d30a9b379ca71bea48b70739241f0f2f

Sharing

Copy URL

Twitter E-mail

General

Target

d30a9b379ca71bea48b70739241f0f2f
Size

13.7MB
MD5

d30a9b379ca71bea48b70739241f0f2f
SHA1

62db833775be105f3bc426fa9d453951f0170c9b
SHA256

7b48427677d8ba2c4f3bde4d5d8cda3a3446b3359f5cdeeec546d8a964091890
SHA512

768ab4ae7d663b49ca0890645705516a8b3e21623509b7c42f36d64774f5a6787bed3ff74788b99be6031c632f2eb8446207134c5056f55c13097b909fef5cef
SSDEEP

196608:XJ6lItIa1CIUmr7XRmMNjyHfcmNIAHxRMSu0IDB4aNrzhJg:XIDmNkceIAPIN4adE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d30a9b379ca71bea48b70739241f0f2f

Files

d30a9b379ca71bea48b70739241f0f2f
.exe windows:5 windows x86 arch:x86

3a7e16c4b85cb105d752784d28eac286

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptProtectData
CryptUnprotectData

ws2_32

getservbyname
WSACleanup
WSAStartup
shutdown
closesocket
WSAEnumProtocolsW
getsockname
htons
inet_addr
gethostbyname
getservbyport
gethostbyaddr
getpeername
ntohs
WSARecv
WSAGetOverlappedResult
WSAEnumNetworkEvents
connect
accept
ioctlsocket
WSAEventSelect
WSAGetLastError
inet_ntoa
WSASetLastError
ntohl
WSAStringToAddressW
htonl
WSCGetProviderPath
WSASocketW
setsockopt
bind
WSASend
listen

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalReAlloc
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetThreadLocale
GetVolumeInformationW
LockFile
UnlockFile
lstrcmpiW
FindResourceExW
VerifyVersionInfoW
SetErrorMode
GetUserDefaultLCID
SearchPathW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
TlsAlloc
SetEnvironmentVariableA
IsValidCodePage
FindFirstFileExW
GlobalFlags
GetConsoleCP
EnumSystemLocalesW
IsValidLocale
SetStdHandle
VirtualQuery
VirtualAlloc
HeapQueryInformation
GetCommandLineW
GetCommandLineA
FreeLibraryAndExitThread
ExitThread
SetConsoleCtrlHandler
InterlockedPushEntrySList
RtlUnwind
GetCPInfo
LCMapStringW
GetStringTypeW
OutputDebugStringW
GetStartupInfoW
SwitchToFiber
DeleteFiber
CreateFiberEx
ConvertFiberToThread
ConvertThreadToFiber
GetCurrentProcess
CloseHandle
SetLastError
GetLastError
GetCurrentThreadId
GetCurrentProcessId
SetEvent
GlobalGetAtomNameW
GetProfileIntW
SetFilePointerEx
VirtualProtect
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceW
GetModuleFileNameW
HeapFree
HeapSize
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
GetProcessHeap
GetLogicalDrives
ResetEvent
CreateEventW
FindFirstFileW
FindNextFileW
FindClose
GetModuleHandleW
MulDiv
lstrcpyW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetExitCodeProcess
GetFileAttributesExW
WaitForMultipleObjects
TerminateProcess
GetSystemTimeAsFileTime
ResumeThread
DeleteFileW
MoveFileExW
LocalFree
GetTempPathW
GetTempFileNameW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CreateProcessW
TerminateThread
GetWindowsDirectoryW
FindNextChangeNotification
FindFirstChangeNotificationW
FindCloseChangeNotification
GlobalLock
GlobalUnlock
GetFileAttributesW
GlobalAlloc
CreateFileW
GlobalSize
CreateHardLinkW
InterlockedIncrement
InterlockedDecrement
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
SuspendThread
SetThreadPriority
MultiByteToWideChar
Sleep
InitializeCriticalSection
TryEnterCriticalSection
IsDebuggerPresent
DebugBreak
GetModuleFileNameA
OutputDebugStringA
GetStdHandle
CreateFileA
WriteFile
ExitProcess
lstrlenW
FormatMessageW
FreeLibrary
VerSetConditionMask
GetSystemDirectoryW
LoadLibraryW
lstrcmpA
GetCurrentThread
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
EncodePointer
FreeResource
DuplicateHandle
GetVersionExW
WriteConsoleW
ReadConsoleW
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetComputerNameExW
WaitForSingleObjectEx
SleepEx
RemoveDirectoryW
CreateDirectoryW
MoveFileW
CopyFileW
FlushFileBuffers
GetFileType
SetEndOfFile
SetFileTime
GetFileTime
GetFileSize
GlobalFree
ExpandEnvironmentStringsW
ConnectNamedPipe
CreateNamedPipeW
SetHandleInformation
GetConsoleMode
GetACP
GetOEMCP
GetProcAddress
InterlockedExchange
SwitchToThread
GetEnvironmentVariableW
CreateFileMappingA
OpenEventW
QueryPerformanceCounter
QueryPerformanceFrequency
GetOverlappedResult
ReadDirectoryChangesW
FindVolumeClose
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
FindFirstVolumeW
CancelIo
GetCPInfoExW
SetFilePointer
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetSystemDirectoryA
LoadLibraryA
LoadLibraryExW
GetLocalTime
GetSystemTime
GetTimeZoneInformation
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
GetLocaleInfoW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetTickCount
LocalSize
LocalAlloc
RtlCaptureStackBackTrace
CompareStringW
WaitForMultipleObjectsEx
GetSystemInfo
GetModuleHandleA
ReadFile
GetFileSizeEx
ReleaseMutex
CreateThread
CreateMutexW
GetModuleHandleExW
InterlockedCompareExchange
WideCharToMultiByte
InterlockedExchangeAdd

user32

DestroyCursor
CreateMenu
SubtractRect
CharUpperBuffW
GetDoubleClickTime
DestroyAcceleratorTable
CreateAcceleratorTableW
GetKeyboardState
ToUnicodeEx
MapVirtualKeyExW
IsCharLowerW
GetKeyboardLayout
WaitMessage
MonitorFromPoint
UpdateLayeredWindow
LockWindowUpdate
CopyIcon
SetCursorPos
EnumDisplayMonitors
SetLayeredWindowAttributes
NotifyWinEvent
InvertRect
HideCaret
EnableScrollBar
GetMenuDefaultItem
UnionRect
PostThreadMessageW
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableW
CharNextW
DeleteMenu
CopyImage
RealChildWindowFromPoint
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
LoadAcceleratorsW
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
TranslateAcceleratorW
BringWindowToTop
GetAsyncKeyState
ShowOwnedPopups
GetMessageW
SetWindowContextHelpId
GetMenuStringW
SendDlgItemMessageA
MapVirtualKeyW
GetKeyNameTextW
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
IsDialogMessageW
CheckDlgButton
SetDlgItemTextW
WinHelpW
GetLastActivePopup
GetTopWindow
GetClassLongW
AdjustWindowRectEx
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
GetMenuItemID
EnableWindow
CopyRect
MessageBoxW
SendMessageW
GetWindowRect
SetMenu
GetMenu
SetWindowPlacement
RegisterClassW
PeekMessageW
RegisterWindowMessageW
LoadMenuW
GetActiveWindow
GetNextDlgTabItem
WindowFromPoint
TrackPopupMenu
DestroyMenu
IntersectRect
TrackPopupMenuEx
ValidateRect
CreateIcon
SetRect
ChildWindowFromPoint
GetCapture
TabbedTextOutW
GrayStringW
DrawTextExW
ShowScrollBar
GetClassInfoW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
SetRectEmpty
DrawStateW
GetMenuItemRect
SetMenuItemInfoW
GetMenuItemInfoW
IsMenu
SetClipboardData
EmptyClipboard
EnumChildWindows
CharLowerBuffW
IsDlgButtonChecked
LoadIconW
GetMenuState
GetSystemMenu
CreateDialogIndirectParamW
DialogBoxIndirectParamW
SetScrollInfo
GetScrollInfo
GetDialogBaseUnits
GetComboBoxInfo
GetUpdateRect
IsZoomed
SetWindowRgn
IsRectEmpty
DrawIconEx
DrawEdge
SetWinEventHook
UnhookWinEvent
MessageBeep
GetClipboardData
GetDlgCtrlID
OffsetRect
GetWindowTextW
GetWindowTextLengthW
ReleaseCapture
SetCapture
TrackMouseEvent
CreateWindowExW
SetClassLongW
DrawFocusRect
FrameRect
DrawFrameControl
IsWindowEnabled
RemovePropA
SetPropA
GetPropA
CreateIconIndirect
GetIconInfo
LoadImageW
AllowSetForegroundWindow
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
GetClassNameA
MonitorFromRect
GetWindowPlacement
GetMonitorInfoW
ScreenToClient
CallWindowProcW
OpenClipboard
MapWindowPoints
InvalidateRect
GetWindowLongW
GetDlgItem
IsWindowVisible
KillTimer
SetTimer
GetKeyState
IsWindow
MoveWindow
MapDialogRect
GetClientRect
GetParent
TranslateMessage
DispatchMessageW
PtInRect
UpdateWindow
SetFocus
DestroyWindow
FindWindowW
ShowWindow
IsIconic
SetForegroundWindow
DestroyIcon
UnregisterClassW
GetSysColor
EndDialog
GetClassInfoExW
LoadCursorW
RegisterClassExW
SetPropW
GetPropW
DefWindowProcW
RemovePropW
BeginPaint
EndPaint
FillRect
GetSysColorBrush
InflateRect
GetFocus
GetCaretBlinkTime
PostMessageW
DrawTextW
ReleaseDC
GetDC
IsChild
SetWindowPos
GetWindowRgn
SystemParametersInfoW
GetWindow
CreatePopupMenu
AppendMenuW
GetCursorPos
SetMenuDefaultItem
ModifyMenuW
EnableMenuItem
CheckMenuItem
SetWindowLongW
GetSystemMetrics
DrawIcon
GetWindowThreadProcessId
GetClassNameW
EnumWindows
PostQuitMessage
GetMessagePos
GetMessageTime
CloseClipboard
SetParent
SetActiveWindow
CharUpperW
RedrawWindow
SetWindowTextW
GetDesktopWindow
GetWindowDC
OpenIcon
EqualRect
SetCursor
CharLowerW
RegisterClipboardFormatW
GetSubMenu
InsertMenuW
RemoveMenu
IsClipboardFormatAvailable
GetMenuItemCount
ClientToScreen
CheckMenuRadioItem
SetClipboardViewer
ChangeClipboardChain
EnumThreadWindows
GetForegroundWindow
wsprintfA
MessageBoxA
MonitorFromWindow
GetUserObjectInformationW
GetProcessWindowStation
wsprintfW

gdi32

DeleteObject
SelectPalette
SetLayout
GetLayout
SetPolyFillMode
SetTextAlign
PolylineTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CopyMetaFileW
StretchDIBits
GetBkColor
GetMapMode
GetRgnBox
EnumFontFamiliesExW
CreateCompatibleBitmap
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
EnumFontFamiliesW
GetTextCharsetInfo
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
Polygon
Polyline
OffsetRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetTextFaceW
CreateCompatibleDC
SelectObject
CreateSolidBrush
BitBlt
DeleteDC
CreateFontIndirectW
SetTextColor
SetBkColor
GetDeviceCaps
CreateRectRgn
LPtoDP
CreateFontW
GetStockObject
Rectangle
CreateRectRgnIndirect
SetRectRgn
GetTextMetricsW
CreateBrushIndirect
CreateBitmapIndirect
SaveDC
RestoreDC
GetTextExtentPoint32W
GetObjectW
GetPixel
SetPixel
CreateBitmap
CreatePen
MoveToEx
LineTo
CreateDIBitmap
CreateDCW
SetBkMode
CreatePatternBrush
SetROP2
GetNearestColor
ExtSelectClipRgn
ExtTextOutW
CombineRgn
SetMapMode
GetClipBox
DPtoLP
SetWindowOrgEx
GetBitmapBits
GetCurrentObject
GetBitmapDimensionEx
SetBitmapDimensionEx
Escape
GetTextColor
PtVisible
RectVisible
TextOutW
CreateRoundRectRgn
FillRgn
CreatePolygonRgn
GetCharWidthW
RoundRect
PatBlt
CreateHatchBrush
ExcludeClipRect
GetCurrentPositionEx
GetObjectType
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
SelectClipRgn
CreatePalette

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetSaveFileNameW
GetOpenFileNameW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

GetTokenInformation
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
RegCloseKey
RegOpenKeyExW
RegQueryValueW
RegEnumKeyW
GetUserNameW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegNotifyChangeKeyValue
SetSecurityDescriptorControl
RegQueryValueExW
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
GetAclInformation
AddAccessAllowedAceEx
SetEntriesInAclW
LookupAccountSidW
InitializeSid
GetSidLengthRequired
CopySid
GetLengthSid
EqualSid
GetSidSubAuthority
IsValidSid
OpenProcessToken

shell32

SHGetMalloc
ShellExecuteExW
ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW
Shell_NotifyIconW
SHGetFileInfoW
DragQueryFileW
SHAppBarMessage
SHGetDesktopFolder
SHGetSpecialFolderLocation
DragFinish
SHFileOperationW
SHGetFolderPathW

comctl32

ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_GetImageCount
ord17

shlwapi

PathIsPrefixW
PathFindExtensionW
PathFindFileNameW
PathIsUNCW
PathStripToRootW
StrFormatKBSizeW
PathRemoveFileSpecW

uxtheme

GetCurrentThemeName
CloseThemeData
DrawThemeBackground
GetThemePartSize
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor
GetWindowTheme
IsAppThemed
GetThemeColor
DrawThemeText
DrawThemeParentBackground
OpenThemeData

ole32

OleGetClipboard
RegisterDragDrop
RevokeDragDrop
OleIsCurrentClipboard
DoDragDrop
CoDisconnectObject
CoFreeUnusedLibraries
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
CreateStreamOnHGlobal
CoRevokeClassObject
CoRegisterMessageFilter
OleFlushClipboard
CoInitialize
CLSIDFromProgID
CLSIDFromString
ReleaseStgMedium
OleDuplicateData
OleUninitialize
OleInitialize
CoTaskMemAlloc
StringFromGUID2
CoCreateGuid
CoCreateInstance
CoTaskMemFree
CoInitializeEx
CoUninitialize
OleLockRunning
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
CoLockObjectExternal
CoGetClassObject

oleaut32

OleCreateFontIndirect
VarBstrFromDate
VariantCopy
SysFreeString
SysAllocString
VariantInit
VariantClear
SysStringLen
SafeArrayDestroy
SysAllocStringLen
VariantChangeType
LoadTypeLi
SystemTimeToVariantTime
VariantTimeToSystemTime

oledlg

OleUIBusyW

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

gdiplus

GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipAlloc
GdipFree
GdiplusStartup
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipCloneImage
GdipDisposeImage
GdiplusShutdown

imm32

ImmGetContext
ImmGetOpenStatus
ImmReleaseContext

winmm

PlaySoundW

psapi

GetModuleFileNameExW

wininet

InternetReadFile
InternetOpenUrlW
InternetOpenW
InternetCloseHandle

secur32

FreeContextBuffer
FreeCredentialsHandle
VerifySignature
EnumerateSecurityPackagesA
QuerySecurityPackageInfoA
AcquireCredentialsHandleW
InitializeSecurityContextW
InitializeSecurityContextA
AcceptSecurityContext
AcquireCredentialsHandleA
MakeSignature
DeleteSecurityContext

iphlpapi

GetTcpTable

Sections

.text
Size: 8.1MB - Virtual size: 8.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 170KB - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 161B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 636KB - Virtual size: 636KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3a7e16c4b85cb105d752784d28eac286

Headers

File Characteristics

Imports

crypt32

ws2_32

version

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

oleacc

gdiplus

imm32

winmm

psapi

wininet

secur32

iphlpapi

Sections

.text Size: 8.1MB - Virtual size: 8.1MB

.rdata Size: 2.6MB - Virtual size: 2.6MB

.data Size: 170KB - Virtual size: 207KB

.tls Size: 512B - Virtual size: 161B

.rsrc Size: 2.3MB - Virtual size: 2.3MB

.reloc Size: 636KB - Virtual size: 636KB

.text
Size: 8.1MB - Virtual size: 8.1MB

.rdata
Size: 2.6MB - Virtual size: 2.6MB

.data
Size: 170KB - Virtual size: 207KB

.tls
Size: 512B - Virtual size: 161B

.rsrc
Size: 2.3MB - Virtual size: 2.3MB

.reloc
Size: 636KB - Virtual size: 636KB