55125f8005fe171a1a975c180314d82e4958efb23578f94bef0e5321bdfb728f

Sharing

Copy URL Twitter E-mail

General

Target

55125f8005fe171a1a975c180314d82e4958efb23578f94bef0e5321bdfb728f
Size

8.0MB
MD5

ec49439801b548d8d526ada136a5d35c
SHA1

3154e1b0db1e3a58643190591c609ffe4b539493
SHA256

55125f8005fe171a1a975c180314d82e4958efb23578f94bef0e5321bdfb728f
SHA512

a44bdb3ca0b5b0645ef0f0fdaa51610e2b9f18147f2469d5897e9db9f67e8c63e928a18c87093f0421bac98b5da41b138be39ced7891d58ba6292685d3c2ecdc
SSDEEP

98304:W7eunUUet11cRejnhuLpiINHLBlNI+VVEwyKWEC0aaRT+hivZ:W7ecfc4ejnhkrfXEKW/0Xys

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
55125f8005fe171a1a975c180314d82e4958efb23578f94bef0e5321bdfb728f

Files

55125f8005fe171a1a975c180314d82e4958efb23578f94bef0e5321bdfb728f
.exe windows:6 windows x86 arch:x86

6842d709a2e2da1940de2bc1f8719490

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

dbghelp

MiniDumpWriteDump

msimg32

AlphaBlend

gdiplus

GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCreateStringFormat
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipSetClipRectI
GdipDrawImage
GdipFillPath
GdipFillEllipse
GdipFillRectangle
GdipDrawRectangle
GdipDrawLines
GdipDrawLine
GdipSetTextRenderingHint
GdipSetCompositingQuality
GdipCreateFromHWNDICM
GdipCreateFromHWND
GdipFlush
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipAddPathLine
GdipClosePathFigures
GdipDeletePath
GdipCreatePath
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipBitmapSetPixel
GdipBitmapGetPixel
GdipCreateBitmapFromHICON
GdipDrawImageRectRectI
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipSetCompositingMode
GdipSetImageAttributesWrapMode
GdipDrawImageRectI
GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipSetStringFormatTrimming
GdiplusStartup
GdipDeleteFontFamily
GdiplusShutdown
GdipAlloc
GdipFree
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromScan0
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipCreateFromHDC
GdipDeleteGraphics
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdipGraphicsClear
GdipDrawImageRectRect
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat

kernel32

SetFileAttributesW
GetModuleFileNameW
GetTickCount
GetVersion
WaitForMultipleObjects
SetDefaultDllDirectories
SetProcessShutdownParameters
GetUserDefaultUILanguage
GetLocaleInfoW
VirtualQuery
WriteConsoleW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEndOfFile
SetStdHandle
FlushFileBuffers
EnumSystemLocalesW
IsValidLocale
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
GetConsoleCP
DecodePointer
GetConsoleMode
ExitProcess
SetFilePointerEx
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
GetDriveTypeW
InterlockedFlushSList
RtlUnwind
GetStringTypeExA
GetUserDefaultLCID
LCMapStringA
GetStringTypeExW
FormatMessageA
CreateWaitableTimerA
GetLogicalProcessorInformation
ResumeThread
SetWaitableTimer
OpenEventA
WaitForMultipleObjectsEx
ReleaseSemaphore
GetStartupInfoW
UnhandledExceptionFilter
LCMapStringW
GetCPInfo
TlsFree
SwitchToThread
InitializeCriticalSectionAndSpinCount
GetStringTypeW
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
MulDiv
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetUserGeoID
GetGeoInfoW
OutputDebugStringW
OutputDebugStringA
GetSystemPowerStatus
SetDllDirectoryW
ReadConsoleW
GetCurrentProcessId
GetCurrentProcess
Sleep
OpenEventW
SetUnhandledExceptionFilter
CreateDirectoryW
GetCommandLineW
ResetEvent
SystemTimeToFileTime
GetModuleHandleW
GetSystemTime
EncodePointer
IsDebuggerPresent
CreateDirectoryA
GlobalFree
GetFileSize
TryEnterCriticalSection
InitializeCriticalSection
GetConsoleDisplayMode
AttachConsole
FreeConsole
QueryFullProcessImageNameW
LocalAlloc
LoadLibraryW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetLocaleInfoA
FindResourceA
SetThreadLocale
GetThreadLocale
TlsSetValue
TlsGetValue
TlsAlloc
CreateMutexA
ReleaseMutex
GetFileSizeEx
GetCurrentThreadId
GetExitCodeThread
TerminateThread
GetThreadPriority
SetThreadPriority
CompareStringW
DosDateTimeToFileTime
GetComputerNameW
GetVolumeInformationW
SetLastError
RaiseException
SetFileTime
CreateFileW
GetSystemDirectoryW
CreateThread
LocalFree
GetExitCodeProcess
TerminateProcess
GetPackageInfo
ClosePackageInfo
OpenPackageInfoByFullName
CreateEventW
CreateEventA
WaitForSingleObjectEx
WaitForSingleObject
SetEvent
CloseHandle
LoadLibraryExW
GetProcAddress
FreeLibrary
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
SetErrorMode
GetLastError
GetFileAttributesW
SetConsoleMode
ReadConsoleA
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
MapViewOfFile
CreateFileMappingW
LockFileEx
UnlockFile
HeapCompact
DeleteFileA
CreateFileA
FlushViewOfFile
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
UnmapViewOfFile
GetPackagesByPackageFamily
CreateMutexW
UnlockFileEx
GetFullPathNameA
LockFile
GetDiskFreeSpaceW
HeapCreate
AreFileApisANSI
GetCurrentPackageFullName
EnumResourceNamesW
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
QueryPerformanceCounter
MultiByteToWideChar
WideCharToMultiByte
MoveFileExA
CompareFileTime
GetSystemTimeAsFileTime
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
FormatMessageW
VerSetConditionMask
VerifyVersionInfoA
GetSystemInfo
VirtualProtect
LoadLibraryExA
GetSystemDefaultUILanguage
GetLocaleInfoEx
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetCurrentThread
FileTimeToSystemTime
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
FindFirstFileExW
GetDiskFreeSpaceExW
GetFileAttributesExW
GetFileInformationByHandle
GetLongPathNameW
GetTempFileNameW
SetFilePointer
WriteFile
GetTempPathW
IsWow64Process
CopyFileW
MoveFileExW
SystemTimeToTzSpecificLocalTime
GetEnvironmentVariableW
ProcessIdToSessionId
OpenProcess
GetVersionExW
VerifyVersionInfoW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetCurrentPackageFamilyName
FreeResource

wininet

FindNextUrlCacheEntryW
InternetSetOptionW
FindFirstUrlCacheEntryW
DeleteUrlCacheEntryW
InternetQueryOptionW

comctl32

_TrackMouseEvent

wtsapi32

WTSFreeMemory
WTSRegisterSessionNotification
WTSEnumerateSessionsW
WTSQueryUserToken

ws2_32

WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
WSAGetLastError
send
recv
recvfrom
WSAEventSelect
ntohl
closesocket
gethostbyname
getnameinfo
sendto
gethostname
shutdown

wldap32

ord33
ord32
ord27
ord26
ord79
ord41
ord50
ord45
ord60
ord211
ord46
ord217
ord143
ord30
ord35
ord200
ord301
ord22

normaliz

IdnToUnicode
IdnToAscii

gdi32

SetDIBColorTable
GetStockObject
SetLayout
SetBrushOrgEx
SetDIBits
CreateCompatibleBitmap
GetObjectW
SetTextColor
CreateSolidBrush
CreateDIBSection
SetBkMode
SelectObject
DeleteObject
CreateFontIndirectW
CreateCompatibleDC
BitBlt
DeleteDC
GetDeviceCaps
TextOutW
CreateBitmap
GetTextExtentPoint32W
SetMapMode
CreateFontW
GetDIBits
GetTextMetricsW
LPtoDP

advapi32

RegFlushKey
RegCloseKey
CryptAcquireContextW
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
OpenProcessToken
OpenThreadToken
RegOpenKeyW
GetSidSubAuthority
GetTokenInformation
RegEnumKeyExW
LookupAccountNameW
ConvertSidToStringSidW
RegEnumValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
ConvertStringSidToSidW
AddAccessAllowedAceEx
AddAce
DuplicateTokenEx
GetAce
GetAclInformation
GetLengthSid
GetSecurityDescriptorSacl
InitializeAcl
GetUserNameW
RegCreateKeyExW
GetSecurityInfo
SetSecurityInfo
RegSetValueExW
RegQueryInfoKeyW
RegDeleteTreeW
RegCopyTreeW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptSignHashW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
CryptEnumProvidersW

ole32

CoUninitialize
CoInitializeEx
OleCreate
PropVariantClear
OleLockRunning
CoTaskMemFree
OleInitialize
OleUninitialize
CoTaskMemAlloc
CoCreateInstance
OleSetContainedObject
CoSetProxyBlanket
CoInitializeSecurity
CoInitialize
StringFromGUID2
CoCreateGuid

oleaut32

CreateErrorInfo
SetErrorInfo
VariantChangeType
GetErrorInfo
SysStringLen
SafeArrayGetElement
SafeArrayGetLBound
SysAllocString
VariantInit
SysFreeString
SysAllocStringLen
SafeArrayGetUBound
VariantClear
VariantCopy

shlwapi

ord176
SHRegDuplicateHKey
PathFileExistsW
StrRetToBufW
ord487
AssocQueryStringW
PathGetArgsW
StrChrIW

msi

ord173
ord217

rpcrt4

UuidCreateSequential
RpcStringFreeW
UuidToStringW

winhttp

WinHttpOpen
WinHttpGetProxyForUrl
WinHttpCloseHandle

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertDuplicateCertificateContext
CertGetIntendedKeyUsage
CertOpenSystemStoreA
CertGetCertificateContextProperty
CertFindCertificateInStore
CertGetEnhancedKeyUsage
CertOpenStore

userenv

GetUserProfileDirectoryW
ExpandEnvironmentStringsForUserW

version

VerQueryValueW

secur32

GetUserNameExW

comdlg32

GetSaveFileNameW

bcrypt

BCryptGenRandom

Sections

.text
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 788KB - Virtual size: 792KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6842d709a2e2da1940de2bc1f8719490

Headers

DLL Characteristics

File Characteristics

Imports

dbghelp

msimg32

gdiplus

kernel32

wininet

comctl32

wtsapi32

ws2_32

wldap32

normaliz

gdi32

advapi32

ole32

oleaut32

shlwapi

msi

rpcrt4

winhttp

crypt32

userenv

version

secur32

comdlg32

bcrypt

Sections

.text Size: 4.9MB - Virtual size: 4.9MB

.rdata Size: 1.0MB - Virtual size: 1.0MB

.data Size: 47KB - Virtual size: 81KB

.rsrc Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 788KB - Virtual size: 792KB

.text
Size: 4.9MB - Virtual size: 4.9MB

.rdata
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: 47KB - Virtual size: 81KB

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 788KB - Virtual size: 792KB