_exit
system
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-math-l1-1-0

fmodf
_dclass
acosf
_dsign
sin
__setusermatherr

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file
_fstat64
_stat64i32
_stat64
_access
remove
_unlink

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
localeconv
___lc_codepage_func

advapi32

AddAccessAllowedAce
GetLengthSid
GetTokenInformation
InitializeAcl
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ConvertSidToStringSidA
CopySid
SetSecurityInfo
IsValidSid
OpenProcessToken

shell32

ShellExecuteA

Sections

.text
Size: 814KB - Virtual size: 814KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 231KB - Virtual size: 230KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e67166c1cfd1333d3807ce3c0a6f5260

Headers

DLL Characteristics

File Characteristics

Imports

xinput1_3

opencv_world452

kernel32

user32

gdi32

imm32

dwmapi

msvcp140

d3d9

normaliz

wldap32

crypt32

ws2_32

rpcrt4

psapi

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

advapi32

shell32

Sections

.text Size: 814KB - Virtual size: 814KB

.rdata Size: 231KB - Virtual size: 230KB

.data Size: 4KB - Virtual size: 7KB

.pdata Size: 31KB - Virtual size: 31KB

_RDATA Size: 9KB - Virtual size: 8KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 814KB - Virtual size: 814KB

.rdata
Size: 231KB - Virtual size: 230KB

.data
Size: 4KB - Virtual size: 7KB

.pdata
Size: 31KB - Virtual size: 31KB

_RDATA
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 2KB - Virtual size: 2KB