312dee75159fc2968e0bb552ab6a5bb4bb87c29725356f6bf468b97c3acbdc04

Sharing

Copy URL Twitter E-mail

General

Target

312dee75159fc2968e0bb552ab6a5bb4bb87c29725356f6bf468b97c3acbdc04
Size

1.1MB
MD5

c668abcf5411f9319029554523e0b7c4
SHA1

d74b7ac7477d2a88a09bdd018e8f37a7dc70392e
SHA256

312dee75159fc2968e0bb552ab6a5bb4bb87c29725356f6bf468b97c3acbdc04
SHA512

bb31165e2d8902bed3f23453a6c25e96c0ea2ef00908c79c4096a68ccded9844d58320cd9c6dc0190c867a0f0040315e63c20bee4af941eb54d16658dc96e8c5
SSDEEP

24576:emSxRVZR7H99cBlEH9kJoO2L0flc/po6Hw5xOwCmE2ZfULTAm+1yR:edxFRhHudapFHzwULTAZcR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
312dee75159fc2968e0bb552ab6a5bb4bb87c29725356f6bf468b97c3acbdc04

Files

312dee75159fc2968e0bb552ab6a5bb4bb87c29725356f6bf468b97c3acbdc04
.exe windows:6 windows x86 arch:x86

830be15f85b2078748ffdbfe6f96d7be

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

timeGetTime

d3d9

Direct3DCreate9

kernel32

GetModuleHandleW
InitializeCriticalSection
MulDiv
GetDiskFreeSpaceExW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
CreateFileW
InitializeCriticalSectionEx
SetFilePointer
GetModuleFileNameW
WriteFile
lstrlenW
InitializeSListHead
LoadLibraryW
CloseHandle
GetFileSizeEx
CreateFileA
FormatMessageA
SetLastError
WaitForMultipleObjects
PeekNamedPipe
GetFileType
GetStdHandle
WaitForSingleObjectEx
MoveFileExA
QueryPerformanceCounter
VerifyVersionInfoA
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
GetSystemDirectoryA
QueryPerformanceFrequency
GetFileSize
DeleteCriticalSection
WideCharToMultiByte
lstrcpyW
MultiByteToWideChar
lstrcatW
OutputDebugStringW
GetCurrentDirectoryW
ReadFile
CreateDirectoryW
GetTempPathW
WaitForSingleObject
SetFileAttributesW
GetLastError
Sleep
DeleteFileW
MoveFileW
GetExitCodeProcess
GetCommandLineW
CreateMutexW
lstrcmpW
SetEvent
ResetEvent
CreateEventW
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
VerSetConditionMask
SleepEx
LeaveCriticalSection
EnterCriticalSection
GetEnvironmentVariableA
FileTimeToDosDateTime
GetTickCount
GetLocalTime
FileTimeToLocalFileTime
UnmapViewOfFile
SystemTimeToFileTime
LocalFileTimeToFileTime

user32

SetScrollPos
IntersectRect
SetScrollRange
EnableScrollBar
MoveWindow
GetScrollRange
FillRect
GetIconInfo
DestroyIcon
CharNextW
DrawTextW
DrawIconEx
InflateRect
SetWindowTextW
GetWindowTextLengthW
CreateAcceleratorTableW
RedrawWindow
GetScrollPos
GetScrollInfo
OffsetRect
AdjustWindowRectEx
CallWindowProcW
GetMenu
SetWindowPos
RegisterClassExW
ShowWindow
IsWindow
SetPropW
SetWindowLongW
PostQuitMessage
SystemParametersInfoW
GetClassInfoExW
LoadImageW
EnableWindow
GetWindowLongW
GetMessageW
DefWindowProcW
GetKeyState
GetWindow
GetWindowRect
GetFocus
DestroyWindow
ShowScrollBar
GetPropW
SetWindowRgn
CreateWindowExW
ScreenToClient
SendMessageW
GetSystemMetrics
DispatchMessageW
SetTimer
MapWindowPoints
IsRectEmpty
SetFocus
GetUpdateRect
TranslateMessage
LoadCursorW
SetCapture
SetCursor
GetClientRect
GetDlgItem
KillTimer
GetParent
RegisterWindowMessageW
PtInRect
ReleaseCapture
InvalidateRect
GetCursorPos
BeginPaint
EndPaint
GetDesktopWindow
GetDC
ReleaseDC
PostMessageW
EnumWindows
GetWindowTextW
MessageBoxW
MessageBoxA
wsprintfW
InvalidateRgn
SetRect

gdi32

RestoreDC
DeleteObject
CreateSolidBrush
CreateFontIndirectW
GetDeviceCaps
GetObjectW
TextOutW
CreateRectRgnIndirect
GetClipBox
CreatePen
StretchBlt
CreateDIBSection
CreateBitmap
SetBitmapBits
CombineRgn
GetRegionData
CreateRectRgn
ExtCreateRegion
GetBitmapBits
SetTextColor
DeleteDC
GetTextMetricsW
GetStockObject
SetWindowOrgEx
CreateCompatibleDC
SelectObject
SaveDC
CreateCompatibleBitmap
BitBlt
ExtTextOutW
RoundRect
ExtSelectClipRgn
SetStretchBltMode
MoveToEx
SelectClipRgn
GetTextExtentPoint32W
Rectangle
LineTo
SetBkMode
SetBkColor
GdiFlush

shell32

ShellExecuteW
ShellExecuteExW
SHGetFolderPathW

ole32

CoUninitialize
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
OleLockRunning
CoInitialize

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

msvcp140

?_Xlength_error@std@@YAXPBD@Z

shlwapi

PathFileExistsW

comctl32

ImageList_LoadImageW
_TrackMouseEvent
ImageList_GetIcon
ord17

vcruntime140

_except_handler4_common
_CxxThrowException
__current_exception_context
__current_exception
longjmp
wcschr
__std_terminate
memchr
strstr
memmove
strrchr
strchr
__CxxLongjmpUnwind
memset
wcsstr
_purecall
__std_exception_copy
__std_exception_destroy
__CxxFrameHandler3
_setjmp3
memcpy

api-ms-win-crt-stdio-l1-1-0

__p__commode
_lseeki64
_read
_write
_close
_open
__stdio_common_vsprintf
_set_fmode
ftell
fopen
fclose
fseek
fwrite
fread
__stdio_common_vfprintf
fgets
_wfopen_s
fflush
__stdio_common_vsscanf
fputc
__stdio_common_vswprintf
feof
_wfopen
fputs
__acrt_iob_func
_putws

api-ms-win-crt-heap-l1-1-0

free
calloc
_set_new_mode
malloc
realloc
_callnewh

api-ms-win-crt-runtime-l1-1-0

_errno
_wsystem
_invalid_parameter_noinfo_noreturn
_beginthreadex
exit
abort
terminate
_getpid
__sys_nerr
_controlfp_s
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_c_exit
_initialize_narrow_environment
_exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
strerror
_endthreadex
_initialize_onexit_table

api-ms-win-crt-string-l1-1-0

wcsncpy
tolower
iswalnum
strpbrk
wcstok
isspace
isdigit
_wcsicmp
_stricmp
_strdup
isprint
isalpha
strncpy
_wcslwr
isxdigit
isalnum
iscntrl
ispunct
islower
iswalpha
iswdigit
iswcntrl
iswspace
iswxdigit
strncmp
strcspn
strspn
_strlwr
isupper
toupper

api-ms-win-crt-utility-l1-1-0

qsort
rand
srand

api-ms-win-crt-convert-l1-1-0

strtod
wcstoul
wcstod
strtoul
atoi
strtoll
_wtoi
wcstol
strtol
_wtol

api-ms-win-crt-time-l1-1-0

_localtime64
_time64
_gmtime64
clock

api-ms-win-crt-filesystem-l1-1-0

_access
_unlink
_fstat64
_wrename
_wremove
_stat64

api-ms-win-crt-environment-l1-1-0

getenv
_wgetenv

api-ms-win-crt-math-l1-1-0

_libm_sse2_atan_precise
_libm_sse2_exp_precise
_libm_sse2_asin_precise
_libm_sse2_log10_precise
_libm_sse2_log_precise
floor
_libm_sse2_acos_precise
_CIfmod
_libm_sse2_pow_precise
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
_libm_sse2_tan_precise
_CIatan2
__setusermatherr
ceil
_libm_sse2_cos_precise

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

ws2_32

WSACleanup
WSAStartup
accept
htonl
WSAIoctl
ioctlsocket
WSASetLastError
__WSAFDIsSet
socket
setsockopt
select
freeaddrinfo
getpeername
ntohs
htons
getsockopt
getsockname
ntohl
connect
bind
WSAGetLastError
getaddrinfo
gethostname
send
sendto
recv
closesocket
listen
recvfrom

normaliz

IdnToAscii

wldap32

ord45
ord41
ord60
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord211
ord46
ord217
ord143
ord50

crypt32

CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptQueryObject
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertGetNameStringA
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CryptStringToBinaryA
CertCreateCertificateChainEngine
CertOpenStore

advapi32

CryptEncrypt
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey

Sections

.text
Size: 885KB - Virtual size: 884KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 176KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

830be15f85b2078748ffdbfe6f96d7be

Headers

DLL Characteristics

File Characteristics

Imports

winmm

d3d9

kernel32

user32

gdi32

shell32

ole32

oleaut32

msvcp140

shlwapi

comctl32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

ws2_32

normaliz

wldap32

crypt32

advapi32

Sections

.text Size: 885KB - Virtual size: 884KB

.rdata Size: 176KB - Virtual size: 176KB

.data Size: 13KB - Virtual size: 108KB

.rsrc Size: 30KB - Virtual size: 29KB

.reloc Size: 50KB - Virtual size: 49KB

.text
Size: 885KB - Virtual size: 884KB

.rdata
Size: 176KB - Virtual size: 176KB

.data
Size: 13KB - Virtual size: 108KB

.rsrc
Size: 30KB - Virtual size: 29KB

.reloc
Size: 50KB - Virtual size: 49KB