c45e1524f4c341b7716e9af4f164669d9e848d63c56bfd57359f9dfbddb18bec

Sharing

Copy URL

Twitter E-mail

General

Target

c45e1524f4c341b7716e9af4f164669d9e848d63c56bfd57359f9dfbddb18bec
Size

4.9MB
MD5

5478870cf8cfa0f7f8eca138689aefe6
SHA1

e631a502057fc5565718ab32d41ccd8b45e22739
SHA256

c45e1524f4c341b7716e9af4f164669d9e848d63c56bfd57359f9dfbddb18bec
SHA512

397fdae9b6d0a03930ff341bc23b176e1c4e217201461b83af60ffdf41b5a0821f5cb611252c12bc273d825aae87f8a63a407dee0d08ab98322b1501957b0df7
SSDEEP

98304:vI4zmJrlQdM9AaUsNObcIzOu0EOhEhpWjKj7:vNmrQuCaU6lx9E

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c45e1524f4c341b7716e9af4f164669d9e848d63c56bfd57359f9dfbddb18bec

Files

c45e1524f4c341b7716e9af4f164669d9e848d63c56bfd57359f9dfbddb18bec
.exe windows:6 windows x86 arch:x86

54aad4da230159a26bc6d8e4afea7e50

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FlushConsoleInputBuffer
lstrlenA
lstrcatA
GlobalMemoryStatus
ReadConsoleInputA
SetConsoleMode
Module32FirstW
GetTempPathW
GetThreadIOPendingFlag
CreateWaitableTimerW
DuplicateHandle
GetOverlappedResult
CreateNamedPipeW
SetNamedPipeHandleState
DisconnectNamedPipe
ConnectNamedPipe
ReadFile
CreateMutexW
ReleaseMutex
CopyFileW
GetCommandLineW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
MoveFileExW
QueryFullProcessImageNameW
lstrcmpW
LocalFree
LocalAlloc
OpenProcess
GetStartupInfoW
CreateProcessW
GetCurrentThread
OutputDebugStringW
WriteFile
SetFileAttributesW
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
SetStdHandle
SetConsoleCtrlHandler
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
GetTimeFormatW
GetDateFormatW
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetModuleHandleExW
ExitThread
RtlUnwind
UnregisterWaitEx
SetEndOfFile
RemoveDirectoryW
GetFileSize
GetFileAttributesW
GetFileAttributesA
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CreateFileA
CreateDirectoryW
lstrlenW
lstrcpynW
LoadLibraryW
IsBadReadPtr
VirtualProtect
GetCurrentThreadId
GetCurrentProcessId
SetUnhandledExceptionFilter
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
SetFilePointer
GetFileAttributesExW
CreateFileW
GetCurrentProcess
CloseHandle
WideCharToMultiByte
lstrcmpiW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
GetExitCodeProcess
TerminateProcess
CancelWaitableTimer
SetWaitableTimer
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetLastError
RaiseException
DecodePointer
MultiByteToWideChar
FindResourceW
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualAlloc
FreeLibraryAndExitThread
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
HeapCreate
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
UnlockFileEx
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
FlushViewOfFile
GetVersionExA
DeleteFileA
GetSystemInfo
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
GetQueuedCompletionStatus
CreateIoCompletionPort
VerifyVersionInfoA
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
VerSetConditionMask
PeekNamedPipe
GetStdHandle
GetFileType
ExpandEnvironmentStringsA
SleepEx
FormatMessageA
GetThreadTimes
FileTimeToSystemTime
GetComputerNameA
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetLocalTime
ResumeThread
GetTempFileNameW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetTickCount
WaitForMultipleObjects
Sleep
CreateEventW
WaitForSingleObject
ResetEvent
SetEvent
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
GetVersion
SystemTimeToFileTime
GetSystemTime
LocalFileTimeToFileTime
ExitProcess
MulDiv
GetACP
GetSystemWindowsDirectoryW
FreeResource
InterlockedCompareExchange
HeapAlloc
IsValidLocale
GetSystemDirectoryW
lstrcmpiA
lstrcmpA
FlushFileBuffers
InterlockedDecrement
IsDebuggerPresent
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
TryEnterCriticalSection
GetStringTypeW
FormatMessageW
GetCurrentDirectoryW
FindFirstFileExW
GetFileInformationByHandle
GetFullPathNameW
SetFileTime
AreFileApisANSI
SetLastError
DeviceIoControl
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetCPInfo
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetVersionExW
OpenFileMappingW
GetFileSizeEx
InterlockedIncrement
HeapDestroy

user32

DrawTextW
mouse_event
SetFocus
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
IsIconic
LoadImageW
MonitorFromWindow
GetClassNameW
IsWindowVisible
GetWindowTextW
EnumWindows
FindWindowW
CharNextW
IsWindowEnabled
DestroyWindow
IsWindow
PostMessageW
SendMessageW
GetDC
BeginPaint
EndPaint
InvalidateRgn
GetClientRect
FillRect
SetRect
CopyRect
IsRectEmpty
EnumDisplayMonitors
GetWindowLongW
SetParent
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
SetWindowPos
PostQuitMessage
GetWindowRect
PtInRect
MsgWaitForMultipleObjectsEx
SendMessageTimeoutW
PeekMessageW
DispatchMessageW
TranslateMessage
ClientToScreen
SystemParametersInfoW
ScreenToClient
ChangeWindowMessageFilter
UnhookWinEvent
SetWinEventHook
SetActiveWindow
SetWindowTextW
ShowWindow
MonitorFromPoint
EnumDisplaySettingsW
GetIconInfo
DestroyIcon
GetWindowThreadProcessId
GetShellWindow
FindWindowExW
GetWindowTextLengthW
ReleaseDC
SetForegroundWindow
GetForegroundWindow
BringWindowToTop
wvsprintfW
SetCursor
LoadCursorW
GetMessageW
CreateWindowExW
IsChild
UpdateLayeredWindow
IsZoomed
GetFocus
GetKeyState
SetCapture
ReleaseCapture
GetUpdateRect
InvalidateRect
CreateCaret
GetCaretBlinkTime
SetCaretPos
MapWindowPoints
SetWindowLongW
GetParent
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
SetWindowRgn
MessageBoxW
CharPrevW
DrawIconEx
RemovePropW
HideCaret
ShowCaret
GetSysColor
GetWindowDC
GetMessagePos
GetDlgCtrlID
DrawFocusRect
CreateAcceleratorTableW
MoveWindow
AttachThreadInput
KillTimer
SetTimer
GetMonitorInfoW
GetCursorPos
wsprintfW
OffsetRect
UnionRect
IntersectRect
InflateRect
RealGetWindowClassW
GetWindow
GetTopWindow
GetDesktopWindow

gdi32

CreateFontIndirectW
RestoreDC
SaveDC
GetTextMetricsW
SetWindowOrgEx
CreateRoundRectRgn
GetDeviceCaps
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
SelectClipRgn
ExtSelectClipRgn
BitBlt
StretchBlt
SetStretchBltMode
CreateDIBSection
SetDIBColorTable
TextOutW
ExtTextOutW
SetDIBitsToDevice
GetTextColor
SetBkMode
SetTextColor
GetDIBits
GetObjectW
CombineRgn
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
CreateFontW
CreatePen
CreatePatternBrush
CreateRectRgn
CreateRectRgnIndirect
CreateSolidBrush
SelectObject
DeleteObject
GetStockObject
SetBkColor
Rectangle
DeleteDC

advapi32

DeregisterEventSource
RegSetKeyValueW
ConvertSidToStringSidA
LookupAccountNameA
RegCreateKeyW
RegQueryValueExA
RegisterEventSourceA
ReportEventA
RegOpenKeyExA
RegEnumKeyExA
GetUserNameW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegGetValueW
LookupPrivilegeValueW
GetTokenInformation
DuplicateTokenEx
AdjustTokenPrivileges
OpenProcessToken
RegQueryValueExW
RegNotifyChangeKeyValue
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey

shell32

ShellExecuteExW
ord680
SHGetFolderPathW
SHGetSpecialFolderPathW
ord165
ord727
SHGetFileInfoW
ShellExecuteW
SHCreateDirectoryExW

ole32

CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
OleLockRunning
CoTaskMemRealloc
OleInitialize
CoCreateGuid
CoInitialize
CoTaskMemFree
CoUninitialize
CoTaskMemAlloc
CoCreateInstance
OleUninitialize

oleaut32

SysAllocString
VariantClear
SafeArrayPutElement
SafeArrayCreate
VariantInit
VarUI4FromStr

shlwapi

PathIsDirectoryW
StrStrIW
StrStrIA
SHGetValueA
SHSetValueA
StrCmpNIW
StrTrimA
StrCmpIW
PathFindFileNameW
SHAutoComplete
PathFileExistsW
StrToIntW
PathRemoveExtensionW
PathStripPathW
PathRemoveFileSpecW
PathFindExtensionW
PathAppendW
PathCombineW
wnsprintfW
SHCreateStreamOnFileEx
PathAddExtensionW
PathRemoveExtensionA
SHGetValueW
SHSetValueW

gdiplus

GdipCreatePath
GdipDeletePath
GdipAddPathLineI
GdipAddPathArcI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipSetPenDashStyle
GdipCreateFromHDC
GdipDrawLineI
GdipDrawRectangleI
GdipDrawPath
GdipFillEllipseI
GdipClosePathFigure
GdipCreateTexture
GdipCreateBitmapFromStream
GdipCreateHBITMAPFromBitmap
GdipCloneBitmapAreaI
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGraphicsClear
GdipFillPath
GdipDrawImagePointsI
GdipDrawImageRectRectI
GdipAddPathArc
GdipDrawEllipseI
GdipLoadImageFromFile
GdipGetImagePixelFormat
GdipDrawImageRectI
GdipLoadImageFromStreamICM
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipAlloc
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipCreateBitmapFromHBITMAP
GdipGetImageHeight
GdipDrawImageRectRect
GdipGetImageEncodersSize
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipDeleteGraphics
GdipBitmapSetPixel
GdipGetImageEncoders
GdiplusShutdown
GdipSaveImageToStream
GdipGetImageGraphicsContext
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipGetImageWidth

msimg32

GradientFill
AlphaBlend

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

ws2_32

getaddrinfo
WSAIoctl
setsockopt
accept
getsockname
getpeername
recv
closesocket
bind
send
WSASetLastError
select
__WSAFDIsSet
socket
WSAGetLastError
WSACleanup
WSAStartup
listen
htons
ntohs
recvfrom
sendto
ioctlsocket
gethostname
freeaddrinfo
getsockopt
connect

comctl32

_TrackMouseEvent
ImageList_DrawEx
ImageList_GetIconSize
InitCommonControlsEx
ord17

crypt32

CertFindCertificateInStore
CertGetNameStringW
CryptQueryObject
CryptMsgGetParam

wldap32

ord50
ord211
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord46
ord217
ord143
ord41
ord22
ord60

iphlpapi

GetAdaptersInfo

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

wininet

InternetGetConnectedState

libssl-1_1

SSL_CTX_use_certificate_chain_file
SSL_SESSION_free
SSL_set_session
SSL_get_peer_certificate
SSL_get_peer_cert_chain
SSL_CTX_set_verify
SSL_CTX_use_PrivateKey
SSL_CTX_use_certificate
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_check_private_key
SSL_new
SSL_free
SSL_connect
SSL_read
SSL_write
SSL_ctrl
SSL_CTX_ctrl
SSL_get_error
TLS_client_method
SSL_shutdown
SSL_alert_desc_string_long
SSL_CTX_add_client_CA
SSL_set_connect_state
SSL_get_certificate
SSL_get_privatekey
SSL_version
SSL_CTX_load_verify_locations
SSL_get_session
SSL_get_verify_result
SSL_get_client_random
SSL_SESSION_get_master_key
SSL_set_ex_data
SSL_get_ex_data
SSL_CTX_use_PrivateKey_file
SSL_set_bio
SSL_set_fd
SSL_pending
SSL_CIPHER_get_name
SSL_get_current_cipher
SSL_CTX_get_cert_store
SSL_CTX_free
SSL_CTX_new
SSL_CTX_set_cipher_list
BIO_f_ssl
SSL_get0_alpn_selected
SSL_CTX_set_alpn_protos
SSL_CTX_set_next_proto_select_cb
SSL_CTX_sess_set_new_cb
SSL_CTX_set_msg_callback
SSL_CTX_use_certificate_file
SSL_CTX_set_options

libcrypto-1_1

DSA_get0_key
X509_get0_extensions
X509_get_X509_PUBKEY
X509_get0_notAfter
X509_get_version
DSA_get0_pqg
DH_get0_key
DH_get0_pqg
RSA_get0_key
EVP_PKEY_get0_DH
EVP_PKEY_get0_DSA
EVP_PKEY_get0_RSA
EVP_MD_CTX_free
EVP_MD_CTX_new
ASN1_STRING_get0_data
OpenSSL_version_num
OPENSSL_sk_pop
OPENSSL_sk_pop_free
OPENSSL_sk_value
OPENSSL_sk_num
X509_get0_notBefore

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 648KB - Virtual size: 648KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 363KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

54aad4da230159a26bc6d8e4afea7e50

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

msimg32

version

urlmon

ws2_32

comctl32

crypt32

wldap32

iphlpapi

wintrust

wininet

libssl-1_1

libcrypto-1_1

Sections

.text Size: 3.7MB - Virtual size: 3.7MB

.rdata Size: 648KB - Virtual size: 648KB

.data Size: 73KB - Virtual size: 126KB

.rsrc Size: 363KB - Virtual size: 363KB

.reloc Size: 171KB - Virtual size: 170KB

.text
Size: 3.7MB - Virtual size: 3.7MB

.rdata
Size: 648KB - Virtual size: 648KB

.data
Size: 73KB - Virtual size: 126KB

.rsrc
Size: 363KB - Virtual size: 363KB

.reloc
Size: 171KB - Virtual size: 170KB