b9fdc05ebb01e00d28b4add9a259c7e8e0aac83ab47a65080de51ca8e5e52e5a

Sharing

Copy URL Twitter E-mail

General

Target

b9fdc05ebb01e00d28b4add9a259c7e8e0aac83ab47a65080de51ca8e5e52e5a
Size

854KB
MD5

be323bb8336375dcc05a0f6693e592d2
SHA1

762534d221dbdbd72338d3c4f5ab530de4a4f421
SHA256

b9fdc05ebb01e00d28b4add9a259c7e8e0aac83ab47a65080de51ca8e5e52e5a
SHA512

cc62ad9549314e6d213e20f3ac74b2c19f3712aeb7d9bb12ab151e0ae428c60f07332d54de5a2af1d12071459a590377444f4afbd9bd32b50c8f8823f1b32627
SSDEEP

12288:MfiaGzUyDZhIdIZe+7B1aZzEUAWzZ43CrypH4WBCsvZleNfHZrut88MY:MKac0dIZL7B1O8Wy3CWpesvZleLG8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b9fdc05ebb01e00d28b4add9a259c7e8e0aac83ab47a65080de51ca8e5e52e5a

Files

b9fdc05ebb01e00d28b4add9a259c7e8e0aac83ab47a65080de51ca8e5e52e5a
.dll windows:6 windows x64 arch:x64

60515494f4451382e2a187da93f662bf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

uxtheme

DrawThemeBackground
IsThemePartDefined
CloseThemeData
OpenThemeData
GetThemePartSize
SetWindowTheme

kernel32

AcquireSRWLockShared
GetTickCount
GetVersionExW
PowerCreateRequest
PowerClearRequest
PowerSetRequest
CompareStringW
GetProcAddress
lstrcmpiW
VerSetConditionMask
VerifyVersionInfoW
lstrlenW
OutputDebugStringW
SetEvent
SetUnhandledExceptionFilter
InitializeCriticalSectionEx
IsProcessorFeaturePresent
ReleaseSRWLockShared
DisableThreadLibraryCalls
ResumeThread
WideCharToMultiByte
IsDebuggerPresent
GetSystemTimeAsFileTime
InitOnceComplete
InitOnceBeginInitialize
EncodePointer
RtlLookupFunctionEntry
ReleaseSRWLockExclusive
LoadLibraryExW
GlobalFree
GlobalAlloc
GlobalLock
AcquireSRWLockExclusive
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
LoadLibraryExA
WakeAllConditionVariable
SleepConditionVariableSRW
GetLastError
DeleteCriticalSection
RaiseException
GetCurrentThreadId
LeaveCriticalSection
GlobalUnlock
GlobalSize
DecodePointer
GetExitCodeProcess
GetStdHandle
CreateFileW
CreateNamedPipeW
GetCurrentProcessId
TerminateProcess
CreateProcessW
GetThreadPriority
CancelIoEx
GetOverlappedResult
WaitForMultipleObjects
WriteFile
ResetEvent
CreateEventW
GetCurrentProcess
DuplicateHandle
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
MulDiv
GetCurrentThread
SetThreadPriority
CloseHandle
WaitForSingleObject
QueryPerformanceCounter
RtlCaptureContext
GetTickCount64
EnterCriticalSection
SetLastError
RtlVirtualUnwind
UnhandledExceptionFilter

user32

GetSystemMetrics
EnumThreadWindows
IsWindowVisible
GetWindowPlacement
IsIconic
MonitorFromRect
GetMenu
GetClipboardData
CloseClipboard
OpenClipboard
AdjustWindowRect
TranslateAcceleratorW
CharLowerW
DestroyAcceleratorTable
LoadAcceleratorsW
SetWindowTextW
MapWindowPoints
GetDlgCtrlID
SetDlgItemInt
DialogBoxParamW
EndDialog
RedrawWindow
GetKeyState
GetParent
SetCursor
RegisterWindowMessageW
DrawEdge
DrawFrameControl
NotifyWinEvent
IsRectEmpty
GetWindowDC
GetMessagePos
InflateRect
FrameRect
UnhookWindowsHookEx
SetWindowsHookExW
WindowFromPoint
CallNextHookEx
GetNextDlgTabItem
InvalidateRgn
CopyRect
SetScrollPos
SetScrollInfo
SetGestureConfig
CloseGestureInfoHandle
GetGestureInfo
SetCapture
SetMenuItemInfoW
GetMenuItemInfoW
KillTimer
GetScrollInfo
AdjustWindowRectEx
GetCursorPos
MapDialogRect
EndDeferWindowPos
IsZoomed
DeferWindowPos
BeginDeferWindowPos
SetRectEmpty
FillRect
DrawFocusRect
CharNextW
DrawTextW
GetWindowTextW
GetWindowTextLengthW
GetClassNameW
GetFocus
SystemParametersInfoW
ReleaseDC
GetDC
GetSysColor
OffsetRect
ReleaseCapture
TrackMouseEvent
GetCapture
UpdateWindow
IsWindow
DestroyMenu
MonitorFromPoint
CreatePopupMenu
TrackPopupMenu
AppendMenuW
PtInRect
IntersectRect
ScreenToClient
GetClassInfoExW
RegisterClassExW
CreateWindowExW
CallWindowProcW
ClientToScreen
GetMonitorInfoW
EndPaint
BeginPaint
GetClientRect
SetLayeredWindowAttributes
GetWindowRect
SetFocus
MessageBeep
GetWindowLongW
SetWindowLongW
SetWindowPos
IsWindowEnabled
DestroyWindow
GetActiveWindow
SetTimer
PostMessageW
SetDlgItemTextW
EnableWindow
SendDlgItemMessageW
ShowWindow
CreateDialogParamW
LoadCursorW
GetWindowLongPtrW
SetWindowLongPtrW
UnregisterClassW
DefWindowProcW
RegisterClassW
GetDlgItem
SendMessageW
InvalidateRect
ScrollWindowEx

gdi32

CreateFontIndirectW
GetStockObject
SetBkMode
GetObjectW
SetDCBrushColor
CreatePolygonRgn
FrameRgn
FillRgn
GetDeviceCaps
CreateCompatibleDC
GetTextMetricsW
LPtoDP
SaveDC
RestoreDC
OffsetWindowOrgEx
SetWindowOrgEx
IntersectClipRect
CreateCompatibleBitmap
SetViewportOrgEx
BitBlt
CombineRgn
SetDCPenColor
LineTo
MoveToEx
CreateRectRgnIndirect
CreateRectRgn
GetTextExtentPoint32W
GetTextColor
GetBkColor
GetCurrentObject
CreatePen
OffsetRgn
ExtTextOutW
SetBkColor
SetTextColor
DeleteObject
DeleteDC
SelectObject

shell32

ord74
ShellExecuteW

oleaut32

SysAllocString
VariantInit
VariantClear

shared

stricmp_utf8_ex
uSearchPath
uGetModuleFileName
uFileExists
uCreateFile
stricmp_utf8_partial
stricmp_utf8
uDeleteFile
uGetDlgItemText
uSendMessageText
?g_from_system@t_font_description@@SA?AU1@H@Z
?create@t_font_description@@QEBAPEAUHFONT__@@XZ
PokeWindow
uGetWindowText
uCharUpper
uReplaceStringAdd
FindOwningPopup
uFindFirstFile
uGetOpenFileName
uBrowseForFolder
uAddStringLower
ModalDialog_CanCreateNew
ModalDialog_PokeExisting
uStringCompare
uCreateDirectory
uGetTempPath
??1uCallStackTracker@@QEAA@XZ
??0uCallStackTracker@@QEAA@PEBD@Z
uSetDlgItemText
uExceptFilterProc
uSetWindowText
GetInfiniteWaitEvent
?scale@audio_math@@YAXPEBN_KPEANN@Z
uFormatSystemErrorMessage
ModalDialog_Switch
uPrintCrashInfo_OnEvent
uBugCheck
uShellExecute

msvcp140

_Thrd_hardware_concurrency
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z

shlwapi

SHAutoComplete

comctl32

ord413
ord410

msimg32

GradientFill

oleacc

AccessibleObjectFromWindow
LresultFromObject

gdiplus

GdipDrawLineI
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipDeletePen
GdipCreatePen1
GdiplusStartup
GdiplusShutdown

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strchr
__std_terminate
__std_type_info_destroy_list
_CxxThrowException
__current_exception_context
__current_exception
memmove
__std_exception_destroy
wcschr
strstr
strrchr
memcmp
memcpy
memset
__C_specific_handler
_purecall
__std_exception_copy

api-ms-win-crt-string-l1-1-0

_strdup
wcslen
wcsnlen
strncmp
strcat_s
strlen
wcscpy_s
strcmp

api-ms-win-crt-heap-l1-1-0

_aligned_free
_aligned_realloc
free
malloc
_expand
_aligned_malloc
realloc
_callnewh
_recalloc

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_controlfp_s
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
abort
_beginthreadex
_initterm
_cexit
_invalid_parameter_noinfo_noreturn
_crt_atexit
_errno
_invalid_parameter_noinfo
_execute_onexit_table
_register_onexit_function

api-ms-win-crt-utility-l1-1-0

_byteswap_ulong
srand
_byteswap_ushort
rand
abs

api-ms-win-crt-math-l1-1-0

ldexp
llround
lround
frexp
fabs
pow
floor
sqrt

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s
__stdio_common_vsprintf
__stdio_common_vsprintf_s

api-ms-win-crt-locale-l1-1-0

setlocale

api-ms-win-crt-convert-l1-1-0

_atoi64
_wtoi
atoi

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

ole32

CoCreateGuid
CoUninitialize
CoInitialize
CoCreateInstance
CreateStreamOnHGlobal
RegisterDragDrop
RevokeDragDrop
ReleaseStgMedium
DoDragDrop

Exports

Exports

foobar2000_get_interface

Sections

.text
Size: 630KB - Virtual size: 629KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.movehcs
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

60515494f4451382e2a187da93f662bf

Headers

DLL Characteristics

File Characteristics

Imports

uxtheme

kernel32

user32

gdi32

shell32

oleaut32

shared

msvcp140

shlwapi

comctl32

msimg32

oleacc

gdiplus

vcruntime140_1

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

advapi32

ole32

Exports

Exports

Sections

.text Size: 630KB - Virtual size: 629KB

.rdata Size: 144KB - Virtual size: 144KB

.data Size: 13KB - Virtual size: 17KB

.pdata Size: 36KB - Virtual size: 35KB

.rsrc Size: 21KB - Virtual size: 20KB

.reloc Size: 8KB - Virtual size: 7KB

.movehcs Size: 1024B - Virtual size: 4KB

.text
Size: 630KB - Virtual size: 629KB

.rdata
Size: 144KB - Virtual size: 144KB

.data
Size: 13KB - Virtual size: 17KB

.pdata
Size: 36KB - Virtual size: 35KB

.rsrc
Size: 21KB - Virtual size: 20KB

.reloc
Size: 8KB - Virtual size: 7KB

.movehcs
Size: 1024B - Virtual size: 4KB