9de59a5828c2500f5e174f4cd7537c2876806716836fe337843fb972fc4d96d9

Sharing

Copy URL Twitter E-mail

General

Target

9de59a5828c2500f5e174f4cd7537c2876806716836fe337843fb972fc4d96d9
Size

3.8MB
MD5

91717a21acaf6028ff492d4fd4b11e5b
SHA1

f42e551c38c666fab039511cbe0f9cd5e059b189
SHA256

9de59a5828c2500f5e174f4cd7537c2876806716836fe337843fb972fc4d96d9
SHA512

93d05f14f3b3b3b5d9dc667eb75170f4887ee8e5859b46fcd712cce58b16e7e1bde77002df18938bd607583e43a4826da6e0de2fe1901f1836ce1fe4b31984fd
SSDEEP

49152:46tt7LLGMWOixjQafK47YZh1pA27lWW9A4no0phTVw5U+1qY7qHg:5tt3LGMWsafK47YFpplWqnn+d7qHg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9de59a5828c2500f5e174f4cd7537c2876806716836fe337843fb972fc4d96d9

Files

9de59a5828c2500f5e174f4cd7537c2876806716836fe337843fb972fc4d96d9
.exe windows:5 windows x86 arch:x86

4199a77498c63babc12a856c61fb2d20

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

kernel32

SetFilePointer
CreateFileA
DeleteFileA
MoveFileA
GetUserDefaultLangID
CreateThread
InterlockedCompareExchange
VirtualProtect
SetUnhandledExceptionFilter
IsBadReadPtr
ResumeThread
SystemTimeToFileTime
WaitForSingleObjectEx
GetDriveTypeW
GetDiskFreeSpaceExW
WaitForMultipleObjects
CopyFileW
OutputDebugStringW
GetFileSizeEx
ReleaseMutex
GetSystemTime
GetLogicalDriveStringsW
CreateDirectoryW
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
FindClose
GetFullPathNameW
FindFirstFileW
FindNextFileW
InterlockedExchange
ExpandEnvironmentStringsW
DeleteAtom
AddAtomW
FindAtomW
RemoveDirectoryW
GlobalLock
GlobalUnlock
CreateProcessW
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
LoadLibraryExW
LoadLibraryW
LoadLibraryA
CreateEventW
CreateMutexW
lstrlenW
lstrcmpiW
CloseHandle
Process32NextW
Process32FirstW
SetEndOfFile
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SizeofResource
FindFirstFileExW
GetOEMCP
IsValidCodePage
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GlobalFree
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
CreateToolhelp32Snapshot
WriteConsoleW
GetFileAttributesExW
GetACP
GetModuleHandleExW
ExitThread
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
ReleaseSemaphore
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
GetFileType
GetStdHandle
GetSystemWindowsDirectoryW
lstrcmpiA
lstrcmpA
DeviceIoControl
UnhandledExceptionFilter
FlushFileBuffers
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
InterlockedExchangeAdd
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetStringTypeW
QueryPerformanceCounter
TryEnterCriticalSection
GetExitCodeThread
GetCurrentThread
SwitchToThread
DuplicateHandle
FormatMessageW
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
IsDebuggerPresent
GetConsoleCP
GlobalAlloc
MoveFileW
GetFileAttributesW
GetTempFileNameW
GetTempPathW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetStartupInfoW
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
LoadResource
Sleep
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetLastError
GetCurrentThreadId
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
OpenProcess
GetShortPathNameW
LocalFree
LocalAlloc
FreeResource
GetWindowsDirectoryW
lstrcmpW
lstrcpynW
MoveFileExW
ResetEvent
WaitForSingleObject
SetEvent
GetTickCount
SetFileAttributesW
CreateFileW
ReadFile
WriteFile
GetFileSize
DeleteFileW
GetLocalTime
WideCharToMultiByte
SetLastError
MultiByteToWideChar
GetVersionExW
GetSystemDirectoryW
FindResourceExW
FindResourceW
ExitProcess
GetCommandLineW
GetProcAddress
FreeLibrary
LockResource
InterlockedDecrement
InterlockedIncrement
DecodePointer

user32

ChangeDisplaySettingsW
EnumChildWindows
ClientToScreen
DrawTextW
GetMenuItemID
GetMenuState
GetMenuStringW
PeekMessageW
DispatchMessageW
TrackMouseEvent
CloseWindow
SendMessageW
SendMessageTimeoutW
PostMessageW
DefWindowProcW
PostQuitMessage
CallWindowProcW
UnregisterClassW
IsWindow
TranslateMessage
DrawFocusRect
EqualRect
UnionRect
GetMessageW
DestroyWindow
SetWindowPos
GetDlgItem
CharNextW
SetFocus
TranslateAcceleratorW
CreatePopupMenu
DestroyMenu
GetMenuItemCount
RemoveMenu
TrackPopupMenuEx
GetMenuItemInfoW
SetMenuItemInfoW
SetMenuDefaultItem
InvalidateRect
GetClientRect
GetWindowRect
MessageBeep
MapWindowPoints
PtInRect
GetWindowLongW
SetWindowLongW
FindWindowW
CheckMenuRadioItem
LoadStringA
LoadStringW
MonitorFromPoint
GetMonitorInfoW
EnumDisplayDevicesW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
ShowWindow
UpdateLayeredWindow
IsWindowVisible
GetAsyncKeyState
SetCapture
ReleaseCapture
SetTimer
KillTimer
GetDC
ReleaseDC
BeginPaint
EndPaint
ScreenToClient
GetParent
LoadCursorW
SystemParametersInfoW
SetWindowTextW
SetRectEmpty
PostThreadMessageW
IsIconic
AppendMenuW
RegisterWindowMessageW
OffsetRect
FindWindowExW
GetAncestor
GetWindowInfo
DestroyIcon
LoadIconW
EnumWindows
GetShellWindow
GetDesktopWindow
SetForegroundWindow
MonitorFromWindow
EnumDisplayMonitors
LoadMenuW
GetSubMenu
TrackPopupMenu
GetCursorPos
LoadImageW
CopyRect
WindowFromPoint
SetCursor
GetForegroundWindow
UpdateWindow
DeleteMenu
EnableMenuItem
GetActiveWindow
EndDialog
DialogBoxParamW
GetDoubleClickTime
ReplyMessage
UnregisterHotKey
RegisterHotKey
SetActiveWindow
GetWindow
IntersectRect
MoveWindow
IsDialogMessageW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
EnableWindow
CheckDlgButton
GetDlgItemTextW
SetDlgItemTextW
CreateDialogParamW
EnumDisplaySettingsW
MessageBoxW
GetSystemMetrics
GetWindowThreadProcessId
GetClassNameW

gdi32

EnumFontFamiliesW
CreateFontW
MoveToEx
LineTo
CreatePen
GetDeviceCaps
GetObjectW
CreateDIBSection
SelectClipRgn
SaveDC
RestoreDC
CreateRectRgnIndirect
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteObject
DeleteDC
CreateDCW
PatBlt
StretchBlt
SetStretchBltMode
GetViewportOrgEx
SetViewportOrgEx
GdiFlush
SelectObject
RectVisible
OffsetViewportOrgEx

advapi32

DuplicateTokenEx
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegSetValueExW
OpenProcessToken
SetTokenInformation
AdjustTokenPrivileges
CreateWellKnownSid
AllocateAndInitializeSid
FreeSid
GetLengthSid
LookupPrivilegeValueW
CheckTokenMembership
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetTokenInformation
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExA

shell32

CommandLineToArgvW
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHFileOperationW
SHGetPathFromIDListW
SHCreateDirectoryExA
SHChangeNotify
ShellExecuteW
ord165
SHCreateDirectoryExW
ShellExecuteExW
SHGetFolderPathW
Shell_NotifyIconW
SHGetSpecialFolderPathW

ole32

CoCreateGuid
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoInitialize
CLSIDFromProgID
CreateStreamOnHGlobal

oleaut32

SysStringLen
SysAllocStringByteLen
SysStringByteLen
SysAllocString
VarUI4FromStr
SysFreeString
VariantClear
VarBstrCmp

shlwapi

SHGetValueA
StrTrimA
StrCmpNIW
StrCmpW
PathIsDirectoryW
SHSetValueA
SHDeleteKeyW
PathRemoveFileSpecA
StrStrIA
AssocQueryStringW
PathFindFileNameW
PathCombineW
StrCmpIW
SHSetValueW
SHGetValueW
SHDeleteValueW
PathRemoveFileSpecW
PathFileExistsW
PathAppendW
StrStrIW

comctl32

_TrackMouseEvent
InitCommonControlsEx

msimg32

AlphaBlend

gdiplus

GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDrawString
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDrawLine
GdipSetStringFormatAlign
GdipCreatePen1
GdipCreateSolidFill
GdipSetStringFormatLineAlign
GdipCloneBrush
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectRectI
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc
GdiplusShutdown
GdipDrawImageRectRect
GdipFillRectangleI
GdipSetTextRenderingHint
GdipSetStringFormatTrimming
GdipDeletePen
GdipGetImageHeight
GdipGetImageWidth
GdipDeleteBrush

ws2_32

WSAAsyncSelect
WSAAsyncGetHostByName
WSAGetLastError
gethostbyname
socket
shutdown
send
recv
htons
connect
closesocket
WSACleanup
WSAStartup

wininet

InternetQueryOptionA
DeleteUrlCacheEntryW
InternetSetCookieW
InternetGetCookieW
InternetCrackUrlW
InternetGetConnectedState
InternetQueryOptionW

secur32

AcquireCredentialsHandleA
FreeCredentialsHandle
InitializeSecurityContextA

rasapi32

RasGetConnectStatusW
RasEnumConnectionsW

psapi

GetModuleFileNameExW

crypt32

CryptBinaryToStringA
CertGetNameStringW

winmm

timeSetEvent
timeKillEvent
timeBeginPeriod
timeEndPeriod

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 426KB - Virtual size: 425KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4199a77498c63babc12a856c61fb2d20

Headers

DLL Characteristics

File Characteristics

Imports

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

ws2_32

wininet

secur32

rasapi32

psapi

crypt32

winmm

wintrust

iphlpapi

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 426KB - Virtual size: 425KB

.data Size: 41KB - Virtual size: 125KB

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 426KB - Virtual size: 425KB

.data
Size: 41KB - Virtual size: 125KB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB