f2afd81bd693e06c25cdb9ecf80a143d5469427f96c0fa4f867d7d29de31197e

Sharing

Copy URL Twitter E-mail

General

Target

f2afd81bd693e06c25cdb9ecf80a143d5469427f96c0fa4f867d7d29de31197e
Size

1.8MB
MD5

33ba67f30226202d968a69e15af00349
SHA1

64c5c0e6071eccb3a0601c7f0b4e68ea16e5d679
SHA256

f2afd81bd693e06c25cdb9ecf80a143d5469427f96c0fa4f867d7d29de31197e
SHA512

cbd30aea5ca1049cf8c3038ad052d8087bd4a6d2139c4343cd31f79be8ea50bfea7e304f687d2511845e33601f12eb500b1bd585a228aedfaf5a08d6fafd6910
SSDEEP

24576:wH/2cL09tEqewcGKUG5TLXKVqx961gCPhf2OBtbQt4HnTwdvABbb0hfAvuytR31V:weq7qwtXKVcRCPt2OHTwFABX08NlCw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f2afd81bd693e06c25cdb9ecf80a143d5469427f96c0fa4f867d7d29de31197e

Files

f2afd81bd693e06c25cdb9ecf80a143d5469427f96c0fa4f867d7d29de31197e
.exe windows:5 windows x86 arch:x86

933202c393a31fb52dddda1de060eab3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateEventW
GetTickCount
CloseHandle
WaitForSingleObject
SetEvent
Sleep
GetLongPathNameW
LocalFree
InitializeCriticalSection
FindResourceExW
FindResourceW
DeleteFileW
MoveFileExW
DecodePointer
InterlockedIncrement
InterlockedDecrement
FreeLibrary
GetProcAddress
GetShortPathNameW
DebugBreak
lstrcmpiW
LoadLibraryExW
GetModuleHandleW
CopyFileW
InterlockedExchange
GetModuleFileNameW
SizeofResource
LoadResource
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
LockResource
WideCharToMultiByte
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetFileInformationByHandle
CompareFileTime
FindCloseChangeNotification
FindFirstChangeNotificationW
SearchPathW
CreateDirectoryW
GetCurrentDirectoryW
FindFirstFileA
SetEndOfFile
WriteConsoleW
WaitForSingleObjectEx
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
GetWindowsDirectoryW
FindFirstFileExW
FindFirstFileExA
SetConsoleCtrlHandler
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
CreateProcessA
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
EnterCriticalSection
SetLastError
GetLastError
CreateThread
GetFileType
SetStdHandle
InterlockedFlushSList
RtlUnwind
FreeResource
InterlockedCompareExchange
lstrcmpiA
lstrcmpA
DeviceIoControl
OpenFileMappingW
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStringTypeW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
FormatMessageW
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
IsDebuggerPresent
GetDiskFreeSpaceExW
GetSystemDirectoryW
GetDriveTypeW
GetLogicalDriveStringsW
GetFileAttributesW
CreateFileA
GetFullPathNameW
RemoveDirectoryW
GetTempPathA
DeleteFileA
GetSystemWindowsDirectoryW
GetCurrentThread
GetLocalTime
GetFileSizeEx
GetExitCodeThread
TerminateThread
WTSGetActiveConsoleSessionId
ProcessIdToSessionId
lstrlenW
lstrcpynW
FindNextFileA
SetFileTime
lstrcmpW
ReleaseMutex
GetSystemDefaultLangID
GetSystemInfo
GetCurrentThreadId
RaiseException
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
OpenProcess
GetCurrentProcessId
CreateMutexW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetVersionExW
MulDiv
VirtualAllocEx
VirtualFreeEx
GetCurrentProcess
GetExitCodeProcess
ReadProcessMemory
WriteProcessMemory
GetFileSize
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
FindClose
GetFileTime
LoadLibraryW
GetPrivateProfileStringW
GetTempPathW
GetTempFileNameW
CreateFileW
SetFileAttributesW
GetFileAttributesExW
FindFirstFileW
FindNextFileW
MoveFileW
AllocConsole
GetConsoleWindow
LocalAlloc
TerminateProcess
WaitForMultipleObjects
CreateProcessW
GetStartupInfoW
Module32FirstW
Module32NextW
OutputDebugStringA
OutputDebugStringW
SetFilePointer
ResetEvent

user32

GetSystemMetrics
SetWindowPos
DestroyWindow
PostQuitMessage
SendMessageW
GetWindowTextLengthW
RedrawWindow
LoadCursorW
GetParent
SetWindowLongW
GetWindowLongW
GetWindowRect
GetClientRect
MoveWindow
BeginPaint
EndPaint
SetWindowTextW
ScreenToClient
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
CallWindowProcW
CopyRect
SetRect
OffsetRect
IsRectEmpty
GetDC
UpdateLayeredWindow
IsWindowVisible
SetTimer
KillTimer
SetWindowRgn
FindWindowExW
GetWindowThreadProcessId
BringWindowToTop
DialogBoxParamW
EndDialog
GetActiveWindow
IsDialogMessageW
PtInRect
SystemParametersInfoW
WaitForInputIdle
GetShellWindow
PostThreadMessageW
LoadStringW
SendMessageTimeoutW
UnregisterClassA
wsprintfW
DefWindowProcW
MapWindowPoints
GetWindow
LoadImageW
MonitorFromWindow
GetMonitorInfoW
GetWindowTextW
EnableWindow
InvalidateRect
ReleaseDC
SetCursor
PostMessageW
ShowWindow
FindWindowW
MessageBoxW
CharNextW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW

gdi32

SaveDC
CreateCompatibleBitmap
CombineRgn
CreateRectRgn
EnumFontFamiliesW
CreateFontIndirectW
GetDeviceCaps
GetTextExtentPoint32W
GetStockObject
CreateCompatibleDC
CreateFontW
BitBlt
RestoreDC
ExtTextOutW
SetBkMode
SetBkColor
SetViewportOrgEx
SelectObject
DeleteObject
DeleteDC

advapi32

SetTokenInformation
RegGetValueW
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCreateKeyW
RegQueryValueExW
CryptContextAddRef
CryptDecrypt
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
CreateWellKnownSid
GetLengthSid
DuplicateTokenEx
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
RevertToSelf
GetTokenInformation
ImpersonateLoggedOnUser
CreateProcessAsUserW
RegOpenCurrentUser
OpenThreadToken
EqualSid
RegEnumValueW
CloseServiceHandle
OpenSCManagerW
OpenServiceW
QueryServiceStatus
GetUserNameW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetKeyParam
CryptGenRandom
CryptImportKey
CryptEncrypt

shell32

SHGetFolderPathW
CommandLineToArgvW
SHGetDesktopFolder
ord165
SHGetFolderPathA
SHGetSpecialFolderPathW
SHCreateDirectoryExA
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHFileOperationW
SHCreateDirectoryExW
ShellExecuteW
ShellExecuteExW
SHChangeNotify

ole32

CoSetProxyBlanket
CoInitializeEx
CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemAlloc
OleRun
CLSIDFromProgID
StringFromGUID2
CoInitializeSecurity
CoCreateGuid
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemRealloc

oleaut32

SysStringLen
GetErrorInfo
SetErrorInfo
CreateErrorInfo
SysStringByteLen
SysFreeString
VarUI4FromStr
VariantChangeType
VariantCopy
VariantClear
VariantInit
SysAllocString
SysAllocStringByteLen

wininet

InternetCrackUrlW
InternetGetConnectedState

shlwapi

StrToIntExW
SHGetValueA
StrCmpNIW
StrTrimA
StrStrIW
StrCmpIW
PathIsRootW
StrStrIA
PathAppendW
PathRemoveFileSpecW
PathFileExistsW
PathFindFileNameW
PathIsRelativeW
StrCmpW
PathCanonicalizeW
PathIsDirectoryW
SHGetValueW
SHSetValueW
AssocQueryStringW
PathCompactPathW
PathFindExtensionA
PathFindExtensionW
PathFindFileNameA
wnsprintfW
PathRelativePathToW
PathCombineW
PathAppendA
PathUnquoteSpacesW
PathRemoveArgsW
PathIsPrefixW
SHSetValueA
PathCombineA
SHDeleteKeyW

comctl32

_TrackMouseEvent
InitCommonControlsEx

gdiplus

GdipGetImageHeight
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipDrawImagePointRectI
GdipDrawImageRectRectI
GdipCreateBitmapFromStream
GdipGetImageWidth
GdipDrawImageRectRect
GdiplusStartup
GdiplusShutdown
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreateImageAttributes
GdipCreateBitmapFromStreamICM
GdipDisposeImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipAlloc
GdipCloneImage
GdipFree
GdipSetStringFormatTrimming
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipSetTextRenderingHint
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign

psapi

GetModuleFileNameExW
EnumProcessModules
EnumProcesses

urlmon

URLDownloadToCacheFileA
URLDownloadToFileW
URLDownloadToCacheFileW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock

winmm

timeGetTime

iphlpapi

GetAdaptersInfo

setupapi

SetupIterateCabinetW

secur32

GetUserNameExW

crypt32

CryptBinaryToStringW
CertGetNameStringW
CryptStringToBinaryA
CryptStringToBinaryW
CryptBinaryToStringA

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 280KB - Virtual size: 280KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 186KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

933202c393a31fb52dddda1de060eab3

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wininet

shlwapi

comctl32

gdiplus

psapi

urlmon

version

wtsapi32

userenv

winmm

iphlpapi

setupapi

secur32

crypt32

wintrust

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 280KB - Virtual size: 280KB

.data Size: 26KB - Virtual size: 40KB

.rsrc Size: 186KB - Virtual size: 185KB

.reloc Size: 67KB - Virtual size: 67KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 280KB - Virtual size: 280KB

.data
Size: 26KB - Virtual size: 40KB

.rsrc
Size: 186KB - Virtual size: 185KB

.reloc
Size: 67KB - Virtual size: 67KB