2cbfd6f3ef36908edc42db1e3f7223e97e74298044e69e7f70f66083791aacbe

Sharing

Copy URL Twitter E-mail

General

Target

2cbfd6f3ef36908edc42db1e3f7223e97e74298044e69e7f70f66083791aacbe
Size

10.0MB
MD5

83788cf79e9804c641670a8444be517b
SHA1

42d6dbdff51936ac905ee81da0e641ca449175b6
SHA256

2cbfd6f3ef36908edc42db1e3f7223e97e74298044e69e7f70f66083791aacbe
SHA512

ec996b91e71353d50cb6bf81cd868ec5f99959e03648784ab3d3b5c3d692ec00aea2bd3189068d141469d0fe5c270c12d1cd7de8aabf1b1865d80c49c4012c4a
SSDEEP

196608:EOwRqKR4YypBhT8p7UtHJjTyt3R1roAO4Q+j6K+M0i:DwRhRDylCUTjTgRNQrK+M7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2cbfd6f3ef36908edc42db1e3f7223e97e74298044e69e7f70f66083791aacbe

Files

2cbfd6f3ef36908edc42db1e3f7223e97e74298044e69e7f70f66083791aacbe
.exe windows:6 windows x86 arch:x86

3ba12670adb5492ac54d42e40272038d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindFirstFileW
FindNextFileW
GetCurrentDirectoryW
SetLastError
GetCurrentProcessId
GetTickCount
GetFileInformationByHandle
GetModuleHandleW
GetModuleHandleA
VirtualAlloc
VirtualFree
FindClose
GetStdHandle
SetFileTime
SetEndOfFile
GetFileSize
MoveFileExW
LoadLibraryW
SetFilePointer
GetProcAddress
FreeLibrary
GetModuleFileNameA
CreateProcessW
GetCurrentThreadId
Sleep
CreateEventW
WaitForSingleObject
SetEvent
WaitNamedPipeW
DisconnectNamedPipe
CreatePipe
SetHandleInformation
GetTempPathA
GetTempPathW
WriteFile
SetFileAttributesW
RemoveDirectoryW
ReadFile
GetLogicalDriveStringsW
GetFileAttributesW
GetDriveTypeW
DeleteFileW
CreateFileW
CreateFileA
FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleFileNameW
FreeResource
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WideCharToMultiByte
MultiByteToWideChar
lstrcpyW
lstrcmpiW
OpenProcess
TerminateProcess
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
GetLastError
RaiseException
CloseHandle
DecodePointer
OutputDebugStringW
OutputDebugStringA
CreateDirectoryW
WriteConsoleW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
SwitchToThread
GetCurrentThread
GetExitCodeThread
GetStringTypeW
FormatMessageW
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetCPInfo
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetACP
GlobalUnlock
GlobalLock
lstrlenW
ExitProcess
MulDiv
LocalFileTimeToFileTime
SystemTimeToFileTime
LocalFree
GetVersionExW
GlobalAlloc
GetLocalTime
lstrcpynW
IsDebuggerPresent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
LoadLibraryExW
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread
ResumeThread
GetModuleHandleExW
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
GetConsoleMode
ReadConsoleW
SetFilePointerEx
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
FlushFileBuffers
GetConsoleCP

user32

GetClientRect
GetWindowRect
GetCursorPos
ScreenToClient
MapWindowPoints
GetSysColor
IntersectRect
IsRectEmpty
PtInRect
GetWindowLongW
SetWindowLongW
GetParent
GetWindow
LoadImageW
MonitorFromWindow
GetMonitorInfoW
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
SetWindowRgn
MessageBoxW
UpdateWindow
IsWindowEnabled
UpdateLayeredWindow
MoveWindow
GetUpdateRect
CharPrevW
DrawTextW
FillRect
ReleaseCapture
CreatePopupMenu
DestroyMenu
EnableMenuItem
AppendMenuW
TrackPopupMenu
CreateCaret
GetCaretBlinkTime
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
EqualRect
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
wsprintfA
DrawTextA
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
SetForegroundWindow
GetKeyboardLayout
GetKeyNameTextW
MapVirtualKeyExW
SetCursor
InflateRect
UnionRect
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetWindowRgn
GetDC
OffsetRect
SetCapture
GetKeyState
GetFocus
GetActiveWindow
ShowWindow
wsprintfW
PostMessageW
PostQuitMessage
SetTimer
KillTimer
CharUpperW
SetFocus
CharNextW
IsZoomed
LoadCursorW
IsIconic
IsWindowVisible
SetWindowPos
DestroyWindow
IsWindow
CreateWindowExW
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
SetRect

advapi32

RegQueryValueExW
RegDeleteValueW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW

shell32

SHGetPathFromIDListW
CommandLineToArgvW
DragQueryFileW
SHGetSpecialFolderPathW
SHGetFolderPathW
SHBrowseForFolderW
ShellExecuteA
ShellExecuteW

ole32

OleLockRunning
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
ReleaseStgMedium
OleDuplicateData
DoDragDrop
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

VariantClear
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
SysStringByteLen
SysAllocStringByteLen
VariantInit

gdiplus

GdipSetInterpolationMode
GdipFillPath
GdipDrawPath
GdipSetSmoothingMode
GdipAlloc
GdipFree
GdipCreatePath
GdipDeletePath
GdipStartPathFigure
GdipClosePathFigure
GdipDeleteGraphics
GdipCreateFromHDC
GdipDeletePen
GdipCreatePen1
GdipSetLinePresetBlend
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipDrawImageRectI
GdipGetPropertyItem
GdipAddPathLineI
GdipAddPathArcI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreateLineBrushI
GdiplusStartup
GdiplusShutdown
GdipAddPathLine
GdipAddPathArc
GdipSetPenMode
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipCloneImage
GdipDisposeImage
GdipSetTextRenderingHint
GdipImageSelectActiveFrame
GdipDrawRectangleI
GdipFillRectangleI
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize

shlwapi

PathFileExistsW
PathRemoveBackslashW
PathRemoveFileSpecW
SHDeleteKeyW
PathIsRootW

ws2_32

gethostname
WSAStartup
gethostbyname

gdi32

Rectangle
RestoreDC
SaveDC
SelectObject
CloseEnhMetaFile
CreateEnhMetaFileW
GetEnhMetaFileHeader
PlayEnhMetaFile
GetTextMetricsW
GetObjectW
SetWindowOrgEx
CreateRoundRectRgn
CreateRectRgn
PtInRegion
CreateDIBSection
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
RemoveFontMemResourceEx
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
GetObjectA
MoveToEx
TextOutW
GdiFlush
CreatePatternBrush
GetTextExtentPointA
GetBitmapBits
SetBitmapBits
AddFontMemResourceEx
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateDIBitmap
CreateCompatibleDC
CreateSolidBrush
BitBlt
CreateCompatibleBitmap

comctl32

_TrackMouseEvent
InitCommonControlsEx
ord17

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

Sections

.text
Size: 943KB - Virtual size: 943KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 219KB - Virtual size: 218KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 53.2MB - Virtual size: 53.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3ba12670adb5492ac54d42e40272038d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

gdiplus

shlwapi

ws2_32

gdi32

comctl32

imm32

Sections

.text Size: 943KB - Virtual size: 943KB

.rdata Size: 219KB - Virtual size: 218KB

.data Size: 17KB - Virtual size: 25KB

.rsrc Size: 53.2MB - Virtual size: 53.2MB

.reloc Size: 54KB - Virtual size: 54KB

.text
Size: 943KB - Virtual size: 943KB

.rdata
Size: 219KB - Virtual size: 218KB

.data
Size: 17KB - Virtual size: 25KB

.rsrc
Size: 53.2MB - Virtual size: 53.2MB

.reloc
Size: 54KB - Virtual size: 54KB