bda35eea319617b581cd64d5c5ce0606

Sharing

Copy URL Twitter E-mail

General

Target

bda35eea319617b581cd64d5c5ce0606
Size

2.1MB
MD5

bda35eea319617b581cd64d5c5ce0606
SHA1

c68f26452d9b9bb548bb9ce49a9f35683dd4dcdf
SHA256

13312932b6c1224fd7825271df30ff31af75ca137251af03ef66487ba3e93dbf
SHA512

f396dd0c7ec5d9f3cac90635e59dc05f76a37fd793e4e01eba3b6a03eda0edd0586f1dae8094d7487617ffd61500dcd69c3a299e2c3db547f71a73e609c8464b
SSDEEP

24576:JM+KpP2lcoWWL7Ul/vMXvepxZqhlldJrKXEL7CMHTPDvkLmaRa8I1E0zGWd0LITq:uonUlpvA5dJrKOtQj4HiWdmITdaP+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bda35eea319617b581cd64d5c5ce0606

Files

bda35eea319617b581cd64d5c5ce0606
.exe windows:5 windows x86 arch:x86

150d43b8f4a67681d93a73c721d8421a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcessId
LoadResource
SizeofResource
FindResourceW
GetCommandLineW
SetCurrentDirectoryW
WideCharToMultiByte
MultiByteToWideChar
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
GetPrivateProfileStringA
FindClose
FindFirstFileW
LocalFree
LocalAlloc
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
SetFilePointer
CloseHandle
ReadFile
GetFileAttributesW
GetComputerNameW
GetSystemDirectoryW
CreateDirectoryW
WritePrivateProfileStringW
GetLocalTime
GetModuleFileNameW
GetTickCount
GetPrivateProfileStringW
LeaveCriticalSection
EnterCriticalSection
TerminateThread
WaitForMultipleObjects
GetCurrentDirectoryW
InterlockedDecrement
GetTempPathW
Sleep
DeleteCriticalSection
InitializeCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryW
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetACP
GlobalLock
GlobalUnlock
lstrlenW
GetModuleHandleW
ExitProcess
InterlockedIncrement
MulDiv
lstrcpyW
FormatMessageW
VerSetConditionMask
FreeResource
LockResource
GetFileSize
CreateFileW
GetCurrentProcess
GetFileType
WriteFile
SetFileTime
DuplicateHandle
SystemTimeToFileTime
DosDateTimeToFileTime
GlobalAlloc
SleepEx
WaitForSingleObject
ExpandEnvironmentStringsA
GetStdHandle
PeekNamedPipe
SetLastError
FormatMessageA
LoadLibraryA
GetModuleHandleA
GetSystemDirectoryA
VerifyVersionInfoA
FlushConsoleInputBuffer
GetCurrentThreadId
QueryPerformanceCounter
GlobalMemoryStatus
GetSystemTime
IsDebuggerPresent
OutputDebugStringW
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetCommandLineA
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetFilePointerEx
SetConsoleCtrlHandler
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
ReadConsoleW
GetConsoleCP
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
GetTimeZoneInformation
HeapReAlloc
GetFullPathNameW
SetStdHandle
FlushFileBuffers
GetFileAttributesExW
SetEndOfFile
HeapSize
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP

user32

IsZoomed
CharNextW
GetActiveWindow
GetFocus
GetKeyState
SetCapture
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetClientRect
CreateCaret
GetCaretBlinkTime
SetCaretPos
ScreenToClient
MapWindowPoints
GetSysColor
IntersectRect
IsRectEmpty
PtInRect
SetWindowLongW
GetParent
GetWindow
SetWindowRgn
MonitorFromWindow
GetMonitorInfoW
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
EnableWindow
DestroyWindow
SetPropW
GetPropW
AdjustWindowRectEx
LoadIconW
SetForegroundWindow
CreateAcceleratorTableW
InvalidateRgn
ClientToScreen
FillRect
GetGUIThreadInfo
UpdateLayeredWindow
GetWindowRgn
CharPrevW
DrawTextW
SetRect
EnableMenuItem
AppendMenuW
HideCaret
ShowCaret
GetCaretPos
GetWindowTextW
GetWindowTextLengthW
IsWindowEnabled
GetKeyboardLayout
GetKeyNameTextW
MapVirtualKeyExW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
WindowFromPoint
TranslateMessage
GetMessageW
LoadCursorW
IsWindow
DispatchMessageW
CreateWindowExW
OffsetRect
UnionRect
InflateRect
SetCursor
GetWindowRect
PostQuitMessage
SetTimer
SetWindowTextW
GetWindowLongW
EnumChildWindows
GetClassNameW
PostMessageW
FindWindowW
SendMessageW
GetMenu
ReleaseCapture
IsWindowVisible
GetWindowThreadProcessId
GetShellWindow
GetDesktopWindow
GetForegroundWindow
ShowWindow
IsIconic
wsprintfW
LoadImageW
SetWindowPos
GetLastInputInfo
KillTimer
MoveWindow
GetSystemMetrics
MessageBoxW
SetFocus
DestroyMenu
TrackPopupMenu
GetCursorPos
InsertMenuW
CreatePopupMenu

advapi32

RegQueryValueExW
RegisterEventSourceA
ReportEventA
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
DeregisterEventSource
RegSetValueExW
RegOpenKeyW
RegEnumValueW

shell32

DragQueryFileW
CommandLineToArgvW
SHGetSpecialFolderPathW
Shell_NotifyIconW
ShellExecuteW

ole32

ReleaseStgMedium
OleLockRunning
CLSIDFromProgID
CLSIDFromString
OleDuplicateData
DoDragDrop
RevokeDragDrop
RegisterDragDrop
CoCreateInstance
CoInitialize
CoUninitialize
CreateStreamOnHGlobal

oleaut32

VariantChangeType
VariantCopy
SysAllocString
SysFreeString
VariantClear
VariantInit

shlwapi

PathIsDirectoryW
PathRemoveFileSpecW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

urlmon

URLDownloadToFileW

wininet

DeleteUrlCacheEntryW

ws2_32

WSAStartup
gethostbyname
htonl
shutdown
gethostname
ioctlsocket
sendto
recvfrom
listen
accept
freeaddrinfo
getaddrinfo
WSAIoctl
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
recv
WSASetLastError
select
__WSAFDIsSet
WSAGetLastError
WSACleanup
getservbyname

gdi32

GetObjectW
SetWindowOrgEx
CreateRoundRectRgn
CreateRectRgn
PtInRegion
CloseEnhMetaFile
SelectObject
SaveDC
RestoreDC
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreatePen
GetTextMetricsW
CreateDIBitmap
CreateDIBSection
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
RoundRect
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateFontIndirectW
CreateEnhMetaFileW
StretchBlt
SetStretchBltMode
SetTextColor
GetObjectA
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
SetBitmapBits
GetBitmapBits
GdiFlush
TextOutW
MoveToEx

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

comctl32

ord17
InitCommonControlsEx
_TrackMouseEvent

gdiplus

GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipDrawImageRectI
GdipLoadImageFromStream
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipFillRectangleI
GdipDrawRectangleI
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipSetPenMode
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipFree
GdipAlloc
GdiplusShutdown
GdiplusStartup
GdipLoadImageFromStreamICM

wldap32

ord79
ord35
ord33
ord32
ord27
ord30
ord22
ord41
ord46
ord143
ord301
ord211
ord60
ord200
ord26
ord50

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 441KB - Virtual size: 441KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

150d43b8f4a67681d93a73c721d8421a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

urlmon

wininet

ws2_32

gdi32

imm32

comctl32

gdiplus

wldap32

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 441KB - Virtual size: 441KB

.data Size: 43KB - Virtual size: 57KB

.gfids Size: 512B - Virtual size: 480B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 48KB - Virtual size: 47KB

.reloc Size: 86KB - Virtual size: 86KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 441KB - Virtual size: 441KB

.data
Size: 43KB - Virtual size: 57KB

.gfids
Size: 512B - Virtual size: 480B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 48KB - Virtual size: 47KB

.reloc
Size: 86KB - Virtual size: 86KB