515a6db36b19116e5453543dcb466268

Sharing

Copy URL Twitter E-mail

General

Target

515a6db36b19116e5453543dcb466268
Size

224KB
MD5

515a6db36b19116e5453543dcb466268
SHA1

3006b1dd39f2052765e92a7fe707ee93721838ad
SHA256

dc3f6c398bec809e7051a58e64abe849e482454426f836497731fda2f29279bc
SHA512

fb1e8b1df78eeb15a71c600ddd5967842ac7c72bcb70eb3e7beb4d63699056c5581f18160c8315cb6d7e25862b68ce93ab519c35bfc3f609bec977ce3070a0ef
SSDEEP

3072:JFKGRvAVOcLUDHNPRXTvz6texGTwkhzgYR72l2pK6eaWb35DFU9IGV7r:KGRa+vTCYx9F2II

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
515a6db36b19116e5453543dcb466268

Files

515a6db36b19116e5453543dcb466268
.exe windows:4 windows x86 arch:x86

0d23bae3e08d691e641c6ba043a6ad6d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHGetSpecialFolderLocation
DragQueryFileA
Shell_NotifyIconW
Shell_NotifyIconA
Shell_NotifyIconW

msvcrt

malloc
wcscspn
srand
memset
_acmdln
atol
memmove
tolower
mbstowcs
time
memset
sprintf
clock
wcstol
malloc
wcscspn
srand
memset
memmove
sprintf
wcstol
swprintf
wcscspn
rand
_acmdln
wcschr
clock
exit
mbstowcs
memcpy
wcsncmp
wcscspn
sqrt
wcsncmp
swprintf
tolower
_acmdln
malloc
rand
sprintf
clock
memset
wcscspn

version

VerQueryValueA
VerQueryValueA
GetFileVersionInfoA
VerFindFileA
GetFileVersionInfoSizeA
VerFindFileA
GetFileVersionInfoSizeA

kernel32

GlobalDeleteAtom
ExitThread
CreateEventA
GetCommandLineW
FreeResource
GetStdHandle
DeleteCriticalSection
FormatMessageA
LocalAlloc
FindClose
GetFullPathNameA
MoveFileExA
WaitForSingleObject
HeapDestroy
DeleteFileA
LoadLibraryExA
IsBadReadPtr
GetDateFormatA
GetFileType
SetEndOfFile
GlobalAddAtomA
lstrcpyA
SetLastError
LocalFree
MoveFileA
GetCommandLineA
CompareStringA
ResetEvent
GetOEMCP
GetStringTypeA
SetHandleCount
FreeLibrary
GetThreadLocale
GetVersion
HeapAlloc
GetUserDefaultLCID
GetCurrentThread
FindResourceA
LoadLibraryA
GetACP
SizeofResource
LoadResource
InitializeCriticalSection
MulDiv
lstrcatA
lstrcpynA
GetFileAttributesA
GetStartupInfoA
GetCurrentProcess
VirtualQuery
EnterCriticalSection
ReadFile
EnumCalendarInfoA
GetModuleHandleA
LocalReAlloc
GetStringTypeW
GetProcessHeap
GetLocaleInfoA
lstrlenA
SetErrorMode
VirtualFree
lstrcmpA
CloseHandle
lstrcmpiA
GetCPInfo
GetLocalTime
GetEnvironmentStrings
GetCurrentProcessId
IsBadHugeReadPtr
CreateThread
GetTickCount
GlobalFindAtomA
GetVersionExA
LockResource
GetTempPathA
GetSystemDefaultLangID
GetFileSize
ExitProcess
VirtualAllocEx
Sleep
GetCurrentThreadId
SetEvent
WriteFile
GlobalAlloc
LoadLibraryExA
RaiseException
lstrcmpA
LocalReAlloc
GetLocalTime
SetEndOfFile
lstrcpynA
HeapFree
GetCurrentThreadId
FindFirstFileA
GetModuleHandleW
WideCharToMultiByte
LoadResource
GetTempPathA
GetUserDefaultLCID
VirtualFree
SizeofResource
GetACP
CloseHandle
lstrcatA
GetVersionExA
GetFileSize
GetDateFormatA
LocalFree
GetCommandLineA
GetStdHandle
FindResourceA
IsBadHugeReadPtr
lstrlenW
HeapAlloc
VirtualQuery
HeapDestroy
LoadLibraryA
GetStringTypeA
MoveFileExA
GetModuleFileNameA
GetModuleHandleA
lstrcmpiA
CreateEventA
CreateFileA
ReadFile
DeleteFileA
GetFileAttributesA
GetTickCount
GetLocaleInfoA
GetDiskFreeSpaceA
FormatMessageA
lstrlenA
GetStringTypeW
GetProcessHeap
GetSystemDefaultLangID
GetCurrentProcess
LockResource
GetVersion
GetOEMCP
InitializeCriticalSection
IsBadReadPtr
GetEnvironmentStrings
FreeResource
VirtualAlloc
GetLastError
GetThreadLocale
FindClose
SetHandleCount
CreateThread
Sleep
MoveFileA
lstrcpyA
GetCPInfo
ExitProcess
WaitForSingleObject
GetStartupInfoA
GetFileType
SetEvent
ResetEvent
SetErrorMode
GetCurrentProcessId
CompareStringA
GlobalFindAtomA
GlobalAddAtomA
EnterCriticalSection
GetModuleHandleA
GlobalDeleteAtom
GetVersion
DeleteFileA
GetSystemDefaultLangID
CloseHandle
IsBadReadPtr
GlobalAddAtomA
IsBadHugeReadPtr
GetUserDefaultLCID
CreateThread
GlobalFindAtomA
FreeLibrary
FindFirstFileA
SetEvent
LoadLibraryA
GetModuleHandleW
GetThreadLocale
GetDateFormatA
LoadResource
GetACP
SetLastError
GetFileAttributesA
GetModuleFileNameA
SetHandleCount
SizeofResource
GetFileType
EnumCalendarInfoA
SetFilePointer
GetTempPathA
GetCPInfo
GetFullPathNameA
lstrlenW
GetVersionExA
MoveFileA
HeapFree
GetLocaleInfoA
VirtualQuery
CompareStringA
FormatMessageA
lstrlenA
FindResourceA
GetDiskFreeSpaceA
ReadFile
GetEnvironmentStrings
MoveFileExA
GetTickCount
GetCommandLineW
LocalFree
GetLastError
SetErrorMode
GetStringTypeW
FindClose
SetEndOfFile
HeapDestroy
GetCurrentThread
CreateFileA
WriteFile
RaiseException
GetStdHandle
VirtualAlloc
GetFileSize
GetLocalTime
FreeResource
lstrcmpiA
ResetEvent
DeleteCriticalSection
GetCurrentProcess
ExitThread
LoadLibraryExA
MulDiv
InitializeCriticalSection
LockResource
ExitProcess
Sleep
lstrcpyA
WideCharToMultiByte
LocalAlloc
GetCurrentThreadId
CreateEventA
GetProcAddress
GetVersion
VirtualAllocEx
GetCurrentThread
MoveFileA
LocalReAlloc
EnterCriticalSection
GetDateFormatA
LoadLibraryExA
GetStringTypeA
GetFileSize
CompareStringA
LocalFree
CreateEventA
IsBadReadPtr
GetCommandLineW
GetACP
HeapAlloc
MulDiv
GetModuleHandleA
lstrlenW
SetThreadLocale
WriteFile
ExitThread
RaiseException
GetModuleFileNameA
GetModuleHandleW
LoadLibraryA
LoadResource
SetEndOfFile
SetHandleCount
InitializeCriticalSection
ReadFile
lstrcpynA
CreateThread
FindClose
LocalAlloc
GlobalDeleteAtom
GetCommandLineA
FindFirstFileA
GetProcessHeap
FindResourceA
FormatMessageA
IsBadHugeReadPtr
CreateFileA
SetLastError
GetCurrentProcess
lstrcpyA
MoveFileExA
GetOEMCP
GetCurrentProcessId
GetTempPathA
ExitProcess
GetUserDefaultLCID
SetEvent
GetThreadLocale
GetEnvironmentStrings
SizeofResource
lstrcatA
GetVersionExA
GetLocaleInfoA
GetStringTypeW
GetProcAddress
GetFileType
SetErrorMode
GetLocalTime
FreeLibrary
GlobalAddAtomA
GetSystemDefaultLangID
CloseHandle
WaitForSingleObject
lstrcmpA
GetDiskFreeSpaceA
DeleteCriticalSection
GetLastError
HeapDestroy
lstrlenA
lstrcmpiA
GetStartupInfoA
GlobalFindAtomA
EnumCalendarInfoA
GetCurrentThreadId
LockResource
DeleteFileA
SetHandleCount
LoadLibraryExA
lstrcmpiA
GetCurrentProcessId
SetErrorMode
EnumCalendarInfoA
GetStdHandle
HeapFree
IsBadReadPtr
WideCharToMultiByte
GetTickCount
GetCurrentProcess
CreateEventA
FormatMessageA
WaitForSingleObject
SetFilePointer
GetACP
HeapDestroy
GetModuleFileNameA
SetEvent
CloseHandle
GetStringTypeA
GetCPInfo
EnterCriticalSection
GlobalDeleteAtom
GetFullPathNameA
SetEndOfFile
GetLocaleInfoA
GetStringTypeW
SizeofResource
LocalReAlloc
FindResourceA
VirtualQuery
GetStartupInfoA
InitializeCriticalSection
GetUserDefaultLCID
IsBadHugeReadPtr
GetOEMCP
GlobalAddAtomA
ExitThread
RaiseException
GetThreadLocale
lstrlenW
GetFileAttributesA
GetFileSize
GetLastError
VirtualFree
GetEnvironmentStrings
VirtualAlloc
lstrcpynA
LoadLibraryA
LoadResource
GetProcessHeap
GetCurrentThreadId
CreateThread
GetDiskFreeSpaceA
GetLocalTime
CreateFileA
GetFileType
GetDateFormatA
DeleteFileA
SetLastError
GetVersionExA
FreeLibrary
FreeResource
MoveFileExA
GetCurrentThread
MulDiv
WriteFile
ExitProcess
MoveFileA
SetThreadLocale
Sleep
lstrcatA
lstrcmpA
FindFirstFileA
GetVersion
LocalAlloc
GetProcAddress
DeleteCriticalSection
HeapAlloc
GetTempPathA
GetLastError
LoadLibraryA
DeleteFileA
VirtualQuery
lstrcmpA
IsBadHugeReadPtr
GetStringTypeW
CloseHandle
ExitProcess
SetEndOfFile
GetProcessHeap
WaitForSingleObject
GetCommandLineW
GetThreadLocale
LoadResource
GetProcAddress
EnumCalendarInfoA
lstrcmpiA
GetFileSize
GetCPInfo
GetModuleHandleA
MoveFileExA
GetOEMCP
LoadLibraryExA
WideCharToMultiByte
CreateFileA
GetModuleFileNameA
DeleteCriticalSection
SetEvent
GetLocaleInfoA
SetFilePointer
ExitThread
RaiseException
GetLocalTime
GetCurrentProcessId
GetCurrentProcess
GetDiskFreeSpaceA
MoveFileA
CompareStringA
FindFirstFileA
GetStdHandle
GetStartupInfoA
VirtualAllocEx
SetLastError
GetVersionExA
GlobalFindAtomA
SetHandleCount
SetErrorMode
FreeResource
lstrcpyA
lstrcatA
GetDateFormatA
GetModuleHandleW
FindClose
IsBadReadPtr
GetTickCount
VirtualAlloc
GetEnvironmentStrings
VirtualFree
lstrlenW
GetVersion
CreateEventA
GetFullPathNameA
ResetEvent
GetCurrentThreadId
GlobalAlloc
LocalFree
LocalReAlloc
lstrcpynA
SizeofResource
GetStringTypeA
FindResourceA
EnterCriticalSection
lstrlenA
GetFileAttributesA
HeapDestroy
InitializeCriticalSection
GetCurrentThread
GlobalAddAtomA
GlobalDeleteAtom
GetFileType
GetFileSize
LocalReAlloc
SetErrorMode
CreateThread
GetLocaleInfoA
GetLocalTime
MoveFileA
GetStringTypeW

shlwapi

SHDeleteValueA
SHEnumValueA
SHGetValueA
SHStrDupA
PathIsDirectoryA
SHQueryValueExA
SHDeleteValueA
SHStrDupA
SHEnumValueA
PathFileExistsA
PathGetCharTypeA
SHQueryInfoKeyA
SHSetValueA
SHStrDupA
PathIsContentTypeA
SHDeleteKeyA

comctl32

ImageList_DrawEx
ImageList_Write
ImageList_Read
ImageList_Create
ImageList_Draw
ImageList_Remove

gdi32

CreateCompatibleDC
CreateDIBitmap
GetRgnBox
CreatePalette

user32

GetMenu
GetClipboardData
GetTopWindow
GetClassNameA
GetClientRect
UpdateWindow
SystemParametersInfoA
PostMessageA
MsgWaitForMultipleObjects
GetKeyboardState
SetWindowsHookExA
EnableWindow
GetSystemMenu

ole32

CoUninitialize
MkParseDisplayName
PropVariantClear
CoCreateGuid
CoDisconnectObject
OleCreateStaticFromData
CoGetObjectContext
CoUnmarshalInterface
MkParseDisplayName
CoGetMalloc
StgCreateDocfileOnILockBytes
CreateBindCtx
CreateOleAdviseHolder
CoRevokeClassObject

oleaut32

SafeArrayCreate
GetErrorInfo
VariantCopyInd
SafeArrayUnaccessData
SysReAllocStringLen
VariantCopyInd
SafeArrayUnaccessData
RegisterTypeLib
SafeArrayGetUBound
GetErrorInfo

comdlg32

FindTextA
GetSaveFileNameA
GetFileTitleA
ChooseColorA
GetOpenFileNameA

advapi32

RegOpenKeyA
GetLengthSid
RegQueryValueA
RegEnumKeyExA
RegQueryInfoKeyA
RegCreateKeyExA

Exports

Exports

Htd
7V@20
6F
_KA
bo@8
AM@24
A9q
_Uk
Jr@20
_qQn@4
__6B
Z7@16
Hh
tut@24
DT@12
voD@16
Jf@8
_eR
_Xtt@4
JOl@16
L6d@8
be2
_E5
xg
_w9X
U2K@20
K2
_AlQ
_8q@8
_kS@20
EdP@16
_lVX@16
6v@12
_Ch
6X@24
Oy@20
_6T@20
8ai
XZ
_XZ9@24
_Y16
8Iq
_Npe@24
_P_@12
_Gn_
_bp
_zR@8
_6T@4
_x76@4
_1IY
Ak
_3ls@12
_QF7@20
lUT
_Ej@12
8c
Gz@24
3fV
_P7A@12
_IKC
_RL@24
_d7I@16
_62@20
_2SC
_Bju@12
_l0
po@4
cmn@12
_0XD
Ypg
BW@12
RrN
_pQX
lVf@8
_Zrc@20
_uyF
5O@8
_z5
wQ@4
_HJc
_rkO@24
_gP@16
tX@4
ly@20
IR@4
LZ
_oR
nIg
NP5@24
UM@24
_QUd@24
_oX
_bI
_wb
G6n
J1
Ry
_bN7@8
C9@16
_Ghj@4
_yBL@24
_65q@16
_p_y@24
we@12
_ET@8
wt
1B
KWB
cdJ@20
f9C
_h0@24
zvN
_lHJ
_V8@24
2C
vxU
X2c
aPS@12
_bEV@16
Ay@16
_Y1@24
Iu
_JB5@16
Zv
HuN
YA@12
_k5g@20
_Ait@8
_Pm@12
ofs
0rQ
hYF@20
_As
Shq
_Kz@8
_YV1@8
QO
dM
fn@8
cxq@8
_J_t@8
_dLz@20
_OU@4
rJ@20
tdP
_j7@12
NW@24
ZV0
Yh@4
tI@24
Xb
_6BD
Hg@12
_Ow@4
_E2@16
_jV
hY@16
ip
_9f
_uw@24
_KlR@16
_F
FX@12
wb0@8
_uB@16
yL@4
wf
_N2t
W6Y@20
_F1r@12
_upc@8
_tNO@20
_5ba@16
_ue
EZG@12
1O@4
_j7f@4
_1k@24
z9
I5E@8
gvf
LK@8
_Tbr@24
Xk
_vI@24
_EL3@24
_XWn
_n3
_ZOX
ey
_WZ
_GLy
DV@16
RW
YW
eaI@24
_SPE@8
_ct@4
wh@12
VMC
OC
2qV
_HZ@16
_N@4
_Td@24
_lI@16
sQ@20
91@4
_Eo@20
QKK@24
6TD
_HEf
V0@12
_c6
_gH
dIt
Lg8@12
_gZr@8
ri3
rAK
YO
xe2
sa@4
_LF5@4
_Lq@12
kr@8
Nv0@12
_X0R@20
lp@16
_aYp
_oa
qUU
_CQj
jRv@4
_zBf
wa@24
_Zb
_mwQ
BI
gD
NJ
61
_JYv@4
yH@12
_UH@20
vQX@12
_2fH@16
_bH
CK@16
K5k
eq@4
_BDa@4
82@20
42@24
Ox1
L5e@20
_Jn@20
_Zq@4
_Oi@4
_XzW@16
yjE@16
_T0@20
_Pt@8
uPQ@24
_MI@16
8q@4
o1@8
15
l6X@4
_X21
_cPd
_zG@12
_2
_50R@8
_lH@16
giZ@8
_ZQ@12
KqW
Fi@20
_Hui@24
onA
b_@20
Vv
Omz@12
dUl
trL
Lbk
_ch@16
_qS1
lv@20
_w9@12
_Cx@16
_Pzl@24
PGc@12
_ECz
_aW@20
_TBK
_73T@8
hN@24
_la@8
_Vt@12
Y8k@12
_TIh
tFd@16
bM
_2K4
zA@16
_Zhw@16
Bx@20
_Pf
D7@16
_8O
x_@4
_lpJ
_4Fz@24
_xt
7y@4
_tRF
cBF@8
_qwS
RcP
_Qr
_VN
VY@24
7O
_JR@8
ZcN@8
_eyP@20
_6FL@4
_Vd@24
db
Bg
_NR
_Cy
ISR
_ivB
_ppZ
_OP@16
_yPr@4
_NSA@20
Z3
4UQ@24
_H3@8
4r
_xH
SU@4
d9D@4
_4vw
wo@24
_yQa@4
_4X
_tP_@16
_N8@20
_hus
_L8
oGy
9F@20
_MuC
_5f
On@16
Q0
_OYi@24
9rV@16
_t
_8RV
_nT2
_U2n
m6@12
_As4
_wM
_GGB
_ZJ
edC
gD
mv@8
_3Bu@4
_02Y@16
zT@12
_me@12
_YOD
_hf_@4
bm
_ixl@24
_x06
_iF
_HrL
_9XR@8
_rAq
pK
Pr
TJ@12
QE
_ZD@24
2j@16
JP@20
ukt@20
_9__@8
Ct@24
7xw
__l_
_rNe@24
y9@16
1h@12
ks
_iW@8
vaS
_xW
_tN1@4
33
C5
Hd
__r9@4
NgH@20
__m
_vxx
_PcI@20
J8@24
_ci
_oLt
z71@16
CpM@4
_O4H@4
qoX@20
_QN@24
_rSF@20
_td
_ErL@20
_CXN
_K@20
dZ9
IPX@20
_UU
_Fy
iQ
_KA
8w@4
qtd
k_r
RUE@16
QPP@20
HA
Zw@16
_SdT@12
_io@8
1nd@4
wh
_qm
CH@20
jS
_IPe@4
q1@12
_rqd
_Db
HM
C9@8
34
_xU@12
_AY
_iPS
6sl@8
_To@4
_aE
psS@16
_lsK
9j@4
SIR@20
Mnp
_YvM
5V@4
Ja@24
_nxz@24
_jk@24
_8Lh
RyC
31
7Gn@12
tt@8
_LN@12
_Iv@12
hny
_xn
_fP
_p4
T_b@8
mq6
AbN@16
gIa@24
_pXN@24
Nu@20
5o@24
4g
j8@20
_oW5
_Dr
cD@8
_RQ
_4mr
_5h
_tqz
1dv@4

Sections

CODE
Size: 156KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sfdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ssdata
Size: 512B - Virtual size: 197B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0d23bae3e08d691e641c6ba043a6ad6d

Headers

File Characteristics

Imports

shell32

msvcrt

version

kernel32

shlwapi

comctl32

gdi32

user32

ole32

oleaut32

comdlg32

advapi32

Exports

Exports

Sections

CODE Size: 156KB - Virtual size: 156KB

DATA Size: 8KB - Virtual size: 8KB

.sfdata Size: 27KB - Virtual size: 26KB

.ssdata Size: 512B - Virtual size: 197B

.edata Size: 28KB - Virtual size: 27KB

.rsrc Size: 2KB - Virtual size: 2KB

CODE
Size: 156KB - Virtual size: 156KB

DATA
Size: 8KB - Virtual size: 8KB

.sfdata
Size: 27KB - Virtual size: 26KB

.ssdata
Size: 512B - Virtual size: 197B

.edata
Size: 28KB - Virtual size: 27KB

.rsrc
Size: 2KB - Virtual size: 2KB