fb3a1cff3896c69028b9cd40153ee763859abb280b15fd1c19f9ac720cbac27c

Sharing

Copy URL Twitter E-mail

General

Target

fb3a1cff3896c69028b9cd40153ee763859abb280b15fd1c19f9ac720cbac27c
Size

12.3MB
MD5

609271f9456541a35cb270e962c8de7e
SHA1

fab4957be1eb5b863d03987946b640a964258b7b
SHA256

fb3a1cff3896c69028b9cd40153ee763859abb280b15fd1c19f9ac720cbac27c
SHA512

c74795dc4c8e4fa1497272d8c8ad619719a20113a8d3d2e6ef7f563cfa28b2569c41575e1fa3188ba05bff9fd92ce08d9e9062770411d7c5e8deab5efdc4a633
SSDEEP

393216:GUYY+Jp4ytcCSh+iCTXh7ftJsv6tWKFdu9CblS9sR:JQndVksR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb3a1cff3896c69028b9cd40153ee763859abb280b15fd1c19f9ac720cbac27c

Files

fb3a1cff3896c69028b9cd40153ee763859abb280b15fd1c19f9ac720cbac27c
.exe windows:6 windows x64 arch:x64

fbd46910baa4f8af1f76e963866c9090

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetFileAttributesExW
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindFirstFileW
GetFileAttributesW
GetFileInformationByHandle
GetFullPathNameW
GetLogicalDrives
GetLongPathNameW
RemoveDirectoryW
GetTempPathW
GetVolumePathNamesForVolumeNameW
DeviceIoControl
CopyFileW
MoveFileW
FileTimeToSystemTime
GetFileInformationByHandleEx
FlushFileBuffers
GetFileType
ReadFile
SetEndOfFile
SetFilePointerEx
WriteFile
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
MoveFileExW
GetTimeZoneInformation
GetGeoInfoW
GetUserGeoID
GetSystemDirectoryW
FindFirstFileExW
FindNextFileW
GetExitCodeProcess
OpenProcess
LoadLibraryA
GetVolumeInformationW
GetDriveTypeW
lstrcmpW
ReleaseMutex
CreateMutexW
VirtualAlloc
VirtualFree
ExitProcess
ExpandEnvironmentStringsW
CreateProcessW
CheckRemoteDebuggerPresent
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalSize
WaitForMultipleObjects
LeaveCriticalSection
InitializeCriticalSection
GetTickCount64
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleFileNameW
GetStartupInfoW
GetLocalTime
GetSystemTime
GetProcAddress
GetModuleHandleW
WaitForSingleObjectEx
CreateFileW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread
GetThreadPriority
SetThreadPriority
GetCurrentThread
CreateEventW
GetLastError
DuplicateHandle
GetConsoleWindow
LocalAlloc
GetUserDefaultLangID
FindNextChangeNotification
FindFirstChangeNotificationW
FindCloseChangeNotification
HeapSize
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindFirstFileExA
WriteConsoleW
GetCPInfo
SetEnvironmentVariableA
EnumSystemLocalesW
IsValidLocale
LCMapStringW
HeapReAlloc
GetStringTypeW
HeapAlloc
HeapFree
GetACP
GetStdHandle
SetStdHandle
SetFileAttributesW
GetConsoleCP
ReadConsoleW
GetConsoleMode
FreeLibraryAndExitThread
ExitThread
SetLastError
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
RtlUnwindEx
RaiseException
EncodePointer
RtlPcToFileHeader
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetUserPreferredUILanguages
GetCurrencyFormatW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
LoadLibraryW
GetModuleHandleExW
FreeLibrary
SetErrorMode
ResetEvent
GetSystemInfo
FormatMessageW
WaitForSingleObject
Sleep
SetEvent
TerminateThread
CloseHandle
CreateThread
DeleteCriticalSection
CreateEventA
GetModuleHandleA
GetModuleFileNameA
OutputDebugStringW
LocalFree
GetCommandLineW
GetUserDefaultLCID
CompareStringW
Process32First
CreateDirectoryA
WideCharToMultiByte
GetCurrentProcessId
RemoveDirectoryA
Process32Next
DeleteFileA
CopyFileA
MultiByteToWideChar
CreateToolhelp32Snapshot
GetCommandLineA
GetLocaleInfoA
GetCurrentThreadId
FindClose
FindNextFileA
GetCurrentProcess
FindFirstFileA
EnterCriticalSection

user32

NotifyWinEvent
SetMenuItemInfoW
TrackPopupMenuEx
MapVirtualKeyW
SetCursorPos
ToAscii
GetKeyboardState
GetKeyState
IsZoomed
GetCursor
LoadCursorW
CreateCursor
CreateIconIndirect
GetIconInfo
GetCursorInfo
GetClipboardFormatNameW
TrackMouseEvent
GetMessageExtraInfo
GetAsyncKeyState
GetWindowTextW
EnumWindows
RealGetWindowClassW
ToUnicode
RegisterClassExA
UnregisterClassA
PeekMessageA
CreateWindowExA
DefWindowProcA
PostMessageA
DestroyWindow
TranslateMessage
DispatchMessageW
PeekMessageW
PostMessageW
DefWindowProcW
RegisterClassW
UnregisterClassW
CreateWindowExW
GetQueueStatus
MsgWaitForMultipleObjectsEx
SetTimer
SetCaretPos
HideCaret
DestroyCaret
CreateCaret
RegisterWindowMessageW
GetKeyboardLayout
RegisterClipboardFormatW
ChangeClipboardChain
SetClipboardViewer
IsHungAppWindow
LoadIconW
EnumDisplayMonitors
KillTimer
GetWindowLongPtrW
SetWindowLongPtrW
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
DrawIconEx
GetMonitorInfoW
MonitorFromWindow
LoadImageW
GetSysColorBrush
ChildWindowFromPointEx
GetCursorPos
GetClientRect
GetFocus
RegisterClassExW
GetClassInfoW
UnregisterDeviceNotification
RegisterDeviceNotificationW
CharNextExA
MessageBoxW
SystemParametersInfoW
GetDC
ReleaseDC
GetSystemMenu
EnableMenuItem
GetSystemMetrics
GetSysColor
SetWindowRgn
GetDesktopWindow
GetMenu
GetDoubleClickTime
IsWindow
MessageBeep
GetCaretBlinkTime
UpdateLayeredWindowIndirect
SendMessageW
AttachThreadInput
IsChild
ShowWindow
UpdateLayeredWindow
SetLayeredWindowAttributes
FlashWindowEx
MoveWindow
SetWindowPos
GetWindowPlacement
SetWindowPlacement
GetKeyboardLayoutList
GetAncestor
DestroyIcon
DestroyCursor
GetWindowThreadProcessId
SetParent
GetParent
SetWindowLongW
GetWindowLongW
ScreenToClient
ClientToScreen
SetCursor
AdjustWindowRectEx
GetWindowRect
SetWindowTextW
InvalidateRect
GetUpdateRect
EndPaint
BeginPaint
SetForegroundWindow
GetForegroundWindow
ReleaseCapture
SetCapture
GetCapture
SetFocus
IsIconic
IsWindowVisible

gdi32

GetBitmapBits
SwapBuffers
CombineRgn
CreateCompatibleDC
CreateRectRgn
DeleteDC
DeleteObject
GetRegionData
SelectClipRgn
SelectObject
CreateDIBSection
GdiFlush
BitBlt
OffsetRgn
GetDeviceCaps
CreateCompatibleBitmap
CreateDCW
ChoosePixelFormat
SetPixelFormat
DescribePixelFormat
GetObjectW
SetGraphicsMode
CreateBitmap
GetDIBits
CreateFontIndirectW
EnumFontFamiliesExW
GetFontData
GetStockObject
AddFontResourceExW
RemoveFontResourceExW
AddFontMemResourceEx
RemoveFontMemResourceEx
GetTextMetricsW
GetTextFaceW
GetCharABCWidthsW
GetCharABCWidthsFloatW
GetGlyphOutlineW
GetOutlineTextMetricsW
GetTextExtentPoint32W
GetCharABCWidthsI
SetBkMode
GetPixelFormat
SetTextColor
SetTextAlign
SetWorldTransform
ExtTextOutW

advapi32

RegFlushKey
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
MapGenericMask
GetTokenInformation
GetLengthSid
FreeSid
DuplicateToken
CopySid
AccessCheck
OpenProcessToken
RegSetValueExW

shell32

SHGetKnownFolderIDList
SHGetPathFromIDListW
SHGetMalloc
SHCreateItemFromParsingName
SHCreateItemFromIDList
ShellExecuteW
ord727
SHGetStockIconInfo
SHGetFileInfoW
SHGetKnownFolderPath
SHGetSpecialFolderPathA
SHBrowseForFolderW

ole32

CoTaskMemAlloc
CoGetMalloc
ReleaseStgMedium
DoDragDrop
OleIsCurrentClipboard
OleGetClipboard
OleSetClipboard
CoInitializeEx
OleUninitialize
OleInitialize
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
StringFromGUID2
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoCreateGuid
CoInitialize
OleFlushClipboard

oleaut32

SysStringLen
SysAllocStringLen
VariantChangeType
SystemTimeToVariantTime
SysAllocString
VariantInit
SysFreeString

dbghelp

MakeSureDirectoryPathExists

winmm

timeSetEvent
timeKillEvent
PlaySoundW

imm32

ImmGetCompositionStringW
ImmGetDefaultIMEWnd
ImmGetContext
ImmReleaseContext
ImmAssociateContext
ImmNotifyIME
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetVirtualKey

ws2_32

WSAAsyncSelect

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

uxtheme

GetThemePartSize
OpenThemeData
CloseThemeData
GetThemeTransitionDuration
GetCurrentThemeName
IsAppThemed
IsThemeActive
SetWindowTheme
GetThemePropertyOrigin
GetThemeMargins
GetThemeEnumValue
GetThemeInt
GetThemeBool
GetThemeColor
IsThemeBackgroundPartiallyTransparent
GetThemeBackgroundRegion
ord47

dwmapi

DwmEnableBlurBehindWindow
DwmIsCompositionEnabled

Exports

Exports

cJSON_AddArrayToObject
cJSON_AddBoolToObject
cJSON_AddFalseToObject
cJSON_AddItemReferenceToArray
cJSON_AddItemReferenceToObject
cJSON_AddItemToArray
cJSON_AddItemToObject
cJSON_AddItemToObjectCS
cJSON_AddNullToObject
cJSON_AddNumberToObject
cJSON_AddObjectToObject
cJSON_AddRawToObject
cJSON_AddStringToObject
cJSON_AddTrueToObject
cJSON_Compare
cJSON_CreateArray
cJSON_CreateArrayReference
cJSON_CreateBool
cJSON_CreateDoubleArray
cJSON_CreateFalse
cJSON_CreateFloatArray
cJSON_CreateIntArray
cJSON_CreateNull
cJSON_CreateNumber
cJSON_CreateObject
cJSON_CreateObjectReference
cJSON_CreateRaw
cJSON_CreateString
cJSON_CreateStringArray
cJSON_CreateStringReference
cJSON_CreateTrue
cJSON_Delete
cJSON_DeleteItemFromArray
cJSON_DeleteItemFromObject
cJSON_DeleteItemFromObjectCaseSensitive
cJSON_DetachItemFromArray
cJSON_DetachItemFromObject
cJSON_DetachItemFromObjectCaseSensitive
cJSON_DetachItemViaPointer
cJSON_Duplicate
cJSON_GetArrayItem
cJSON_GetArraySize
cJSON_GetErrorPtr
cJSON_GetObjectItem
cJSON_GetObjectItemCaseSensitive
cJSON_GetStringValue
cJSON_HasObjectItem
cJSON_InitHooks
cJSON_InsertItemInArray
cJSON_IsArray
cJSON_IsBool
cJSON_IsFalse
cJSON_IsInvalid
cJSON_IsNull
cJSON_IsNumber
cJSON_IsObject
cJSON_IsRaw
cJSON_IsString
cJSON_IsTrue
cJSON_Minify
cJSON_Parse
cJSON_ParseWithOpts
cJSON_Print
cJSON_PrintBuffered
cJSON_PrintPreallocated
cJSON_PrintUnformatted
cJSON_ReplaceItemInArray
cJSON_ReplaceItemInObject
cJSON_ReplaceItemInObjectCaseSensitive
cJSON_ReplaceItemViaPointer
cJSON_SetNumberHelper
cJSON_Version
cJSON_free
cJSON_malloc

Sections

.text
Size: 7.7MB - Virtual size: 7.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 119KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 429KB - Virtual size: 428KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmetad
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 404KB - Virtual size: 403KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fbd46910baa4f8af1f76e963866c9090

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

dbghelp

winmm

imm32

ws2_32

version

uxtheme

dwmapi

Exports

Exports

Sections

.text Size: 7.7MB - Virtual size: 7.7MB

.rdata Size: 3.6MB - Virtual size: 3.6MB

.data Size: 119KB - Virtual size: 167KB

.pdata Size: 429KB - Virtual size: 428KB

.tls Size: 512B - Virtual size: 13B

.qtmetad Size: 512B - Virtual size: 272B

.gfids Size: 512B - Virtual size: 280B

_RDATA Size: 512B - Virtual size: 272B

.rsrc Size: 404KB - Virtual size: 403KB

.reloc Size: 45KB - Virtual size: 45KB

.text
Size: 7.7MB - Virtual size: 7.7MB

.rdata
Size: 3.6MB - Virtual size: 3.6MB

.data
Size: 119KB - Virtual size: 167KB

.pdata
Size: 429KB - Virtual size: 428KB

.tls
Size: 512B - Virtual size: 13B

.qtmetad
Size: 512B - Virtual size: 272B

.gfids
Size: 512B - Virtual size: 280B

_RDATA
Size: 512B - Virtual size: 272B

.rsrc
Size: 404KB - Virtual size: 403KB

.reloc
Size: 45KB - Virtual size: 45KB