c56edaa8099d95afc52da7b34303f5be017525086b4f0c0c4177103cc5310d73

Sharing

Copy URL Twitter E-mail

General

Target

c56edaa8099d95afc52da7b34303f5be017525086b4f0c0c4177103cc5310d73
Size

10.0MB
MD5

836f34c66f8bac3c1f1de52604e301e2
SHA1

70888fa17d35e837b726c0281b68d522bbf69b60
SHA256

c56edaa8099d95afc52da7b34303f5be017525086b4f0c0c4177103cc5310d73
SHA512

98898060cbafe1d1f216d5aa794610c1c423320ea6891be1786e5a326841d778094b526ceb7ac1f757671649f4aa5bb5b8dad963fda93857d85f26dbdf274e4d
SSDEEP

196608:yvsY8O7MgIl0ayf1ke4eXlT3xeRGMTg+/kyw3KAKmERPDqFSIN2:usXf1lj8BczwNvEdWk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c56edaa8099d95afc52da7b34303f5be017525086b4f0c0c4177103cc5310d73

Files

c56edaa8099d95afc52da7b34303f5be017525086b4f0c0c4177103cc5310d73
.exe windows:5 windows x86 arch:x86

000935a8cddb62ca66a715bb925facab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

WSAStartup
gethostbyname
__WSAFDIsSet
select
inet_ntoa
recv
WSAGetLastError
htonl
ioctlsocket
setsockopt
inet_addr
socket
htons
connect
send
WSACleanup
closesocket

shlwapi

PathStripToRootW
SHSetValueW
PathIsDirectoryW
StrStrIW
StrStrA
PathRemoveBackslashW
PathFileExistsW
PathRemoveFileSpecW
PathAppendW
PathRemoveExtensionA
PathFindFileNameA
StrStrIA
SHGetValueW
PathFindFileNameW
SHDeleteKeyW
PathCombineW

kernel32

lstrcpynA
FlushFileBuffers
GetTickCount
GetCommandLineW
GetCurrentProcessId
SetFileValidData
LoadLibraryW
FreeLibrary
GetProcAddress
GetCurrentProcess
GetFileAttributesW
FindFirstFileW
RemoveDirectoryW
lstrcmpiW
FindNextFileW
DeleteFileW
FindClose
GetModuleHandleA
SetErrorMode
GetDiskFreeSpaceExW
GetLogicalDriveStringsW
GetDriveTypeW
GetTempPathW
lstrcpyW
GetModuleFileNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
TerminateProcess
Sleep
GetUserDefaultUILanguage
LoadLibraryExW
InterlockedDecrement
InterlockedIncrement
CreateMutexW
WritePrivateProfileStringW
ProcessIdToSessionId
WTSGetActiveConsoleSessionId
GetSystemInfo
GetModuleHandleW
lstrcmpW
LocalFree
SystemTimeToFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
GetProcessHeap
HeapDestroy
DecodePointer
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
GetConsoleCP
ReadConsoleW
lstrcpynW
SetFilePointerEx
HeapAlloc
FindResourceW
LoadResource
FindResourceExW
RaiseException
HeapReAlloc
LockResource
GetPrivateProfileStringW
HeapSize
FreeResource
InitializeCriticalSectionAndSpinCount
HeapFree
SizeofResource
lstrlenW
MultiByteToWideChar
GetModuleFileNameA
GetModuleHandleExW
WaitForMultipleObjects
GetExitCodeThread
SetThreadPriority
ResumeThread
TerminateThread
GetCurrentThreadId
SetEndOfFile
lstrlenA
ResetEvent
SetEvent
CreateEventW
WaitForSingleObject
InitializeCriticalSection
SetFileAttributesW
SetFileTime
CreateDirectoryW
DeleteCriticalSection
LeaveCriticalSection
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
TlsGetValue
GetStdHandle
EnterCriticalSection
GetVersionExW
VirtualAlloc
VirtualFree
GetFileSize
CloseHandle
GetLastError
TlsAlloc
SetLastError
GetCPInfo
EncodePointer
GetSystemTimeAsFileTime
FindFirstFileExW
FreeLibraryAndExitThread
ExitThread
CreateThread
RtlUnwind
InterlockedPushEntrySList
CreateFileW
SetFilePointer
WriteFile
ReadFile
TlsSetValue
TlsFree
GetPrivateProfileIntW
GetLocalTime
GetConsoleMode
WideCharToMultiByte
CompareStringW
GlobalUnlock
GlobalLock
GlobalAlloc
DosDateTimeToFileTime
DuplicateHandle
GetFileType
MulDiv
GetACP
ExitProcess
GetCurrentDirectoryW
OutputDebugStringW
LCMapStringW
GetLocaleInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
WaitForSingleObjectEx
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetStringTypeW

user32

IsWindow
FindWindowW
MessageBoxW
PostMessageW
KillTimer
SetTimer
DispatchMessageW
TranslateMessage
GetMessageW
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
ShowWindow
IsWindowVisible
IsIconic
SetFocus
SetPropW
GetPropW
GetClientRect
GetWindowLongW
SetWindowLongW
GetWindowRect
GetWindow
LoadCursorW
DestroyIcon
MonitorFromWindow
GetMonitorInfoW
DestroyWindow
UpdateLayeredWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
GetDC
ReleaseDC
CharNextW
EndPaint
GetUpdateRect
InvalidateRect
GetCursorPos
CreateCaret
GetCaretBlinkTime
SetCaretPos
ScreenToClient
IntersectRect
UnionRect
IsRectEmpty
PtInRect
IsZoomed
SetWindowRgn
SetCursor
InflateRect
OffsetRect
HideCaret
ShowCaret
GetCaretPos
ClientToScreen
GetSysColor
EqualRect
MoveWindow
GetWindowRgn
CharPrevW
DrawTextW
FillRect
SetRect
MapWindowPoints
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
CreateAcceleratorTableW
InvalidateRgn
RegisterWindowMessageW
PeekMessageW
PostThreadMessageW
SetWindowPos
EnableWindow
SendMessageW
BeginPaint
PostQuitMessage
GetParent

advapi32

LookupAccountNameW
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
GetAce
EqualSid
AddAce
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
SetFileSecurityW
RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
GetTokenInformation
DuplicateTokenEx
OpenProcessToken
AddAccessAllowedAceEx
SetSecurityDescriptorControl
GetExplicitEntriesFromAclW
DeleteAce
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
GetUserNameW
GetFileSecurityW

shell32

ord680
SHChangeNotify
SHFileOperationW
SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteW
SHGetSpecialFolderPathW

ole32

OleUninitialize
OleInitialize
OleLockRunning
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
CoInitializeEx
CoUninitialize
CoCreateInstance
CoInitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

SysStringLen
SysFreeString
SysAllocString
VarUI4FromStr
VariantInit
VariantClear

userenv

CreateEnvironmentBlock

comctl32

ord17
_TrackMouseEvent

wininet

InternetCrackUrlW
InternetTimeToSystemTimeA
InternetGetCookieA
InternetSetCookieA

urlmon

ObtainUserAgentString
UrlMkGetSessionOption

gdi32

MoveToEx
StretchBlt
SetBkMode
TextOutW
SetStretchBltMode
SetTextColor
SetBkColor
CreateFontIndirectW
CreatePen
DeleteDC
DeleteObject
GetStockObject
RestoreDC
SaveDC
SelectObject
GetTextMetricsW
CreateDIBSection
GetObjectW
CreateRoundRectRgn
GetDeviceCaps
CreateRectRgn
PtInRegion
CombineRgn
ExtSelectClipRgn
SelectClipRgn
RoundRect
Rectangle
LineTo
GetTextExtentPoint32W
GetClipBox
GetCharABCWidthsW
CreateSolidBrush
CreatePenIndirect
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateRectRgnIndirect

imm32

ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow

gdiplus

GdipCreatePen1
GdipDrawImageRectRectI
GdipDrawImageRectI
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipDeletePen
GdipFillEllipse
GdipDrawArc
GdiplusStartup
GdiplusShutdown
GdipAlloc
GdipFree
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipFillRectangleI
GdipCreateFontFromDC
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList

Sections

.text
Size: 675KB - Virtual size: 675KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 188KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 180.9MB - Virtual size: 180.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

000935a8cddb62ca66a715bb925facab

Headers

DLL Characteristics

File Characteristics

Imports

wsock32

shlwapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

userenv

comctl32

wininet

urlmon

gdi32

imm32

gdiplus

Sections

.text Size: 675KB - Virtual size: 675KB

.rdata Size: 188KB - Virtual size: 187KB

.data Size: 10KB - Virtual size: 26KB

.tls Size: 512B - Virtual size: 9B

.gfids Size: 1024B - Virtual size: 992B

.rsrc Size: 180.9MB - Virtual size: 180.9MB

.reloc Size: 39KB - Virtual size: 39KB

.text
Size: 675KB - Virtual size: 675KB

.rdata
Size: 188KB - Virtual size: 187KB

.data
Size: 10KB - Virtual size: 26KB

.tls
Size: 512B - Virtual size: 9B

.gfids
Size: 1024B - Virtual size: 992B

.rsrc
Size: 180.9MB - Virtual size: 180.9MB

.reloc
Size: 39KB - Virtual size: 39KB