16066a03d0b1f996e369c154b014b597

Sharing

Copy URL

Twitter E-mail

General

Target

16066a03d0b1f996e369c154b014b597
Size

1.7MB
MD5

16066a03d0b1f996e369c154b014b597
SHA1

83f1d9312dffbffd615d5311a8cd6166500879a2
SHA256

eb016172673dfc7a5570c07e79f8384f7e559effcbb4e30703f54c16cb3b4e2e
SHA512

54c9ad117f4b2e27010883666428f33a351448db85d738ce369554e7dfe80e5d874e8413a0c0d89a553ae173287300807ff3d219a11d09b3a0ecb2a5ff5ce1a4
SSDEEP

49152:iFcGJt9mOgPhd1gn3lT/03nDa82/fyzrGwE3rHhZ/:WDxkhvy3t/03DaXfsrGw+rHhZ/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16066a03d0b1f996e369c154b014b597

Files

16066a03d0b1f996e369c154b014b597
.exe windows:4 windows x86 arch:x86

33bbf682fed7f8c27a3c93fc0f51dcb6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

setupapi

SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiOpenClassRegKeyExW
SetupDiEnumDeviceInterfaces
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdW
SetupDiOpenDevRegKey
SetupDiGetDeviceRegistryPropertyW
SetupDiCreateDeviceInfoList
SetupDiOpenDeviceInfoW
SetupDiDestroyDeviceInfoList

samlib

SamAddMemberToAlias

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wininet

InternetGetCookieW

shell32

SHFileOperationW
SHAppBarMessage
ExtractIconW
Shell_NotifyIconW
DragQueryFileW

ws2_32

WSAIoctl
getaddrinfo
freeaddrinfo
WSALookupServiceNextW
WSALookupServiceEnd
WSALookupServiceBeginW
WSANSPIoctl

netapi32

NetApiBufferFree
NetGetJoinInformation

rpcrt4

MesEncodeDynBufferHandleCreate
NdrDllUnregisterProxy
CStdStubBuffer_Invoke
MesDecodeBufferHandleCreate
NdrDllRegisterProxy
CStdStubBuffer_IsIIDSupported
NdrMesTypeFree2
CStdStubBuffer_DebugServerRelease
NdrMesTypeEncode2
MesHandleFree
IUnknown_QueryInterface_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
NdrDllGetClassObject
NdrOleFree
IUnknown_AddRef_Proxy
CStdStubBuffer_Disconnect
NdrOleAllocate
IUnknown_Release_Proxy
NdrMesTypeDecode2
NdrCStdStubBuffer_Release
CStdStubBuffer_AddRef
NdrDllCanUnloadNow
CStdStubBuffer_QueryInterface
CStdStubBuffer_Connect

user32

GetKeyboardLayout
RegisterDeviceNotificationW
FillRect
CharPrevW
DrawTextW
SetFocus
FlashWindow
GetWindowThreadProcessId
GetSysColor
PostMessageW
SetTimer
GetDlgItem
GetClipboardData
LoadCursorW
SendInput
RegisterClipboardFormatW
GetKeyboardLayoutNameA
MapVirtualKeyW
LoadImageW
ReleaseDC
IsDlgButtonChecked
GetGUIThreadInfo
GetClipboardViewer
UnregisterDeviceNotification
DefDlgProcW
GetCapture
SetActiveWindow
DefWindowProcW
SetRectEmpty
ScreenToClient
RegisterClassExW
UnhookWindowsHookEx
RegisterWindowMessageW
BringWindowToTop
DestroyCursor
UnregisterClassW
MsgWaitForMultipleObjectsEx
SetScrollInfo
ShowCursor
CloseClipboard
SetScrollPos
SystemParametersInfoA
GetKeyboardState
SystemParametersInfoW
EnumClipboardFormats
AttachThreadInput
MoveWindow
FindWindowW
GetKeyState
GetSystemMenu
DestroyIcon
RegisterRawInputDevices
MapWindowPoints
GetDesktopWindow
SetWindowRgn
GetClassInfoW
GetWindow
GetDC
DialogBoxParamW
CallNextHookEx
UnionRect
SetClipboardData
GetForegroundWindow
CountClipboardFormats
GetKeyboardType
SetRect
SetCursor
UpdateWindow
AdjustWindowRect
LoadIconW
GetSystemMetrics
GetRawInputData
CopyRect
CallWindowProcW
GetMonitorInfoW
GetClassNameW
wsprintfW
EndDeferWindowPos
SetParent
GetClassInfoExW
GetActiveWindow
IsWindowVisible
FindWindowExW
SetWindowTextW
ChangeClipboardChain
DispatchMessageW
SetCapture
LockWindowUpdate
GetSysColorBrush
CreateDialogParamW
SetForegroundWindow
SetWindowPos
ShowScrollBar
EmptyClipboard
CopyIcon
CloseWindow
ShowWindow
GetParent
BeginPaint
GetClientRect
EnableWindow
IsWindow
GetLastInputInfo
SetWindowsHookExW
EndPaint
GetWindowPlacement
GetWindowTextW
InvalidateRect
PostQuitMessage
GetLastActivePopup
CharLowerW
RegisterClassW
UnregisterHotKey
CreateWindowExW
EqualRect
MessageBeep
SetDlgItemTextW
PostThreadMessageW
CheckDlgButton
LoadStringW
RedrawWindow
ReleaseCapture
GetMessageExtraInfo
SendMessageW
DeferWindowPos
SetWindowLongW
SetClipboardViewer
IsClipboardFormatAvailable
GetKeyboardLayoutNameW
PeekMessageW
BeginDeferWindowPos
ClientToScreen
keybd_event
MonitorFromWindow
EndDialog
KillTimer
GetClipboardFormatNameW
GetMessageW
InflateRect
DrawIconEx
GetCursorPos
CreateIconIndirect
IsChild
DestroyAcceleratorTable
DestroyWindow
PtInRect
GetWindowLongW
CreateCursor
GetFocus
RegisterHotKey
GetWindowDC
IsIconic
IsWindowEnabled
EnableMenuItem
SetWindowPlacement
IntersectRect
OffsetRect
IsZoomed
CharNextW
OpenClipboard
GetAsyncKeyState
GetWindowRect
SetCursorPos

kernel32

Beep
GetSystemTimeAsFileTime
SetErrorMode
SetCommTimeouts
GetUserDefaultUILanguage
GetSystemInfo
GetProcessHeap
OpenThread
GlobalAddAtomW
FindNextChangeNotification
CreateMutexW
FindCloseChangeNotification
DeleteCriticalSection
InterlockedDecrement
GlobalLock
TlsGetValue
GetFileAttributesW
SetFilePointer
lstrcatW
VerifyVersionInfoW
GetTimeZoneInformation
FindFirstChangeNotificationW
FlushInstructionCache
FlushFileBuffers
ReleaseSemaphore
LockFileEx
FormatMessageW
SetCommMask
GetCommConfig
OutputDebugStringA
SystemTimeToFileTime
UnlockFile
FindResourceW
BindIoCompletionCallback
lstrcmpiW
FindResourceExW
CreateDirectoryW
lstrcmpA
GetSystemDirectoryW
CreateSemaphoreW
GetFileSize
SetEvent
WaitForMultipleObjects
lstrcpynW
FindFirstFileW
HeapAlloc
VirtualProtect
VirtualAlloc
LocalAlloc
FreeLibraryAndExitThread
WriteFile
SetUnhandledExceptionFilter
WaitForSingleObject
lstrcmpiA
FindClose
LoadLibraryA
Sleep
UnmapViewOfFile
HeapFree
LoadLibraryExW
GlobalUnlock
CancelIo
TlsSetValue
GetModuleHandleA
ExpandEnvironmentStringsW
RaiseException
VirtualFree
GetFileAttributesExW
MulDiv
CreateProcessW
GlobalHandle
GlobalFree
DeviceIoControl
GetLocaleInfoW
EnterCriticalSection
UnhandledExceptionFilter
MultiByteToWideChar
DisableThreadLibraryCalls
lstrcmpW
GetCurrentProcessId
GetCommProperties
InterlockedCompareExchange
InterlockedExchange
QueryPerformanceCounter
QueryDosDeviceW
lstrlenA
lstrcpyW
GetSystemDefaultUILanguage
EscapeCommFunction
GetVersionExA
MoveFileW
GetCurrentProcess
LockFile
LoadResource
GlobalSize
GetCurrentThreadId
GetACP
WaitForMultipleObjectsEx
TransmitCommChar
CreateFileMappingW
GlobalAlloc
WaitCommEvent
GetFileInformationByHandle
GetVersion
GetModuleFileNameW
GetDiskFreeSpaceW
TlsFree
QueueUserWorkItem
LeaveCriticalSection
LockResource
FreeResource
SetCommState
SetFileTime
GetCommModemStatus
CreateThread
FreeLibrary
CreateFileW
GetCommTimeouts
SetEndOfFile
DeleteFileW
GetVersionExW
GetSystemDirectoryA
DuplicateHandle
GetOverlappedResult
SetFileAttributesW
GetProcAddress
GetVolumeInformationW
HeapDestroy
ClearCommError
CloseHandle
GetSystemTime
LoadLibraryW
ResumeThread
lstrlenW
OutputDebugStringW
VirtualQuery
GetProfileStringW
WideCharToMultiByte
SearchPathW
LocalFree
InterlockedIncrement
ReadFile
GetModuleHandleW
InitializeCriticalSection
MapViewOfFile
TlsAlloc
ResetEvent
RemoveDirectoryW
GetModuleHandleExW
SetLastError
GetDriveTypeW
SetupComm
GetComputerNameW
GetLastError
PurgeComm
GetComputerNameA
CreateEventW
TerminateProcess
GetTempFileNameW
GetSystemDefaultLangID
DebugBreak
GetTempPathW
GetCommState
GlobalDeleteAtom
FindNextFileW
GetTickCount
SizeofResource
GetCommMask
GetFullPathNameW
GetDefaultCommConfigW

ntdll

VerSetConditionMask
NtOpenFile
RtlInsertElementGenericTable
RtlDeleteElementGenericTable
RtlAreBitsSet
RtlAcquireResourceShared
RtlGetLastNtStatus
RtlUnwind
RtlInitializeResource
NtWriteFile
RtlAcquireResourceExclusive
RtlInitializeGenericTable
RtlFindClearBitsAndSet
RtlEnumerateGenericTableWithoutSplaying
RtlLookupElementGenericTable
RtlEnumerateGenericTable
RtlReleaseResource
NtAllocateVirtualMemory
NtDeviceIoControlFile
RtlClearBits
RtlInitializeCriticalSection
RtlInitUnicodeString
RtlDeleteResource
RtlInitializeBitMap

gdi32

GetBrushOrgEx
CreateBitmap
SetWindowExtEx
CreateFontIndirectW
GetCurrentObject
GetMapMode
GetTextAlign
ExtSelectClipRgn
SelectObject
CreatePatternBrush
SetTextColor
GetDeviceCaps
SetPolyFillMode
GetRgnBox
CreateRectRgnIndirect
UpdateColors
CreateDCW
SetDCBrushColor
SetDIBColorTable
CreatePolygonRgn
SelectClipRgn
PatBlt
SetMetaFileBitsEx
RestoreDC
DPtoLP
LineTo
CreateBrushIndirect
FrameRgn
GetMetaFileBitsEx
CreateCompatibleDC
CombineRgn
SetBkMode
OffsetClipRgn
GdiFlush
CreateCompatibleBitmap
BitBlt
SetStretchBltMode
FillRgn
CreateSolidBrush
CreatePen
Rectangle
GetBkMode
GetNearestPaletteIndex
GdiDrawStream
GetTextExtentPointW
OffsetRgn
SetBrushOrgEx
CreateMetaFileW
Ellipse
DeleteMetaFile
GetStockObject
StretchBlt
Polygon
CreateDIBitmap
SetWindowOrgEx
StretchDIBits
SetRectRgn
CreateDIBSection
GetNearestColor
CloseMetaFile
SetTextAlign
GetDIBColorTable
SetBitmapBits
SaveDC
MoveToEx
SetViewportOrgEx
CreateRectRgn
GetPaletteEntries
SelectPalette
SetBkColor
GetClipBox
GetObjectW
DeleteDC
CreatePalette
SetROP2
LPtoDP
DeleteObject
SetMapMode
RealizePalette
CreateDIBPatternBrushPt
PlayMetaFile

advapi32

CryptReleaseContext
CredReadDomainCredentialsW
RegSetValueExA
RegOpenKeyA
TraceMessage
RegQueryValueExW
CredWriteDomainCredentialsW
CredUnmarshalCredentialW
RegQueryInfoKeyA
RegDeleteValueA
RegCreateKeyExW
SetFileSecurityW
RegConnectRegistryW
GetTraceEnableFlags
RegOpenKeyExW
RegCreateKeyW
GetUserNameW
RegEnumValueW
RegEnumKeyExW
RegQueryValueExA
RegCloseKey
CryptAcquireContextW
GetTraceLoggerHandle
GetSecurityDescriptorLength
RegDeleteKeyW
GetUserNameA
GetTraceEnableLevel
RegSetValueExW
CredWriteW
CredReadW
RegDeleteValueW
RegCreateKeyExA
RegOpenKeyW
RegisterTraceGuidsW
RegOpenKeyExA
RegFlushKey
CredDeleteW
RegQueryInfoKeyW
CredGetSessionTypes
RegEnumKeyExA
GetFileSecurityW
UnregisterTraceGuids
CryptGenRandom
CredFree

crypt32

CertVerifySubjectCertificateContext
CertCompareCertificate
CryptMsgClose
CryptDecodeObject
CryptVerifyDetachedMessageSignature
CertOpenStore
CryptMsgUpdate
CryptBinaryToStringW
CryptProtectData
CryptMsgOpenToDecode
CertCreateCertificateContext
CertVerifyCertificateChainPolicy
CryptSignMessage
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertFreeCertificateChain
CertGetEnhancedKeyUsage
CertAddCertificateContextToStore
CryptStringToBinaryW
CertCloseStore
CertFindExtension
CertGetCertificateChain
CertGetNameStringW
CertDuplicateCertificateChain
CertFreeCertificateContext
CertFindCertificateInStore

shlwapi

PathRemoveFileSpecW

ole32

StringFromCLSID
CoTaskMemRealloc
CoInitializeEx
CoCreateInstance
OleLoadFromStream
OleSetClipboard
OleInitialize
CoTaskMemAlloc
CoTaskMemFree
OleRegGetUserType
CoInitialize
OleRegEnumVerbs
OleGetClipboard
OleRegGetMiscStatus
CreateOleAdviseHolder
OleSaveToStream
CoUninitialize
CoGetMalloc
OleUninitialize
CreateDataAdviseHolder
OleIsCurrentClipboard
CLSIDFromString
ReleaseStgMedium
WriteClassStm

winmm

waveOutPrepareHeader
waveOutOpen
waveOutWrite
waveOutClose
waveOutUnprepareHeader
waveOutSetVolume
waveOutReset
waveOutGetVolume
waveOutGetPitch

msvcrt

bsearch
_resetstkoflw
__mb_cur_max
wcsrchr
toupper
_read
floor
memmove
__badioinfo
wcsncmp
ferror
_initterm
_vsnprintf
_iob
wctomb
__dllonexit
_wcsnicmp
_adjust_fdiv
wcschr
malloc
__pioinfo
_snprintf
isdigit
strncmp
calloc
isxdigit
iswctype
_vsnwprintf
_fileno
free
_stricmp
wcsstr
_wtol
fclose
_amsg_exit
realloc
_errno
strtoul
_lseeki64
_wtoi
printf
time
_write
_wcsicmp
_CxxThrowException
_onexit
memset
wcspbrk
localeconv
ceil
iswdigit
_unlock
_strlwr
_XcptFilter
iswalnum
memcpy
_lock
strtok
srand
_wcslwr
wcstombs
_isatty
_itoa
mbtowc
ungetc
_strnicmp
isleadbyte
wcstok
towlower
_purecall
strchr

Sections

.text
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 171KB - Virtual size: 22.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 717KB - Virtual size: 717KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 735KB - Virtual size: 734KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

33bbf682fed7f8c27a3c93fc0f51dcb6

Headers

File Characteristics

Imports

setupapi

samlib

version

wininet

shell32

ws2_32

netapi32

rpcrt4

user32

kernel32

ntdll

gdi32

advapi32

crypt32

shlwapi

ole32

winmm

msvcrt

Sections

.text Size: 121KB - Virtual size: 120KB

.data Size: 171KB - Virtual size: 22.3MB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 717KB - Virtual size: 717KB

.rdata Size: 735KB - Virtual size: 734KB

.text
Size: 121KB - Virtual size: 120KB

.data
Size: 171KB - Virtual size: 22.3MB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 717KB - Virtual size: 717KB

.rdata
Size: 735KB - Virtual size: 734KB