86dc034725b873caa97c1944f783ee8aeecdfd6eddbb974233bd8ea78f486af0

Sharing

Copy URL Twitter E-mail

General

Target

86dc034725b873caa97c1944f783ee8aeecdfd6eddbb974233bd8ea78f486af0
Size

4.7MB
MD5

dee5b004bd7fb3b0e6a1bd6f066165b0
SHA1

52b25958da6df421bdd051b87ba9046531c30322
SHA256

86dc034725b873caa97c1944f783ee8aeecdfd6eddbb974233bd8ea78f486af0
SHA512

893383d0044e389a1c265f906a2af7136a1bf2db89b788a430c35fa7c7fa3de330c1fb7ec9068bd80891f35d5de3f07b280ce4281bdb830cc7f7c63dbdf95059
SSDEEP

49152:DScjOZcMf7vdkbiBSKu5p4LBLbHjt2ofc5G+WCsfCUif6cO6tfEN9XkcrFOqGalj:euWVaieUHKUihEN9UGOqGLd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
86dc034725b873caa97c1944f783ee8aeecdfd6eddbb974233bd8ea78f486af0

Files

86dc034725b873caa97c1944f783ee8aeecdfd6eddbb974233bd8ea78f486af0
.exe windows:6 windows x64 arch:x64

fd8f0af92cf4a055a313089ef2917d39

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

lrecorderopt

lIndexFileFindNextIndex2
lIndexFileFindFirstIndex2
lIndexFileClose
lIndexFileFindIndexByTime2
lIndexFileFindLastIndex2
lIndexFileOpenW

lapputility

lHTTPUploadCreate
lHTTPUploadAddData
lHTTPUploadUpload
lHTTPUploadRelease
lSMTPCreateSession
lSMTPSendMessage3
lSMTPCloseSession
lFTPUploadFile

lserverobj

lIOSvrSetRecvCallBack
lIOSvrOpen
lIOSvrRegister3
lIOSvrClose
lIOSvrRelease
lIOSvrPostIOMessage
lIOSvrCreate

ffmcodec

ord19
ord21
ord20
ord22
ord26
ord16
ord6
ord10
ord3

aadp

XGetNextFrame2
XStartTransferStreamingEngineData
XSetEngineConfig2
XSetEngineConfig
XGetSessionID
XGetRawFileInfo2
XGetCurrentTimeUTC
XSetCurrentTimeUTC
XGetCurrentTime
XSetCurrentTime
XGetEndTimeUTC
XGetBeginTimeUTC
XGetEndTime
XGetBeginTime
XGetMotionInfo
XSetMotionInfo
XSetControlDataCallBack
XExit
XSendCommand
XDisconnect
XSetCertificate
XSetParam
XSendData
XGetPrevIFrame2
XGetPrevIFrame
XGetPrevFrame2
XGetPrevFrame
XGetNextIFrame2
XGetNextIFrame
XGetNextFrame
XStop
XGetXSession
XStopStreaming
XStartStreaming
XInit
XCreate
XSetMediaConfig4
XConnect
XSetVideoConfig
XGetVideoConfig
XSetVideoTransformConfig

rpcrt4

RpcStringFreeA
UuidCreate
UuidToStringA

lmyonvif

lONVIFSetUri
lONVIFRelease
lONVIFCreate
lONVIFGetResultData2
lONVIFGetRecordingSummary
lONVIFSetAccount
lONVIFSetPassword
lONVIFSetCertificate
lONVIFGetSystemDateAndTime
lONVIFGetCapabilities
lONVIFGetServices
lONVIFGetReplayUri

kernel32

GetUserDefaultUILanguage
GlobalFlags
VirtualProtect
GetOEMCP
GetCPInfo
FileTimeToLocalFileTime
GetFileAttributesExA
GetFileTime
DuplicateHandle
lstrcmpiA
GetVolumeInformationA
lstrcpyA
FindResourceExW
GetWindowsDirectoryA
VerSetConditionMask
VerifyVersionInfoA
GetProfileIntA
SearchPathA
GetTempFileNameA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
CreateEventW
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
ResumeThread
SetThreadPriority
LocalReAlloc
GlobalHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GlobalReAlloc
MulDiv
GlobalFree
GlobalUnlock
GlobalSize
GlobalGetAtomNameA
GlobalFindAtomA
GlobalAddAtomA
FindResourceA
lstrcmpW
GetModuleHandleW
FreeResource
GetSystemDirectoryW
EncodePointer
SetErrorMode
GetStringTypeW
CompareStringA
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
lstrcmpA
GlobalDeleteAtom
GlobalLock
GlobalAlloc
LoadLibraryExW
GetModuleHandleExW
GetVersionExA
GetCurrentThread
SetLastError
GetSystemDefaultUILanguage
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetFileSize
LockFileEx
CreateFileMappingA
UnlockFile
HeapCompact
LoadLibraryW
GetSystemInfo
WaitForSingleObjectEx
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateMutexW
GetTempPathW
UnlockFileEx
GetFullPathNameA
SetFilePointer
InitializeCriticalSection
LockFile
GetDiskFreeSpaceW
GetFullPathNameW
HeapCreate
TryEnterCriticalSection
AreFileApisANSI
FindFirstFileA
GetCurrentProcess
GetCurrentProcessId
GetACP
GetProcessHeap
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
HeapFree
MoveFileA
GetLocaleInfoW
GetCurrentDirectoryA
DeleteFileA
CopyFileA
CreateDirectoryA
GetModuleFileNameW
FormatMessageA
LocalFree
LocalAlloc
GetSystemTime
FlushFileBuffers
SetNamedPipeHandleState
GetDiskFreeSpaceExA
WinExec
FindResourceW
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
OutputDebugStringA
GetOverlappedResult
WaitForMultipleObjects
ConnectNamedPipe
CreateNamedPipeA
ExitThread
DisconnectNamedPipe
FindNextFileW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetCurrentThreadId
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
MultiByteToWideChar
WritePrivateProfileStringA
GetTickCount
CompareStringW
LCMapStringW
SetEndOfFile
ReadFile
WriteFile
SetFilePointerEx
GetPrivateProfileIntA
GetFileSizeEx
CreateFileW
CreateFileA
GetTimeZoneInformation
ResetEvent
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
FreeLibrary
GetProcAddress
LoadLibraryA
CreateThread
GetModuleFileNameA
Sleep
GetModuleHandleA
GetCommandLineA
SetUnhandledExceptionFilter
CloseHandle
WaitForSingleObject
CreateEventA
GetLastError
SetEvent
RtlUnwindEx
RtlPcToFileHeader
GetConsoleCP
GetLogicalDrives
GetCurrentDirectoryW
FreeLibraryAndExitThread
GetCommandLineW
VirtualAlloc
VirtualQuery
HeapQueryInformation
SetStdHandle
GetFileType
QueryPerformanceFrequency
ExitProcess
GetStdHandle
GetConsoleMode
SetConsoleMode
GetNumberOfConsoleInputEvents
ReadConsoleInputW
PeekConsoleInputA
ReadConsoleW
FindFirstFileExW
IsValidCodePage
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
GetPrivateProfileStringA

user32

MapVirtualKeyExA
IsCharLowerA
GetKeyboardLayout
WaitMessage
PostThreadMessageA
GetComboBoxInfo
ReuseDDElParam
UnpackDDElParam
InsertMenuItemA
LoadMenuA
TranslateAcceleratorA
LoadAcceleratorsA
MonitorFromPoint
UpdateLayeredWindow
UnionRect
DrawIcon
FrameRect
CopyIcon
SetCursorPos
BringWindowToTop
GetSystemMenu
IsZoomed
DrawFrameControl
DrawEdge
DrawStateA
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
SetParent
SetWindowRgn
SetClassLongPtrA
EnumDisplayMonitors
SetLayeredWindowAttributes
GetKeyNameTextA
MapVirtualKeyA
GetMenuDefaultItem
CreatePopupMenu
NotifyWinEvent
LoadCursorW
InvertRect
HideCaret
EnableScrollBar
MessageBeep
GetIconInfo
DrawIconEx
LoadImageA
IsRectEmpty
DrawFocusRect
WindowFromPoint
ReleaseCapture
SetCapture
GetNextDlgGroupItem
LoadImageW
TrackMouseEvent
DestroyIcon
CharUpperA
MapDialogRect
GetAsyncKeyState
GetNextDlgTabItem
GetKeyboardState
CreateDialogIndirectParamA
LoadCursorA
GetSysColorBrush
OffsetRect
SetRectEmpty
IsDialogMessageA
SendDlgItemMessageA
CheckDlgButton
MoveWindow
ShowWindow
IntersectRect
FillRect
ReleaseDC
GetWindowDC
TabbedTextOutA
GrayStringA
DrawTextA
InvalidateRect
SetTimer
RealChildWindowFromPoint
ClientToScreen
SetWindowTextA
DeleteMenu
GetWindowThreadProcessId
IsWindowEnabled
SetCursor
ShowOwnedPopups
GetActiveWindow
GetMessageA
CopyImage
LoadBitmapW
SetMenuItemInfoA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetDesktopWindow
RemoveMenu
DestroyCursor
InsertMenuA
GetMenuState
GetMonitorInfoA
MonitorFromWindow
WinHelpA
GetScrollInfo
SetScrollInfo
LoadIconW
CallNextHookEx
SetWindowsHookExA
GetWindow
GetLastActivePopup
GetTopWindow
GetClassNameA
GetParent
GetClassLongPtrA
GetClassLongA
ToAsciiEx
LoadAcceleratorsW
CreateAcceleratorTableA
DestroyAcceleratorTable
CopyAcceleratorTableA
LockWindowUpdate
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuA
RegisterClipboardFormatA
CharUpperBuffA
IsClipboardFormatAvailable
GetUpdateRect
DrawMenuBar
DefFrameProcA
DefMDIChildProcA
TranslateMDISysAccel
SubtractRect
CreateMenu
EndDialog
SetWindowLongPtrA
GetWindowLongPtrA
GetWindowLongA
PtInRect
EqualRect
MapWindowPoints
ScreenToClient
MessageBoxA
AdjustWindowRectEx
GetWindowRect
GetClientRect
GetWindowTextLengthA
GetWindowTextA
RemovePropA
GetPropA
SetPropA
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
ValidateRect
EndPaint
BeginPaint
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
UpdateWindow
TrackPopupMenu
GetMenuItemCount
GetMenuItemID
SetMenu
GetMenu
EnableWindow
GetCapture
GetKeyState
GetFocus
SetFocus
GetDlgCtrlID
GetDlgItem
IsIconic
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
DestroyWindow
IsChild
IsMenu
IsWindow
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
CallWindowProcA
DefWindowProcA
SendMessageA
GetMessageTime
GetMessagePos
RegisterWindowMessageA
UnhookWindowsHookEx
SystemParametersInfoA
InflateRect
CopyRect
GetSysColor
GetMenuItemInfoA
DestroyMenu
GetMenuStringA
GetSystemMetrics
PostQuitMessage
PostMessageA
DrawTextW
SetRect
GetDC
SetWindowLongA
LoadIconA
SetWindowPos
DialogBoxParamA
CreateDialogParamA
GetCursorPos
GetSubMenu
LoadMenuW
KillTimer
DispatchMessageA
TranslateMessage
PeekMessageA
GetWindowRgn
AppendMenuA
DrawTextExA

gdi32

GetTextFaceA
CombineRgn
ScaleViewportExtEx
OffsetWindowOrgEx
FillRgn
RoundRect
GetRgnBox
Rectangle
LPtoDP
CreateRoundRectRgn
Polyline
Polygon
CreatePatternBrush
CreateRectRgn
CreateSolidBrush
Escape
GetViewportOrgEx
GetWindowOrgEx
SetPixelV
SetPaletteEntries
ExtFloodFill
PtInRegion
GetBoundsRect
ScaleWindowExtEx
CreatePolygonRgn
GetTextColor
Ellipse
CreateEllipticRgn
SetDIBColorTable
CreateDIBSection
StretchBlt
SetPixel
GetTextCharsetInfo
EnumFontFamiliesA
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
FrameRgn
CreateDIBitmap
GetBkColor
RealizePalette
GetSystemPaletteEntries
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
EnumFontFamiliesExA
GetTextMetricsA
DPtoLP
SetRectRgn
PatBlt
OffsetRgn
ExcludeClipRect
SetViewportExtEx
TextOutA
MoveToEx
SetTextAlign
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SelectPalette
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetPixel
GetObjectType
GetClipBox
CreateCompatibleDC
DeleteDC
CreateCompatibleBitmap
SelectObject
SetStretchBltMode
StretchDIBits
DeleteObject
CreateFontA
SetBkColor
SetBkMode
SetTextColor
GetDIBits
BitBlt
CreateFontIndirectA
GetTextExtentPoint32A
GetObjectA
ExtTextOutA
CopyMetaFileA
CreateDCA
GetDeviceCaps
CreateBitmap
CreateHatchBrush
CreatePen
CreateRectRgnIndirect

msimg32

TransparentBlt
AlphaBlend

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

advapi32

CryptImportKey
CryptGetProvParam
RegCloseKey
OpenSCManagerA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
CryptAcquireContextA
RegDeleteValueA
RegSetValueExA
RegEnumKeyA
RegQueryValueA
RegEnumValueA
RegEnumKeyExA
RegDeleteKeyA
CryptReleaseContext
CryptGenKey
CryptAcquireContextW
SetServiceStatus
RegisterServiceCtrlHandlerA
DeleteService
QueryServiceStatus
ControlService
CreateServiceA
StartServiceCtrlDispatcherA
CloseServiceHandle
StartServiceA
OpenServiceA
CryptDestroyKey

shell32

SHGetFileInfoA
ShellExecuteA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHGetDesktopFolder
DragQueryFileA
DragFinish
SHBrowseForFolderA
SHAppBarMessage

shlwapi

PathFileExistsW
PathFindExtensionA
PathFindFileNameA
PathFileExistsA
PathIsUNCA
PathStripToRootA
PathRemoveFileSpecW
StrFormatKBSizeA

uxtheme

GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
IsAppThemed
GetWindowTheme
GetThemePartSize
DrawThemeParentBackground
GetCurrentThemeName
GetThemeColor
DrawThemeBackground
CloseThemeData
OpenThemeData
DrawThemeText

ole32

OleDuplicateData
ReleaseStgMedium
CoCreateInstance
CoInitialize
CoDisconnectObject
CoInitializeEx
CreateStreamOnHGlobal
DoDragDrop
OleGetClipboard
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleLockRunning
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid
CoUninitialize

oleaut32

VarBstrFromDate
VariantCopy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
LoadTypeLi
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
VariantInit
VariantClear
VariantChangeType
SysAllocString

ws2_32

WSACleanup
gethostname
getaddrinfo
inet_ntop
inet_pton
freeaddrinfo
inet_addr
WSAStartup

odbc32

ord1
ord2
ord3
ord5
ord68
ord61
ord59
ord41
ord76
ord39
ord20
ord49
ord19
ord48
ord18
ord38
ord45
ord44
ord43
ord17
ord16
ord15
ord14
ord13
ord12
ord11
ord10
ord9
ord8

crypt32

CryptUnprotectData
CryptProtectData
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
PFXImportCertStore
CertSetCertificateContextProperty
CertCreateCertificateContext
CryptDecodeObjectEx
CryptStringToBinaryA
CertStrToNameW
CryptFindCertificateKeyProvInfo
CertCreateSelfSignCertificate
CryptEncodeObjectEx
CertFreeCertificateContext

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

wininet

InternetQueryDataAvailable
InternetWriteFile
InternetSetFilePointer
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
InternetSetOptionA
InternetGetLastResponseInfoA
InternetSetStatusCallback
InternetConnectA
InternetReadFile
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA
HttpQueryInfoA

gdiplus

GdipFree
GdipAlloc
GdiplusShutdown
GdipCloneImage
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdiplusStartup
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipDrawImageI
GdipGetImagePaletteSize
GdipCreateBitmapFromHBITMAP
GdipDeleteGraphics
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateBitmapFromStream
GdipGetImagePalette

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundA

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 858KB - Virtual size: 858KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 529KB - Virtual size: 561KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 394KB - Virtual size: 394KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd8f0af92cf4a055a313089ef2917d39

Headers

DLL Characteristics

File Characteristics

Imports

lrecorderopt

lapputility

lserverobj

ffmcodec

aadp

rpcrt4

lmyonvif

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

ws2_32

odbc32

crypt32

oleacc

wininet

gdiplus

imm32

winmm

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

.rdata Size: 858KB - Virtual size: 858KB

.data Size: 529KB - Virtual size: 561KB

.pdata Size: 126KB - Virtual size: 125KB

.rsrc Size: 394KB - Virtual size: 394KB

.reloc Size: 63KB - Virtual size: 63KB

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 858KB - Virtual size: 858KB

.data
Size: 529KB - Virtual size: 561KB

.pdata
Size: 126KB - Virtual size: 125KB

.rsrc
Size: 394KB - Virtual size: 394KB

.reloc
Size: 63KB - Virtual size: 63KB