13d59bb70583812af7ddec67c9698e5e

Sharing

Copy URL Twitter E-mail

General

Target

13d59bb70583812af7ddec67c9698e5e
Size

6.4MB
MD5

13d59bb70583812af7ddec67c9698e5e
SHA1

1f895238ac68d1f577f1ae943fda63308985a8c5
SHA256

33b44762650affd09832f6629f8a7fb5b96072621fe50b440b8962faa0b537da
SHA512

e74dc7a37c7dafdeac437e6a3d321fb025a454b9a01a47b4ad5ebee110d760fbf31d4b14526c1415090fb6f7f4cf3d2bd45ecf1e22acd73ac353afe48c0a1c54
SSDEEP

98304:sve9zgnrElBGupd/m0p+tZlDk9q9a5P/hVrM1DSFG6Ugog97IHqWeZ:s24Elx+0pwQ9oeP3Y1Yog97JnZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
13d59bb70583812af7ddec67c9698e5e

Files

13d59bb70583812af7ddec67c9698e5e
.exe windows:5 windows x86 arch:x86

9f22b5abede8491b5947462879856dd1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

wininet

InternetCloseHandle
InternetGetLastResponseInfoW
HttpQueryInfoW
InternetReadFile
InternetOpenUrlW
InternetOpenW

advapi32

RegQueryValueW
GetKernelObjectSecurity
GetLengthSid
LookupPrivilegeValueA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyW
IsTextUnicode
RegEnumKeyW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumValueW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegQueryInfoKeyW
RegEnumKeyExW
OpenProcessToken
GetUserNameW
RegCreateKeyW
GetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
AllocateAndInitializeSid
SetSecurityDescriptorOwner
SetEntriesInAclW
FreeSid
RegSetKeySecurity
AdjustTokenPrivileges
RegSetValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
GetSecurityDescriptorSacl

oleaut32

VariantInit
VariantChangeType
VariantClear
SysAllocStringLen
SysReAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
OleLoadPicture
SysFreeString

ole32

CoInitializeEx
CreateStreamOnHGlobal
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoInitialize

kernel32

WaitForSingleObjectEx
OpenMutexW
BeginUpdateResourceW
GetCurrentThreadId
ReleaseMutex
SetEvent
CreateEventW
GlobalAlloc
MulDiv
ResetEvent
ResumeThread
FreeResource
GetCommandLineW
SetFilePointer
GetComputerNameW
GetVersionExW
GetVersion
FindFirstFileExW
GetSystemTimeAsFileTime
GetWindowsDirectoryW
GetLongPathNameW
WaitNamedPipeW
InitializeCriticalSection
LeaveCriticalSection
GetExitCodeProcess
GetModuleFileNameW
MultiByteToWideChar
lstrlenW
GetTempPathW
EnterCriticalSection
GetLocalTime
SetNamedPipeHandleState
UpdateResourceW
EnumResourceLanguagesW
LocalFree
ExpandEnvironmentStringsW
SystemTimeToFileTime
SetFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
FlushViewOfFile
CreateFileMappingW
OpenFileMappingW
GetLogicalDrives
QueryDosDeviceW
GetFileInformationByHandle
DeleteCriticalSection
VirtualFree
VirtualAlloc
LocalAlloc
GetThreadLocale
EndUpdateResourceW
GetLocaleInfoA
GetCommandLineA
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
lstrlenA
lstrcpyW
lstrcpyA
lstrcmpiA
lstrcmpA
lstrcatW
WaitForMultipleObjects
VirtualQuery
VirtualProtect
TerminateThread
SetThreadPriority
ReleaseSemaphore
OpenMutexA
OpenFileMappingA
OpenEventW
OpenEventA
LoadLibraryExA
LoadLibraryA
IsBadWritePtr
IsBadReadPtr
GetVersionExA
GetThreadContext
GetSystemDirectoryA
GetModuleHandleA
GetModuleFileNameA
GetFileAttributesA
GetExitCodeThread
GetCurrentThread
GetCurrentDirectoryA
InterlockedExchange
FormatMessageA
DeviceIoControl
CreateSemaphoreA
CreateProcessA
CreatePipe
CreateMutexA
CreateFileMappingA
CreateFileA
CreateEventA
InterlockedDecrement
FormatMessageW
lstrcmpW
CompareStringW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
FlushFileBuffers
CompareStringA
GetLocaleInfoW
ConvertDefaultLocale
GlobalFlags
GlobalReAlloc
GlobalHandle
LocalReAlloc
InterlockedIncrement
SetErrorMode
WritePrivateProfileStringW
GetStartupInfoW
HeapFree
HeapAlloc
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
ExitThread
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
QueryPerformanceCounter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
LCMapStringA
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
LoadLibraryExW
FreeLibrary
CreateMutexW
EnumResourceNamesW
GetSystemTime
GetCurrentProcessId
RemoveDirectoryW
SetCurrentDirectoryW
MoveFileW
FileTimeToSystemTime
LoadLibraryW
GetSystemDirectoryW
GetTickCount
OutputDebugStringW
SleepEx
WaitForSingleObject
SetEnvironmentVariableW
CompareFileTime
CreateProcessW
CreateThread
DisconnectNamedPipe
CreateNamedPipeW
ConnectNamedPipe
GlobalFree
GlobalUnlock
GlobalLock
DeleteFileW
GetFileAttributesW
CopyFileW
WriteFile
SetFileAttributesW
FindNextFileW
GetSystemInfo
FindClose
CreateFileW
ReadFile
CreateDirectoryW
GetDriveTypeW
FindFirstFileW
GetFileSize
GetEnvironmentVariableW
ExitProcess
Sleep
CloseHandle
IsWow64Process
SetLastError
TerminateProcess
OpenProcess
WriteProcessMemory
DuplicateHandle
LockResource
VirtualProtectEx
GetProcAddress
GetLastError
ReadProcessMemory
SizeofResource
WideCharToMultiByte
VirtualQueryEx
GetModuleHandleW
GetCurrentProcess
LoadResource
FindResourceW
GetStartupInfoA

user32

GetForegroundWindow
SetFocus
RemovePropW
GetPropW
SetPropW
GetClassLongW
CallNextHookEx
SetWindowsHookExW
GetCapture
WinHelpW
SendDlgItemMessageA
SendDlgItemMessageW
IsDialogMessageW
SetWindowTextW
SetCursor
ValidateRect
DestroyMenu
GetSysColorBrush
UnregisterClassW
PtInRect
GetDlgCtrlID
CallWindowProcW
GetMenu
SetWindowLongW
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindow
GetMenuItemCount
UnhookWindowsHookEx
GetActiveWindow
GetTopWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
EndPaint
BeginPaint
ClientToScreen
ScreenToClient
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetWindowThreadProcessId
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
GetFocus
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
CloseDesktop
DispatchMessageA
GetSystemMetrics
GetThreadDesktop
GetUserObjectInformationA
MsgWaitForMultipleObjects
OpenInputDesktop
PeekMessageA
GetKeyboardType
MessageBoxA
EnumWindows
GetWindowTextW
SetActiveWindow
TrackPopupMenu
RegisterWindowMessageW
GetMenuItemID
KillTimer
GetSubMenu
LoadMenuW
GetClassNameW
IsWindow
SetMenuDefaultItem
PostMessageW
SetForegroundWindow
TrackPopupMenuEx
AppendMenuW
GetCursorPos
CreatePopupMenu
RemoveMenu
FillRect
GetDC
SetRect
ReleaseDC
GetSysColor
CopyRect
WaitMessage
SystemParametersInfoW
wsprintfW
DestroyWindow
GetMessageW
PostQuitMessage
LoadCursorW
TranslateMessage
RegisterClassExW
LoadIconW
GetMessageTime
GetMessagePos
MapWindowPoints
GetKeyState
SetMenu
GetDesktopWindow
ShowWindow
IsWindowVisible
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
CreateDialogIndirectParamW
CreateWindowExW
DefWindowProcW
MoveWindow
DispatchMessageW
GetWindowRect
GetParent
InvalidateRect
UpdateWindow
FindWindowW
SendMessageW
GetClientRect
LoadBitmapW
EnableWindow
MessageBoxW
PeekMessageW

gdi32

CreateSolidBrush
GetStockObject
BitBlt
StretchBlt
DeleteDC
CreateBitmap
SaveDC
RestoreDC
SetBkColor
SetBkMode
SetTextColor
SetMapMode
CreateCompatibleDC
ExtTextOutW
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
CreateCompatibleBitmap
DeleteObject
RectVisible
ScaleWindowExtEx
SelectObject
PtVisible
GetDeviceCaps
GetClipBox
GetObjectW
TextOutW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

shell32

ShellExecuteExW
ShellExecuteW
CommandLineToArgvW
Shell_NotifyIconW
SHChangeNotify

comctl32

InitCommonControlsEx

shlwapi

PathFindExtensionW
PathFindFileNameW
SHCopyKeyW

msi

ord173
ord217

oleacc

CreateStdAccessibleObject
LresultFromObject

Sections

CODE
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 564KB - Virtual size: 563KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 470KB - Virtual size: 469KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9f22b5abede8491b5947462879856dd1

Headers

DLL Characteristics

File Characteristics

Imports

version

wininet

advapi32

oleaut32

ole32

kernel32

user32

gdi32

winspool.drv

shell32

comctl32

shlwapi

msi

oleacc

Sections

CODE Size: 121KB - Virtual size: 121KB

.text Size: 564KB - Virtual size: 563KB

.rdata Size: 135KB - Virtual size: 134KB

.data Size: 10KB - Virtual size: 27KB

DATA Size: 5KB - Virtual size: 5KB

BSS Size: 2KB - Virtual size: 2KB

.rsrc Size: 470KB - Virtual size: 469KB

CODE
Size: 121KB - Virtual size: 121KB

.text
Size: 564KB - Virtual size: 563KB

.rdata
Size: 135KB - Virtual size: 134KB

.data
Size: 10KB - Virtual size: 27KB

DATA
Size: 5KB - Virtual size: 5KB

BSS
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 470KB - Virtual size: 469KB