d71e7ab5a4daa7ca36b89b418962f92e

Sharing

Copy URL Twitter E-mail

General

Target

d71e7ab5a4daa7ca36b89b418962f92e
Size

3.4MB
MD5

d71e7ab5a4daa7ca36b89b418962f92e
SHA1

2f9bad25062faea05e537c7345db408971282f6d
SHA256

391cc0f1880904a0e5d982cb27059485c751c2cd038986910d813fae0ed583f0
SHA512

b5081e1bb672285468049b2f4e820c09efaefd9da38a856f89e6bd5ca02c8f6cf285cd72d83f5a3b81c941c518f3d79b1f2ff3a4805983c94c691b78ba37a75c
SSDEEP

49152:5Q9W719uTk8sw9fou6J/Y9WMmZ+agamF5Z56rZS4UUFdTZ3cngAfukXpkoyUHH3S:3q0wq/5MuEUFzcnr5JHH3el

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d71e7ab5a4daa7ca36b89b418962f92e

Files

d71e7ab5a4daa7ca36b89b418962f92e
.exe windows:5 windows x64 arch:x64

e2e09ebd7104300ff0c5a41dabd44954

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

LockFile
SetFilePointer
UnlockFile
DuplicateHandle
GetThreadLocale
VirtualProtect
SetErrorMode
GetFileSizeEx
GetFileTime
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
CompareStringW
GetCurrentDirectoryW
VerSetConditionMask
VerifyVersionInfoW
WriteConsoleW
LocalReAlloc
SetEnvironmentVariableA
GetFullPathNameW
GetEnvironmentStringsW
GetCPInfo
IsValidCodePage
FindFirstFileExW
ReadConsoleW
GetConsoleMode
GetConsoleCP
SetStdHandle
GetStringTypeW
LCMapStringW
GetTimeFormatW
GetDateFormatW
ExitProcess
GetStdHandle
VirtualQuery
HeapQueryInformation
FreeLibraryAndExitThread
ExitThread
GetCommandLineW
GetCommandLineA
CreateDirectoryW
PeekNamedPipe
GetFileType
RtlUnwindEx
RtlPcToFileHeader
OutputDebugStringW
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
GetFileSize
GlobalFlags
GetSystemDefaultUILanguage
FreeEnvironmentStringsW
GetLocaleInfoW
TlsSetValue
TlsGetValue
TlsAlloc
GetProfileIntW
GetTickCount
MulDiv
GlobalSize
GlobalFindAtomW
GetSystemDirectoryW
EncodePointer
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
CreateEventW
SetEvent
CompareStringA
lstrcmpW
lstrcmpA
GlobalDeleteAtom
LoadLibraryExW
GetCurrentThread
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GetModuleHandleExW
OutputDebugStringA
GetACP
SetEndOfFile
FlushFileBuffers
SetFilePointerEx
GlobalFree
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalMemoryStatusEx
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemInfo
GetNativeSystemInfo
ReadFile
GetTempFileNameW
CopyFileW
RemoveDirectoryW
DeleteFileW
VirtualFree
VirtualAlloc
MoveFileExW
SetFileTime
GetDiskFreeSpaceW
FindNextFileW
SetFileAttributesW
GetFileInformationByHandle
GetFileAttributesExW
GetVolumeInformationW
TerminateProcess
Module32FirstW
GetCurrentThreadId
Process32NextW
OpenProcess
Process32FirstW
CreateToolhelp32Snapshot
GetCPInfoExW
EnumSystemCodePagesW
DeviceIoControl
GetDiskFreeSpaceExW
GetDriveTypeW
GetLogicalDriveStringsW
GetUserDefaultUILanguage
ExpandEnvironmentStringsW
lstrlenW
SetLastError
LocalFree
FormatMessageW
WriteFile
CreateFileW
SetPriorityClass
GetCurrentProcess
SetProcessWorkingSetSize
GetCurrentProcessId
GetModuleFileNameW
FindClose
FindFirstFileW
GetFileAttributesW
GetTempPathW
LocalFileTimeToFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToLocalFileTime
GetTimeZoneInformation
GetVersionExW
GetModuleHandleW
FreeResource
EndUpdateResourceW
UpdateResourceW
BeginUpdateResourceW
EnumResourceLanguagesW
FindResourceExW
EnumResourceNamesW
EnumResourceTypesW
GlobalAddAtomW
lstrcpyW
SetThreadPriority
GetThreadPriority
ResumeThread
WaitForSingleObject
TerminateThread
CreateThread
SuspendThread
GetProcAddress
FreeLibrary
LoadLibraryW
GetSystemPowerStatus
GetLocalTime
FindResourceW
LoadResource
LockResource
SizeofResource
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTimeAsFileTime
GetOEMCP
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
Sleep
GetComputerNameW
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionAndSpinCount
HeapFree

user32

DestroyMenu
GetWindowDC
MapDialogRect
SetWindowContextHelpId
IsDialogMessageW
SetWindowTextW
MoveWindow
WinHelpW
GetScrollInfo
SetScrollInfo
LoadIconW
UnhookWindowsHookEx
GetWindow
GetTopWindow
GetClassNameW
GetClassLongPtrW
SetWindowLongPtrW
GetWindowLongPtrW
EqualRect
MapWindowPoints
AdjustWindowRectEx
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
SetPropW
GetScrollPos
SetScrollPos
EndPaint
BeginPaint
SetActiveWindow
TrackPopupMenu
GetMenuItemCount
InflateRect
SetMenu
GetMenu
GetDlgCtrlID
UnregisterClassW
EnableWindow
ChangeClipboardChain
SetClipboardViewer
DestroyIcon
GetDlgItem
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPos
DestroyWindow
IsChild
IsMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
GetLastActivePopup
IsWindowEnabled
CallNextHookEx
SetWindowsHookExW
ValidateRect
GetKeyState
GetActiveWindow
IsWindowVisible
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
LoadBitmapW
SetMenuItemInfoW
CreateDialogIndirectParamW
EndDialog
GetNextDlgTabItem
RealChildWindowFromPoint
GetSysColorBrush
CharUpperW
CharNextW
CopyAcceleratorTableW
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
GetFocus
PostQuitMessage
SetRectEmpty
SendDlgItemMessageA
GetSubMenu
SendMessageW
IsWindow
GetSysColor
SetCapture
GetClientRect
DrawMenuBar
EnumDisplayMonitors
SetRect
GetSystemMetrics
MonitorFromRect
MonitorFromWindow
GetDC
ReleaseDC
GetWindowRect
ClientToScreen
GetForegroundWindow
WindowFromPoint
SystemParametersInfoW
MessageBoxW
OffsetRect
SetWindowRgn
ShowWindow
RedrawWindow
SetForegroundWindow
IsIconic
IsZoomed
PostMessageW
SetWindowLongW
GetWindowLongW
KillTimer
GetCursorPos
SetTimer
RegisterHotKey
UnregisterHotKey
DefWindowProcW
GetAsyncKeyState
SetCursor
LoadCursorW
ReleaseCapture
UpdateWindow
PostThreadMessageW
GetMonitorInfoW
PtInRect
IntersectRect
CallWindowProcW
CreatePopupMenu
AppendMenuW
CheckMenuItem
InsertMenuW
DeleteMenu
CopyRect
GetDesktopWindow
UnionRect
ScreenToClient
SetClipboardData
CloseClipboard
EmptyClipboard
OpenClipboard
GetParent
IsRectEmpty
DrawIconEx
GetIconInfo
SendMessageTimeoutW
EnumWindows
GetWindowThreadProcessId
EnumDesktopWindows
GetThreadDesktop
CreateIconFromResource
CreateIconFromResourceEx
GetMenuInfo
RegisterClassExW
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
GetCapture
InvalidateRect
RegisterClipboardFormatW
wsprintfW
SetFocus
WaitForInputIdle
GetMenuItemID
CheckMenuRadioItem
EnableMenuItem
ModifyMenuW

gdi32

GetMapMode
DPtoLP
GetTextColor
CreateRectRgnIndirect
ScaleWindowExtEx
ScaleViewportExtEx
OffsetViewportOrgEx
SetWindowExtEx
SetStretchBltMode
SetMapMode
ExtSelectClipRgn
SaveDC
RestoreDC
GetWindowExtEx
GetViewportExtEx
GetRgnBox
GetDIBColorTable
GetClipBox
ExcludeClipRect
CreatePen
CopyMetaFileW
CreateBitmap
GetBkColor
CreateCompatibleBitmap
GetTextExtentPoint32W
CreateFontIndirectW
SetTextColor
SetBkMode
GetStockObject
SetBkColor
CreateSolidBrush
GetStretchBltMode
Ellipse
CombineRgn
CreateRoundRectRgn
CreateRectRgn
GetPaletteEntries
GetCurrentObject
SetDIBColorTable
CreateCompatibleDC
SelectObject
BitBlt
DeleteObject
CreateDCW
SetViewportOrgEx
SetViewportExtEx
GetDeviceCaps
DeleteDC
StartDocW
StartPage
StretchBlt
EndPage
EndDoc
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetObjectW
CreateDIBSection

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

ControlService
RegOpenKeyExW
RegEnumKeyExW
RegQueryValueExW
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
QueryServiceConfigW
RegCloseKey
StartServiceW
DeleteService
ChangeServiceConfigW
OpenServiceW
CreateServiceW
CloseServiceHandle
OpenSCManagerW
GetUserNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation

shell32

DragQueryFileW
Shell_NotifyIconW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteW
ShellExecuteExW
SHGetFileInfoW
SHFileOperationW
DragFinish
DragAcceptFiles
SHChangeNotify
ord716
ord155
SHGetDesktopFolder
ord162
ord190

comctl32

InitCommonControlsEx
ImageList_GetIcon
ImageList_AddMasked
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragMove
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragShowNolock

shlwapi

PathFindExtensionW
PathFindFileNameW
PathRemoveExtensionW
PathRemoveFileSpecW
PathIsUNCW
StrFormatByteSizeW
PathStripToRootW

ole32

CoGetClassObject
DoDragDrop
OleGetClipboard
OleIsCurrentClipboard
OleFlushClipboard
CoInitializeEx
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
CLSIDFromProgID
CLSIDFromString
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
ReleaseStgMedium
OleDuplicateData
CoTaskMemAlloc
CoCreateGuid
CoTaskMemFree
CoCreateInstance
CoInitializeSecurity
CoUninitialize
CoInitialize
CoRegisterMessageFilter
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
CreateStreamOnHGlobal
CoRevokeClassObject

oleaut32

VariantInit
VariantClear
SysAllocStringLen
VariantChangeType
SysStringLen
SafeArrayDestroy
SysAllocString
VariantCopy
OleCreateFontIndirect
SysFreeString
SystemTimeToVariantTime
VariantTimeToSystemTime

oledlg

OleUIBusyW

urlmon

URLDownloadToFileW
URLDownloadToCacheFileW

wininet

HttpSendRequestW
HttpQueryInfoW
HttpOpenRequestW
InternetCloseHandle
InternetConnectW
InternetOpenW
InternetGetConnectedState
InternetReadFile

iphlpapi

GetIfTable
GetTcpStatistics
GetPerAdapterInfo
GetAdaptersInfo

psapi

GetProcessImageFileNameW
GetPerformanceInfo

ws2_32

WSACleanup

oleacc

CreateStdAccessibleObject
LresultFromObject

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 581KB - Virtual size: 580KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.giats
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 955KB - Virtual size: 955KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

fuufjql
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e2e09ebd7104300ff0c5a41dabd44954

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

urlmon

wininet

iphlpapi

psapi

ws2_32

oleacc

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 581KB - Virtual size: 580KB

.data Size: 41KB - Virtual size: 107KB

.pdata Size: 100KB - Virtual size: 100KB

.gfids Size: 10KB - Virtual size: 10KB

.giats Size: 512B - Virtual size: 4B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 955KB - Virtual size: 955KB

.reloc Size: 60KB - Virtual size: 61KB

fuufjql Size: - Virtual size: 4KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 581KB - Virtual size: 580KB

.data
Size: 41KB - Virtual size: 107KB

.pdata
Size: 100KB - Virtual size: 100KB

.gfids
Size: 10KB - Virtual size: 10KB

.giats
Size: 512B - Virtual size: 4B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 955KB - Virtual size: 955KB

.reloc
Size: 60KB - Virtual size: 61KB

fuufjql
Size: - Virtual size: 4KB