0de263b7b0df455c03ef6a9ff61d5388

Sharing

Copy URL

Twitter E-mail

General

Target

0de263b7b0df455c03ef6a9ff61d5388
Size

90KB
MD5

0de263b7b0df455c03ef6a9ff61d5388
SHA1

a54fa18ba9f5a50c1dcafa20defa3b063e5d6159
SHA256

35d5ae225a1455885d24092e2118dcb1e167428e0d2596afe4069a1646f77f55
SHA512

0b21d697eada79de174d96d10dfd57aacb03a23ce7089db8ea8a6f5fbc4abc2c5966734a15b59714abf24badef25be9f866e08164db25c899bcf08346940b767
SSDEEP

1536:wN2LR12uvhS2Si67eAdy6g64UkCzPlrU1rrPsMP2SH:+CRjvhSm8eAAD3Ul272SH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0de263b7b0df455c03ef6a9ff61d5388

Files

0de263b7b0df455c03ef6a9ff61d5388
.dll windows:4 windows x86 arch:x86

0555e1d117597c29946e4dad82b3aee5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

BringWindowToTop
ShowWindow
DestroyWindow
UpdateWindow
wsprintfA
MessageBoxA
SetThreadDesktop
OpenInputDesktop
GetThreadDesktop
ExitWindowsEx
CallNextHookEx
UnhookWindowsHookEx
GetMessageA
SetTimer
SetWindowsHookExA
SendInput
SetCursorPos
DispatchMessageA
PostMessageA
OpenDesktopA
GetForegroundWindow
SetWindowsHookExW
GetWindowTextA
GetWindowThreadProcessId
wsprintfW
EnumWindows
CharUpperA
CharLowerA
PostThreadMessageA
OpenWindowStationA
SetProcessWindowStation
CloseDesktop
CloseWindowStation
TranslateMessage
CreateWindowExA
RegisterDeviceNotificationA
LoadIconA
LoadCursorA
GetSystemMetrics
LoadImageA
RegisterClassExA
IsWindow
SendMessageA
GetActiveWindow

gdi32

CreateDCA
CreateCompatibleBitmap
DeleteObject
DeleteDC
BitBlt
GetStockObject
GetDeviceCaps
GetDIBits
CreateCompatibleDC
SelectObject

advapi32

OpenThreadToken
CreateServiceA
StartServiceA
RegisterServiceCtrlHandlerA
SetServiceStatus
LogonUserA
CreateProcessAsUserA
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
QueryServiceConfigA
EnumServicesStatusA
ChangeServiceConfigA
RegCreateKeyExA
RegSetValueExA
OpenProcessToken
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetUserNameW
LookupPrivilegeValueA
ImpersonateSelf
OpenServiceA
AdjustTokenPrivileges
OpenSCManagerA
DeleteService
ControlService
CloseServiceHandle

shell32

ShellExecuteA
SHEmptyRecycleBinA
SHFileOperationA

ole32

CreateStreamOnHGlobal

ws2_32

bind
inet_ntoa
gethostbyname
inet_addr
recv
select
send
listen
setsockopt
closesocket
socket
htons
WSASocketA
connect
getsockname
ntohs
accept
WSAStartup

shlwapi

StrCmpNIA
StrChrA
StrStrA
StrCmpW
SHDeleteKeyA
StrToIntA
StrRChrA

psapi

GetModuleFileNameExA

imm32

ImmReleaseContext
ImmGetCompositionStringW
ImmGetCompositionStringA
ImmGetContext

avicap32

capCreateCaptureWindowA
capGetDriverDescriptionA

winmm

waveInClose
waveInStop
waveInStart
waveInAddBuffer
waveInPrepareHeader
waveInOpen
waveInUnprepareHeader

msvcrt

??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
_beginthread
strchr
free
wcscmp
malloc
strrchr
getenv
_adjust_fdiv
rand
srand
time
__dllonexit
_onexit
_initterm

kernel32

ResetEvent
WaitForMultipleObjects
lstrcpyW
GlobalLock
GlobalAlloc
GetFileSize
OpenMutexA
OpenEventA
SearchPathA
GetModuleFileNameA
OpenProcess
CreateDirectoryA
MoveFileA
GetDriveTypeA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetLogicalDriveStringsA
GetFileAttributesExA
FindClose
GetLastError
FindNextFileA
lstrcmpA
FindFirstFileA
lstrcmpiA
Process32Next
Process32First
CreateToolhelp32Snapshot
DuplicateHandle
SetStdHandle
CreatePipe
GetStdHandle
lstrcatW
GetProcAddress
FreeLibrary
LocalAlloc
InterlockedExchange
RaiseException
ReleaseMutex
GlobalFree
CreateEventA
CreateMutexA
GetFileSizeEx
SetFilePointerEx
ReadFile
GetCurrentProcess
GetPriorityClass
GetThreadPriority
SetPriorityClass
SetThreadPriority
QueryPerformanceFrequency
QueryPerformanceCounter
GetVersion
GetVersionExA
TerminateProcess
ResumeThread
GetSystemInfo
GlobalMemoryStatus
GetComputerNameA
GetACP
GetOEMCP
GetLocalTime
GetTempPathA
WriteFile
GetCurrentThread
GetCurrentProcessId
lstrlenA
DeviceIoControl
CreateFileA
CloseHandle
GetSystemDirectoryA
SetEvent
DeleteFileA
lstrcpyA
lstrlenW
FlushFileBuffers
SetFilePointer
CopyFileA
LoadLibraryA
WideCharToMultiByte
GetCurrentThreadId
GetStartupInfoA
CreateProcessA
Sleep
lstrcatA
WaitForSingleObject
GetTickCount

Exports

Exports

ServiceMain
WqMainWork
WqService

Sections

.text
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Share
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0555e1d117597c29946e4dad82b3aee5

Headers

File Characteristics

Imports

user32

gdi32

advapi32

shell32

ole32

ws2_32

shlwapi

psapi

imm32

avicap32

winmm

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 70KB - Virtual size: 69KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 2KB - Virtual size: 2KB

Share Size: 5KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 70KB - Virtual size: 69KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 2KB - Virtual size: 2KB

Share
Size: 5KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 4KB