d2b6ab980f72183ad83a0e13298029d5afd3215e8b36059a793e3af6b994b3a3

Sharing

Copy URL Twitter E-mail

General

Target

d2b6ab980f72183ad83a0e13298029d5afd3215e8b36059a793e3af6b994b3a3
Size

3.3MB
MD5

59b54bc1f429382c9ab7a97da420e6d0
SHA1

74b3b19efd69eaafddfd5466574826aae02e00c1
SHA256

d2b6ab980f72183ad83a0e13298029d5afd3215e8b36059a793e3af6b994b3a3
SHA512

21be153e521a0de14b21ae3ed3e2661e6cbf877520678db26cca5921197cb7b4bba610658796381d57be3b8ed1756bca653978c99a5e4757047cb117b977ffc5
SSDEEP

49152:JCPDa/4enbIuF/smbbvyJqYZhYG+XUDfiBQ78O+IxnEcBRCd2fmGcoJ4pNfzz/fK:JCi4eP/tiJqYZhYk5zEcSdroJ4nzsGQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d2b6ab980f72183ad83a0e13298029d5afd3215e8b36059a793e3af6b994b3a3

Files

d2b6ab980f72183ad83a0e13298029d5afd3215e8b36059a793e3af6b994b3a3
.exe windows:5 windows x86

9dd883723c933c504034375da3b3cfb4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

getservbyport
ntohs
inet_addr
htonl
gethostbyaddr
WSASetLastError
htons
WSAGetLastError
gethostbyname
ioctlsocket
getservbyname
inet_ntoa
gethostname
shutdown
WSACleanup
closesocket
connect
socket
WSAStartup
send
recv
WSAAsyncSelect

winmm

mixerGetDevCapsW
joyGetDevCapsW
waveOutSetVolume
waveOutGetVolume
mixerSetControlDetails
mixerGetControlDetailsW
mixerClose
mixerGetLineControlsW
mixerOpen
mciSendStringW
mixerGetLineInfoW
joyGetPosEx

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

comctl32

ImageList_Create
ImageList_Destroy
ImageList_GetIconSize
ImageList_ReplaceIcon
CreateStatusWindowW
ImageList_AddMasked

shlwapi

HashData

crypt32

CryptBinaryToStringA

psapi

GetProcessImageFileNameW
GetModuleBaseNameW
GetModuleFileNameExW

wininet

InternetReadFile
InternetOpenUrlW
InternetCloseHandle
InternetReadFileExA
InternetOpenW

kernel32

GetSystemTimeAsFileTime
VirtualProtect
InitializeCriticalSection
SetErrorMode
LoadLibraryW
AddVectoredExceptionHandler
GlobalLock
GlobalUnlock
WideCharToMultiByte
GetSystemDirectoryA
LoadLibraryA
FreeLibrary
GetCurrentThreadId
GetEnvironmentVariableW
SuspendThread
ResumeThread
EnterCriticalSection
LeaveCriticalSection
OpenThread
lstrcmpiW
GetStringTypeExW
CreateThread
SetThreadPriority
GetExitCodeThread
CloseHandle
CreateMutexW
GetLastError
GetModuleHandleW
MultiByteToWideChar
SystemTimeToFileTime
SetFilePointerEx
ReadFile
SetFilePointer
GlobalSize
lstrcpyA
lstrlenA
lstrcmpiA
lstrcmpA
LocalFileTimeToFileTime
CreateDirectoryA
CreateDirectoryW
IsBadReadPtr
CreateFileW
CreateFileA
WriteFile
SetFileTime
DuplicateHandle
LoadResource
LockResource
SizeofResource
GetCurrentDirectoryA
GetLocalTime
FileTimeToDosDateTime
GetFileInformationByHandle
GetFileSize
lstrlenW
FindFirstFileW
FindNextFileW
FindClose
GetCurrentProcess
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
SetLastError
FlushInstructionCache
GetTempPathA
HeapAlloc
HeapReAlloc
VirtualAlloc
VirtualFree
GetProcessHeap
HeapCreate
HeapFree
HeapDestroy
GetCommandLineW
WaitForSingleObject
GetThreadLocale
VirtualQuery
GetVersionExW
InitializeCriticalSectionAndSpinCount
RaiseException
DeleteCriticalSection
GetModuleFileNameW
GetFileAttributesW
OpenProcess
GetCurrentProcessId
GetFullPathNameW
LocalFree
GetShortPathNameW
FileTimeToLocalFileTime
SetEnvironmentVariableW
Beep
MoveFileW
OutputDebugStringW
CreateProcessW
GetExitCodeProcess
WriteProcessMemory
ReadProcessMemory
TerminateProcess
SetPriorityClass
GetDateFormatW
GetTimeFormatW
GetDiskFreeSpaceExW
SetVolumeLabelW
DeviceIoControl
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceW
GetCurrentDirectoryW
DeleteFileW
CopyFileW
SetFileAttributesW
GetFileSizeEx
GetSystemTime
GetSystemDefaultUILanguage
GetComputerNameW
GetSystemWindowsDirectoryW
GetTempPathW
TryEnterCriticalSection
QueryDosDeviceW
CompareStringW
RemoveDirectoryW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FormatMessageW
GetPrivateProfileStringW
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
WritePrivateProfileSectionW
HeapWalk
HeapSize
SetEndOfFile
GetACP
GetFileType
GetStdHandle
FileTimeToSystemTime
VirtualAllocEx
VirtualFreeEx
EnumResourceNamesW
LoadLibraryExW
RemoveVectoredExceptionHandler
ExitProcess
ExitThread
CheckRemoteDebuggerPresent
GetCurrentThread
GetProcAddress
GlobalFree
_lclose
_lopen
_lread
GetModuleFileNameA
GlobalAlloc
GetModuleHandleA
FindResourceW
GetCPInfo
SetCurrentDirectoryW
Sleep
GetTickCount
MulDiv
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCommandLineA
GetModuleHandleExW
FreeLibraryAndExitThread
HeapQueryInformation
LCMapStringW
GetStringTypeW
GetConsoleMode
ReadConsoleW
GetProcessTimes
GetConsoleOutputCP
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
WriteConsoleW

user32

SetFocus
SetWindowRgn
SetWindowPos
SetLayeredWindowAttributes
InvalidateRect
EnableWindow
GetWindowTextLengthW
EnumWindows
IsZoomed
IsIconic
EnumDisplayMonitors
GetMonitorInfoW
RegisterWindowMessageW
GetSysColor
GetSysColorBrush
DrawIconEx
FillRect
DefWindowProcW
SetForegroundWindow
DialogBoxParamW
SendDlgItemMessageW
GetDlgItem
SetDlgItemTextW
MessageBeep
ClientToScreen
GetCursorInfo
GetLastInputInfo
GetSystemMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuStringW
ExitWindowsEx
SetScrollInfo
ScrollWindow
SetMenu
FlashWindow
GetPropW
SetPropW
RemovePropW
MapWindowPoints
RedrawWindow
SetParent
GetClassInfoExW
DefDlgProcW
GetAncestor
UpdateWindow
GetMessagePos
GetClassLongW
CallWindowProcW
CheckRadioButton
IntersectRect
GetUpdateRect
PtInRect
CreateDialogIndirectParamW
CreateAcceleratorTableW
InsertMenuItemW
SetMenuDefaultItem
RemoveMenu
SetMenuItemInfoW
IsMenu
GetMenuItemInfoW
CreateMenu
CreatePopupMenu
SetMenuInfo
AppendMenuW
DestroyMenu
TrackPopupMenuEx
GetDesktopWindow
CopyImage
CreateIconIndirect
CreateIconFromResourceEx
EnumClipboardFormats
GetWindow
BringWindowToTop
GetTopWindow
EnumChildWindows
LoadCursorW
DestroyAcceleratorTable
UnregisterClassW
DestroyIcon
DestroyWindow
IsCharAlphaW
MapVirtualKeyW
VkKeyScanExW
MapVirtualKeyExW
GetKeyboardLayoutNameW
ActivateKeyboardLayout
GetGUIThreadInfo
GetWindowTextW
mouse_event
GetSystemMetrics
keybd_event
SetKeyboardState
GetKeyboardState
GetCursorPos
GetAsyncKeyState
AttachThreadInput
SendInput
UnregisterHotKey
RegisterHotKey
PostQuitMessage
SendMessageTimeoutW
UnhookWindowsHookEx
SetWindowsHookExW
PostThreadMessageW
IsCharAlphaNumericW
IsCharUpperW
IsCharLowerW
ToUnicodeEx
GetKeyboardLayout
CallNextHookEx
CharLowerW
ReleaseDC
GetDC
MessageBoxW
OpenClipboard
GetClipboardData
GetClipboardFormatNameW
CloseClipboard
SetClipboardData
EmptyClipboard
PostMessageW
FindWindowW
EndDialog
IsWindow
DispatchMessageW
TranslateMessage
CountClipboardFormats
SetWindowLongW
ScreenToClient
IsDialogMessageW
WindowFromPoint
SendMessageW
IsWindowEnabled
GetWindowLongW
GetKeyState
TranslateAcceleratorW
KillTimer
PeekMessageW
GetFocus
GetClassNameW
GetWindowThreadProcessId
GetForegroundWindow
GetMessageW
SetTimer
GetScrollInfo
MoveWindow
GetWindowRect
GetClientRect
SystemParametersInfoW
AdjustWindowRectEx
DrawTextW
SetRect
GetIconInfo
SetWindowTextW
IsWindowVisible
BlockInput
GetMenu
CheckMenuItem
CharLowerA
LoadImageW
GetParent
GetDlgCtrlID
CharUpperW
IsClipboardFormatAvailable
ChangeClipboardChain
SetClipboardViewer
LoadAcceleratorsW
SetActiveWindow
CreateWindowExW
GetQueueStatus
RegisterClassExW
ShowWindow

gdi32

CreateFontW
GetStockObject
SelectObject
GetTextFaceW
CreateSolidBrush
CreateDCW
ExcludeClipRect
GetTextMetricsW
GetObjectW
DeleteDC
CreateEllipticRgn
CreateRoundRectRgn
CreateRectRgn
CreatePolygonRgn
CreateCompatibleDC
GetDIBits
GetSystemPaletteEntries
GdiFlush
CreateDIBSection
EnumFontFamiliesExW
SetBrushOrgEx
CreatePatternBrush
SetBkMode
GetCharABCWidthsW
GetClipBox
FillRgn
DeleteObject
GetDeviceCaps
SetTextColor
SetBkColor
GetPixel
BitBlt
CreateCompatibleBitmap
GetClipRgn

comdlg32

CommDlgExtendedError
GetOpenFileNameW
GetSaveFileNameW

advapi32

CryptReleaseContext
CryptDestroyKey
CryptDestroyHash
CryptDeriveKey
CryptHashData
CryptCreateHash
CryptAcquireContextW
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
CloseServiceHandle
RegCreateKeyExW
RegQueryValueExW
AdjustTokenPrivileges
RegCloseKey
RegConnectRegistryW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
GetUserNameW
OpenSCManagerW
LookupPrivilegeValueW
LockServiceDatabase
UnlockServiceDatabase
OpenProcessToken

shell32

DragFinish
Shell_NotifyIconW
ExtractIconW
DragQueryPoint
SHEmptyRecycleBinW
SHFileOperationW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetDesktopFolder
SHGetMalloc
SHGetFolderPathW
ShellExecuteExW
CommandLineToArgvW
DragQueryFileW

ole32

CoInitialize
CoCreateInstance
CoUninitialize
CLSIDFromString
CLSIDFromProgID
CoGetObject
StringFromGUID2
CreateStreamOnHGlobal

oleaut32

VariantChangeType
VariantClear
SafeArrayCopy
VariantCopyInd
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayLock
SafeArrayPtrOfIndex
SafeArrayUnlock
SafeArrayAccessData
SafeArrayCreate
SysStringLen
GetActiveObject
SafeArrayDestroy
SysFreeString
SafeArrayGetElemsize
SafeArrayUnaccessData
OleLoadPicture
SysAllocString
SafeArrayGetUBound

Exports

Exports

ADDFILE
ADDSCRIPT
AHKASSIGN
AHKEXEC
AHKEXECUTELINE
AHKFINDFUNC
AHKFINDLABEL
AHKFUNCTION
AHKGETVAR
AHKISUNICODE
AHKLABEL
AHKPAUSE
AHKPOSTFUNCTION
AddFile
AddScript
Addfile
Addscript
AhkAssign
AhkExec
AhkExecuteLine
AhkExecuteline
AhkFindFunc
AhkFindLabel
AhkFindfunc
AhkFindlabel
AhkFunction
AhkGetVar
AhkGetvar
AhkIsUnicode
AhkIsunicode
AhkLabel
AhkPause
AhkPostFunction
AhkPostfunction
Ahkassign
Ahkexec
AhkexecuteLine
Ahkexecuteline
AhkfindFunc
AhkfindLabel
Ahkfindfunc
Ahkfindlabel
Ahkfunction
AhkgetVar
Ahkgetvar
AhkisUnicode
Ahkisunicode
Ahklabel
Ahkpause
AhkpostFunction
Ahkpostfunction
MinHookDisable
MinHookEnable
addFile
addScript
addfile
addscript
ahkAssign
ahkExec
ahkExecuteLine
ahkExecuteline
ahkFindFunc
ahkFindLabel
ahkFindfunc
ahkFindlabel
ahkFunction
ahkGetVar
ahkGetvar
ahkIsUnicode
ahkIsunicode
ahkLabel
ahkPause
ahkPostFunction
ahkPostfunction
ahkassign
ahkexec
ahkexecuteLine
ahkexecuteline
ahkfindFunc
ahkfindLabel
ahkfindfunc
ahkfindlabel
ahkfunction
ahkgetVar
ahkgetvar
ahkisUnicode
ahkisunicode
ahklabel
ahkpause
ahkpostFunction
ahkpostfunction

Sections

.text
Size: 933KB - Virtual size: 933KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 190KB - Virtual size: 189KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9dd883723c933c504034375da3b3cfb4

Headers

File Characteristics

Imports

wsock32

winmm

version

comctl32

shlwapi

crypt32

psapi

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 933KB - Virtual size: 933KB

.rdata Size: 190KB - Virtual size: 189KB

.data Size: 11KB - Virtual size: 32KB

.rsrc Size: 2.2MB - Virtual size: 2.2MB

.text
Size: 933KB - Virtual size: 933KB

.rdata
Size: 190KB - Virtual size: 189KB

.data
Size: 11KB - Virtual size: 32KB

.rsrc
Size: 2.2MB - Virtual size: 2.2MB