f4e8dd28e8d61f5bf87dca264d1ab55b55be7803a97852ab26665111e677f4c9

Sharing

Copy URL

Twitter E-mail

General

Target

f4e8dd28e8d61f5bf87dca264d1ab55b55be7803a97852ab26665111e677f4c9
Size

5.6MB
MD5

2df82e3b234ed18344eb43f5ed78429e
SHA1

9a5ebff4cdfc9a5052911979211c8f88fd36fc57
SHA256

f4e8dd28e8d61f5bf87dca264d1ab55b55be7803a97852ab26665111e677f4c9
SHA512

ffb96c60a2f0997de56f1d50652fc2f7659a180ec602fd4be7468f9c6652b99a114d883fcb59c8784816e430deef9898ab9b437acc06ff1087ea60d82748c71c
SSDEEP

98304:LBWJ0gnVmU2LBHBkFKYQPJSI7FLOAkGkzdnEVomFHKnP:1WJ0OV0zYQPJBFLOyomFHKnP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f4e8dd28e8d61f5bf87dca264d1ab55b55be7803a97852ab26665111e677f4c9

Files

f4e8dd28e8d61f5bf87dca264d1ab55b55be7803a97852ab26665111e677f4c9
.exe windows:6 windows x64 arch:x64

aa69924b8264130888921420ada2dcd5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

lib_unlockvolume_sdk

unLockVolumeToPw
offBitlokcer
unLockVolumeToNPw
getNPw
getVolumeIDs
getProStatus
InitUnlockVolumeLog
addVolumeLetter

lib_changepw_sdk

restoreFiles
getFullName
getUserInfo
openSAMFile
InitChangePwLog
changePassword
disposableByPass
writeSAMFile
closeSAMFile

ntpasswd

remove_password
liveID2local
GetHash
GetUserInfo

resetuser

?CreateResetUserObj@@YAPEAVIResetUser@@XZ
?FreeResetUserObj@@YAXPEAVIResetUser@@@Z

kernel32

SetErrorMode
GetProfileIntW
SearchPathW
GetWindowsDirectoryW
GetTempFileNameW
GetUserDefaultLCID
FindResourceExW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetFileSizeEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
PeekNamedPipe
GetFileInformationByHandle
WriteConsoleW
GetFileType
GetStdHandle
RtlPcToFileHeader
RtlUnwindEx
GetCPInfo
LCMapStringW
GetStringTypeW
GetFileTime
GetFileAttributesExW
VirtualProtect
IsProcessorFeaturePresent
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GetCurrentDirectoryW
GlobalGetAtomNameW
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SystemTimeToTzSpecificLocalTime
FileTimeToLocalFileTime
GetThreadLocale
lstrcmpiW
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
GetFileSize
FlushFileBuffers
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
VerifyVersionInfoW
VerSetConditionMask
GetSystemDirectoryW
EncodePointer
GetPrivateProfileStringW
GetPrivateProfileIntW
InitializeCriticalSectionAndSpinCount
lstrcpyW
FreeResource
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
lstrcmpW
lstrcmpA
GlobalDeleteAtom
LoadLibraryW
LoadLibraryExW
GetModuleHandleExW
FreeLibrary
GetVersionExW
OutputDebugStringA
SetLastError
FormatMessageW
MulDiv
LocalFree
GlobalUnlock
GlobalLock
GlobalSize
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
HeapFree
ResetEvent
ReadFile
GetStartupInfoW
CreatePipe
GetDiskFreeSpaceExW
RemoveDirectoryW
FindClose
DeleteFileW
FindNextFileW
FindFirstFileW
DeviceIoControl
CreateFileW
WritePrivateProfileStringW
SetEvent
OutputDebugStringW
CreateThread
GlobalAlloc
GlobalFree
CreateEventW
OpenThread
VirtualQuery
FlushInstructionCache
GetCurrentProcessId
GetProcAddress
GetThreadContext
VirtualProtectEx
GetSystemInfo
GetThreadPriority
ResumeThread
SuspendThread
InitializeCriticalSection
LeaveCriticalSection
SetThreadPriority
VirtualAlloc
GetCurrentProcess
VirtualFree
EnterCriticalSection
GetCurrentThreadId
GetModuleHandleW
GetCurrentThread
TerminateProcess
OpenProcess
MultiByteToWideChar
GetTickCount
FileTimeToSystemTime
lstrlenW
GetSystemPowerStatus
WaitForSingleObject
WideCharToMultiByte
CopyFileW
CreateDirectoryW
GetFileAttributesW
GetDriveTypeW
GetLogicalDriveStringsW
GetTempPathW
CloseHandle
GetLastError
CreateMutexW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
FindResourceW
LoadResource
LockResource
SizeofResource
GetModuleFileNameW
CreateProcessW
Sleep
GetCommandLineA
GetCommandLineW
ExitThread
FreeLibraryAndExitThread
SetStdHandle
HeapQueryInformation
QueryPerformanceFrequency
ExitProcess
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetFilePointerEx
ReadConsoleW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WaitForSingleObjectEx

user32

GetTopWindow
GetClassLongPtrW
EqualRect
AdjustWindowRectEx
GetWindowTextLengthW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
SetForegroundWindow
GetForegroundWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
SetFocus
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
IsChild
IsMenu
CreateWindowExW
GetClassInfoExW
RegisterClassW
GetMessageTime
GetMessagePos
EndPaint
BeginPaint
GetWindowDC
GetLastActivePopup
GetWindowThreadProcessId
MessageBoxW
ShowOwnedPopups
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
EnumDisplayMonitors
GetMonitorInfoW
SystemParametersInfoW
GetClassInfoW
DefWindowProcW
GetDesktopWindow
SetActiveWindow
IsWindowEnabled
GetNextDlgTabItem
GetDlgItem
EndDialog
CreateDialogIndirectParamW
DestroyWindow
GetCursorPos
ValidateRect
GetKeyState
GetActiveWindow
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
DrawIconEx
DrawFocusRect
GetSysColorBrush
GetSysColor
GetScrollInfo
DrawStateW
DrawFrameControl
DrawEdge
RegisterWindowMessageW
MapDialogRect
GetWindow
SetWindowContextHelpId
PostQuitMessage
RemoveMenu
InsertMenuW
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringW
UnregisterClassW
IsWindowVisible
LoadCursorW
SetCursor
FillRect
GetMenuItemCount
UnhookWindowsHookEx
SetWindowsHookExW
CallWindowProcW
CallNextHookEx
SetWindowLongPtrW
WinHelpW
MonitorFromWindow
SendDlgItemMessageA
CharUpperW
ShowWindow
SetWindowRgn
ScreenToClient
ReleaseDC
GetDC
InflateRect
GetWindowTextW
OffsetRect
GrayStringW
DrawTextExW
TabbedTextOutW
DrawTextW
CopyRect
GetFocus
CloseWindow
GetAsyncKeyState
LoadImageW
GetParent
PtInRect
IsRectEmpty
SetLayeredWindowAttributes
GetWindowLongPtrW
CheckDlgButton
SetWindowTextW
IsDialogMessageW
IntersectRect
DestroyMenu
GetMenuItemInfoW
LoadMenuW
GetKeyNameTextW
MapVirtualKeyW
SetWindowLongW
SetRect
SetRectEmpty
WaitMessage
SetCapture
ReleaseCapture
WindowFromPoint
CopyImage
DeleteMenu
RealChildWindowFromPoint
CharNextW
CopyAcceleratorTableW
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
SetParent
MonitorFromPoint
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DestroyIcon
GetWindowRgn
DestroyCursor
InvertRect
HideCaret
CreateMenu
GetComboBoxInfo
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
MapVirtualKeyExW
IsCharLowerW
PostThreadMessageW
FrameRect
UpdateLayeredWindow
CharUpperBuffW
SubtractRect
RegisterClipboardFormatW
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
TranslateAcceleratorW
CreateAcceleratorTableW
LoadAcceleratorsW
GetKeyboardState
GetKeyboardLayout
MoveWindow
SetWindowPos
GetClassNameW
GetWindowLongW
GetSystemMetrics
FindWindowW
SwitchToThisWindow
wsprintfW
LoadIconW
SendMessageW
PostMessageW
GetClientRect
ToUnicodeEx
SetTimer
IsIconic
DrawIcon
CreatePopupMenu
IsClipboardFormatAvailable
GetUpdateRect
SetClassLongPtrW
DestroyAcceleratorTable
ModifyMenuW
SetMenuDefaultItem
GetMenuDefaultItem
CopyIcon
GetIconInfo
GetDoubleClickTime
EnableScrollBar
LockWindowUpdate
BringWindowToTop
UnionRect
SetCursorPos
NotifyWinEvent
GetSystemMenu
IsZoomed
AppendMenuW
GetWindowRect
ClientToScreen
RedrawWindow
KillTimer
IsWindow
UpdateWindow
InvalidateRect
EnableWindow
SetScrollInfo
MapWindowPoints
TrackMouseEvent

gdi32

GetTextColor
PatBlt
CreatePolygonRgn
Polygon
Polyline
GetTextMetricsW
CreateDIBitmap
CreatePatternBrush
EnumFontFamiliesW
GetTextCharsetInfo
CreateBitmap
GetClipBox
GetObjectType
GetPixel
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetBkColor
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextColor
SetTextAlign
CreateRectRgn
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
GetBkColor
GetMapMode
SetRectRgn
DPtoLP
GetRgnBox
RealizePalette
SetPixel
StretchBlt
SetDIBColorTable
OffsetRgn
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
EnumFontFamiliesExW
LPtoDP
ExtFloodFill
SetPaletteEntries
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
GetViewportOrgEx
GetWindowOrgEx
SetPixelV
GetTextFaceW
CreateHatchBrush
CreateEllipticRgn
CombineRgn
GetDeviceCaps
CreateDCW
CopyMetaFileW
DeleteDC
ExcludeClipRect
CreateRoundRectRgn
GetStockObject
CreateDIBSection
SelectObject
GetTextExtentPoint32W
RoundRect
DeleteObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
BitBlt
Ellipse
ScaleWindowExtEx
CreateRectRgnIndirect
CreateCompatibleBitmap
CreateCompatibleDC
Rectangle
CreateSolidBrush
GetCurrentObject
GetObjectW
RemoveFontResourceW
MoveToEx
CreatePen
CreateFontIndirectW

msimg32

TransparentBlt
AlphaBlend

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

RegEnumKeyW
RegUnLoadKeyW
RegOpenKeyExW
RegLoadKeyW
RegCloseKey
RegQueryValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegFlushKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW

shell32

ShellExecuteExW
ShellExecuteW
SHGetMalloc
DragFinish
DragQueryFileW
SHAppBarMessage
SHGetFileInfoW
SHGetDesktopFolder
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetPathFromIDListW

comctl32

InitCommonControlsEx
_TrackMouseEvent

shlwapi

PathFileExistsW
PathFindExtensionW
PathFindFileNameW
PathIsUNCW
PathStripToRootW
PathRemoveFileSpecW
StrFormatKBSizeW

uxtheme

GetThemeSysColor
IsAppThemed
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
DrawThemeParentBackground
DrawThemeText
GetWindowTheme
GetThemePartSize
IsThemeBackgroundPartiallyTransparent

ole32

CoInitialize
CreateStreamOnHGlobal
CoRegisterMessageFilter
CoRevokeClassObject
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
StringFromGUID2
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoDisconnectObject
CoInitializeEx
CLSIDFromProgID
CLSIDFromString
CoCreateGuid
ReleaseStgMedium
OleDuplicateData
OleLockRunning
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize
CoCreateInstance

oleaut32

SysAllocStringLen
VariantCopy
SysStringLen
SysAllocStringByteLen
VariantInit
VarBstrFromDate
SysAllocString
OleCreateFontIndirect
VariantClear
VariantChangeType
LoadTypeLi
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
SysFreeString

oledlg

OleUIBusyW

gdiplus

GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipImageGetFrameDimensionsList
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipImageGetFrameCount
GdipGetImagePixelFormat
GdipGetPropertyItem
GdipGetImagePalette
GdipImageSelectActiveFrame
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipGetPropertyItemSize
GdipImageGetFrameDimensionsCount
GdiplusStartup
GdiplusShutdown
GdipLoadImageFromFile
GdipFree
GdipAlloc
GdipCloneImage
GdipDisposeImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawImageRect
GdipDrawImageRectRect
GdipStringFormatGetGenericTypographic
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDeleteFont
GdipSetTextRenderingHint
GdipMeasureString
GdipDrawString
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageRectI
GdipGetImageThumbnail
GdipImageRotateFlip
GdipFillRectangleI
GdipSetInterpolationMode

softwarelog

CreateExportObj
DestroyExportObj

bugsplat64

??0MiniDmpSender@@QEAA@PEB_W000K@Z
?setCallback@MiniDmpSender@@QEAAXP6A_NIPEAX0@Z@Z
??1MiniDmpSender@@UEAA@XZ
?getMinidumpPath@MiniDmpSender@@QEAAXPEA_W_K@Z

cfgmgr32

CM_Get_Device_ID_Size
CM_Get_Device_IDW
CM_Enumerate_Classes

setupapi

SetupDiDestroyDriverInfoList
SetupGetInfDriverStoreLocationW
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiEnumDriverInfoW
SetupDiGetDeviceRegistryPropertyW
SetupDiBuildDriverInfoList
SetupDiGetDriverInfoDetailW

libqrencode

QRcode_encodeString
QRcode_free

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

register

?GetRegisterObj@@YAPEAVIRegisterManager@@XZ

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 897KB - Virtual size: 896KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 203KB - Virtual size: 235KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aa69924b8264130888921420ada2dcd5

Headers

DLL Characteristics

File Characteristics

Imports

lib_unlockvolume_sdk

lib_changepw_sdk

ntpasswd

resetuser

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

softwarelog

bugsplat64

cfgmgr32

setupapi

libqrencode

version

register

oleacc

imm32

winmm

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 897KB - Virtual size: 896KB

.data Size: 203KB - Virtual size: 235KB

.pdata Size: 107KB - Virtual size: 107KB

.rsrc Size: 1.8MB - Virtual size: 1.8MB

.reloc Size: 70KB - Virtual size: 70KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 897KB - Virtual size: 896KB

.data
Size: 203KB - Virtual size: 235KB

.pdata
Size: 107KB - Virtual size: 107KB

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

.reloc
Size: 70KB - Virtual size: 70KB