59abd994f0835b7b4bd69c13dd7f2ec8

Sharing

Copy URL Twitter E-mail

General

Target

59abd994f0835b7b4bd69c13dd7f2ec8
Size

1.5MB
MD5

59abd994f0835b7b4bd69c13dd7f2ec8
SHA1

b94a31cf7509a7560c45f218752492a0d5495e71
SHA256

23a04a915df9fbcc46af7836c0686274226350a0ad7576f2d39a389ac7567baa
SHA512

a49ac7bb6948421bc01d3f9bec043eec7cbae78a48df068da92d6d302055a4da5e5b27f7558f34b4d9fd3f3a742ef3361274ae1bb5af375301eebbcb64cf9f10
SSDEEP

24576:BFZ5R1pc2Aw7GuW9aTWn6H7k8NWKx8nibffn3/JgrMpghMvLsUMiul1UnFodyEQ:BFXkwiWTWyqKMiDBo6AMvAhiul1CF4dQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
59abd994f0835b7b4bd69c13dd7f2ec8

Files

59abd994f0835b7b4bd69c13dd7f2ec8
.exe windows:5 windows x86 arch:x86

518d86d85a07a95afdcffbdd5217810d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFullPathNameW
GetCurrentDirectoryW
SearchPathW
GetTempFileNameW
FindClose
FindFirstFileW
FindNextFileW
FindCloseChangeNotification
FindFirstChangeNotificationW
GetLogicalDriveStringsW
GetFileSize
SetFilePointer
GetFileInformationByHandle
ReadFile
SetEndOfFile
GetStdHandle
CompareFileTime
FileTimeToSystemTime
WideCharToMultiByte
SizeofResource
MultiByteToWideChar
lstrcmpiW
GetLastError
CreateMutexW
SetLastError
GetDiskFreeSpaceExW
GetExitCodeThread
Sleep
RaiseException
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
FlushInstructionCache
GetTickCount
lstrcpynW
DeleteFileW
MoveFileExW
GetShortPathNameW
CreateDirectoryW
RemoveDirectoryW
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
GetTimeZoneInformation
SetFileTime
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
IsValidLocale
EnumSystemLocalesA
lstrlenA
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
InterlockedExchange
SetConsoleCtrlHandler
LCMapStringW
LCMapStringA
GetCurrentProcessId
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoA
GetFileType
SetHandleCount
HeapDestroy
HeapCreate
FatalAppExitA
HeapReAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
HeapSize
GetCurrentThread
TlsGetValue
RtlUnwind
GetStartupInfoW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ExitThread
TlsFree
TlsAlloc
SetWaitableTimer
CreateWaitableTimerW
GetSystemDirectoryW
GetWindowsDirectoryW
MoveFileW
ResetEvent
SetEvent
FreeResource
GlobalAlloc
ResumeThread
GlobalFree
MulDiv
GlobalUnlock
GlobalLock
CreateEventW
WriteFile
CreateFileW
LockResource
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameW
LoadLibraryExW
FindResourceW
WriteConsoleW
LoadResource
OutputDebugStringW
DebugBreak
SetFileAttributesW
GetFileAttributesW
InterlockedDecrement
lstrlenW
GetTempPathW
GetVersionExW
GetCurrentProcess
CancelWaitableTimer
TlsSetValue
IsBadWritePtr
IsBadReadPtr
lstrcmpiA
lstrcmpA
DeviceIoControl
CreateThread
ExpandEnvironmentStringsW
SystemTimeToFileTime
GetSystemTime
LocalFree
LocalAlloc
GetSystemInfo
GetProcessTimes
GetSystemTimeAsFileTime
DuplicateHandle
SetErrorMode
FileTimeToLocalFileTime
GetFileTime
VirtualQuery
ExitProcess
SetProcessWorkingSetSize
WaitForMultipleObjects
GetModuleHandleA
TerminateProcess
OpenProcess
CopyFileW
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
GetModuleHandleW
GetExitCodeProcess
WaitForSingleObject
CloseHandle
CreateProcessW
FreeLibrary
LoadLibraryW
GetUserDefaultLCID
GetProcAddress
HeapFree
InterlockedCompareExchange

user32

SetWindowRgn
wvsprintfW
CharNextW
BeginPaint
SendMessageW
GetWindowLongW
GetClientRect
GetWindowTextW
EndPaint
SetWindowPos
SetWindowLongW
InvalidateRect
KillTimer
GetWindowRect
SetTimer
LoadCursorW
ShowWindow
GetDlgItem
SetWindowTextW
EnableWindow
MapWindowPoints
GetDesktopWindow
GetMessageW
GetKeyNameTextW
MapVirtualKeyW
PostMessageW
SubtractRect
FindWindowExW
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
CharToOemW
CopyRect
GetUpdateRect
SetRect
ReleaseDC
GetWindowDC
GetWindow
MonitorFromWindow
GetMonitorInfoW
LoadImageW
GetWindowTextLengthW
ReleaseCapture
GetDlgCtrlID
SystemParametersInfoW
SetCapture
MonitorFromPoint
CallWindowProcW
SetCursor
GetDC
PtInRect
ClientToScreen
GetCapture
UpdateWindow
DrawFocusRect
GetSystemMetrics
InflateRect
DrawEdge
GetSysColor
IsWindowEnabled
OffsetRect
FillRect
DrawTextW
MessageBoxW
PeekMessageW
TranslateMessage
DispatchMessageW
DefWindowProcW
BringWindowToTop
SetForegroundWindow
FindWindowW
CreateDialogParamW
GetParent
AdjustWindowRectEx
GetMenu
DestroyWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
IsWindow
RedrawWindow
IsIconic
LoadStringW
PostQuitMessage
PostThreadMessageW
SetDlgItemTextW
UnregisterClassA
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
EmptyClipboard
SetClipboardData

gdi32

CreatePatternBrush
CreateDIBPatternBrushPt
CreateFontW
CreateSolidBrush
GetCurrentObject
CreateDIBSection
SetTextColor
CreatePolygonRgn
CreateFontIndirectW
OffsetViewportOrgEx
GetStockObject
SetViewportOrgEx
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
DeleteDC
SelectObject
SetBkMode
GetDeviceCaps
GetBitmapBits
GetObjectW

advapi32

RegQueryValueExW
GetTokenInformation
OpenProcessToken
RegEnumKeyW
RegSetKeySecurity
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
CopySid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
RegGetKeySecurity
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAce

shell32

SHGetSpecialFolderPathW
SHChangeNotify
SHGetSpecialFolderLocation
SHGetFileInfoW
SHBrowseForFolderW
SHGetPathFromIDListW
ord165
SHFileOperationW
SHFreeNameMappings
SHAppBarMessage

ole32

OleUninitialize
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
OleInitialize
CoCreateGuid
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree

oleaut32

VariantCopy
VariantClear
SysAllocStringByteLen
OleLoadPicture
SysFreeString
VariantInit
VarUI4FromStr
SysAllocString

shlwapi

StrStrIW
PathIsPrefixW
PathRemoveFileSpecW
SHSetValueW
SHDeleteKeyW
SHDeleteValueW
SHGetValueW
SHGetValueA
PathGetDriveNumberW
StrToIntExW
PathIsURLW
PathIsRootW
PathFindExtensionW
PathMatchSpecW
PathIsDirectoryW
PathCombineW
PathFileExistsW
PathAppendW

comctl32

InitCommonControlsEx
ImageList_Draw
ImageList_Destroy
_TrackMouseEvent
ImageList_Create
ImageList_Add
ImageList_SetImageCount
ImageList_GetIconSize
ImageList_Duplicate
ImageList_Remove

msimg32

AlphaBlend

setupapi

SetupIterateCabinetW

wininet

InternetSetOptionA
HttpOpenRequestW
HttpSendRequestExW
InternetConnectW
InternetSetStatusCallbackW
InternetOpenW
InternetOpenUrlW
InternetCloseHandle
CommitUrlCacheEntryW
GetUrlCacheEntryInfoW
InternetReadFile
InternetCrackUrlW
HttpQueryInfoW
FtpGetFileSize
InternetQueryOptionW
InternetSetOptionW
InternetGetLastResponseInfoW
FtpCommandW
InternetWriteFile
HttpEndRequestW
InternetReadFileExA
FtpOpenFileW
CreateUrlCacheEntryW

wintrust

WinVerifyTrust
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminAcquireContext

urlmon

ObtainUserAgentString

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

netapi32

Netbios

psapi

EnumProcessModules
GetModuleFileNameExW
GetModuleBaseNameW
GetProcessMemoryInfo
EnumProcesses

comdlg32

GetOpenFileNameW
GetSaveFileNameW

Sections

.text
Size: 368KB - Virtual size: 368KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

518d86d85a07a95afdcffbdd5217810d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

setupapi

wininet

wintrust

urlmon

version

netapi32

psapi

comdlg32

Sections

.text Size: 368KB - Virtual size: 368KB

.rdata Size: 68KB - Virtual size: 67KB

.data Size: 10KB - Virtual size: 36KB

.rsrc Size: 2.8MB - Virtual size: 2.8MB

.text
Size: 368KB - Virtual size: 368KB

.rdata
Size: 68KB - Virtual size: 67KB

.data
Size: 10KB - Virtual size: 36KB

.rsrc
Size: 2.8MB - Virtual size: 2.8MB