8cb7b872d053627d12f1483514a798a377be465e740885ab19c51b60a3882b2f

Sharing

Copy URL Twitter E-mail

General

Target

8cb7b872d053627d12f1483514a798a377be465e740885ab19c51b60a3882b2f
Size

1.3MB
MD5

249d78a4a5ee8588b687afd5d693cfa1
SHA1

0e7029c8fd6bb8615afc87b208dd09d7c818f113
SHA256

8cb7b872d053627d12f1483514a798a377be465e740885ab19c51b60a3882b2f
SHA512

3fa23c22b408761e103fbf787fb8bb8ac071cd033e1d018aa39da214b88eab50da02396c507e9ccdd110eb8d79de98382f4037c08e50eb68976de630b4e02934
SSDEEP

24576:/W5QSJ6gqHS8PQJDhW2TLdtbxWEs9sqjnhMgeiCl7G0nehbGZpbD:eh/D02TLdlVshDmg27RnWGj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8cb7b872d053627d12f1483514a798a377be465e740885ab19c51b60a3882b2f

Files

8cb7b872d053627d12f1483514a798a377be465e740885ab19c51b60a3882b2f
.exe windows:6 windows x86 arch:x86

137ce2d99a3a52c7b418c896916242c3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

common

?InitPlatform@CoreCenter@Util@@YAHPA_W@Z
??8CTXBSTR@@QBE_NPB_W@Z
?SetConfigFile@TXI18N@@YAHPB_W0@Z
?IsEmpty@CTXStringW@@QBE_NXZ
?CreateTXData@Data@Util@@YAHPAPAUITXData@@@Z
?GetParentDir@FS@Util@@YA?AVCTXStringW@@V3@@Z
??7CTXStringW@@QBE_NXZ
??0CTXStringW@@QAE@UtagEN@@PBDH@Z
?CreateFileW@FS@@YAHPB_WKPAPAUITXFile@@@Z
??0CTXStringA@@QAE@XZ
?Format@CTXStringA@@QAAXPBDZZ
??M@YA_NABVCTXStringA@@0@Z
?SetMainAndLogicThreadId@Misc@Util@@YAXKK@Z
?OnExitCoreCenter@Misc@Util@@YAXXZ
?OnExitWinMain@Misc@Util@@YAXXZ
?OnUninitCom@Misc@Util@@YAXXZ
??H@YA?AVCTXStringW@@_WABV0@@Z
?GetExeDir@Sys@Util@@YA?AVCTXStringW@@XZ
?InitPlatformFileSystem@Boot@Util@@YAHXZ
?InitPlatformI18NConfig@Boot@Util@@YAHXZ
?InitPlatformCoreConfig@Boot@Util@@YAHXZ
?InitPlatformGFConfig@Boot@Util@@YAHXZ
?CreateObjectFromDllFile@Com@Util@@YGJPB_WABU_GUID@@1PAPAXPAUIUnknown@@@Z
?LoadStringW@TXStringBundle@@YAPB_WPB_W@Z
??4CTXBSTR@@QAEAAV0@PB_W@Z
??8CTXBSTR@@QBE_NABV0@@Z
??9CTXBSTR@@QBE_NABV0@@Z
??0CTXStringW@@QAE@UtagUTF8@@PBDH@Z
??ICTXBSTR@@QAEPAPA_WXZ
??0CTXBSTR@@QAE@XZ
??4CTXStringW@@QAEAAV0@PB_W@Z
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
?DelIdleCallback@Window@Util@@YAJPAVVTXMsgLoopIdleCallback@@@Z
??0CTXBSTR@@QAE@ABVCTXStringW@@@Z
??0CTXStringW@@QAE@PA_W@Z
??0CTXStringW@@QAE@XZ
??0CTXStringW@@QAE@PB_W@Z
??1CTXStringW@@QAE@XZ
??H@YA?AVCTXStringW@@ABV0@0@Z
??BCTXStringW@@QBEPB_WXZ
??1CTXStringA@@QAE@XZ
??0CTXBSTR@@QAE@PB_W@Z
?GetPlatformCore@Core@Util@@YAHPAPAUITXCore@@@Z
??1CTXBSTR@@QAE@XZ
??BCTXBSTR@@QBEPA_WXZ
?TXAssert@@YAHPB_W0H@Z
?ClearDeadQueue@Misc@Util@@YAXXZ
?NotifyIdle@TXTimer@@YAXXZ
?TXLoadString@@YAPB_WPB_W0@Z

gf

?CreateObject@GF@Util@@YAJABU_GUID@@0PAPAX@Z
?RawCreateGFElementByXtml@GF@Util@@YAJPA_WPAPAUIGFElement@@PAU3@PAUITXCore@@H@Z
?SetCustomObjectFactory@GF@Util@@YAXP6AHABU_GUID@@0PAPAX@Z@Z

kernel32

LoadLibraryA
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSectionEx
DeleteCriticalSection
GetModuleFileNameW
GetCommandLineW
GetPrivateProfileStringW
GetPrivateProfileSectionW
GetFileAttributesW
DeleteFileW
GetLogicalDrives
GetLocalTime
GetTickCount
GetDiskFreeSpaceExW
CreateFileW
DeviceIoControl
WriteFile
SetFilePointer
ReadFile
GetFileAttributesExW
MoveFileW
ResumeThread
VirtualAlloc
GetThreadContext
SetThreadContext
FlushInstructionCache
SuspendThread
SetLastError
GetFileSize
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
MoveFileExW
GetLocaleInfoW
EnterCriticalSection
LeaveCriticalSection
SleepEx
RaiseException
LocalFree
GetACP
SetEvent
UnhandledExceptionFilter
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalAddAtomW
SwitchToThread
GetDateFormatW
GetTimeFormatW
GetCurrentProcessId
ProcessIdToSessionId
InitializeCriticalSection
SystemTimeToFileTime
FileTimeToLocalFileTime
GetNumberFormatW
GetCurrencyFormatW
OutputDebugStringW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
WaitForSingleObjectEx
ResetEvent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
GetModuleHandleA
FlushFileBuffers
lstrlenA
CreateFileA
CopyFileA
InterlockedCompareExchange
InterlockedDecrement
InterlockedIncrement
InterlockedExchange
GetPrivateProfileIntW
ReleaseMutex
CreateMutexW
GetLastError
CloseHandle
WaitForSingleObject
Sleep
GetModuleHandleW
GetProcAddress
VirtualProtect
IsBadWritePtr
VirtualQuery
LoadLibraryExW
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TerminateThread
GetCurrentThread
IsBadReadPtr
WriteProcessMemory
GetSystemDefaultLangID
GetSystemInfo
GetVersionExW
lstrcpynW
GetDriveTypeW
FreeLibrary
LoadLibraryW
GetSystemDirectoryW
GetProcessHeap
HeapAlloc
HeapFree
CreateEventW
HeapSize
HeapDestroy
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
HeapReAlloc

user32

GetForegroundWindow
CreateWindowExW
PostMessageW
FindWindowW
GetSystemMetrics
EnumDisplaySettingsW
GetWindowThreadProcessId
AttachThreadInput
SetWindowPos
SetForegroundWindow
DefWindowProcW
MsgWaitForMultipleObjects
PostThreadMessageW
CallWindowProcW
GetKeyState
SendMessageTimeoutW
RegisterHotKey
LoadImageW
SystemParametersInfoW
GetWindowTextW
SetWindowLongW
GetWindowLongW
EnableWindow
IsWindow
FindWindowExW
SetWindowTextW
GetMessageW
SendMessageW
SetCursorPos
GetCursorPos
RegisterClassExW
DestroyWindow
TranslateMessage
PeekMessageW
WaitMessage
DispatchMessageW
MessageBoxW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
RegCreateKeyExW
RegDeleteValueW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceConfigW
ChangeServiceConfigW
CreateServiceW
RegCloseKey

shell32

SHGetSpecialFolderPathW
SHGetMalloc
SHBrowseForFolderW
ShellExecuteW
SHCreateDirectoryExW
CommandLineToArgvW
SHGetPathFromIDListW

ole32

CoCreateGuid
CoCreateInstance
OleUninitialize
OleInitialize
CoReleaseServerProcess
CoAddRefServerProcess

oleaut32

SysStringLen
SysFreeString
LoadRegTypeLi
LoadTypeLi

ws2_32

htons
send
WSASend
htonl

msvcp140

?_Xbad_function_call@std@@YAXXZ
?_Throw_C_error@std@@YAXH@Z
_Mtx_lock
_Mtx_unlock
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Xtime_get_ticks
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_BADOFF@std@@3_JB
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z

shlwapi

StrFormatByteSizeW
StrFormatKBSizeW
PathRemoveFileSpecA
PathAppendA
StrFromTimeIntervalW
PathFileExistsA
PathCombineW
PathAppendW
PathMakePrettyW
PathStripPathW
PathRemoveFileSpecW
PathFileExistsW
PathAddBackslashW
PathFindFileNameW

comctl32

InitCommonControlsEx

psapi

GetProcessMemoryInfo
GetPerformanceInfo

vcruntime140

_except_handler4_common
__vcrt_InitializeCriticalSectionEx
__CxxFrameHandler3
__std_exception_destroy
memmove
memcpy
__std_exception_copy
memset
__std_terminate
_purecall
memcmp
wcsstr
wcsrchr
wcschr
__std_type_info_name
_CxxThrowException

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnwprintf_s
__stdio_common_vsprintf_s
__p__commode
_set_fmode
__stdio_common_vswprintf_s
__stdio_common_vsprintf
_wfopen
fseek
putchar
putwchar
ftell
fread
fwrite
__stdio_common_vswprintf
fclose
__stdio_common_vswscanf

api-ms-win-crt-string-l1-1-0

strcpy_s
strlen
wcscmp
wcsnlen
toupper
wcscpy_s
wcsncmp
wcscat_s
_wcsicmp
wcslen
strnlen
_wcslwr_s
wcsncpy_s
wcsncat_s
wmemcpy_s

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo
_errno
_controlfp_s
_register_thread_local_exe_atexit_callback
_c_exit
_exit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_invalid_parameter_noinfo_noreturn
_crt_atexit
_register_onexit_function
_initialize_onexit_table
terminate

api-ms-win-crt-heap-l1-1-0

_recalloc
realloc
_set_new_mode
_callnewh
free
malloc
calloc

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s

api-ms-win-crt-convert-l1-1-0

strtoull
wcstol
strtoll
strtod
_wtoi
_wtol

api-ms-win-crt-math-l1-1-0

__setusermatherr
_dtest
_dsign
_except1

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
localeconv

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-utility-l1-1-0

rand
srand

Sections

.text
Size: 242KB - Virtual size: 241KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 403KB - Virtual size: 402KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 588KB - Virtual size: 592KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

137ce2d99a3a52c7b418c896916242c3

Headers

DLL Characteristics

File Characteristics

Imports

common

gf

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

msvcp140

shlwapi

comctl32

psapi

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

Sections

.text Size: 242KB - Virtual size: 241KB

.rdata Size: 114KB - Virtual size: 114KB

.data Size: 12KB - Virtual size: 15KB

.gfids Size: 512B - Virtual size: 92B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 403KB - Virtual size: 402KB

.reloc Size: 588KB - Virtual size: 592KB

.text
Size: 242KB - Virtual size: 241KB

.rdata
Size: 114KB - Virtual size: 114KB

.data
Size: 12KB - Virtual size: 15KB

.gfids
Size: 512B - Virtual size: 92B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 403KB - Virtual size: 402KB

.reloc
Size: 588KB - Virtual size: 592KB