0539e8ce59490dce8d38500a22652631

Sharing

Copy URL

Twitter E-mail

General

Target

0539e8ce59490dce8d38500a22652631
Size

117KB
MD5

0539e8ce59490dce8d38500a22652631
SHA1

b1f7f8279f06086c3b33125ade1554c2ec653446
SHA256

42b7e994d08e6959196eee197c6407615d07dad1f2d89455ee5202bb59985783
SHA512

7d9eb69b117f0fa8360003131cc27eddb3990e95eaf272e8ddde95ceffce3921811427bb97162b3b7eed28fecd75f99cda4b4165b29d0ee42447b0b0100f7f59
SSDEEP

3072:CuXpfG4iup2HuYXzA9ISjhTMR/lC3Na+jOZkXfuoorx:VG1C2HPDA9jslC3NvjuD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0539e8ce59490dce8d38500a22652631

Files

0539e8ce59490dce8d38500a22652631
.exe windows:4 windows x86 arch:x86

004674c79274589fa3b2ff2ce1d5dafe

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryW
CreateFileA
GetWindowsDirectoryA
lstrlenA
lstrcpyA
VirtualAlloc

gdi32

EngCreateBitmap
ExtFloodFill
FrameRgn
EngGetDriverName
SetVirtualResolution
BRUSHOBJ_pvGetRbrush
EngStrokePath
SetDIBitsToDevice
GdiAlphaBlend
LineTo
FillPath
GetGlyphOutlineA
CreatePatternBrush
GetDIBColorTable
GdiIsMetaPrintDC
CopyMetaFileW
GdiDeleteLocalDC
EngAssociateSurface
GdiDllInitialize
ColorCorrectPalette
FONTOBJ_pQueryGlyphAttrs
SetViewportExtEx
GetKerningPairsA
EnumFontFamiliesExW
GetViewportOrgEx
EnumFontFamiliesW
SetWindowExtEx
FONTOBJ_vGetInfo
EngCreateClip
GetCharWidthFloatW
GdiCreateLocalEnhMetaFile
HT_Get8BPPMaskPalette
FONTOBJ_cGetAllGlyphHandles
GdiEntry10
GdiValidateHandle
SetROP2
GdiReleaseDC
GetBitmapDimensionEx
GdiAddGlsRecord
GetWorldTransform
UnloadNetworkFonts
BRUSHOBJ_hGetColorTransform
EngReleaseSemaphore
EngMarkBandingSurface
GetCharABCWidthsW
SetTextAlign
GdiEntry5
Pie
CreateBitmapIndirect
EnumFontsW
ResetDCW
GetRandomRgn
GdiDeleteSpoolFileHandle
CreatePalette
AngleArc
GdiEndPageEMF
GetTextExtentExPointI
GetRasterizerCaps
GetTextMetricsW
ExtTextOutW
SelectClipPath
TextOutW
GetLayout
GetMetaRgn
GetMetaFileW
ResetDCA
PlayEnhMetaFile
GdiInitializeLanguagePack
XFORMOBJ_bApplyXform
SetBkColor
GetObjectA
Rectangle
EndPath
GetCurrentObject
GdiPlayDCScript
SetBitmapDimensionEx
SelectClipRgn
SetBrushOrgEx
GdiDescribePixelFormat
CreateICA
MirrorRgn
SetRelAbs
TextOutA
GdiArtificialDecrementDriver
EngTextOut
GetEnhMetaFileHeader
GetDeviceCaps
GetGraphicsMode
CombineTransform
GetStockObject
CreateCompatibleDC
CreateFontIndirectW
PolyPolyline
CreateColorSpaceW
GetWindowOrgEx
GdiFlush
GdiEntry3
PolyPolygon
GdiSetAttrs
SetWinMetaFileBits
EndPage
SetTextJustification
FloodFill
GdiStartDocEMF
GdiGetDC
GetTextExtentExPointWPri
EngTransparentBlt
DPtoLP
PlayEnhMetaFileRecord
PATHOBJ_vEnumStart
GetEUDCTimeStampExW
GetICMProfileA
FONTOBJ_pfdg
GetColorSpace
RectInRegion
GetRgnBox
CreateRectRgn
CreateFontIndirectExW
CreateBrushIndirect
GetPath
CreateHalftonePalette
GetTextFaceA
FONTOBJ_pifi
SetGraphicsMode
GdiGetPageCount
GetCharWidthI
STROBJ_vEnumStart
EnumICMProfilesA
GetBkColor
BitBlt
GetNearestPaletteIndex
EngStretchBltROP
GetOutlineTextMetricsA
SelectFontLocal
EnumFontFamiliesA
Polyline
PolyBezier
Ellipse
Escape
SetMiterLimit
GdiSetBatchLimit
CopyMetaFileA
SetWindowOrgEx
EngFillPath
GetNearestColor
EudcLoadLinkW
EngCreateSemaphore
OffsetClipRgn
GetClipBox
GetDCPenColor
SetBoundsRect
PATHOBJ_bEnum
DeleteDC
GetTextCharset
GetEnhMetaFileDescriptionA
SetPixel
bInitSystemAndFontsDirectoriesW
ChoosePixelFormat
SetICMMode
MaskBlt
GdiGetSpoolFileHandle
CLIPOBJ_ppoGetPath
GdiInitSpool
CreateCompatibleBitmap
GetSystemPaletteEntries
RemoveFontResourceExW
PtVisible
GetEnhMetaFilePixelFormat
GetICMProfileW
GetTextExtentExPointA

msvcr90

ungetwc
sin
_ftol
_toupper
_exit
_lsearch
_wexecvpe
_heapset
_isnan
_spawnle
_eof
_isctype
__RTCastToVoid
__iscsym
wprintf
_fileno
_utime64
iswpunct
_wmktemp
_mbbtype
_ui64toa
_fstat64
wcspbrk
_unloaddll
__pxcptinfoptrs
ldexp
_finite
_ui64tow
_adj_fdivr_m16i
_swab
_adj_fdiv_r
__set_app_type
setvbuf
_CIcosh
strcoll
__STRINGTOLD
_Getdays
fopen
_purecall
_setsystime
realloc
free
_wfopen
_mbsset
mbtowc
_spawnlpe
_putws
__wgetmainargs
clock
wcsrchr
_wpgmptr
_wfreopen
_execvpe
_heapwalk
_msize
__getmainargs
_mkdir
__p__mbcasemap
_callnewh
__dllonexit
wcslen
_dup
fgets
_putch
isprint
atexit
_getw
_get_sbh_threshold
__winitenv
_safe_fdiv
_beep
_setmbcp
_strnicmp
_clearfp
_cgets
wcstol
wcstombs
strstr
_cprintf
_CIfmod
floor
_CIsin
_wexecve
_putw
cos
is_wctype
strtol
wcsspn
_creat
_ecvt
_wunlink
_wexecle
wcsftime
_wsearchenv
strcmp
strcat
_popen
_Gettnames
wcstod
_wrename
_wfindfirst64
wcscpy
_strlwr
_chdrive
_strtime
__lc_collate_cp
_mbscoll
atol
_wcsrev
_pwctype
_jn
_strnset
_ismbchira
_wasctime
_pgmptr
sscanf
_getdcwd
fputc
_ismbckata
_ismbcpunct
__fpecode
clearerr
setlocale
_mbclen
_set_sbh_threshold
_ismbcl1
_getws
_wgetcwd
atan2
strchr
_mbsupr
_sleep
_ismbbpunct
_rmdir
__p__amblksiz
_wmkdir
_mbschr
__crtCompareStringA
exit
strcspn
_wspawnvp
strlen
signal
fgetpos
_unlock
_setjmp
_setmode
_adj_fdiv_m64
putwc
_wspawnvpe
_flsbuf
rand
_CIsqrt
iswdigit
fgetc
_getmbcp
calloc
_wstat64
fflush
_lock
_chmod
_ismbbtrail
_environ
fgetwc
setbuf
tmpnam
_timezone
strcpy
_gmtime32
_time32
_findnext32
_stat32
_difftime32
_wfindfirst32i64

advapi32

RegOpenKeyExW

oleaut32

VarR8FromUI1
VarParseNumFromStr
SafeArraySetIID
VarUI1FromCy
VarUI1FromBool
VarDecFromR4
BSTR_UserUnmarshal
VarR4FromDate
SafeArrayGetElement
VarR4FromUI4
VarUI4FromDisp
VarBoolFromCy
VarDecFromCy
VarCyMul
VarUI2FromUI4
LPSAFEARRAY_Marshal
VarCyFromDisp
VarUI4FromDec
VarDecMul
VarWeekdayName
VarI4FromDate
VarUI1FromR4
VarBstrFromI4
LoadTypeLibEx
VarI4FromR4
VarR4FromCy
VarDecNeg
VarUI2FromI4
VariantTimeToDosDateTime
VarI4FromR8
SafeArrayLock
VarI2FromDec
SafeArrayDestroyDescriptor
VarAnd
VarI2FromR4
VarDecCmpR8
VarFormatNumber
VarCyRound
VarI1FromI4
VarBstrFromUI1
VarDecInt
VarBstrFromR8
VarI4FromBool
VarI1FromR8
OleLoadPictureFile
VarMul
VarOr
VarPow
VarI4FromStr
RevokeActiveObject
VarI4FromUI2
VarBoolFromUI1
SafeArrayAllocData
VarDateFromUdate
VarDateFromDisp
VarCyMulI4
SafeArrayGetElemsize
VarUdateFromDate
VarCyFromUI1
VarI1FromCy
VarRound
VariantCopy
CreateTypeLib2
VarBoolFromUI2
SysAllocString
VarDateFromI4
VarIdiv
OleCreatePropertyFrame
SysAllocStringLen
VARIANT_UserFree
QueryPathOfRegTypeLi
VarDateFromI1
VariantClear
VarI1FromR4
VarI4FromCy
VarUI4FromStr
SafeArrayGetRecordInfo
VariantChangeTypeEx
VarFormatDateTime
LPSAFEARRAY_UserSize
VarUI2FromBool
VarAdd
GetActiveObject
SafeArrayDestroyData
RegisterActiveObject
VarR4FromDisp
OACreateTypeLib2
VarUI1FromDisp
VarI4FromDec
SysFreeString
VarR8FromUI2
SafeArrayCreate
VarR4FromBool
VarBstrFromUI4
VarDecRound
VarDiv
VarI4FromI1
VarR4FromR8
OleLoadPicture
VariantChangeType
SysStringByteLen
VarUI4FromI2
VarDateFromUI1
VarUI4FromCy
VarBstrCmp
VarFormatPercent
VarUI1FromI2
CreateDispTypeInfo
VarR8FromI1
LoadRegTypeLi
VarI1FromUI1
VarBstrFromI1
SetErrorInfo
VarI4FromI2
VarI1FromStr
VarDateFromUI4
VarDecFromUI1
VarCyFromStr
VarBoolFromR8
OleLoadPicturePath
VarI1FromDate
VarUI1FromUI2
VarDateFromUI2
VarI2FromUI1
BSTR_UserFree
OleSavePictureFile
VARIANT_UserMarshal
VarUI4FromR4
VarDecFromUI2
VarImp
VarCmp
VarBoolFromDec
LPSAFEARRAY_UserUnmarshal
VarI2FromUI4
VarDateFromI2
VectorFromBstr
SystemTimeToVariantTime
OleCreatePropertyFrameIndirect
VarUI2FromDec
VarSu
VarBoolFromR4
VarR4FromStr
VarUI2FromUI1
LoadTypeLi
VarDecFromI2
SafeArrayAccessData
SafeArrayCopy
VARIANT_UserUnmarshal
VarCyFromDec
VarDateFromCy
VarCyFromR8
SysReAllocStringLen

imm32

ImmGetStatusWindowPos
ImmGetCandidateListCountA
ImmGetDescriptionW
ImmCreateIMCC
ImmRequestMessageA
ImmGetCandidateListA
ImmDestroySoftKeyboard
ImmGetContext
ImmGetHotKey
ImmInstallIMEW
ImmGetRegisterWordStyleA
ImmGetConversionStatus
ImmEnumRegisterWordA
ImmUnlockIMC
ImmIsUIMessageA
ImmAssociateContext
ImmGetRegisterWordStyleW
ImmGetIMCLockCount
ImmSetCompositionWindow
ImmSetStatusWindowPos
ImmSetConversionStatus
ImmSetCandidateWindow
ImmGetConversionListW
ImmGetDefaultIMEWnd
ImmGetConversionListA
ImmSimulateHotKey
ImmGetProperty
ImmUnlockIMCC
ImmDisableIME
ImmIsIME
ImmGetImeMenuItemsW
ImmShowSoftKeyboard
ImmLockIMCC
ImmEnumRegisterWordW
ImmConfigureIMEA
ImmGetCompositionWindow
ImmConfigureIMEW
ImmSetOpenStatus
ImmGetIMCCLockCount
ImmRequestMessageW
ImmAssociateContextEx
ImmSetHotKey
ImmGetCandidateWindow
ImmSetCompositionStringA
ImmDestroyContext
ImmUnregisterWordA
ImmReleaseContext
ImmGetGuideLineA
ImmGetDescriptionA
ImmCreateContext
ImmCreateSoftKeyboard
ImmEscapeA
ImmNotifyIME
ImmGetIMCCSize
ImmRegisterWordA
ImmSetCompositionFontA
ImmGetCompositionStringW
ImmEnumInputContext
ImmGetCompositionStringA
ImmGetVirtualKey
ImmGetCompositionFontA
ImmEscapeW
ImmGetCandidateListW
ImmGetImeMenuItemsA
ImmGetOpenStatus
ImmGetGuideLineW
ImmInstallIMEA
ImmGetIMEFileNameW
ImmGetCandidateListCountW
ImmIsUIMessageW
ImmSetCompositionFontW
ImmRegisterWordW
ImmDestroyIMCC

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

n2
Size: 257KB - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

004674c79274589fa3b2ff2ce1d5dafe

Headers

File Characteristics

Imports

kernel32

gdi32

msvcr90

advapi32

oleaut32

imm32

Sections

.text Size: 5KB - Virtual size: 5KB

.data Size: 12KB - Virtual size: 12KB

n2 Size: 257KB - Virtual size: 256KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 5KB - Virtual size: 5KB

.data
Size: 12KB - Virtual size: 12KB

n2
Size: 257KB - Virtual size: 256KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB