d2c6688292d6fc14037d7c3c5b46f65334bcaf551359ad302e6a97eb06dde91c

Sharing

Copy URL Twitter E-mail

General

Target

d2c6688292d6fc14037d7c3c5b46f65334bcaf551359ad302e6a97eb06dde91c
Size

4.3MB
MD5

fa6401a1f117776daf3ef37e143ff4b1
SHA1

72a2459553daa35484264135fb05d9d399a72daf
SHA256

d2c6688292d6fc14037d7c3c5b46f65334bcaf551359ad302e6a97eb06dde91c
SHA512

062da279daf6cae3a80f359618621dd58c49856d8d970bf59746436426f04e22165af911d16fc510ca7f414d022d65f304df8c9bf5039cb58822aa87d995a71a
SSDEEP

49152:8sw69hdcKbC/okpBESGt2Viau2mzC5EfeTk86EwPT+jPn5qy+2G7MJGgdXIDqpsF:Nw6J2/A7bDakDDpBT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d2c6688292d6fc14037d7c3c5b46f65334bcaf551359ad302e6a97eb06dde91c

Files

d2c6688292d6fc14037d7c3c5b46f65334bcaf551359ad302e6a97eb06dde91c
.exe windows:6 windows x64 arch:x64

ee2e0048210af79a7a40782f02090b4e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

comctl32

ImageList_Add
ImageList_Create
ImageList_Destroy
ord410
ord17
ord412
ord413

winmm

timeEndPeriod
timeBeginPeriod

shlwapi

SHDeleteKeyW
ord12
SHAutoComplete
StrCmpLogicalW

uxtheme

OpenThemeData
GetThemePartSize
DrawThemeBackground
SetWindowTheme
CloseThemeData
EnableThemeDialogTexture
IsThemePartDefined

kernel32

TryEnterCriticalSection
SetThreadPriority
GetSystemPowerStatus
VerifyVersionInfoW
VerSetConditionMask
GlobalFree
SystemTimeToFileTime
LocalFileTimeToFileTime
ResumeThread
GetLocaleInfoW
GetNumberFormatW
DecodePointer
GlobalSize
LoadLibraryW
CreateEventW
FindResourceW
FindResourceExW
LoadResource
LockResource
SizeofResource
SetEndOfFile
GetFileTime
FlushFileBuffers
CreateFileW
GetDiskFreeSpaceExW
FindFirstFileW
DeleteFileW
RemoveDirectoryW
GetFileAttributesW
MoveFileExW
GetFileAttributesExW
FindNextFileW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
EnterCriticalSection
SleepConditionVariableSRW
WakeAllConditionVariable
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
FindClose
InitOnceComplete
InitOnceBeginInitialize
SystemTimeToTzSpecificLocalTime
Sleep
OutputDebugStringW
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
DeviceIoControl
SetFileTime
SetFilePointer
DosDateTimeToFileTime
GetFileSizeEx
FileTimeToSystemTime
GetSystemTimeAsFileTime
ReadDirectoryChangesW
GetThreadPriority
GetThreadId
GetFileInformationByHandle
GetCurrentProcess
DuplicateHandle
WriteFile
CancelIo
GetOverlappedResult
ReadFile
WideCharToMultiByte
MultiByteToWideChar
WaitForMultipleObjects
FormatMessageW
GlobalUnlock
GlobalLock
GlobalAlloc
GetCommandLineW
LoadLibraryExW
lstrlenW
GetNativeSystemInfo
GetVersionExW
PowerCreateRequest
PowerClearRequest
PowerSetRequest
LeaveCriticalSection
GetTickCount64
CreateMutexW
NormalizeString
GetCurrentThread
GetExitCodeThread
GetCurrentProcessId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
CopyFileW
VirtualQuery
VirtualProtect
GetSystemInfo
IsDebuggerPresent
FreeLibrary
SetDllDirectoryW
SetEvent
ResetEvent
CloseHandle
WaitForSingleObject
GetModuleHandleW
GetProcAddress
GetTickCount
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
SetErrorMode
DeleteCriticalSection
InitializeCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
MulDiv
InitializeCriticalSectionEx
GetLastError
RaiseException
GetCurrentThreadId
EncodePointer
SetLastError
RtlCaptureContext

user32

SendDlgItemMessageW
GetActiveWindow
GetWindowLongW
GetClientRect
ClientToScreen
GetWindowRect
SetWindowPos
SetLayeredWindowAttributes
BeginPaint
CharUpperW
GetComboBoxInfo
GetSystemMetrics
EnumThreadWindows
GetWindowPlacement
IsIconic
AdjustWindowRect
DrawEdge
SetClipboardData
CloseClipboard
OpenClipboard
FillRect
GetWindowTextLengthW
GetWindowTextW
NotifyWinEvent
RedrawWindow
IsRectEmpty
DrawTextW
TrackMouseEvent
InflateRect
CreateDialogParamW
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
GetNextDlgTabItem
InvalidateRgn
SystemParametersInfoW
ScrollWindowEx
SetScrollPos
UpdateWindow
SetScrollInfo
SetRectEmpty
SetGestureConfig
CloseGestureInfoHandle
GetGestureInfo
GetScrollInfo
MapDialogRect
IsZoomed
SetMenuItemInfoW
GetMenuItemInfoW
GetDC
EndPaint
InvalidateRect
IsWindowEnabled
SetWindowLongW
PostMessageW
CreateWindowExW
ScreenToClient
IntersectRect
PtInRect
DefWindowProcW
GetCursorPos
SetFocus
KillTimer
SetCapture
SetCursor
LoadCursorW
SetTimer
RegisterClassExW
GetClassInfoExW
GetWindowLongPtrW
CallWindowProcW
GetWindowDC
RegisterClipboardFormatW
DrawFrameControl
UnregisterClassW
DestroyWindow
SetWindowTextW
EnableWindow
ShowWindow
SendMessageW
GetDlgItem
SetWindowLongPtrW
DrawTextExW
CheckMenuRadioItem
WindowFromPoint
GetWindow
GetWindowThreadProcessId
GetClipboardData
IsCharAlphaW
IsClipboardFormatAvailable
LoadImageW
MonitorFromWindow
GetDesktopWindow
OffsetRect
LoadIconW
SetForegroundWindow
GetClassNameW
CopyRect
MonitorFromRect
CharLowerW
EndDeferWindowPos
BeginDeferWindowPos
DeferWindowPos
EmptyClipboard
IsWindowVisible
EnumWindows
AllowSetForegroundWindow
wsprintfW
FrameRect
ReleaseDC
GetParent
GetKeyState
GetMessagePos
AppendMenuW
TrackPopupMenu
CreatePopupMenu
MonitorFromPoint
GetMonitorInfoW
DestroyMenu
MessageBoxW
EndDialog
DialogBoxParamW
MessageBeep
SetActiveWindow
EnumChildWindows
MapWindowPoints
SetMenuDefaultItem
TrackPopupMenuEx
GetDlgCtrlID
GetSysColor
GetFocus
TranslateAcceleratorW
LoadAcceleratorsW
DestroyAcceleratorTable
RegisterHotKey
UnregisterHotKey
SetDlgItemTextW
MapVirtualKeyW
AdjustWindowRectEx
GetMenu
IsDialogMessageW
PeekMessageW
MsgWaitForMultipleObjects
GetMessageW
PostQuitMessage
TranslateMessage
DispatchMessageW
RegisterClassW
RegisterWindowMessageW
DeregisterShellHookWindow
RegisterShellHookWindow
MoveWindow
IsChild

gdi32

CreateCompatibleDC
CreateCompatibleBitmap
ExtTextOutW
SetBkColor
SetTextColor
DeleteDC
DeleteObject
GetObjectW
CreateFontIndirectW
OffsetRgn
GetStockObject
SetDCBrushColor
CreateRectRgnIndirect
CreateRectRgn
GetTextExtentPoint32W
GetTextColor
GetBkColor
SelectObject
GetCurrentObject
GetDeviceCaps
GetTextMetricsW
LPtoDP
SaveDC
RestoreDC
OffsetWindowOrgEx
SetWindowOrgEx
IntersectClipRect
CreatePolygonRgn
FrameRgn
FillRgn
SetViewportOrgEx
BitBlt
CombineRgn
SetDCPenColor
LineTo
MoveToEx
SetBkMode
CreatePen

advapi32

CryptDestroyHash
RegSetValueExW
RegCloseKey
RegOpenKeyW
RegCreateKeyW
RegDeleteValueW
RegQueryInfoKeyW
CryptGetHashParam
CryptVerifySignatureW
CryptHashData
CryptCreateHash
RegGetValueW
CryptDestroyKey
RegQueryValueExW
CryptReleaseContext
CryptImportKey
CryptAcquireContextW
RegOpenKeyExW
RegEnumKeyExW
RegEnumValueW

shell32

SHCreateItemFromIDList
ord680
SHGetFolderPathW
ShellExecuteW
DragFinish
DragAcceptFiles
SHOpenFolderAndSelectItems
SHGetDesktopFolder
ShellExecuteExW
ord74

ole32

CoCreateInstance
OleSetClipboard
OleGetClipboard
CoTaskMemFree
PropVariantClear
CLSIDFromString
CoTaskMemAlloc
ReleaseStgMedium
CoUninitialize
CoInitialize
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
RegisterDragDrop
RevokeDragDrop
CoCreateGuid
DoDragDrop

oleaut32

VariantClear
SysAllocString
VariantInit

zlib1

inflate
inflateEnd
inflateInit2_
crc32

sqlite3

sqlite3_exec
sqlite3_busy_timeout
sqlite3_close
sqlite3_errmsg
sqlite3_open_v2
sqlite3_column_name
sqlite3_column_count
sqlite3_step
sqlite3_bind_blob
sqlite3_last_insert_rowid
sqlite3_bind_int64
sqlite3_finalize
sqlite3_bind_text
sqlite3_column_int
sqlite3_bind_int
sqlite3_changes
sqlite3_clear_bindings
sqlite3_column_type
sqlite3_bind_null
sqlite3_bind_double
sqlite3_column_double
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_column_text
sqlite3_column_int64
sqlite3_reset
sqlite3_prepare_v2

shared

?calculate_peak@audio_math@@YANPEBN_K@Z
?create@t_font_description@@QEBAPEAUHFONT__@@XZ
?g_from_system@t_font_description@@SA?AU1@H@Z
uPrintCrashInfo_AddEnvironmentInfo
uCharUpper
?popup_dialog@t_font_description@@QEAA_NPEAUHWND__@@@Z
uGetClipboardString
uFixAmpersandChars_v2
uDragQueryFile
uDragQueryFileCount
uSetWindowTextEx
stricmp_utf8_max
stricmp_utf8_ex
uCharLower
?scale@audio_math@@YAXPEBN_KPEANN@Z
uGetCommandLine
LoadSystemLibrary
uGetModuleHandle
uSetCurrentDirectory
uPrintCrashInfo_SetDumpPath
uPrintCrashInfo_StartLogging
uPrintCrashInfo_Init
uGetCurrentDirectory
uGetEnvironmentVariable
uCreateFile
uEvalKnownFolder
uGetKeyNameText
uRemovePanicHandler
uAddPanicHandler
uSearchPath
uFixPathCaps
uCreateDirectory
uGetFileAttributes
uAddStringLower
uAddStringUpper
uBrowseForFolder
uBrowseForFolderEx
uGetOpenFileName
uGetOpenFileNameMulti
uSendDlgItemMessageText
uSendMessageText
uAppendMenu
ModalDialog_Switch
uSetClipboardString
?uPrintCrashInfo_Suppress@@YAXXZ
uPrintCrashInfo_SetComponentList
uMessageBox
uLoadLibrary
uFindFirstFile
GetInfiniteWaitEvent
?convert_to_int32@audio_math@@YAXPEBN_KPEAHN@Z
?convert_to_int16@audio_math@@YAXPEBN_KPEAFN@Z
uGetTempFileName
uGetTempPath
stricmp_utf8
uGetModuleFileName
stricmp_utf8_partial
ModalDialog_PokeExisting
ModalDialog_CanCreateNew
PokeWindow
LoadResourceEx
uFileExists
uShellExecute
uStringCompare
??1uCallStackTracker@@QEAA@XZ
??0uCallStackTracker@@QEAA@PEBD@Z
uGetDlgItemText
uSetDlgItemText
FindOwningPopup
uGetWindowText
uExceptFilterProc
uSetWindowText
uPrintCrashInfo_OnEvent
uBugCheck
uReplaceCharAdd
uFormatSystemErrorMessage

msvcp140

_Cnd_do_broadcast_at_thread_exit
_Cnd_wait
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Thrd_detach
_Cnd_broadcast
_Mtx_unlock
_Mtx_lock
_Cnd_destroy_in_situ
_Cnd_init_in_situ
_Thrd_hardware_concurrency
_Thrd_id
_Thrd_join
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z

msimg32

GradientFill

oleacc

LresultFromObject
AccessibleObjectFromWindow

crypt32

CertVerifyRevocation
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertVerifyTimeValidity
CertCloseStore
CertFreeCertificateChain
CertFreeCertificateContext

winhttp

WinHttpGetProxyForUrl
WinHttpCloseHandle
WinHttpOpen
WinHttpGetIEProxyConfigForCurrentUser

gdiplus

GdipFree
GdipDrawLineI
GdipDeletePen
GdipCreatePen1
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToFile
GdipLoadImageFromStream
GdipGraphicsClear
GdipGetImageGraphicsContext
GdipDrawImageRect
GdipSetSmoothingMode
GdipSetCompositingMode
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipGetImageRawFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageType
GdiplusStartup
GdipCreateBitmapFromStream
GdipCloneImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipSetCompositingQuality
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipAlloc
GdiplusShutdown

secur32

DecryptMessage
InitializeSecurityContextW
EncryptMessage
AcquireCredentialsHandleW
FreeContextBuffer
AcceptSecurityContext
QueryContextAttributesW
FreeCredentialsHandle
DeleteSecurityContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memchr
__std_terminate
__std_exception_copy
__std_exception_destroy
_purecall
__C_specific_handler
strchr
strstr
wcschr
_set_purecall_handler
strrchr
wcsstr
memcpy
memset
memmove
memcmp
__current_exception
__current_exception_context
_CxxThrowException

api-ms-win-crt-heap-l1-1-0

_aligned_realloc
_recalloc
realloc
_expand
malloc
_aligned_free
free
_callnewh
_set_new_mode
_aligned_malloc

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
abort
_controlfp_s
_beginthreadex
_invalid_parameter_noinfo
_errno
_set_invalid_parameter_handler
_set_abort_behavior
signal
terminate
_register_thread_local_exe_atexit_callback
_c_exit
_exit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
exit
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode
__stdio_common_vsprintf
__stdio_common_vsprintf_s
__stdio_common_vswprintf_s

api-ms-win-crt-math-l1-1-0

lround
log10
log
__setusermatherr
_dclass
floor
tan
lroundf
exp
llround
pow
sin
ceilf
_fpclass

api-ms-win-crt-string-l1-1-0

wcsnlen
strcpy_s
strlen
_strdup
wcslen
wcscmp
wcscpy_s
wcsncpy_s
wcstok_s
wcsncmp
strcmp
strcat_s
wmemcpy_s
isalpha
strncmp

api-ms-win-crt-convert-l1-1-0

_atoi64
atoll
_wtoi
atoi

api-ms-win-crt-utility-l1-1-0

rand
srand
_byteswap_ushort
_byteswap_uint64
_byteswap_ulong

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 650KB - Virtual size: 649KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 114KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 171KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.movehcs
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ee2e0048210af79a7a40782f02090b4e

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

winmm

shlwapi

uxtheme

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

zlib1

sqlite3

shared

msvcp140

msimg32

oleacc

crypt32

winhttp

gdiplus

secur32

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.rdata Size: 650KB - Virtual size: 649KB

.data Size: 114KB - Virtual size: 143KB

.pdata Size: 171KB - Virtual size: 171KB

_RDATA Size: 136KB - Virtual size: 136KB

.rsrc Size: 123KB - Virtual size: 123KB

.reloc Size: 42KB - Virtual size: 41KB

.movehcs Size: 6KB - Virtual size: 8KB

.text
Size: 3.1MB - Virtual size: 3.1MB

.rdata
Size: 650KB - Virtual size: 649KB

.data
Size: 114KB - Virtual size: 143KB

.pdata
Size: 171KB - Virtual size: 171KB

_RDATA
Size: 136KB - Virtual size: 136KB

.rsrc
Size: 123KB - Virtual size: 123KB

.reloc
Size: 42KB - Virtual size: 41KB

.movehcs
Size: 6KB - Virtual size: 8KB