1681139642076e63eeb792fb7a331543

Sharing

Copy URL Twitter E-mail

General

Target

1681139642076e63eeb792fb7a331543
Size

7.2MB
MD5

1681139642076e63eeb792fb7a331543
SHA1

72a055fe42bddb1de21f754d3c60324520e4ac0f
SHA256

40be32d961239c58401a0fac2b440c2e79a98a031d9f3575f655818afe9ad6bc
SHA512

85ad09fa6fcb7fc8511f5eda8c06a7e092fb6284ecd6bae5cabca3b68b8f14f59299209e77708fed826f1a3d49adcb2d596431331acbfaa18d2a94899e7a2933
SSDEEP

196608:MTpvzKi1y9uUZQk+nftzgVji8ppjwg5G6m5J:wz312uUZanfRcbvp54

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1681139642076e63eeb792fb7a331543

Files

1681139642076e63eeb792fb7a331543
.exe windows:4 windows x86 arch:x86

99414c8b1cc07ca5be5ef0ed5ad93aed

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteW
Shell_NotifyIconW
CommandLineToArgvW
SHFileOperationW
SHBrowseForFolderW
SHCreateDirectoryExW

msi

ord137
ord141
ord88
ord70
ord32
ord118
ord8
ord169
ord160
ord195
ord159
ord92

advapi32

RegQueryValueExW
OpenServiceW
ChangeServiceConfigW
RegDeleteValueW
RegSetValueExW
RegCreateKeyW
CloseServiceHandle
RegCloseKey
OpenSCManagerW
QueryServiceStatus
RegOpenKeyExW
RegEnumKeyW
RegCreateKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
StartServiceW

shlwapi

PathCombineW
PathAppendW
PathFileExistsW
PathStripToRootW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

psapi

EnumProcessModules
GetModuleFileNameExW

ws2_32

htonl
htons
gethostbyname
WSAStartup
connect
socket
inet_ntoa
recv
WSACleanup
send
inet_addr
closesocket

kernel32

FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetStartupInfoA
GetFileType
SetHandleCount
FlushFileBuffers
GetStdHandle
HeapCreate
HeapDestroy
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetConsoleMode
GetConsoleCP
ExitProcess
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetCPInfo
FormatMessageW
LocalFree
GetLastError
GetSystemDirectoryW
GetVersionExW
SetFileAttributesW
LeaveCriticalSection
CreateProcessW
GetModuleFileNameW
EnterCriticalSection
FindFirstFileW
CloseHandle
CreateMutexW
GetCurrentDirectoryW
GetFileAttributesW
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
VirtualFree
VirtualAlloc
FreeResource
GetDriveTypeW
FindResourceW
LoadResource
CreateDirectoryW
WriteFile
SizeofResource
CreateFileW
MultiByteToWideChar
LockResource
GlobalUnlock
GlobalAlloc
GlobalLock
Sleep
CopyFileW
CreateThread
SuspendThread
GetDiskFreeSpaceExW
FreeLibrary
FindNextFileW
GetPrivateProfileStringW
LoadLibraryW
MoveFileExW
GetProcAddress
RemoveDirectoryW
FindClose
GetPrivateProfileIntW
WideCharToMultiByte
DeleteFileW
ResumeThread
WritePrivateProfileStringW
GetTempPathW
GetTickCount
GetWindowsDirectoryW
MoveFileW
QueryPerformanceFrequency
QueryPerformanceCounter
IsBadReadPtr
IsBadWritePtr
Process32NextW
WaitForSingleObject
lstrcmpiW
TerminateProcess
DeleteFileA
OpenProcess
lstrcatA
GetACP
lstrcmpW
Process32FirstW
CreateToolhelp32Snapshot
RemoveDirectoryA
GetCommandLineW
GetModuleHandleW
GetSystemTimeAsFileTime
GetProcessTimes
GetCurrentProcessId
SetFilePointer
LoadLibraryA
VirtualQuery
GetCurrentProcess
GetModuleFileNameA
GetModuleHandleA
SetProcessAffinityMask
GetProcessAffinityMask
RaiseException
InterlockedIncrement
InterlockedDecrement
RtlUnwind
GetStartupInfoW
GetProcessHeap
GetVersionExA
HeapSize
HeapReAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapAlloc
HeapFree
InterlockedExchange
InterlockedCompareExchange
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
CreateFileA
SetEndOfFile
GetThreadLocale
ReadFile
LocalAlloc

user32

GetClassNameW
DefWindowProcW
GetActiveWindow
ExitWindowsEx
GetClassInfoExW
GetDesktopWindow
RegisterClassExW
SetWindowLongW
BringWindowToTop
SetCursor
EnumWindows
SetDlgItemTextW
GetWindowThreadProcessId
PtInRect
CharNextW
GetWindowRect
GetKeyState
CreateDialogParamW
GetDlgCtrlID
OffsetRect
DestroyWindow
SetWindowPos
GetClientRect
PostMessageW
DrawTextW
GetWindowTextW
DrawIconEx
MapVirtualKeyW
TranslateMessage
GetWindow
SetWindowRgn
SetWindowsHookExW
UnhookWindowsHookEx
BeginPaint
GetParent
TrackMouseEvent
ReleaseCapture
DestroyIcon
SetTimer
ShowWindow
GetDlgItem
SetWindowTextW
EnableWindow
LoadAcceleratorsW
DispatchMessageW
EndDialog
MessageBoxW
DialogBoxParamW
TranslateAcceleratorW
GetMessageW
SendMessageW
EndPaint
CallNextHookEx
GetDC
LoadBitmapW
LoadImageW
InvalidateRect
UpdateWindow
KillTimer
IsWindow
GetFocus
GetDlgItemTextW
CreateWindowExW
SetFocus
SetClassLongW
PostQuitMessage
ScreenToClient
GetWindowDC
GetCursorPos
ReleaseDC
LoadCursorW
GetWindowLongW
IsWindowVisible

gdi32

CreateCompatibleDC
OffsetRgn
CreateRectRgn
CombineRgn
SetBkColor
BitBlt
CreateCompatibleBitmap
GetStockObject
DeleteObject
SelectObject
DeleteDC
GetTextExtentExPointW
GetTextExtentPointW
SetTextColor
CreateFontW
SetBkMode

ole32

CoCreateInstance
CoInitializeEx
StringFromCLSID
CreateStreamOnHGlobal
CoUninitialize

oleaut32

SysAllocString
SysStringLen
SysFreeString

Sections

.text
Size: 368KB - Virtual size: 366KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 436KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39.5MB - Virtual size: 39.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

99414c8b1cc07ca5be5ef0ed5ad93aed

Headers

File Characteristics

Imports

shell32

msi

advapi32

shlwapi

version

psapi

ws2_32

kernel32

user32

gdi32

ole32

oleaut32

Sections

.text Size: 368KB - Virtual size: 366KB

.rdata Size: 76KB - Virtual size: 74KB

.data Size: 12KB - Virtual size: 436KB

.rsrc Size: 39.5MB - Virtual size: 39.5MB

.text
Size: 368KB - Virtual size: 366KB

.rdata
Size: 76KB - Virtual size: 74KB

.data
Size: 12KB - Virtual size: 436KB

.rsrc
Size: 39.5MB - Virtual size: 39.5MB