a25981da0582ab21a7cace83f599e4c975d2407958690c61d3022bf4d13a6c32

Sharing

Copy URL Twitter E-mail

General

Target

a25981da0582ab21a7cace83f599e4c975d2407958690c61d3022bf4d13a6c32
Size

12.8MB
MD5

7274a8330260311847c0333e0c13a031
SHA1

e935d0a536b2c5a4a6f44f41368918fe0a49896c
SHA256

a25981da0582ab21a7cace83f599e4c975d2407958690c61d3022bf4d13a6c32
SHA512

82ecfaf0374ea78d6c76a7019883585ca3d074bd272bd91edaad9be7be911d6e34ea4f8958e31e15cc92ed3536d467263e3ea84ca49a7b0a129fe3879709bde4
SSDEEP

196608:p4ky3nF9f3+AwTrabqQwc+P0MIA3xANc5ITDj3ulAFLOyomFHKnP:ikCF9f3+Ao+5wbICKP3lF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a25981da0582ab21a7cace83f599e4c975d2407958690c61d3022bf4d13a6c32

Files

a25981da0582ab21a7cace83f599e4c975d2407958690c61d3022bf4d13a6c32
.exe windows:6 windows x86 arch:x86

200624c7fba63970b29074967fcf2790

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DecodePointer
InitializeCriticalSectionEx
LoadLibraryW
GetProcAddress
CreateMutexW
OpenProcess
TerminateProcess
GetModuleHandleW
OpenMutexW
SetVolumeMountPointW
SetFileAttributesW
GlobalMemoryStatusEx
DeleteVolumeMountPointW
GetCurrentThread
SetThreadPriority
WaitForMultipleObjectsEx
CancelIoEx
CreateWaitableTimerW
GetQueuedCompletionStatus
SetWaitableTimer
CreateIoCompletionPort
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
SetStdHandle
CreatePipe
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
HeapSize
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
ExitProcess
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
SleepEx
FreeLibraryAndExitThread
ExitThread
CreateThread
QueueUserAPC
TerminateThread
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateEventW
HeapFree
GetProcessHeap
HeapAlloc
SetLocalTime
GetTickCount
ReleaseSemaphore
WaitForSingleObject
GetLastError
SetLastError
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemTimeAsFileTime
WaitForSingleObjectEx
CreateEventA
PostQueuedCompletionStatus
SetEvent
GetSystemInfo
LeaveCriticalSection
EnterCriticalSection
LoadLibraryExW
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AreFileApisANSI
CopyFileExW
GetFullPathNameW
GetFileTime
GetFileAttributesExW
DeleteFileW
CreateWaitableTimerA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread
OpenEventA
ResetEvent
GetCPInfo
CompareStringEx
LCMapStringEx
EncodePointer
GetLocaleInfoEx
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetStringTypeW
FreeUserPhysicalPages
MapUserPhysicalPages
AllocateUserPhysicalPages
VirtualFree
VirtualAlloc
VirtualUnlock
VirtualLock
FileTimeToSystemTime
GetFileInformationByHandle
SystemTimeToFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
lstrcpynW
SetFilePointer
SearchPathW
lstrcmpW
SetThreadAffinityMask
SetProcessWorkingSetSize
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
SetThreadUILanguage
SetThreadLocale
GetUserDefaultLangID
GetUserDefaultUILanguage
WTSGetActiveConsoleSessionId
GetEnvironmentVariableW
GetExitCodeProcess
GetSystemTimes
FlushViewOfFile
MapViewOfFileEx
UnmapViewOfFile
CloseHandle
LocalFree
WideCharToMultiByte
FormatMessageW
GetModuleHandleExW
FormatMessageA
SwitchToThread
FlushFileBuffers
GetFileType
CreateFileMappingA
DuplicateHandle
CreateSemaphoreA
GetCurrentThreadId
SetUnhandledExceptionFilter
RtlCaptureStackBackTrace
SetPriorityClass
SetProcessPriorityBoost
GetPriorityClass
lstrlenW
lstrcatW
lstrcpyW
GetDiskFreeSpaceExW
QueryDosDeviceW
GetVolumePathNamesForVolumeNameW
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
GetComputerNameExW
SetFileTime
IsDebuggerPresent
OutputDebugStringW
RaiseException
MultiByteToWideChar
GetACP
GetModuleHandleA
FindFirstFileW
FindNextFileW
GetFileAttributesW
CreateDirectoryW
GetModuleFileNameW
FindClose
CreateFileW
FreeLibrary
DeviceIoControl
Sleep
GetCurrentProcess
GetCurrentProcessId
CreateFileA
MoveFileExW
ReadFile
WriteFile
GetFileSizeEx
GetSystemDirectoryW
GetTempPathW
RemoveDirectoryW
SetEndOfFile
SetFilePointerEx
GetVersionExW
GetProductInfo
CreateProcessW
GetStdHandle
SetConsoleCtrlHandler
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetWindowsDirectoryW
GetTempFileNameW
ExpandEnvironmentStringsW
FindResourceW
LoadResource
LockResource
SizeofResource
FreeResource
GetLogicalDriveStringsW
GetDriveTypeW
GetVolumeNameForVolumeMountPointW

user32

PostMessageW
GetLastActivePopup
SetForegroundWindow
RegisterClassExW
EnumWindows
GetPropW
GetSystemMetrics
SetWindowLongW
SetPropW
DestroyWindow
IsWindowVisible
GetTopWindow
CreateWindowExW
LockSetForegroundWindow
ShowWindow
GetClientRect
InvalidateRect
UpdateWindow
GetMessageW
IsDialogMessageW
TranslateMessage
DispatchMessageW
RegisterWindowMessageW
GetWindowLongW
DefWindowProcW
BeginPaint
GetDC
DrawTextW
ReleaseDC
EndPaint
PostQuitMessage
SendMessageW
UnregisterDeviceNotification
LoadStringW
SetWindowPos
LoadIconW
SendMessageTimeoutW
CallNextHookEx
GetAsyncKeyState
GetKeyState
SystemParametersInfoW
GetDlgItemTextW
EndDialog
EnumChildWindows
EnableWindow
SendDlgItemMessageW
UnhookWindowsHookEx
SetWindowsHookExW
SetDlgItemTextW
CreateDialogParamW
GetCursorPos
DialogBoxParamW
GetLastInputInfo
MessageBoxA
MessageBoxW
GetDlgItem
GetWindow
FindWindowW
RegisterDeviceNotificationW
IsChild
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetWindowRect
GetParent
DestroyMenu
TrackPopupMenuEx
OpenWindowStationW
SetProcessWindowStation
OpenDesktopW
SetThreadDesktop
CloseDesktop
CloseWindowStation
ExitWindowsEx
GetWindowThreadProcessId
EnumDisplayDevicesW
EnumDisplaySettingsW
ChangeDisplaySettingsExW
MonitorFromWindow
GetDesktopWindow
FindWindowExW
LoadKeyboardLayoutW
ActivateKeyboardLayout
UnloadKeyboardLayout
keybd_event
GetDisplayConfigBufferSizes
QueryDisplayConfig
DisplayConfigGetDeviceInfo
DisplayConfigSetDeviceInfo
CharNextW
IsCharAlphaNumericW
CharUpperW
wsprintfW
DeleteMenu
LoadMenuW
GetMenuItemCount
GetMenuItemID
GetMenuStringW
ModifyMenuW
GetSubMenu

gdi32

CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
GetDeviceCaps
GetObjectW
GetStockObject
CreateFontIndirectW
SetTextColor
SetBkColor
SetBkMode
DeleteObject
GetTextMetricsW
BitBlt
DeleteDC

advapi32

OpenSCManagerW
FreeSid
ChangeServiceConfig2W
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus
RegDeleteValueW
RegCreateKeyW
RegOpenKeyW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
QueryServiceStatus
DuplicateTokenEx
SetTokenInformation
ImpersonateSelf
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
RegEnumKeyW
RegSetValueExA
RegLoadKeyW
RegUnLoadKeyW
AllocateAndInitializeSid
RegDeleteKeyW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegCreateKeyExW
CreateProcessAsUserW
OpenProcessToken
RegQueryValueExW
CheckTokenMembership
CloseServiceHandle
OpenServiceW
CreateServiceW
ChangeServiceConfigW
StartServiceW
ControlService
DeleteService
QueryServiceConfigW
EnumDependentServicesW

shell32

Shell_NotifyIconW
ShellExecuteExW
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoInitialize
CoSetProxyBlanket
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoInitializeSecurity
CoInitializeEx
CreateStreamOnHGlobal

ws2_32

WSARecvFrom
WSAStartup
WSACleanup
htonl
WSASetLastError
WSAGetLastError
closesocket
ioctlsocket
shutdown
listen
WSASend
WSASocketW
setsockopt
WSAAddressToStringW
ntohl
ntohs
htons
bind
inet_addr
WSAStringToAddressW
gethostname
getsockopt
getpeername
getsockname
inet_ntoa
WSARecv
WSASendTo
getaddrinfo
freeaddrinfo
WSAIoctl
__WSAFDIsSet
select
accept
connect

mswsock

AcceptEx
GetAcceptExSockaddrs

setupapi

SetupDefaultQueueCallbackW
SetupInstallFromInfSectionW
SetupInitDefaultQueueCallback
SetupInstallServicesFromInfSectionW
SetupTermDefaultQueueCallback
SetupDiCallClassInstaller
SetupDiSetDeviceRegistryPropertyW
SetupDiCreateDeviceInfoW
SetupDiCreateDeviceInfoList
SetupDiGetINFClassW
SetupDiDestroyDriverInfoList
SetupDiGetDriverInfoDetailW
SetupDiEnumDriverInfoW
SetupDiBuildDriverInfoList
SetupDiGetDeviceInstanceIdW
SetupGetSourceFileLocationW
SetupGetTargetPathW
SetupGetStringFieldW
SetupGetIntField
SetupFindNextLine
SetupGetFieldCount
SetupFindFirstLineW
SetupEnumInfSectionsW
SetupCloseInfFile
SetupQueryInfFileInformationW
SetupGetInfInformationW
SetupOpenInfFileW
CM_Reenumerate_DevNode
CM_Locate_DevNodeW
CM_Get_Sibling
CM_Get_DevNode_Status
CM_Get_Device_IDW
CM_Get_Child
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
InstallHinfSectionW

netapi32

NetJoinDomain

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses
GetIfTable

mprapi

MprConfigServerConnect
MprConfigServerDisconnect
MprConfigGetFriendlyName

mpr

WNetAddConnection2W
WNetCancelConnection2W

dxva2

SetMonitorBrightness
GetMonitorBrightness
GetNumberOfPhysicalMonitorsFromHMONITOR
GetPhysicalMonitorsFromHMONITOR

psapi

GetModuleFileNameExW
EnumProcessModules
GetProcessImageFileNameW

dbgeng

DebugCreate

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock
GetAllUsersProfileDirectoryW
GetProfilesDirectoryW

wtsapi32

WTSQueryUserToken

newdev

UpdateDriverForPlugAndPlayDevicesW

winspool.drv

ord204
EnumPrintersW
ord203

oleaut32

SysFreeString
VariantCopy
SysAllocString
VariantChangeType
VariantClear
VariantInit
VarBstrCmp
OleLoadPicture

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 470KB - Virtual size: 470KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 104KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9.7MB - Virtual size: 9.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

200624c7fba63970b29074967fcf2790

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

ws2_32

mswsock

setupapi

netapi32

iphlpapi

mprapi

mpr

dxva2

psapi

dbgeng

userenv

wtsapi32

newdev

winspool.drv

oleaut32

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rdata Size: 470KB - Virtual size: 470KB

.data Size: 104KB - Virtual size: 187KB

.rsrc Size: 9.7MB - Virtual size: 9.7MB

.reloc Size: 121KB - Virtual size: 120KB

.text
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 470KB - Virtual size: 470KB

.data
Size: 104KB - Virtual size: 187KB

.rsrc
Size: 9.7MB - Virtual size: 9.7MB

.reloc
Size: 121KB - Virtual size: 120KB