611beaabc1f809ea523bc6a35ff6bc1be9f9248c1596950a113254cc58698ae1

Sharing

Copy URL Twitter E-mail

General

Target

611beaabc1f809ea523bc6a35ff6bc1be9f9248c1596950a113254cc58698ae1
Size

4.5MB
MD5

9c067adcc876e1311236031738fa7479
SHA1

e2a1bc1ad2c7a38b0d7982a167e0a5c6ab1153e3
SHA256

611beaabc1f809ea523bc6a35ff6bc1be9f9248c1596950a113254cc58698ae1
SHA512

b6d7912e952f6e91efbfd25c380009ca3df1be8f65d54b0a142c6d5a4ed982fcac00d9736f52f36fdf3c0664a60d26211421aeb6ab5be930b6258c0dc5f32b62
SSDEEP

49152:u80+DS/Qd2pJiztucHKseYHH6pQYhOp09B/pwkFOMBDv0tO:K+DySfHKsVapnPGE5Dv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
611beaabc1f809ea523bc6a35ff6bc1be9f9248c1596950a113254cc58698ae1

Files

611beaabc1f809ea523bc6a35ff6bc1be9f9248c1596950a113254cc58698ae1
.exe windows:5 windows x86 arch:x86

9d5bf35d163da2ee626ca08f13816346

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LockResource
lstrcpyW
InterlockedExchange
GetFileInformationByHandle
CompareFileTime
FindCloseChangeNotification
FindFirstChangeNotificationW
SearchPathW
GetCurrentDirectoryW
GetWindowsDirectoryW
SetFileTime
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
LoadResource
SizeofResource
GetModuleFileNameW
FindResourceW
FindResourceExW
WideCharToMultiByte
MultiByteToWideChar
InitializeCriticalSection
LocalFree
LockFile
UnlockFile
GetFileSize
ReadFile
CloseHandle
CreateFileW
GetLastError
GetShortPathNameW
Sleep
GlobalDeleteAtom
GlobalAddAtomW
GlobalFindAtomW
DeleteFileW
DecodePointer
InterlockedIncrement
InterlockedDecrement
FreeLibrary
GetProcAddress
GetSystemTime
lstrcmpiW
LoadLibraryExW
GetModuleHandleW
CreateProcessW
GetStartupInfoW
GetCommandLineW
OutputDebugStringA
OutputDebugStringW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Module32FirstW
Module32NextW
GetCurrentProcess
VirtualAllocEx
VirtualFreeEx
OpenProcess
ReadProcessMemory
SetEndOfFile
WriteConsoleW
WaitForSingleObjectEx
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
FindFirstFileExA
GetCurrentThreadId
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
CreateProcessA
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
GetFileType
SetStdHandle
InterlockedFlushSList
RtlUnwind
FindNextFileA
FindFirstFileA
FreeResource
InterlockedCompareExchange
CreateFileA
lstrcmpiA
lstrcmpA
DeviceIoControl
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStringTypeW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
OpenFileMappingW
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
IsDebuggerPresent
GetEnvironmentVariableW
ResetEvent
CreateDirectoryW
WritePrivateProfileStringW
FormatMessageW
GetSystemDirectoryW
GetLogicalDriveStringsW
GetFileAttributesW
GetFullPathNameW
RemoveDirectoryW
DeleteFileA
GetSystemWindowsDirectoryW
GetCurrentThread
CreateEventW
SetEvent
GetLocalTime
GetFileSizeEx
GetExitCodeThread
TerminateThread
WTSGetActiveConsoleSessionId
RaiseException
lstrlenW
lstrcpynW
lstrcmpW
ReleaseMutex
CreateFileMappingW
SetConsoleCtrlHandler
ProcessIdToSessionId
UnmapViewOfFile
MapViewOfFile
SetFilePointer
GetSystemDefaultLangID
GetSystemInfo
GetDiskFreeSpaceExW
GetDriveTypeW
GetVersionExW
GetTickCount
WriteProcessMemory
WaitForMultipleObjects
TerminateProcess
LocalAlloc
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetLongPathNameW
GetCurrentProcessId
CreateMutexW
MulDiv
GetExitCodeProcess
WaitForSingleObject
GetStdHandle
WriteFile
FlushFileBuffers
FindClose
GetFileTime
LoadLibraryW
GetPrivateProfileStringW
GetTempPathW
GetTempFileNameW
SetFileAttributesW
GetFileAttributesExW
FindFirstFileW
FindNextFileW
CopyFileW
MoveFileW
MoveFileExW
AllocConsole
GetConsoleWindow

user32

PostMessageW
RedrawWindow
CreateIconFromResource
FindWindowExW
FindWindowW
GetMonitorInfoW
LookupIconIdFromDirectory
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
MonitorFromWindow
OpenClipboard
GetSystemMetrics
ExitWindowsEx
SendMessageW
GetDC
SetWindowTextW
ScreenToClient
MapWindowPoints
GetWindow
GetWindowTextW
GetWindowTextLengthW
CreateIconFromResourceEx
CharNextW
BringWindowToTop
PeekMessageW
DefWindowProcW
SetCursor
DialogBoxParamW
EndDialog
GetActiveWindow
IsDialogMessageW
IsWindowVisible
SetWindowRgn
PtInRect
PostThreadMessageW
WaitForInputIdle
GetShellWindow
LoadStringW
MessageBoxW
GetWindowDC
UnregisterClassA
wsprintfW
DispatchMessageW
TranslateMessage
GetMessageW
CallWindowProcW
SystemParametersInfoW
IsRectEmpty
OffsetRect
CopyRect
KillTimer
SetTimer
SetWindowPos
LoadImageW
SetRect
FillRect
ReleaseDC
GetWindowThreadProcessId
SendMessageTimeoutW
UnregisterClassW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
IsWindow
ShowWindow
MoveWindow
BeginPaint
EndPaint
InvalidateRect
GetClientRect
GetWindowRect
GetWindowLongW
SetWindowLongW
GetParent
LoadCursorW
PostQuitMessage
DestroyWindow
UpdateLayeredWindow

gdi32

CreateHalftonePalette
CreateFontW
EnumFontFamiliesW
CombineRgn
CreateRectRgn
GetDeviceCaps
GetTextExtentPoint32W
GetStockObject
SetDIBitsToDevice
SetPixelV
CreateDIBSection
SetDIBColorTable
GdiFlush
GetPaletteEntries
StretchBlt
SetStretchBltMode
CreateFontIndirectW
SaveDC
RestoreDC
GetPixel
CreateSolidBrush
ExtTextOutW
SetBkColor
SetViewportOrgEx
SelectObject
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt

advapi32

ImpersonateLoggedOnUser
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
RegGetValueW
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
CryptContextAddRef
CryptDecrypt
CryptEncrypt
CryptImportKey
CryptGenRandom
CryptSetKeyParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
GetTrusteeNameW
BuildExplicitAccessWithNameW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
GetExplicitEntriesFromAclW
SetEntriesInAclW
LookupAccountNameW
LookupAccountSidW
DeleteAce
GetUserNameW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegEnumValueW
EqualSid
OpenThreadToken
RegOpenCurrentUser
CreateProcessAsUserW
RegCloseKey
GetTokenInformation
RevertToSelf
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
DuplicateTokenEx
GetLengthSid
CreateWellKnownSid
SetTokenInformation
RegCreateKeyW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW

shell32

SHCreateDirectoryExA
ShellExecuteExW
SHGetFolderPathA
ord165
SHCreateDirectoryExW
SHFileOperationW
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetMalloc
SHGetSpecialFolderPathW
SHGetFolderPathW
ord680
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHChangeNotify
CommandLineToArgvW

ole32

CoSetProxyBlanket
CoInitializeEx
CoUninitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoInitializeSecurity
OleRun
CLSIDFromProgID
StringFromGUID2
CoCreateGuid
CreateStreamOnHGlobal
CoTaskMemFree
CoInitialize

oleaut32

SysStringLen
GetErrorInfo
CreateErrorInfo
SysAllocStringByteLen
VarUI4FromStr
SysStringByteLen
VariantChangeType
SysFreeString
VariantCopy
VariantClear
VariantInit
SysAllocString
SetErrorInfo

wininet

InternetCrackUrlW
InternetGetConnectedState

shlwapi

StrStrW
PathIsRootW
PathAppendA
StrCmpIW
StrStrIW
StrTrimA
StrCmpNIW
SHSetValueA
SHGetValueA
StrToIntExW
StrStrIA
AssocQueryStringW
PathAppendW
PathRemoveFileSpecW
PathFileExistsW
SHGetValueW
StrCmpW
PathFindFileNameW
PathCanonicalizeW
PathIsDirectoryW
SHSetValueW
PathCompactPathW
PathFindExtensionA
PathFindExtensionW
PathFindFileNameA
wnsprintfW
PathRelativePathToW
PathCombineW
PathIsRelativeW
SHDeleteKeyW
SHDeleteValueW
PathIsPrefixW
PathRemoveArgsW
PathUnquoteSpacesW

comctl32

InitCommonControlsEx
_TrackMouseEvent

gdiplus

GdipSetPenEndCap
GdipSetPenStartCap
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipCloneBrush
GdipFree
GdipAlloc
GdipDeleteBrush
GdipSetStringFormatTrimming
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawLine
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipDrawString
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipDrawImageRectRect
GdipDrawImageRectRectI
GdipDrawImagePointRectI
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipSetTextRenderingHint
GdipMeasureString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign

psapi

GetModuleFileNameExW
EnumProcesses
EnumProcessModules

urlmon

URLDownloadToCacheFileA
URLDownloadToFileW
URLDownloadToCacheFileW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock

winmm

timeGetTime

iphlpapi

GetAdaptersInfo

setupapi

SetupIterateCabinetW

secur32

GetUserNameExW

crypt32

CryptStringToBinaryW
CertGetNameStringW
CryptBinaryToStringW
CryptBinaryToStringA
CryptStringToBinaryA

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 314KB - Virtual size: 314KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9d5bf35d163da2ee626ca08f13816346

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wininet

shlwapi

comctl32

gdiplus

psapi

urlmon

version

wtsapi32

userenv

winmm

iphlpapi

setupapi

secur32

crypt32

wintrust

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 314KB - Virtual size: 314KB

.data Size: 27KB - Virtual size: 41KB

.rsrc Size: 2.7MB - Virtual size: 2.7MB

.reloc Size: 75KB - Virtual size: 74KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 314KB - Virtual size: 314KB

.data
Size: 27KB - Virtual size: 41KB

.rsrc
Size: 2.7MB - Virtual size: 2.7MB

.reloc
Size: 75KB - Virtual size: 74KB