70f17ad64cd4e96174dcbd058e165c6a

Sharing

Copy URL Twitter E-mail

General

Target

70f17ad64cd4e96174dcbd058e165c6a
Size

1.8MB
MD5

70f17ad64cd4e96174dcbd058e165c6a
SHA1

7dc7a8aada279ca74f398a164bd357fae21e7985
SHA256

da4f9b74f982ad8ef3b850b686ccb1580360f4307405a5e6331255da187e28a0
SHA512

84289ce37d79fbc47a0b5c1568f350eb0208225de9ec9fa745f2a88ad849843b08223fd0514a457c4749333731098d99b2ab7ac290efdfc27f9fff249f7dfb55
SSDEEP

24576:sSflSD57KtZutwYw/lP3wHPdGckzxKw8cj51CdKwH4DiL08qAEdro/8LPmZnt2T0:sDD5Q/wPQ/j5dwYrAB/8LPat2nX2quBP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
70f17ad64cd4e96174dcbd058e165c6a

Files

70f17ad64cd4e96174dcbd058e165c6a
.exe windows:5 windows x86 arch:x86

30417e3b63e1ac074c39ba76b6a2d139

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

WSACleanup
inet_addr
gethostbyname
gethostname
WSAStartup

winmm

mixerGetControlDetailsW
mixerSetControlDetails
mixerGetLineControlsW
mciSendStringW
mixerOpen
mixerClose
mixerGetLineInfoW
waveOutGetVolume
joyGetPosEx
joyGetDevCapsW
waveOutSetVolume
mixerGetDevCapsW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

comctl32

ImageList_AddMasked
ImageList_ReplaceIcon
CreateStatusWindowW
InitCommonControlsEx
ImageList_Create
ImageList_GetIconSize
ImageList_Destroy

shlwapi

HashData

crypt32

CryptBinaryToStringA
CryptStringToBinaryA
CryptStringToBinaryW

psapi

GetModuleFileNameExW
GetModuleBaseNameW

kernel32

CloseHandle
CreateMutexW
GetLastError
GetModuleHandleW
WideCharToMultiByte
MultiByteToWideChar
SystemTimeToFileTime
SetFilePointerEx
ReadFile
SetFilePointer
GlobalSize
lstrcpyA
lstrlenA
lstrcmpiA
lstrcmpA
LocalFileTimeToFileTime
CreateDirectoryA
CreateDirectoryW
IsBadReadPtr
CreateFileW
CreateFileA
WriteFile
SetFileTime
DuplicateHandle
LoadResource
LockResource
SizeofResource
GetCurrentDirectoryA
FileTimeToSystemTime
GetLocalTime
GetFileInformationByHandle
GetFileSize
lstrlenW
FindFirstFileW
FindNextFileW
FindClose
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
SetLastError
GetExitCodeThread
VirtualFree
GetTempPathA
LoadLibraryA
FreeLibrary
GetNativeSystemInfo
HeapAlloc
GetProcessHeap
HeapFree
HeapDestroy
GetCommandLineW
WaitForSingleObject
GetThreadLocale
VirtualQuery
HeapCreate
FlushInstructionCache
GetVersionExW
InterlockedIncrement
InterlockedDecrement
GetCPInfo
GetModuleFileNameW
FileTimeToLocalFileTime
SetEnvironmentVariableW
Beep
MoveFileW
CreateProcessW
GetFileAttributesW
GetExitCodeProcess
WriteProcessMemory
ReadProcessMemory
GetCurrentProcessId
OpenProcess
TerminateProcess
SetPriorityClass
GetEnvironmentVariableW
GetDateFormatW
GetTimeFormatW
GetDiskFreeSpaceW
SetVolumeLabelW
DeviceIoControl
GetDriveTypeW
GetVolumeInformationW
DeleteFileW
SetFileAttributesW
GetFileSizeEx
GetSystemTime
GetSystemDefaultUILanguage
GetComputerNameW
GetWindowsDirectoryW
GetTempPathW
GetFullPathNameW
GetShortPathNameW
TryEnterCriticalSection
QueryDosDeviceW
CompareStringW
RemoveDirectoryW
CopyFileW
FormatMessageW
GetPrivateProfileStringW
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
WritePrivateProfileSectionW
SetEndOfFile
GetACP
GetFileType
GetStdHandle
VirtualAllocEx
VirtualFreeEx
EnumResourceNamesW
LoadLibraryExW
RemoveVectoredExceptionHandler
ExitProcess
ExitThread
SetThreadPriority
CreateThread
GetStringTypeExW
lstrcmpiW
OpenThread
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
ResumeThread
SuspendThread
GlobalUnlock
GlobalLock
AddVectoredExceptionHandler
LoadLibraryW
GetCurrentDirectoryW
SetErrorMode
InitializeCriticalSection
FindResourceW
VirtualProtect
GetSystemTimeAsFileTime
GetProcessTimes
GetCurrentProcess
CheckRemoteDebuggerPresent
GetCurrentThread
GetProcAddress
GlobalFree
_lclose
_lopen
_lread
GetModuleFileNameA
GlobalAlloc
GetModuleHandleA
OutputDebugStringW
SetCurrentDirectoryW
Sleep
GetTickCount
MulDiv
InterlockedExchange
InterlockedCompareExchange
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
UnhandledExceptionFilter
IsDebuggerPresent
VirtualAlloc
IsProcessorFeaturePresent

user32

SetMenu
ScrollWindow
SetScrollInfo
ExitWindowsEx
GetMenuStringW
GetSubMenu
GetMenuItemID
GetMenuItemCount
GetLastInputInfo
GetCursor
ClientToScreen
MessageBeep
SetDlgItemTextW
GetDlgItem
SendDlgItemMessageW
DialogBoxParamW
SetForegroundWindow
DefWindowProcW
FillRect
DrawIconEx
GetSysColorBrush
GetSysColor
RegisterWindowMessageW
IsIconic
IsZoomed
EnumWindows
GetWindowTextLengthW
EnableWindow
InvalidateRect
SetLayeredWindowAttributes
SetWindowPos
SetWindowRgn
SetFocus
GetGUIThreadInfo
SetActiveWindow
EnumChildWindows
MoveWindow
GetQueueStatus
GetWindowRect
GetClientRect
SystemParametersInfoW
AdjustWindowRectEx
DrawTextW
SetRect
GetIconInfo
SetWindowTextW
IsWindowVisible
CheckMenuItem
MessageBoxW
LoadImageW
ChangeClipboardChain
LoadAcceleratorsW
EnableMenuItem
SetPropW
RemovePropW
MapWindowPoints
RedrawWindow
SetParent
GetClassInfoExW
GetAncestor
UpdateWindow
GetMessagePos
GetClassLongW
DefDlgProcW
CallWindowProcW
GetTopWindow
GetMenu
CreateWindowExW
RegisterClassExW
LoadCursorW
DestroyAcceleratorTable
UnregisterClassW
DestroyIcon
DestroyWindow
IsCharAlphaW
BringWindowToTop
GetWindow
EnumClipboardFormats
CreateIconFromResourceEx
CopyImage
GetDesktopWindow
FlashWindow
TrackPopupMenuEx
DestroyMenu
AppendMenuW
SetMenuInfo
CreatePopupMenu
CreateMenu
GetMenuItemInfoW
IsMenu
SetMenuItemInfoW
RemoveMenu
SetMenuDefaultItem
InsertMenuItemW
CreateAcceleratorTableW
CreateDialogIndirectParamW
MapVirtualKeyW
MapVirtualKeyExW
VkKeyScanExW
GetWindowTextW
mouse_event
GetSystemMetrics
keybd_event
SetKeyboardState
GetKeyboardState
GetCursorPos
GetAsyncKeyState
AttachThreadInput
SendInput
UnregisterHotKey
RegisterHotKey
PostQuitMessage
SendMessageTimeoutW
UnhookWindowsHookEx
SetWindowsHookExW
PostThreadMessageW
IsCharAlphaNumericW
IsCharUpperW
IsCharLowerW
ToUnicodeEx
GetKeyboardLayout
CallNextHookEx
CharLowerW
ReleaseDC
GetDC
OpenClipboard
GetClipboardData
GetClipboardFormatNameW
CloseClipboard
SetClipboardData
EmptyClipboard
PostMessageW
FindWindowW
EndDialog
IsWindow
DispatchMessageW
TranslateMessage
ShowWindow
CountClipboardFormats
SetWindowLongW
ScreenToClient
IsDialogMessageW
WindowFromPoint
SendMessageW
IsWindowEnabled
GetWindowLongW
GetKeyState
TranslateAcceleratorW
KillTimer
PeekMessageW
GetFocus
GetClassNameW
GetWindowThreadProcessId
GetForegroundWindow
GetMessageW
SetTimer
GetScrollInfo
GetParent
GetDlgCtrlID
CharUpperW
IsClipboardFormatAvailable
PtInRect
IntersectRect
CheckRadioButton
CreateIconIndirect
GetPropW
SetClipboardViewer

gdi32

GetSystemPaletteEntries
CreateCompatibleBitmap
BitBlt
GetDIBits
CreatePolygonRgn
CreateRectRgn
CreateRoundRectRgn
CreateEllipticRgn
DeleteDC
GetObjectW
GetTextMetricsW
GetTextFaceW
SelectObject
GetStockObject
CreateDCW
CreateSolidBrush
CreateFontW
DeleteObject
CreateCompatibleDC
GdiFlush
CreateDIBSection
EnumFontFamiliesExW
SetBrushOrgEx
CreatePatternBrush
SetBkMode
GetCharABCWidthsW
GetClipBox
FillRgn
GetClipRgn
ExcludeClipRect
SetTextColor
SetBkColor
GetPixel
GetDeviceCaps

comdlg32

CommDlgExtendedError
GetOpenFileNameW
GetSaveFileNameW

advapi32

RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegConnectRegistryW
RegCloseKey
CryptReleaseContext
CryptDestroyKey
CryptDestroyHash
CryptDeriveKey
CryptHashData
CryptCreateHash
CryptAcquireContextW
RegDeleteValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
GetUserNameW
OpenSCManagerW
LockServiceDatabase
UnlockServiceDatabase
CloseServiceHandle
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegDeleteKeyW

shell32

DragQueryPoint
ExtractIconW
SHEmptyRecycleBinW
SHFileOperationW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetDesktopFolder
SHGetMalloc
SHGetFolderPathW
ShellExecuteExW
Shell_NotifyIconW
DragFinish
DragQueryFileW

ole32

OleInitialize
CoCreateInstance
CoInitialize
CoUninitialize
CLSIDFromString
CoGetObject
StringFromGUID2
CreateStreamOnHGlobal

oleaut32

SafeArrayGetDim
GetActiveObject
SysStringLen
SysFreeString
OleLoadPicture
SafeArrayUnaccessData
SafeArrayGetElemsize
SafeArrayAccessData
SafeArrayUnlock
SafeArrayPtrOfIndex
SafeArrayLock
SafeArrayDestroy
SafeArrayGetLBound
SafeArrayGetUBound
VariantCopyInd
SafeArrayCopy
SysAllocString
VariantChangeType
VariantClear
SafeArrayCreate

msvcr100

_wtoi
_isctype
??_V@YAXPAX@Z
qsort
??_U@YAPAXI@Z
wcsstr
wcschr
memmove
realloc
_wcsnicmp
__iob_func
setvbuf
_swprintf
__wargv
__argc
malloc
_wcsicmp
_i64tow
_cexit
_exit
_XcptFilter
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
free
exit
__wgetmainargs
isxdigit
wcstol
isdigit
rand
_wcstoi64
_wtoi64
_stricmp
_beginthreadex
wcsncpy
_snwprintf
iswspace
_wtof
??3@YAXPAX@Z
iswdigit
wcsncmp
wcsrchr
??2@YAPAXI@Z
tolower
toupper
iswxdigit
fwprintf
fputws
_purecall
_wcstoui64
_ultow
towupper
_wcsupr
_wcsdup
_scwprintf
wcstoul
_wfopen
fseek
ftell
fread
fclose
wcstombs
fwrite
_wsplitpath
_vsnwprintf
wcstod
wcscspn
_msize
_expand
_unlock
__dllonexit
_lock
_onexit
_amsg_exit
_fmode
__set_app_type
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
memcpy
memset
__RTDynamicCast
__CxxFrameHandler3
_except_handler3
_itow

Exports

Exports

AHKASSIGN
AHKEXECUTELINE
AHKFINDFUNC
AHKFINDLABEL
AHKFUNCTION
AHKGETVAR
AHKISUNICODE
AHKLABEL
AHKPAUSE
AHKPOSTFUNCTION
AhkAssign
AhkExecuteLine
AhkExecuteline
AhkFindFunc
AhkFindLabel
AhkFindfunc
AhkFindlabel
AhkFunction
AhkGetVar
AhkGetvar
AhkIsUnicode
AhkIsunicode
AhkLabel
AhkPause
AhkPostFunction
AhkPostfunction
Ahkassign
AhkexecuteLine
Ahkexecuteline
AhkfindFunc
AhkfindLabel
Ahkfindfunc
Ahkfindlabel
Ahkfunction
AhkgetVar
Ahkgetvar
AhkisUnicode
Ahkisunicode
Ahklabel
Ahkpause
AhkpostFunction
Ahkpostfunction
ahkAssign
ahkExecuteLine
ahkExecuteline
ahkFindFunc
ahkFindLabel
ahkFindfunc
ahkFindlabel
ahkFunction
ahkGetVar
ahkGetvar
ahkIsUnicode
ahkIsunicode
ahkLabel
ahkPause
ahkPostFunction
ahkPostfunction
ahkassign
ahkexecuteLine
ahkexecuteline
ahkfindFunc
ahkfindLabel
ahkfindfunc
ahkfindlabel
ahkfunction
ahkgetVar
ahkgetvar
ahkisUnicode
ahkisunicode
ahklabel
ahkpause
ahkpostFunction
ahkpostfunction

Sections

.text
Size: 678KB - Virtual size: 677KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 151KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 970KB - Virtual size: 969KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

30417e3b63e1ac074c39ba76b6a2d139

Headers

File Characteristics

Imports

wsock32

winmm

version

comctl32

shlwapi

crypt32

psapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

msvcr100

Exports

Exports

Sections

.text Size: 678KB - Virtual size: 677KB

.rdata Size: 151KB - Virtual size: 151KB

.data Size: 9KB - Virtual size: 31KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 970KB - Virtual size: 969KB

.text
Size: 678KB - Virtual size: 677KB

.rdata
Size: 151KB - Virtual size: 151KB

.data
Size: 9KB - Virtual size: 31KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 970KB - Virtual size: 969KB