e5637c7a5d8601bca0f4c8595b012a28

Sharing

Copy URL Twitter E-mail

General

Target

e5637c7a5d8601bca0f4c8595b012a28
Size

2.5MB
MD5

e5637c7a5d8601bca0f4c8595b012a28
SHA1

b1e57b50358dd028f5e4f5d9c69766f473489b65
SHA256

09cc38d9c24de13361d1a6b2024e12059cba5b476041735bb94b57814cd323a3
SHA512

124ba2ee37ee593e92e24aeaeaa7cd182d4a250485eba39498592ddce7bd4d5b71f855e4c2acf56309e5a30c1d4ea5b46e3790887c0a6d6f9444a6b9b70d1e77
SSDEEP

49152:MsFQ5NztLBIhEYVPrM/8q/FkKQnhM4ckmraPsGdtdwCJeoCDx/kS:M4QzhL2hEYVPrM/8qLQnmzrsdtdwke

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e5637c7a5d8601bca0f4c8595b012a28

Files

e5637c7a5d8601bca0f4c8595b012a28
.exe windows:5 windows x86 arch:x86

c6b14cc98da7409b4b8ac24ced18a750

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemTime
GlobalMemoryStatus
FlushConsoleInputBuffer
DeleteCriticalSection
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
ReadConsoleInputA
FindNextFileW
GetDiskFreeSpaceExW
GetDriveTypeW
GetLogicalDriveStringsW
FreeLibrary
LoadLibraryW
WaitForSingleObject
GetTempPathW
ReadFile
SetFilePointer
SetConsoleMode
CreateProcessW
GetStartupInfoW
CreatePipe
Sleep
DeleteFileW
WriteFile
CreateFileW
FindClose
FindFirstFileW
FreeResource
GetCommandLineW
SetCurrentDirectoryW
WideCharToMultiByte
GetSystemInfo
GetModuleHandleW
GetProcAddress
GetComputerNameW
GetSystemDirectoryW
WritePrivateProfileStringW
GetTickCount
CreateDirectoryW
GetLocalTime
CloseHandle
GetPrivateProfileStringW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentProcessId
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetModuleFileNameW
GetLastError
MultiByteToWideChar
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
SetEndOfFile
GetFileAttributesExW
WriteConsoleW
SetConsoleCtrlHandler
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
FlushFileBuffers
SetStdHandle
GetFullPathNameW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
GetACP
GlobalLock
GlobalUnlock
lstrlenW
GetCurrentDirectoryW
ExitProcess
MulDiv
GetFileSize
LocalFree
FormatMessageW
VerSetConditionMask
GetCurrentProcess
GetFileType
SetFileTime
DuplicateHandle
SystemTimeToFileTime
DosDateTimeToFileTime
GlobalAlloc
InterlockedIncrement
InterlockedDecrement
lstrcpyW
InitializeCriticalSection
SleepEx
ExpandEnvironmentStringsA
WaitForMultipleObjects
GetStdHandle
PeekNamedPipe
SetLastError
FormatMessageA
LoadLibraryA
GetModuleHandleA
GetSystemDirectoryA
VerifyVersionInfoA
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetConsoleCP
GetStringTypeW
GetTimeZoneInformation
CompareStringW
LCMapStringW

user32

BringWindowToTop
SetCursor
InflateRect
UnionRect
OffsetRect
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
DefWindowProcW
PostQuitMessage
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
IsWindow
SetWindowPos
SetFocus
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
GetClientRect
GetWindowRect
GetWindowLongW
SetWindowLongW
GetParent
GetWindow
LoadImageW
MonitorFromWindow
GetMonitorInfoW
DestroyWindow
IsWindowVisible
IsZoomed
CharNextW
GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
ShowWindow
GetCursorPos
CreateCaret
GetCaretBlinkTime
KillTimer
ScreenToClient
MapWindowPoints
GetSysColor
IntersectRect
IsRectEmpty
PtInRect
SetWindowRgn
LoadIconW
SetCaretPos
MoveWindow
GetWindowRgn
CharPrevW
DrawTextW
FillRect
SetRect
CreatePopupMenu
DestroyMenu
EnableMenuItem
AppendMenuW
TrackPopupMenu
HideCaret
ShowCaret
GetCaretPos
ClientToScreen
IsWindowEnabled
GetWindowTextLengthW
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
SetForegroundWindow
GetKeyboardLayout
GetKeyNameTextW
MapVirtualKeyExW
SetTimer
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetWindowTextW
FindWindowW
IsIconic
PostMessageW
GetDesktopWindow
InvalidateRect
MessageBoxW
GetDC
SetWindowTextW
wsprintfW
UpdateLayeredWindow

gdi32

SetWindowOrgEx
CreateRoundRectRgn
CreateRectRgn
PtInRegion
CreateDIBSection
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
LineTo
RoundRect
SelectClipRgn
CreateEnhMetaFileW
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
GetObjectW
GetObjectA
MoveToEx
TextOutW
GdiFlush
GetBitmapBits
SetBitmapBits
CloseEnhMetaFile
SaveDC
RestoreDC
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateDIBitmap
GetTextExtentPoint32W
SelectObject
GetTextMetricsW
PlayEnhMetaFile
SetTextColor
GetEnhMetaFileHeader
CreateCompatibleBitmap
CreateCompatibleDC
ExtSelectClipRgn
BitBlt

advapi32

DeregisterEventSource
ReportEventA
RegOpenKeyW
RegOpenKeyExW
RegEnumValueW
RegCloseKey
RegQueryValueExW
RegisterEventSourceA

shell32

DragQueryFileW
SHChangeNotify
CommandLineToArgvW
SHGetSpecialFolderPathW
ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW
Shell_NotifyIconW

ole32

CoCreateGuid
OleLockRunning
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
ReleaseStgMedium
OleDuplicateData
CoInitialize
RevokeDragDrop
RegisterDragDrop
DoDragDrop
CoCreateInstance
CoUninitialize

shlwapi

PathIsDirectoryW
PathRemoveFileSpecW
PathFileExistsW

imagehlp

MakeSureDirectoryPathExists

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

urlmon

URLDownloadToFileW

ws2_32

bind
getservbyname
htonl
shutdown
ioctlsocket
sendto
recvfrom
listen
accept
freeaddrinfo
getaddrinfo
WSAIoctl
socket
setsockopt
ntohs
htons
gethostbyname
gethostname
WSAStartup
WSACleanup
WSAGetLastError
__WSAFDIsSet
select
WSASetLastError
recv
send
getsockname
getpeername
connect
closesocket
getsockopt

wldap32

ord27
ord26
ord22
ord41
ord50
ord32
ord33
ord60
ord211
ord46
ord35
ord79
ord30
ord200
ord301
ord143

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow

comctl32

_TrackMouseEvent
ord17
InitCommonControlsEx

gdiplus

GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipCloneBrush
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipDrawRectangleI
GdipFillRectangleI
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipDrawImageRectI
GdipFree
GdipAlloc
GdiplusShutdown
GdiplusStartup
GdipCreateFromHDC

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 445KB - Virtual size: 445KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 44KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 199KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 158KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c6b14cc98da7409b4b8ac24ced18a750

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

imagehlp

version

urlmon

ws2_32

wldap32

oleaut32

imm32

comctl32

gdiplus

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 445KB - Virtual size: 445KB

.data Size: 44KB - Virtual size: 58KB

.gfids Size: 512B - Virtual size: 480B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 199KB - Virtual size: 199KB

.reloc Size: 158KB - Virtual size: 160KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 445KB - Virtual size: 445KB

.data
Size: 44KB - Virtual size: 58KB

.gfids
Size: 512B - Virtual size: 480B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 199KB - Virtual size: 199KB

.reloc
Size: 158KB - Virtual size: 160KB