ffa3149fb2cd31f1e3f3d3b8462616f6

Sharing

Copy URL Twitter E-mail

General

Target

ffa3149fb2cd31f1e3f3d3b8462616f6
Size

2.5MB
MD5

ffa3149fb2cd31f1e3f3d3b8462616f6
SHA1

be52e617415d05231b40c922b6535243588eae3e
SHA256

86e820070d2ab679a0512057eda6daad9ef26bcd381278961be4532863eab9c5
SHA512

3a45cdf6d2a02f527f1520616a6febc3012d0c625de7778d2238210a90ad0d510c1ac83406db7020c6ccfd21fea6711808dd1f41fef6ae7062ba0dc480720654
SSDEEP

49152:NunAtoWzSLRplDf85LC5gFiOsxx6hpprbkV146/EjK3:Nuhz85LC5gFi9aZrbkuK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffa3149fb2cd31f1e3f3d3b8462616f6

Files

ffa3149fb2cd31f1e3f3d3b8462616f6
.exe windows:6 windows x86 arch:x86

850535f8e7feb59a73a049c4cbe21eb0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

connect
closesocket
ntohs
socket
send
getservbyport
gethostbyaddr
ioctlsocket
WSAGetLastError
WSAAsyncSelect
WSASetLastError
WSACleanup
gethostbyname
gethostname
shutdown
inet_addr
getservbyname
recv
htonl
htons
inet_ntoa
WSAStartup

winmm

joyGetPosEx
joyGetDevCapsW
waveOutSetVolume
waveOutGetVolume
mixerSetControlDetails
mixerGetControlDetailsW
mixerGetLineControlsW
mixerClose
mixerGetLineInfoW
mixerGetDevCapsW
mixerOpen
mciSendStringW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

comctl32

ImageList_Destroy
ImageList_Create
InitCommonControlsEx
ImageList_AddMasked
ImageList_ReplaceIcon
ImageList_GetIconSize
CreateStatusWindowW

shlwapi

HashData

crypt32

CryptBinaryToStringA
CryptStringToBinaryW
CryptStringToBinaryA

psapi

GetModuleFileNameExW
GetModuleBaseNameW

kernel32

SetErrorMode
GetCurrentDirectoryW
LoadLibraryW
AddVectoredExceptionHandler
GlobalLock
GlobalUnlock
GetEnvironmentVariableW
GetCurrentThreadId
OutputDebugStringW
GetSystemDirectoryA
LoadLibraryA
FreeLibrary
WideCharToMultiByte
SuspendThread
ResumeThread
EnterCriticalSection
LeaveCriticalSection
OpenThread
lstrcmpiW
GetStringTypeExW
CreateThread
SetThreadPriority
GetExitCodeThread
CloseHandle
CreateMutexW
GetLastError
GetModuleHandleW
MultiByteToWideChar
SystemTimeToFileTime
SetFilePointerEx
ReadFile
SetFilePointer
GlobalSize
lstrcpyA
lstrlenA
lstrcmpiA
lstrcmpA
LocalFileTimeToFileTime
CreateDirectoryA
CreateDirectoryW
IsBadReadPtr
CreateFileW
CreateFileA
WriteFile
VirtualProtect
DuplicateHandle
LoadResource
LockResource
SizeofResource
GetCurrentDirectoryA
FileTimeToSystemTime
GetLocalTime
GetFileInformationByHandle
GetFileSize
lstrlenW
FindFirstFileW
FindNextFileW
FindClose
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
SetLastError
VirtualAlloc
VirtualFree
GetTempPathA
GetNativeSystemInfo
HeapAlloc
GetProcessHeap
HeapFree
HeapDestroy
GetCommandLineW
WaitForSingleObject
GetThreadLocale
VirtualQuery
HeapCreate
FlushInstructionCache
GetVersionExW
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
GetFileAttributesW
OpenProcess
GetCurrentProcessId
GetFullPathNameW
LocalFree
FileTimeToLocalFileTime
SetEnvironmentVariableW
Beep
MoveFileW
CreateProcessW
GetExitCodeProcess
WriteProcessMemory
ReadProcessMemory
TerminateProcess
SetPriorityClass
GetDateFormatW
GetTimeFormatW
GetDiskFreeSpaceW
SetVolumeLabelW
DeviceIoControl
GetDriveTypeW
GetVolumeInformationW
DeleteFileW
CopyFileW
SetFileAttributesW
GetFileSizeEx
GetSystemTime
GetSystemDefaultUILanguage
GetComputerNameW
GetWindowsDirectoryW
GetTempPathW
GetShortPathNameW
TryEnterCriticalSection
QueryDosDeviceW
CompareStringW
RemoveDirectoryW
FormatMessageW
GetPrivateProfileStringW
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
WritePrivateProfileSectionW
SetEndOfFile
GetACP
GetFileType
GetStdHandle
VirtualAllocEx
VirtualFreeEx
EnumResourceNamesW
LoadLibraryExW
ExitProcess
GetSystemTimeAsFileTime
InitializeCriticalSection
GetProcessTimes
GetCurrentProcess
CheckRemoteDebuggerPresent
GetCurrentThread
GetProcAddress
GlobalFree
_lclose
_lopen
_lread
GetModuleFileNameA
GlobalAlloc
GetModuleHandleA
FindResourceW
GetCPInfo
SetCurrentDirectoryW
Sleep
GetTickCount
MulDiv
InitializeSListHead
QueryPerformanceCounter
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
SetFileTime
InitializeCriticalSectionAndSpinCount

user32

RegisterClassExW
CreateWindowExW
LoadAcceleratorsW
SetClipboardViewer
ChangeClipboardChain
LoadImageW
CharLowerA
CheckMenuItem
GetMenu
IsWindowVisible
SetWindowTextW
GetIconInfo
SetRect
DrawTextW
AdjustWindowRectEx
SystemParametersInfoW
GetClientRect
GetWindowRect
GetQueueStatus
MoveWindow
EnumChildWindows
SetActiveWindow
SetFocus
SetWindowRgn
SetWindowPos
SetLayeredWindowAttributes
InvalidateRect
EnableWindow
DestroyIcon
EnumWindows
IsZoomed
IsIconic
RegisterWindowMessageW
GetSysColor
GetSysColorBrush
DrawIconEx
FillRect
DefWindowProcW
SetForegroundWindow
DialogBoxParamW
SendDlgItemMessageW
GetDlgItem
SetDlgItemTextW
MessageBeep
ClientToScreen
GetCursor
GetLastInputInfo
GetSystemMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuStringW
ExitWindowsEx
SetScrollInfo
ScrollWindow
SetMenu
FlashWindow
GetPropW
SetPropW
RemovePropW
MapWindowPoints
RedrawWindow
SetParent
GetClassInfoExW
GetAncestor
UpdateWindow
GetMessagePos
GetClassLongW
DefDlgProcW
CallWindowProcW
CheckRadioButton
IntersectRect
GetUpdateRect
PtInRect
CreateDialogIndirectParamW
CreateAcceleratorTableW
InsertMenuItemW
SetMenuDefaultItem
RemoveMenu
SetMenuItemInfoW
IsMenu
GetMenuItemInfoW
DestroyAcceleratorTable
CreatePopupMenu
SetMenuInfo
AppendMenuW
DestroyMenu
TrackPopupMenuEx
GetDesktopWindow
CopyImage
CreateIconIndirect
CreateIconFromResourceEx
EnumClipboardFormats
GetWindow
BringWindowToTop
GetTopWindow
DestroyWindow
IsCharAlphaW
MapVirtualKeyW
VkKeyScanExW
MapVirtualKeyExW
GetKeyboardLayoutNameW
ActivateKeyboardLayout
GetGUIThreadInfo
GetWindowTextW
mouse_event
GetSystemMetrics
keybd_event
SetKeyboardState
GetKeyboardState
GetCursorPos
GetAsyncKeyState
AttachThreadInput
SendInput
UnregisterHotKey
RegisterHotKey
PostQuitMessage
SendMessageTimeoutW
UnhookWindowsHookEx
SetWindowsHookExW
PostThreadMessageW
IsCharAlphaNumericW
IsCharUpperW
IsCharLowerW
ToUnicodeEx
GetKeyboardLayout
CallNextHookEx
CharLowerW
ReleaseDC
GetDC
MessageBoxW
OpenClipboard
GetClipboardData
GetClipboardFormatNameW
CloseClipboard
SetClipboardData
EmptyClipboard
PostMessageW
FindWindowW
EndDialog
IsWindow
DispatchMessageW
TranslateMessage
ShowWindow
CountClipboardFormats
SetWindowLongW
ScreenToClient
IsDialogMessageW
WindowFromPoint
SendMessageW
GetWindowLongW
GetKeyState
TranslateAcceleratorW
KillTimer
PeekMessageW
GetFocus
GetClassNameW
GetWindowThreadProcessId
GetForegroundWindow
GetMessageW
SetTimer
GetScrollInfo
GetParent
GetDlgCtrlID
CharUpperW
IsClipboardFormatAvailable
LoadCursorW
CreateMenu
UnregisterClassW
IsWindowEnabled
GetWindowTextLengthW

gdi32

SetTextColor
SetBkColor
GetPixel
ExcludeClipRect
CreateCompatibleBitmap
SetBkMode
CreatePatternBrush
GetClipRgn
GetClipBox
BitBlt
GetCharABCWidthsW
SetBrushOrgEx
EnumFontFamiliesExW
CreateDIBSection
GetSystemPaletteEntries
GetDIBits
CreateCompatibleDC
CreatePolygonRgn
CreateRectRgn
CreateRoundRectRgn
CreateEllipticRgn
DeleteDC
GetObjectW
GetTextMetricsW
GetTextFaceW
SelectObject
GetStockObject
CreateDCW
CreateSolidBrush
CreateFontW
DeleteObject
FillRgn
GdiFlush
GetDeviceCaps

comdlg32

GetOpenFileNameW
GetSaveFileNameW
CommDlgExtendedError

advapi32

RegCreateKeyExW
RegConnectRegistryW
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
CloseServiceHandle
UnlockServiceDatabase
CryptReleaseContext
CryptDestroyKey
CryptDestroyHash
CryptDeriveKey
CryptHashData
CryptCreateHash
CryptAcquireContextW
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
LockServiceDatabase
RegQueryValueExW
OpenSCManagerW
AdjustTokenPrivileges
LookupPrivilegeValueW
GetUserNameW
OpenProcessToken

shell32

SHGetPathFromIDListW
ShellExecuteExW
DragQueryPoint
SHGetFolderPathW
ExtractIconW
SHFileOperationW
SHEmptyRecycleBinW
Shell_NotifyIconW
DragFinish
DragQueryFileW
CommandLineToArgvW
SHGetMalloc
SHGetDesktopFolder
SHBrowseForFolderW

ole32

StringFromGUID2
CoGetObject
CreateStreamOnHGlobal
CoUninitialize
CoCreateInstance
CoInitialize
OleInitialize
CLSIDFromString

oleaut32

SafeArrayGetElemsize
SafeArrayUnaccessData
OleLoadPicture
SafeArrayAccessData
SafeArrayUnlock
SafeArrayPtrOfIndex
SafeArrayLock
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
VariantCopyInd
SafeArrayCopy
SysAllocString
VariantChangeType
SafeArrayDestroy
GetActiveObject
SysStringLen
SysFreeString
SafeArrayCreate
VariantClear

vcruntime140

__std_exception_copy
memmove
__std_terminate
wcsrchr
memset
memcpy
_except_handler3
__RTDynamicCast
_CxxThrowException
__std_exception_destroy
__CxxFrameHandler3
_except_handler4_common
wcsstr
strchr
strstr
wcschr
_purecall

api-ms-win-crt-convert-l1-1-0

wcstod
_i64tow
_wcstoi64
_wtoi64
wcstoul
_wtof
_ultoa
_itow
_wcstoui64
_itoa
_wtoi
strtoul
_ultow
atof
wcstol
atoi
wcstombs
_atoi64
strtol

api-ms-win-crt-string-l1-1-0

strcat_s
towupper
wcsncpy
iswxdigit
tolower
_wcsupr
_stricmp
wcsncmp
iswdigit
strncpy_s
_wcsicmp
_wcsdup
strncmp
_wcsnicmp
isxdigit
_isctype
iswspace
isdigit
wcscspn
strcpy_s
_strnicmp
toupper

api-ms-win-crt-heap-l1-1-0

_set_new_mode
realloc
calloc
_callnewh
_expand
free
malloc
_msize

api-ms-win-crt-runtime-l1-1-0

_initialize_wide_environment
exit
_controlfp_s
terminate
__p___argc
_register_thread_local_exe_atexit_callback
_c_exit
_exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_configure_wide_argv
_beginthreadex
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
__p___wargv

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
setvbuf
__stdio_common_vswprintf
__stdio_common_vsprintf
fwrite
__p__commode
fclose
fread
ftell
fseek
_wfopen
__stdio_common_vsprintf_s
__stdio_common_vfwprintf
_set_fmode
fputws

api-ms-win-crt-utility-l1-1-0

qsort
rand

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath

api-ms-win-crt-math-l1-1-0

__setusermatherr
_except1

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

ADDFILE
ADDSCRIPT
AHKASSIGN
AHKEXEC
AHKEXECUTELINE
AHKFINDFUNC
AHKFINDLABEL
AHKFUNCTION
AHKGETVAR
AHKISUNICODE
AHKLABEL
AHKPAUSE
AHKPOSTFUNCTION
AddFile
AddScript
Addfile
Addscript
AhkAssign
AhkExec
AhkExecuteLine
AhkExecuteline
AhkFindFunc
AhkFindLabel
AhkFindfunc
AhkFindlabel
AhkFunction
AhkGetVar
AhkGetvar
AhkIsUnicode
AhkIsunicode
AhkLabel
AhkPause
AhkPostFunction
AhkPostfunction
Ahkassign
Ahkexec
AhkexecuteLine
Ahkexecuteline
AhkfindFunc
AhkfindLabel
Ahkfindfunc
Ahkfindlabel
Ahkfunction
AhkgetVar
Ahkgetvar
AhkisUnicode
Ahkisunicode
Ahklabel
Ahkpause
AhkpostFunction
Ahkpostfunction
addFile
addScript
addfile
addscript
ahkAssign
ahkExec
ahkExecuteLine
ahkExecuteline
ahkFindFunc
ahkFindLabel
ahkFindfunc
ahkFindlabel
ahkFunction
ahkGetVar
ahkGetvar
ahkIsUnicode
ahkIsunicode
ahkLabel
ahkPause
ahkPostFunction
ahkPostfunction
ahkassign
ahkexec
ahkexecuteLine
ahkexecuteline
ahkfindFunc
ahkfindLabel
ahkfindfunc
ahkfindlabel
ahkfunction
ahkgetVar
ahkgetvar
ahkisUnicode
ahkisunicode
ahklabel
ahkpause
ahkpostFunction
ahkpostfunction

Sections

.text
Size: 732KB - Virtual size: 731KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 165KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

850535f8e7feb59a73a049c4cbe21eb0

Headers

File Characteristics

Imports

wsock32

winmm

version

comctl32

shlwapi

crypt32

psapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

vcruntime140

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 732KB - Virtual size: 731KB

.rdata Size: 165KB - Virtual size: 164KB

.data Size: 9KB - Virtual size: 28KB

.rsrc Size: 1.6MB - Virtual size: 1.6MB

.text
Size: 732KB - Virtual size: 731KB

.rdata
Size: 165KB - Virtual size: 164KB

.data
Size: 9KB - Virtual size: 28KB

.rsrc
Size: 1.6MB - Virtual size: 1.6MB