230992ef41752f4f2d5d4e0291031b246bc52c9a97eda9688fbe0152d7db39eb

Sharing

Copy URL Twitter E-mail

General

Target

230992ef41752f4f2d5d4e0291031b246bc52c9a97eda9688fbe0152d7db39eb
Size

3.7MB
MD5

818fe8c997c2f09e4ced718b7d599853
SHA1

d489ccc35e153d2c7a5482bfbb43f8cb59e4455e
SHA256

230992ef41752f4f2d5d4e0291031b246bc52c9a97eda9688fbe0152d7db39eb
SHA512

20cb590915216a54569eb5291bc0f9c738e8e9eec5cd052d37ca37ade00ba91cc2bc85aa1edbaf220049a31b67f90d3ed449f891ac5042328cc4bff2a8655fc5
SSDEEP

49152:B96DvHZwTKIjK/dMA6a5Q8g92+NyLwNQ57L+oJLkCnQZgb7k0WS2c4osxB0EEMA:qDvHZwBCX6p9jw1L++/QZMhWS3CxB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
230992ef41752f4f2d5d4e0291031b246bc52c9a97eda9688fbe0152d7db39eb

Files

230992ef41752f4f2d5d4e0291031b246bc52c9a97eda9688fbe0152d7db39eb
.exe windows:5 windows x86 arch:x86

09dfcf10be7b8a62a35de68b7fc5c42c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

dbghelp

MakeSureDirectoryPathExists

kernel32

CreateToolhelp32Snapshot
MoveFileExW
FindNextFileW
FindFirstFileW
GetFileAttributesW
SetFileAttributesW
CreateFileW
GetFullPathNameW
RemoveDirectoryW
GetTempFileNameW
GetStartupInfoW
lstrlenW
FindClose
SetFilePointer
WriteFile
GetExitCodeProcess
TerminateProcess
GetCurrentProcessId
OpenProcess
WritePrivateProfileStringW
GetPrivateProfileStringW
GetLocalTime
GetCurrentProcess
CreateProcessW
lstrcpynW
CreateMutexW
SetLastError
GetVersionExW
GetTickCount
GetModuleFileNameW
LoadLibraryExW
lstrcmpiW
SetErrorMode
QueryDepthSList
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
GetCommandLineW
lstrcmpW
GetTickCount64
MultiByteToWideChar
MoveFileW
CopyFileW
DeleteFileW
FindResourceExW
FindResourceW
GetModuleHandleW
LoadLibraryW
CreateEventW
CloseHandle
SizeofResource
LoadResource
WaitForMultipleObjects
WaitForSingleObject
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
Process32FirstW
RaiseException
GetShortPathNameW
GetProcessHeap
ReleaseSemaphore
VirtualProtect
GetThreadTimes
UnregisterWait
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SignalObjectAndWait
CreateTimerQueue
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
GetFileType
HeapSize
HeapFree
HeapReAlloc
FreeLibraryAndExitThread
ExitThread
RtlUnwind
InterlockedFlushSList
GetSystemWindowsDirectoryW
CreateFileA
lstrcmpiA
HeapAlloc
HeapDestroy
GetProcAddress
FreeLibrary
LockResource
DecodePointer
lstrcmpA
DeviceIoControl
GetLastError
Process32NextW
UnregisterWaitEx
RegisterWaitForSingleObject
OutputDebugStringA
GetModuleHandleExW
GetModuleHandleExA
GetModuleHandleA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
EncodePointer
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
LoadLibraryExA
GetStringTypeW
FormatMessageW
QueryPerformanceFrequency
DuplicateHandle
WaitForSingleObjectEx
Sleep
SwitchToThread
GetCurrentThread
GetNativeSystemInfo
TryEnterCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetFileTime
GetSystemDirectoryW
GetTempPathW
CreateDirectoryW
GetFileSize
ReadFile
SetEndOfFile
GetStdHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetFileSizeEx
LocalFree
ReleaseMutex
LocalFileTimeToFileTime
DosDateTimeToFileTime
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
FlushFileBuffers
GetACP
FreeResource
ExitProcess
MulDiv
IsBadReadPtr
ResetEvent
GetVersion
InterlockedExchange
InterlockedCompareExchange
ResumeThread
CreateThread
SetThreadPriority
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SetFilePointerEx

user32

PostMessageW
DestroyIcon
UnregisterClassW
LoadImageW
MoveWindow
wsprintfW
CopyRect
OffsetRect
UnionRect
EqualRect
SetCursor
DrawFocusRect
RegisterClassW
EnableWindow
GetMenu
SetPropW
GetPropW
AdjustWindowRectEx
wvsprintfW
InflateRect
IsChild
GetFocus
GetKeyState
GetUpdateRect
IsRectEmpty
GetClassNameW
IntersectRect
IsIconic
SetWindowRgn
FindWindowExW
CharPrevW
DrawTextW
SetRect
DrawIconEx
CreateCaret
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
GetSysColor
RemovePropW
GetWindowDC
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
CreateAcceleratorTableW
InvalidateRgn
FillRect
PeekMessageW
WaitMessage
CallMsgFilterW
GetQueueStatus
MsgWaitForMultipleObjectsEx
GetIconInfo
LoadStringW
DispatchMessageW
TranslateMessage
GetMessageW
LoadCursorW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
FindWindowW
GetSystemMetrics
CreateDialogParamW
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW
LoadIconW
GetWindow
GetParent
GetDesktopWindow
SetWindowLongW
GetWindowLongW
PtInRect
MapWindowPoints
ScreenToClient
GetCursorPos
GetWindowRect
MessageBoxW
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
SetForegroundWindow
SwitchToThisWindow
UpdateWindow
KillTimer
SetTimer
ReleaseCapture
SetCapture
GetAsyncKeyState
SetFocus
IsZoomed
IsWindowVisible
SetWindowPos
UpdateLayeredWindow
ShowWindow
IsWindow
CreateWindowExW
PostQuitMessage
SendMessageW
RegisterWindowMessageW
CharNextW
DestroyWindow
DefWindowProcW
GetClientRect

gdi32

GetCharABCWidthsW
GetClipBox
LineTo
RoundRect
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
BitBlt
SetTextColor
MoveToEx
TextOutW
ExtTextOutW
CombineRgn
CreateDCW
SetDIBitsToDevice
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
CreateRectRgnIndirect
DeleteDC
DeleteObject
RestoreDC
SaveDC
SelectClipRgn
SelectObject
CreateRoundRectRgn
CreateDIBSection
GetObjectW
GetDIBits
SetWindowOrgEx
GetTextMetricsW
Rectangle
SetViewportOrgEx
GetStockObject
CreatePen
CreateFontIndirectW
OffsetViewportOrgEx
GetDeviceCaps
RectVisible
GetTextExtentPoint32W
SetStretchBltMode

advapi32

CheckTokenMembership
LookupPrivilegeValueW
FreeSid
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
GetTokenInformation
RegQueryValueExW
RegCreateKeyW

shell32

ord165
ShellExecuteExW
SHCreateDirectoryExW
ShellExecuteW
SHGetSpecialFolderPathW
Shell_NotifyIconW
SHFileOperationW
SHChangeNotify

ole32

CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoUninitialize
CoInitialize
CoCreateGuid
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
OleLockRunning

oleaut32

SafeArrayPutElement
SafeArrayCreate
VariantClear
SysAllocString
SysFreeString
VarUI4FromStr
VariantInit
SysAllocStringLen

shlwapi

PathIsDirectoryA
PathFindFileNameW
PathFileExistsA
SHSetValueW
SHGetValueW
PathCombineW
StrCpyW
SHDeleteKeyW
PathRemoveFileSpecW
PathIsDirectoryW
PathFileExistsW
StrStrIW
StrStrIA
StrCmpIW
StrTrimA
StrCmpNIW
SHSetValueA
SHGetValueA
AssocQueryStringW
PathAppendW

psapi

EnumProcesses
EnumProcessModules
GetModuleFileNameExW

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

comctl32

InitCommonControlsEx
_TrackMouseEvent
ord17

gdiplus

GdiplusShutdown
GdipDrawEllipseI
GdipDrawPath
ord1
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImagePointsI
GdipFillPath
GdipSetInterpolationMode
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCloneBitmapAreaI
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipSaveImageToFile
GdiplusStartup
GdipAlloc
GdipFree
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipGetImageWidth
GdipGetImageHeight
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetTextRenderingHint
GdipFillRectangleI
GdipDrawImageRectRect
GdipDrawImageRectRectI
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDrawString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipSetSmoothingMode
GdipFillEllipseI
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipGraphicsClear
GdipDrawImageRectI
GdipCreatePath
GdipDeletePath
GdipClosePathFigure
GdipAddPathArcI
GdipCreateTexture

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

wininet

InternetSetCookieW
InternetGetConnectedState
InternetCrackUrlW
InternetGetCookieExW

iphlpapi

GetAdaptersInfo

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

msimg32

GradientFill
AlphaBlend

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 308KB - Virtual size: 308KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

09dfcf10be7b8a62a35de68b7fc5c42c

Headers

DLL Characteristics

File Characteristics

Imports

dbghelp

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

psapi

urlmon

comctl32

gdiplus

version

crypt32

wintrust

wininet

iphlpapi

winmm

msimg32

imm32

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 308KB - Virtual size: 308KB

.data Size: 30KB - Virtual size: 46KB

.rsrc Size: 1.9MB - Virtual size: 1.9MB

.reloc Size: 79KB - Virtual size: 79KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 308KB - Virtual size: 308KB

.data
Size: 30KB - Virtual size: 46KB

.rsrc
Size: 1.9MB - Virtual size: 1.9MB

.reloc
Size: 79KB - Virtual size: 79KB