1ef87c0bcdc62f444632648e895b096675b8b7df211eb982c8f3b088718f66b2

Sharing

Copy URL Twitter E-mail

General

Target

1ef87c0bcdc62f444632648e895b096675b8b7df211eb982c8f3b088718f66b2
Size

10.0MB
MD5

04b470abc2b02a93626c3861533c6190
SHA1

2bc77b7e6f7c99b550bbad7202984ccafd710291
SHA256

1ef87c0bcdc62f444632648e895b096675b8b7df211eb982c8f3b088718f66b2
SHA512

6486b0b057a5356309ed77c46a6e9e1c9c9a484ed9da109a4640ed8816d0c0f31d00bc3d06b8c185a09344514cf95f16457139b3d79c19eb633eed70ec69ad12
SSDEEP

98304:1V+bIk+wtDpKBC0ZZfBp9HPT+nLKY98OYjxHCNvuyOhVGgAM+QLWruEG/ponIf07:TivvUfvT+N8OYFHkuBaQzEG/ponIf1+p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1ef87c0bcdc62f444632648e895b096675b8b7df211eb982c8f3b088718f66b2

Files

1ef87c0bcdc62f444632648e895b096675b8b7df211eb982c8f3b088718f66b2
.exe windows:6 windows x64

3f99e2edd7fe7384db9f249ce2b34533

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

gdiplus

GdipCreateHBITMAPFromBitmap
GdipGetImagePixelFormat
GdipDisposeImage
GdipAlloc
GdipCreateBitmapFromStream
GdipGetPropertyItem
GdipCloneImage
GdipGetImagePaletteSize
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdiplusShutdown
GdiplusStartup
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipImageSelectActiveFrame
GdipImageGetFrameDimensionsList
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipGetLogFontW
GdipDeleteFont
GdipImageGetFrameCount
GdipCreateMatrix
GdipDeleteMatrix
GdipGetImagePalette
GdipSetSmoothingMode
GdipCreatePen1
GdipDeletePen
GdipDrawArc
GdipCreateLineBrushFromRect
GdipDeleteBrush
GdipCloneBrush
GdipSetLineBlend
GdipCreatePen2
GdipTranslateMatrix
GdipRotateMatrix
GdipSetWorldTransform
GdipDrawImageRect
GdipImageRotateFlip
GdipLoadImageFromFile
GdipClonePen
GdipSetPenWidth
GdipGetPenWidth
GdipSetPenColor
GdipSetPenStartCap
GdipSetPenEndCap
GdipSetPenDashCap197819
GdipGetPenStartCap
GdipGetPenEndCap
GdipGetPenDashCap197819
GdipGetImageWidth
GdipSetPenLineJoin
GdipGetPenLineJoin
GdipSetPenDashStyle
GdipGetPenDashStyle
GdipGetPropertyItemSize
GdipCreateBitmapFromFile
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipMeasureString
GdipSetStringFormatFlags
GdipFillPath
GdipFillEllipseI
GdipDrawEllipseI
GdipDrawString
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipCloneStringFormat
GdipSetTextRenderingHint
GdipDrawPath
GdipDrawRectangleI
GdipDrawBezierI
GdipDrawLineI
GdipFillRectangle
GdipReleaseDC
GdipDrawImageRectRect
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipDeletePath
GdipTransformPath
GdipIsOutlineVisiblePathPointI
GdipIsVisiblePathPointI
GdipGetPathWorldBoundsI
GdipAddPathPolygonI
GdipAddPathPieI
GdipAddPathArcI
GdipAddPathEllipseI
GdipAddPathRectangleI
GdipAddPathCurveI
GdipAddPathBezierI
GdipAddPathLine2I
GdipAddPathLineI
GdipClosePathFigure
GdipStartPathFigure
GdipGetPathFillMode
GdipSetPathFillMode
GdipResetPath
GdipClonePath
GdipCreatePath
GdipCreateTexture
GdipCreateSolidFill
GdipCreateLineBrushFromRectI
GdipFillRectangleI
GdipDeleteFontFamily
GdipGetFamily
GdipAddPathString
GdipGetFontSize
GdipGetStringFormatAlign
GdipScaleMatrix
GdipFree
GdipCreateFontFromLogfontW

shlwapi

PathIsDirectoryA
PathFindFileNameW
PathIsUNCW
PathStripToRootW
PathFindExtensionW
PathRemoveFileSpecW
StrFormatKBSizeW
PathFileExistsW
PathIsRelativeW
PathIsDirectoryW
PathIsRelativeA

msimg32

TransparentBlt
AlphaBlend

imm32

ImmGetOpenStatus
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

winmm

timeGetTime
timeKillEvent
timeSetEvent
PlaySoundW

comctl32

ord17
_TrackMouseEvent

wldap32

ord32
ord143
ord46
ord211
ord60
ord50
ord41
ord22
ord26
ord27
ord79
ord33
ord35
ord30
ord200
ord301

ws2_32

select
send
gethostname
inet_ntoa
gethostbyname
WSAStartup
WSACleanup
WSAGetLastError
bind
closesocket
connect
getpeername
getsockname
getsockopt
getnameinfo
shutdown
ioctlsocket
sendto
htons
ntohs
recv
setsockopt
socket
recvfrom
__WSAFDIsSet
getaddrinfo
WSASetLastError
accept
freeaddrinfo
listen
WSAIoctl

crypt32

CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertOpenStore
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore

kernel32

GlobalLock
GlobalUnlock
HeapFree
GetCurrentProcess
WaitForSingleObject
CreateFileW
DuplicateHandle
TerminateThread
DeleteFileW
CloseHandle
LoadLibraryW
CreateThread
HeapAlloc
GetProcAddress
GetCurrentProcessId
GetProcessHeap
FreeLibrary
WriteFile
SetFilePointer
GetLastError
CreateFileA
DeleteFileA
GetTickCount
FlushFileBuffers
GetDiskFreeSpaceExA
GetComputerNameA
GetCommandLineW
Sleep
SetCurrentDirectoryW
LocalFree
CopyFileW
CreateMutexW
GetLocaleInfoW
GetCurrentThreadId
GetUserDefaultLCID
GetModuleHandleW
ReadFile
InitializeCriticalSectionEx
MoveFileA
CopyFileA
MoveFileExA
MoveFileExW
CreateDirectoryW
SizeofResource
FindFirstFileW
FindFirstFileA
SetPriorityClass
FindNextFileW
GetModuleFileNameW
FindNextFileA
SetThreadPriority
FindClose
GetCurrentThread
LockResource
LoadResource
FindResourceW
SetFileAttributesA
GetFileSize
RemoveDirectoryA
ExitProcess
CreateProcessW
CreateSemaphoreW
CreateDirectoryA
GetSystemTime
SetLastError
OutputDebugStringA
DecodePointer
RaiseException
HeapReAlloc
HeapSize
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetModuleHandleExW
CreateActCtxW
ActivateActCtx
DeactivateActCtx
FindActCtxSectionStringW
QueryActCtxW
InitializeCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalAlloc
GlobalReAlloc
GlobalHandle
GlobalFree
LocalAlloc
LocalReAlloc
WideCharToMultiByte
GlobalSize
MulDiv
FormatMessageW
MultiByteToWideChar
CreateEventW
ResumeThread
CompareStringW
lstrcmpA
GlobalGetAtomNameW
FileTimeToSystemTime
SystemTimeToFileTime
EncodePointer
GetSystemDirectoryW
FreeResource
LoadLibraryExW
GlobalDeleteAtom
lstrcmpW
GlobalAddAtomW
GlobalFindAtomW
GetFullPathNameW
GetVolumeInformationW
LockFile
SetEndOfFile
UnlockFile
lstrcmpiW
GlobalFlags
GetVersionExW
GetUserDefaultUILanguage
VirtualProtect
FileTimeToLocalFileTime
GetFileAttributesW
GetFileAttributesExW
GetFileSizeEx
GetFileTime
LocalFileTimeToFileTime
SystemTimeToTzSpecificLocalTime
lstrcpyW
GetCurrentDirectoryW
FindResourceExW
GetWindowsDirectoryW
VerSetConditionMask
VerifyVersionInfoW
GetTempPathW
GetProfileIntW
SearchPathW
GetTempFileNameW
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
QueryPerformanceFrequency
GetModuleHandleA
GetEnvironmentVariableW
WaitForMultipleObjects
GetStdHandle
VirtualQuery
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
SetEnvironmentVariableW
FormatMessageA
GetTickCount64
SleepEx
GetFileType
PeekNamedPipe
ExpandEnvironmentStringsA
GetSystemDirectoryA
LoadLibraryA
VerifyVersionInfoA
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GlobalMemoryStatus
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
LoadLibraryExA
LCMapStringEx
GetStringTypeW
GetCPInfo
OutputDebugStringW
RtlUnwindEx
GetSystemInfo
SetEvent
RtlPcToFileHeader
GetCommandLineA
ExitThread
FreeLibraryAndExitThread
HeapQueryInformation
VirtualAlloc
SetStdHandle
GetDriveTypeW
GetFileInformationByHandle
SetFilePointerEx
SetConsoleCtrlHandler
GetConsoleOutputCP
LCMapStringW
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
GetDiskFreeSpaceExW
RtlUnwind

user32

RealChildWindowFromPoint
DrawTextW
DrawTextExW
GrayStringW
TabbedTextOutW
GetWindowDC
FillRect
GetMenuItemInfoW
InflateRect
SystemParametersInfoW
CopyImage
SendDlgItemMessageA
SetRectEmpty
OffsetRect
CreateDialogIndirectParamW
EndDialog
GetNextDlgTabItem
GetAsyncKeyState
MapDialogRect
IntersectRect
TrackMouseEvent
InvalidateRect
ShowOwnedPopups
SetCursor
DeleteMenu
SetTimer
KillTimer
GetNextDlgGroupItem
SetCapture
ReleaseCapture
WindowFromPoint
DrawFocusRect
IsRectEmpty
DrawIconEx
GetIconInfo
MessageBeep
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
GetMenuDefaultItem
MapVirtualKeyW
GetKeyNameTextW
LoadMenuW
SetLayeredWindowAttributes
EnumDisplayMonitors
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateW
SetClassLongPtrW
SetWindowRgn
SetParent
DrawEdge
DrawFrameControl
IsZoomed
GetSystemMenu
BringWindowToTop
SetCursorPos
CopyIcon
FrameRect
DrawIcon
UnionRect
UpdateLayeredWindow
MonitorFromPoint
LoadAcceleratorsW
TranslateAcceleratorW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
GetComboBoxInfo
PostThreadMessageW
WaitMessage
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
DestroyIcon
CopyAcceleratorTableW
SetRect
LockWindowUpdate
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuW
RegisterClipboardFormatW
CharUpperBuffW
IsClipboardFormatAvailable
GetUpdateRect
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
SubtractRect
GetWindowRgn
DestroyCursor
RegisterClassExW
GetClipboardData
GetQueueStatus
CallMsgFilterW
MsgWaitForMultipleObjectsEx
GetAncestor
GetProcessWindowStation
GetUserObjectInformationW
GetKeyState
GetActiveWindow
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
RemoveMenu
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringW
GetWindowLongW
MessageBoxW
IsWindowEnabled
UnhookWindowsHookEx
UnregisterClassW
GetLastActivePopup
PostMessageW
IsWindowVisible
GetPropW
GetDesktopWindow
wsprintfW
MoveWindow
GetSystemMetrics
CreatePopupMenu
DestroyMenu
TrackPopupMenuEx
AppendMenuW
CreateMenu
LoadImageW
GetCursorPos
GetWindow
SetFocus
EnableWindow
GetWindowThreadProcessId
RemovePropW
IsWindow
AttachThreadInput
SetPropW
ShowWindow
FindWindowW
PostQuitMessage
PtInRect
SetForegroundWindow
IsIconic
SendMessageW
ClientToScreen
GetParent
CharNextW
IsDialogMessageW
SetWindowTextW
CheckDlgButton
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
LoadIconW
GetTopWindow
GetClassNameW
GetClassLongPtrW
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
EqualRect
CopyRect
MapWindowPoints
ScreenToClient
AdjustWindowRectEx
GetWindowRect
GetClientRect
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
EndPaint
BeginPaint
GetForegroundWindow
SetActiveWindow
UpdateWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
GetDlgCtrlID
GetDlgItem
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
DestroyWindow
IsChild
IsMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CharUpperW
EnableMenuItem
CheckMenuItem
GetFocus
GetWindowTextLengthW
GetWindowTextW
LoadCursorW
GetSysColorBrush
GetSysColor
ReleaseDC
GetDC
CallNextHookEx
SetWindowsHookExW
DestroyAcceleratorTable
ValidateRect

gdi32

PtVisible
RectVisible
RestoreDC
SaveDC
LineTo
IntersectClipRect
SelectClipRgn
ExtSelectClipRgn
SelectObject
SelectPalette
GetWindowExtEx
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetStretchBltMode
ExtFloodFill
PtInRegion
SetTextAlign
GetViewportExtEx
GetStockObject
GetPixel
GetObjectType
SetPaletteEntries
SetBkMode
GetTextFaceW
GetBoundsRect
GetWindowOrgEx
GetViewportOrgEx
GetClipBox
FrameRgn
FillRgn
RoundRect
ExcludeClipRect
Escape
OffsetRgn
GetRgnBox
Rectangle
LPtoDP
CreateRoundRectRgn
Polyline
Polygon
CreatePolygonRgn
GetTextColor
Ellipse
CreateEllipticRgn
SetDIBColorTable
CreateDIBSection
StretchBlt
SetPixel
GetTextCharsetInfo
EnumFontFamiliesW
CreateDIBitmap
CreateCompatibleBitmap
GetBkColor
RealizePalette
GetSystemPaletteEntries
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
EnumFontFamiliesExW
GetTextMetricsW
DPtoLP
SetRectRgn
PatBlt
CreateRectRgnIndirect
CombineRgn
GetTextExtentPoint32W
CreateFontIndirectW
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
ExtTextOutW
TextOutW
MoveToEx
SetPixelV
CreateSolidBrush
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateCompatibleDC
BitBlt
SetTextColor
SetBkColor
CreateBitmap
GetDeviceCaps
CreateDCW
CopyMetaFileW
DeleteDC
GetObjectW
DeleteObject

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

RegDeleteKeyW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
CryptGenRandom
RegQueryValueExW
RegEnumKeyExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExA
RegSetValueExW
RegOpenKeyExW
RegGetValueW
RegDeleteValueW

shell32

SHAppBarMessage
SHGetPathFromIDListW
CommandLineToArgvW
ShellExecuteA
Shell_NotifyIconW
SHChangeNotify
ShellExecuteW
SHGetFileInfoW
SHGetSpecialFolderLocation
SHBrowseForFolderW
DragFinish
DragQueryFileW
SHGetDesktopFolder

ole32

CreateStreamOnHGlobal
OleUninitialize
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
CoInitializeEx
CoInitialize
CoUninitialize
CoCreateInstance
CoDisconnectObject
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
OleInitialize

oleaut32

LoadTypeLi
SysStringLen
SysAllocStringLen
SysFreeString
SystemTimeToVariantTime
SysAllocString
VariantInit
VarBstrFromDate
VariantChangeType
VariantCopy
VariantClear
VariantTimeToSystemTime

iphlpapi

GetAdaptersInfo

uxtheme

IsAppThemed
GetWindowTheme
GetCurrentThemeName
GetThemeColor
DrawThemeBackground
CloseThemeData
OpenThemeData
DrawThemeParentBackground
DrawThemeText
GetThemeSysColor
GetThemePartSize
IsThemeBackgroundPartiallyTransparent

oleacc

CreateStdAccessibleObject
LresultFromObject
AccessibleObjectFromWindow

Sections

.text
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 133KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 217KB - Virtual size: 217KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 23.2MB - Virtual size: 23.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3f99e2edd7fe7384db9f249ce2b34533

Headers

DLL Characteristics

File Characteristics

Imports

gdiplus

shlwapi

msimg32

imm32

winmm

comctl32

wldap32

ws2_32

crypt32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

iphlpapi

uxtheme

oleacc

Sections

.text Size: 4.5MB - Virtual size: 4.5MB

.rdata Size: 1.4MB - Virtual size: 1.4MB

.data Size: 133KB - Virtual size: 185KB

.pdata Size: 217KB - Virtual size: 217KB

_RDATA Size: 512B - Virtual size: 252B

.rsrc Size: 23.2MB - Virtual size: 23.2MB

.reloc Size: 97KB - Virtual size: 97KB

.text
Size: 4.5MB - Virtual size: 4.5MB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 133KB - Virtual size: 185KB

.pdata
Size: 217KB - Virtual size: 217KB

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 23.2MB - Virtual size: 23.2MB

.reloc
Size: 97KB - Virtual size: 97KB