2867bb2fdf721d50143121c3aa73cad064bf37a46aaf815488a6395b4ad556c8

Sharing

Copy URL Twitter E-mail

General

Target

2867bb2fdf721d50143121c3aa73cad064bf37a46aaf815488a6395b4ad556c8
Size

5.2MB
MD5

8d7ec8210a6472c3d5ca58c5ab96f5e4
SHA1

ab2b00f5e198267ff722e7d7a83b562d011363f2
SHA256

2867bb2fdf721d50143121c3aa73cad064bf37a46aaf815488a6395b4ad556c8
SHA512

2062c9739b52649e7d62a033037c5e3768827df921c8b7ad156a31f7fa8d252a1a0a1afecd9706727f2953fb0d9933efa87e15da874f8ec9c33f0b4776fae6e3
SSDEEP

49152:CPlyEjw7d5V+fiBxqArIs8WnIt2qDa5ok29bQokE6p/VmUvce4uI7wKpuw1TA5iF:iPiBfciE6p/VbUSI7Siq0lCkz458Ekd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2867bb2fdf721d50143121c3aa73cad064bf37a46aaf815488a6395b4ad556c8

Files

2867bb2fdf721d50143121c3aa73cad064bf37a46aaf815488a6395b4ad556c8
.exe windows:6 windows x64 arch:x64

69e70a468ab941fdb9038b8e4e220683

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shlwapi

PathIsRootW
PathRemoveExtensionW
PathRemoveFileSpecW
PathIsUNCW
PathIsDirectoryW
PathFindFileNameW
StrRChrW
PathFileExistsW
PathFindExtensionW
PathRenameExtensionW
StrFormatKBSizeW
PathStripToRootW
PathAddBackslashW

kernel32

WaitForSingleObjectEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
ReadConsoleW
GetTimeZoneInformation
EnumSystemLocalesW
IsValidLocale
LCMapStringW
GetTimeFormatW
GetDateFormatW
GetConsoleMode
GetConsoleOutputCP
ExitProcess
GetStdHandle
SetStdHandle
QueryPerformanceFrequency
VirtualQuery
IsProcessorFeaturePresent
HeapQueryInformation
GetCommandLineW
GetCommandLineA
FreeLibraryAndExitThread
ExitThread
CreateThread
TzSpecificLocalTimeToSystemTime
InterlockedFlushSList
InterlockedPushEntrySList
RtlPcToFileHeader
RtlUnwindEx
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SetFilePointerEx
GetACP
GetFileType
MoveFileExW
OutputDebugStringW
ResetEvent
TerminateProcess
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LocalUnlock
LocalLock
GetUserDefaultLCID
ReplaceFileW
GetTempFileNameW
GetDiskFreeSpaceW
Sleep
SearchPathW
GetProfileIntW
GetTempPathW
VerifyVersionInfoW
VerSetConditionMask
GetWindowsDirectoryW
FindResourceExW
SetErrorMode
SystemTimeToFileTime
UnhandledExceptionFilter
SetFileTime
SetFileAttributesW
LocalFileTimeToFileTime
GetFileTime
GetFileSizeEx
GetFileAttributesExW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FileTimeToLocalFileTime
VirtualProtect
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetAtomNameW
GlobalGetAtomNameW
InitializeCriticalSection
GlobalFlags
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetTickCount
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
CompareStringA
GetCurrentThread
lstrcmpA
ResumeThread
SuspendThread
SetThreadPriority
CreateEventW
WaitForSingleObject
SetEvent
GetCurrentProcessId
GetThreadLocale
GetStringTypeExW
MoveFileW
GetCurrentProcess
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetVolumeInformationW
GetShortPathNameW
GetFullPathNameW
FlushFileBuffers
DeleteFileW
CopyFileW
FormatMessageW
MulDiv
LocalFree
GlobalLock
GlobalUnlock
GlobalSize
GlobalAlloc
CompareStringW
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GlobalFindAtomW
GlobalAddAtomW
GlobalDeleteAtom
LoadLibraryExW
GetModuleHandleExW
GetSystemDirectoryW
SetLastError
EncodePointer
OutputDebugStringA
GetModuleHandleW
GetSystemInfo
GetFileAttributesW
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
lstrcpynW
FindNextFileW
FindFirstFileW
FindClose
lstrcmpiW
LoadLibraryW
GetProcAddress
FreeLibrary
CreateDirectoryW
GetCurrentDirectoryW
GetModuleFileNameW
lstrcatW
SizeofResource
SetThreadUILanguage
SetThreadLocale
FindResourceW
LockResource
LoadResource
GetVersionExW
GetCurrentThreadId
WideCharToMultiByte
lstrcpyW
IsDBCSLeadByte
GetCPInfo
MultiByteToWideChar
lstrlenW
lstrlenA
lstrcmpW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CloseHandle
GetFileSize
CreateFileW
GlobalFree
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
SetConsoleCtrlHandler
WriteConsoleW
RtlUnwind
VirtualAlloc

user32

DestroyMenu
GetSysColorBrush
RealChildWindowFromPoint
MapVirtualKeyW
GetKeyNameTextW
RegisterClipboardFormatW
ShowOwnedPopups
IntersectRect
WindowFromPoint
GetMessageW
OffsetRect
SetRectEmpty
SendDlgItemMessageA
GetDesktopWindow
GetActiveWindow
GetNextDlgTabItem
CreateDialogIndirectParamW
FillRect
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextW
GetWindowThreadProcessId
CharUpperW
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuState
GetMenuStringW
IsClipboardFormatAvailable
LoadMenuW
IsDialogMessageW
ScrollWindowEx
IsWindowEnabled
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
GetDlgItemTextW
SetDlgItemTextW
GetDlgItemInt
SetDlgItemInt
MoveWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
GetLastActivePopup
GetTopWindow
GetClassLongPtrW
SetWindowLongPtrW
GetWindowLongPtrW
EqualRect
CopyRect
MapWindowPoints
MessageBoxW
AdjustWindowRectEx
GetWindowTextLengthW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
ValidateRect
EndPaint
BeginPaint
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
TrackPopupMenuEx
TrackPopupMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
SetMenu
GetMenu
GetCapture
SystemParametersInfoW
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
DestroyWindow
IsChild
IsMenu
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetFocus
LoadImageW
DestroyIcon
CopyImage
GetAsyncKeyState
MapDialogRect
GetDialogBaseUnits
TrackMouseEvent
DeleteMenu
SetTimer
KillTimer
LoadIconW
GetCursorPos
LockWindowUpdate
DrawIcon
GetSystemMetrics
IsIconic
CharNextW
UnregisterClassW
DrawTextExW
PostQuitMessage
PeekMessageW
DispatchMessageW
TranslateMessage
FindWindowExW
AdjustWindowRect
PostMessageW
WaitMessage
PostThreadMessageW
CreatePopupMenu
GetMenuDefaultItem
GetNextDlgGroupItem
DrawFocusRect
IsRectEmpty
DrawIconEx
GetIconInfo
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
SetLayeredWindowAttributes
EnumDisplayMonitors
OpenClipboard
ScreenToClient
ClientToScreen
CloseClipboard
SetClipboardData
IsZoomed
EmptyClipboard
GetMenuItemInfoW
DrawStateW
SendMessageW
GetKeyState
EnableWindow
GetWindowLongW
SetWindowLongW
GetParent
GetClientRect
GetWindowRect
MessageBeep
GetDlgItem
SendDlgItemMessageW
GetDlgCtrlID
GetDC
ReleaseDC
SetWindowTextW
GetClassNameW
GetWindow
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
IsWindow
SetCapture
ReleaseCapture
InvalidateRect
RedrawWindow
SetCursor
GetSysColor
InflateRect
PtInRect
LoadCursorW
DestroyCursor
UpdateWindow
CreateWindowExW
ShowWindow
SetClassLongPtrW
SetWindowRgn
SetParent
SetWindowPos
EndDialog
SetFocus
GetWindowTextW
DrawEdge
DrawFrameControl
GetTabbedTextExtentW
GetDCEx
GetWindowRgn
WindowFromDC
CreateMenu
InSendMessage
MonitorFromRect
SendNotifyMessageW
SubtractRect
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
EnumChildWindows
GetUpdateRect
CharUpperBuffW
ModifyMenuW
GetDoubleClickTime
SetMenuDefaultItem
SetRect
CopyAcceleratorTableW
DestroyAcceleratorTable
CreateAcceleratorTableW
GetKeyboardState
ToUnicodeEx
MapVirtualKeyExW
IsCharLowerW
GetKeyboardLayout
GetComboBoxInfo
MonitorFromPoint
UpdateLayeredWindow
UnionRect
ReuseDDElParam
UnpackDDElParam
GetMenuBarInfo
InsertMenuItemW
TranslateAcceleratorW
LoadAcceleratorsW
FrameRect
CopyIcon
SetCursorPos
BringWindowToTop
GetSystemMenu
IsWindowVisible

gdi32

DeleteDC
DeleteObject
Escape
ExcludeClipRect
GetClipBox
GetClipRgn
GetCurrentPositionEx
GetObjectType
GetPixel
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
OffsetClipRgn
PlayMetaFile
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectObject
SelectPalette
SetBkMode
SetMapperFlags
SetGraphicsMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextCharacterExtra
SetTextAlign
SetTextJustification
PlayMetaFileRecord
EnumMetaFile
SetWorldTransform
ModifyWorldTransform
SetColorAdjustment
StartDocW
ArcTo
PolyDraw
SelectClipPath
SetArcDirection
ExtCreatePen
MoveToEx
TextOutW
ExtTextOutW
PolyBezierTo
PolylineTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CombineRgn
CreateSolidBrush
GetMapMode
PatBlt
SetRectRgn
DPtoLP
GetTextMetricsW
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
GetBkColor
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
GetDIBits
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
Rectangle
GetRgnBox
OffsetRgn
GetCurrentObject
CreateFontW
GetCharWidthW
StretchDIBits
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
CloseMetaFile
CreateMetaFileW
DeleteMetaFile
EndDoc
StartPage
EndPage
AbortDoc
SetAbortProc
GetROP2
GetBkMode
GetNearestColor
GetPolyFillMode
GetStretchBltMode
GetTextAlign
GetTextFaceW
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateDIBPatternBrushPt
CreateCompatibleDC
BitBlt
GetDeviceCaps
CreateDCW
CopyMetaFileW
SetTextColor
SetBkColor
CreateBitmap
GetObjectW
GetTextExtentPoint32W
GetStockObject
CreateRectRgnIndirect
CreateFontIndirectW
GetTextExtentPointW

msimg32

TransparentBlt
AlphaBlend

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter
GetJobW

advapi32

RegQueryValueExW
GetSecurityInfo
RegCloseKey
SetFileSecurityW
GetFileSecurityW
RegEnumKeyExW
RegEnumValueW
RegSetValueW
RegSetValueExW
IsTextUnicode
RegEnumKeyW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueW
RegOpenKeyExW

shell32

DragQueryFileW
DragFinish
ShellExecuteW
SHGetMalloc
SHGetPathFromIDListW
ShellExecuteExW
SHAppBarMessage
SHGetSpecialFolderLocation
ExtractIconW
SHAddToRecentDocs
SHGetFileInfoW
SHChangeNotify
SHFileOperationW
SHGetDesktopFolder
SHBrowseForFolderW

comctl32

InitCommonControlsEx

uxtheme

GetThemePartSize
GetThemeSysColor
DrawThemeText
DrawThemeParentBackground
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
IsThemeBackgroundPartiallyTransparent
GetWindowTheme
IsAppThemed
OpenThemeData

ole32

RevokeDragDrop
PropVariantCopy
OleSetMenuDescriptor
OleLockRunning
StgCreateDocfile
CreateItemMoniker
OleCreate
RegisterDragDrop
OleCreateFromData
DoDragDrop
OleRun
CLSIDFromProgID
CoRegisterMessageFilter
OleIsCurrentClipboard
OleFlushClipboard
OleCreateLinkFromData
StgOpenStorageOnILockBytes
StgIsStorageFile
CreateGenericComposite
CreateILockBytesOnHGlobal
CreateFileMoniker
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleRegGetMiscStatus
OleRegEnumVerbs
StgCreateDocfileOnILockBytes
WriteClassStm
GetHGlobalFromILockBytes
StgOpenStorage
OleSetClipboard
CoRevokeClassObject
CoRegisterClassObject
CoGetClassObject
CLSIDFromString
StringFromGUID2
CreateStreamOnHGlobal
CoDisconnectObject
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CoInitialize
CoCreateGuid
CoCreateInstance
CoInitializeEx
CoUninitialize
SetConvertStg
OleRegGetUserType
OleDuplicateData
ReadFmtUserTypeStg
WriteFmtUserTypeStg
CreateBindCtx
CoTreatAsClass
WriteClassStg
ReadClassStg
CoTaskMemAlloc
StringFromCLSID
ReleaseStgMedium
OleGetClipboard
CoTaskMemFree
OleCreateLinkToFile
OleCreateFromFile
OleLoad
OleSave
OleSaveToStream
OleSetContainedObject
OleGetIconOfClass
CreateDataAdviseHolder
CreateOleAdviseHolder
GetRunningObjectTable
OleIsRunning
CoGetMalloc
OleCreateStaticFromData
OleQueryLinkFromData
OleQueryCreateFromData
CoLockObjectExternal

oleaut32

LoadTypeLi
LoadRegTypeLi
RegisterTypeLi
SysReAllocStringLen
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayCreate
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayRedim
SafeArrayGetDim
SafeArrayGetElemsize
SysAllocString
SafeArrayGetLBound
SafeArrayLock
SafeArrayUnlock
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayCopy
SafeArrayPtrOfIndex
VariantCopy
VarDateFromStr
VarCyFromStr
VarBstrFromCy
VarBstrFromDate
VarBstrFromDec
VarDecFromStr
SysAllocStringLen
SysAllocStringByteLen
SysStringByteLen
SysFreeString
VariantClear
VariantChangeType
SafeArrayGetUBound
VariantInit

oledlg

OleUIBusyW

gdiplus

GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdiplusShutdown
GdipAlloc
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromScan0
GdipBitmapLockBits

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW

bcrypt

BCryptGenerateSymmetricKey
BCryptCreateHash
BCryptSetProperty
BCryptHashData
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptDestroyKey
BCryptDeriveKeyPBKDF2
BCryptEncrypt

Sections

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 193KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

69e70a468ab941fdb9038b8e4e220683

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

uxtheme

ole32

oleaut32

oledlg

gdiplus

oleacc

imm32

winmm

bcrypt

Sections

.text Size: 3.8MB - Virtual size: 3.8MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 42KB - Virtual size: 1.1MB

.pdata Size: 193KB - Virtual size: 192KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 49KB - Virtual size: 49KB

.reloc Size: 80KB - Virtual size: 79KB

.text
Size: 3.8MB - Virtual size: 3.8MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 42KB - Virtual size: 1.1MB

.pdata
Size: 193KB - Virtual size: 192KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 49KB - Virtual size: 49KB

.reloc
Size: 80KB - Virtual size: 79KB