3bfa8f591434a71a3e762fb684041175

Sharing

Copy URL

Twitter E-mail

General

Target

3bfa8f591434a71a3e762fb684041175
Size

931KB
MD5

3bfa8f591434a71a3e762fb684041175
SHA1

971b4481a60519a2f5bc990ac18c07ac0946137e
SHA256

143badda9cc574c70bcc22885ba1c51e1c3d681d9796c80ff0e212785337d82f
SHA512

632a6ab16423ea63e96283341f4736f0c5ba48e175541be4bebf40b6e48a10540c171ee767cac39b617ac485a38651c48738e53b5d210e96a981f3ed58ae257c
SSDEEP

24576:awa2WRC3X9ovTzB4uOG6A4Sgt8G0+j4OHISDE:tQ8X9Szd76A4S68o31DE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3bfa8f591434a71a3e762fb684041175

Files

3bfa8f591434a71a3e762fb684041175
.exe windows:6 windows x86 arch:x86

33750815e329ca40359b527b3c3f9520

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegGetValueW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyExW
GetSecurityDescriptorOwner
GetSecurityDescriptorDacl
RegEnumValueW
ImpersonateLoggedOnUser
OpenThreadToken
RevertToSelf
DuplicateToken
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
LookupPrivilegeValueW
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
CloseServiceHandle
GetTokenInformation
ConvertSidToStringSidW
RegisterTraceGuidsW
GetTraceLoggerHandle
TraceEvent
UnregisterTraceGuids
DuplicateTokenEx
ConvertStringSidToSidW
SetTokenInformation
AdjustTokenPrivileges
CreateProcessAsUserW
CreateWellKnownSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenProcessToken
SetNamedSecurityInfoW
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
SetSecurityInfo
CopySid
IsValidSid
GetLengthSid
InitializeAcl
AddAce
GetUserNameW

kernel32

CreateEventW
ResetEvent
InterlockedCompareExchange
InterlockedExchangeAdd
OpenMutexW
SetFileAttributesW
RemoveDirectoryW
MoveFileExW
GetFileAttributesW
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
GetPrivateProfileStringW
ReleaseMutex
WritePrivateProfileStringW
DeviceIoControl
FindNextFileW
FindFirstFileW
FindClose
CreateDirectoryW
GetTempFileNameW
CreateFileW
LockFileEx
UnlockFileEx
DeleteFileW
EnumResourceNamesW
FindResourceExW
LockResource
GetComputerNameExW
GetExitCodeProcess
CreateProcessW
SetEnvironmentVariableA
CompareStringA
ReadFile
FlushFileBuffers
CreateFileA
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
CopyFileW
CreateSemaphoreW
IsProcessorFeaturePresent
ExitThread
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
SetFilePointer
InitializeCriticalSectionAndSpinCount
LoadLibraryA
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapDestroy
HeapCreate
GetCurrentThread
GetCurrentThreadId
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleHandleA
GetStdHandle
WriteFile
ExitProcess
SetUnhandledExceptionFilter
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapReAlloc
HeapAlloc
HeapFree
GetStartupInfoW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedExchange
RaiseException
lstrlenW
InterlockedIncrement
InterlockedDecrement
LocalFree
GetLastError
FormatMessageW
CompareStringW
CloseHandle
WaitForSingleObject
CompareFileTime
SystemTimeToFileTime
QueueUserWorkItem
ReleaseSemaphore
WaitForMultipleObjects
ExpandEnvironmentStringsW
VerifyVersionInfoW
SetEnvironmentVariableW
GetEnvironmentVariableW
OpenProcess
FlushInstructionCache
SetWaitableTimer
GetTempPathW
GetExitCodeThread
CreateWaitableTimerW
GlobalFree
GetFullPathNameW
GetFileSizeEx
GetFileSize
GetLocalTime
QueryFullProcessImageNameW
GetLocaleInfoEx
CreateMutexW
lstrlenA
CreateNamedPipeW
GetNamedPipeServerProcessId
UnmapViewOfFile
MapViewOfFile
FreeLibraryAndExitThread
DuplicateHandle
GetSystemTimeAsFileTime
SetThreadPriority
FreeLibrary
FreeResource
GetThreadPriority
FileTimeToSystemTime
GetLongPathNameW
OpenFileMappingW
GetProcessHeap
GetUserDefaultLocaleName
GetNativeSystemInfo
GetThreadUILanguage
GetProcAddress
LoadLibraryW
GetModuleHandleW
lstrcmpiW
GetProductInfo
TerminateThread
GetFileAttributesExW
GetTickCount64
CreateTimerQueueTimer
DeleteTimerQueueTimer
LoadLibraryExW
GetModuleFileNameW
GetCurrentProcessId
GetSystemDirectoryW
Sleep
HeapSetInformation
FileTimeToLocalFileTime
SetDllDirectoryW
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
SetLastError
WaitForMultipleObjectsEx
GetComputerNameW
GetSystemDefaultLocaleName
GlobalMemoryStatusEx
WerRegisterFile
GetVersionExW
GetSystemDefaultUILanguage
GetSystemDefaultLCID
GetShortPathNameW
GetTempFileNameA
CreateDirectoryA
SetFilePointerEx
RemoveDirectoryA
GetTempPathA
GetFullPathNameA
DeleteFileA
GetFileInformationByHandle
LocalAlloc
SetEvent
OpenEventW
MulDiv
GetSystemTime
CreateFileMappingW
GetFileAttributesA
FileTimeToDosDateTime
GetModuleFileNameA
CreateThread

gdi32

SetTextColor
CreateSolidBrush
GetObjectW
GetStockObject
SetBkMode
CreateFontIndirectW
GetTextMetricsW
SelectObject
DeleteDC
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreatePen
Rectangle
GetDeviceCaps
GetTextExtentPoint32W
ExcludeClipRect
IntersectClipRect
GetClipRgn
CreateRectRgn
CreateRoundRectRgn
DeleteObject
RestoreDC
SaveDC
SetLayout
SetBkColor

user32

SetWindowLongW
ChangeWindowMessageFilter
NotifyWinEvent
CreateAcceleratorTableW
GetMessageW
TranslateAcceleratorW
IsDialogMessageW
DestroyAcceleratorTable
InflateRect
RedrawWindow
MapDialogRect
GetLayeredWindowAttributes
SetLayeredWindowAttributes
PostQuitMessage
SendNotifyMessageW
DestroyWindow
PostMessageW
GetSysColor
IsWindowVisible
EnableWindow
GetParent
ShowWindow
GetWindowLongW
AdjustWindowRectEx
GetDesktopWindow
FillRect
DrawTextW
LoadIconW
ReleaseDC
GetDC
EndDialog
SendMessageW
GetClientRect
GetSystemMetrics
RegisterWindowMessageW
EndPaint
BeginPaint
GetWindowInfo
GetShellWindow
GetClassNameW
GetWindowTextW
GetWindowTextLengthW
MapWindowPoints
IsWindowEnabled
UpdateWindow
PtInRect
GetClassInfoExW
DefWindowProcW
RegisterClassExW
CallWindowProcW
GetAncestor
SetWindowPlacement
DefDlgProcW
EnumChildWindows
CreateDialogIndirectParamW
DialogBoxIndirectParamW
EnableScrollBar
SetScrollInfo
GetScrollPos
GetScrollInfo
IntersectRect
GetScrollRange
GetFocus
TrackMouseEvent
EnableMenuItem
GetSystemMenu
DrawFocusRect
GetDCEx
ScreenToClient
WindowFromPoint
PostThreadMessageW
MsgWaitForMultipleObjects
BringWindowToTop
GetNextDlgTabItem
MoveWindow
InvalidateRect
SetWindowTextW
SetWindowPos
SetWindowRgn
SetRect
PeekMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage
DispatchMessageW
IsWindow
SystemParametersInfoW
GetWindowPlacement
CopyRect
GetWindowRect
LoadCursorW
SetCursor
ExitWindowsEx
GetWindowThreadProcessId
SetFocus
CharNextW
SetProcessDefaultLayout
SetTimer
KillTimer
LoadStringW
CreateWindowExW
UnregisterClassA

sensapi

IsNetworkAlive

urlmon

CreateAsyncBindCtx
IsValidURL
CoInternetGetSession
CreateURLMoniker

msi

ord270
ord48
ord266
ord150
ord78
ord195
ord92
ord32
ord159
ord205
ord113
ord190
ord141
ord254
ord70
ord203
ord173
ord118
ord115
ord244
ord242
ord116
ord88
ord238
ord240
ord8
ord286
ord285
ord160
ord171

comctl32

ord17

wintrust

WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WinVerifyTrustEx

userenv

UnloadUserProfile

secur32

GetUserNameExW

crypt32

CertVerifyCertificateChainPolicy
CryptBinaryToStringW
CryptStringToBinaryW

uxtheme

SetWindowTheme

psapi

EnumProcesses

shlwapi

StrRChrW
PathFindFileNameW
SHDeleteValueW
StrRChrA
StrStrA
SHSetValueW
SHCreateStreamOnFileW
PathFileExistsW
SHDeleteKeyW
PathIsDirectoryW
PathIsRelativeW
PathFindExtensionW
StrStrIW
PathCombineW
SHCreateStreamOnFileEx
SHGetValueW
PathAppendW
PathRemoveFileSpecW
UrlCanonicalizeW
PathStripToRootW
PathStripPathW
PathUnquoteSpacesW
PathRemoveArgsW
UrlCreateFromPathW
PathCreateFromUrlW
PathFindFileNameA
PathFileExistsA
SHCreateStreamOnFileA
PathGetDriveNumberA
PathIsDirectoryA
StrCmpNIW
StrCmpNW
ord437

wininet

InternetCreateUrlW
InternetCombineUrlW
InternetCrackUrlW

gdiplus

GdipDrawImageRectRect
GdipCloneImage
GdipGetLogFontW
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipAlloc
GdipFree
GdipDrawImageRectRectI
GdipCreateFromHDC
GdipGetImageHeight
GdipCreateFont
GdipDisposeImage
GdipCreateBitmapFromStreamICM
GdipDeleteFont
GdipCreateBitmapFromStream
GdipGetImageWidth
GdipDeleteGraphics
GdiplusStartup
GdiplusShutdown
GdipCreateFromHWND
GdipDrawImagePointRectI
GdipDrawImageRectI
GdipDrawImageI

winhttp

WinHttpOpen
WinHttpWriteData
WinHttpAddRequestHeaders
WinHttpTimeFromSystemTime
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpQueryOption
WinHttpSetStatusCallback
WinHttpQueryHeaders
WinHttpReadData
WinHttpSendRequest
WinHttpOpenRequest
WinHttpConnect
WinHttpCrackUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetDefaultProxyConfiguration
WinHttpDetectAutoProxyConfigUrl
WinHttpGetProxyForUrl
WinHttpSetTimeouts
WinHttpSetCredentials

cabinet

ord11
ord14
ord13
ord10

ntdll

RtlAllocateHeap
RtlUnwind
RtlFreeHeap
NtQuerySystemTime
VerSetConditionMask

oleacc

LresultFromObject
AccessibleObjectFromWindow

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wer

WerReportCreate
WerReportSubmit
WerReportAddFile
WerReportSetParameter
WerReportCloseHandle
WerReportSetUIOption

rstrtmgr

RmShutdown
RmRestart
RmCancelCurrentTask
RmEndSession
RmStartSession
RmAddFilter
RmRegisterResources

wsock32

inet_addr
gethostbyname
WSACleanup
WSAGetLastError
WSAStartup

shell32

SHGetFolderPathAndSubDirW
ord165
ord43
SHGetFolderPathW
CommandLineToArgvW
SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHGetKnownFolderPath
ShellExecuteExW
SHGetFolderPathA

ole32

CreateStreamOnHGlobal
StringFromGUID2
CoCreateGuid
CoQueryProxyBlanket
CoCopyProxy
CoCreateFreeThreadedMarshaler
CoRegisterClassObject
CoInitializeSecurity
CoSetProxyBlanket
CoRevokeClassObject
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoInitializeEx
CoUninitialize
CoCreateInstance

oleaut32

LoadRegTypeLi
VariantCopy
SysAllocStringLen
VariantChangeType
SysStringLen
VariantClear
VariantInit
VarUI4FromStr
SysAllocString
SysFreeString
LoadTypeLibEx
LoadTypeLi

Sections

.text
Size: 923KB - Virtual size: 922KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 142.6MB - Virtual size: 142.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

33750815e329ca40359b527b3c3f9520

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

sensapi

urlmon

msi

comctl32

wintrust

userenv

secur32

crypt32

uxtheme

psapi

shlwapi

wininet

gdiplus

winhttp

cabinet

ntdll

oleacc

version

wer

rstrtmgr

wsock32

shell32

ole32

oleaut32

Sections

.text Size: 923KB - Virtual size: 922KB

.data Size: 17KB - Virtual size: 38KB

.rsrc Size: 142.6MB - Virtual size: 142.6MB

.reloc Size: 59KB - Virtual size: 59KB

.text
Size: 923KB - Virtual size: 922KB

.data
Size: 17KB - Virtual size: 38KB

.rsrc
Size: 142.6MB - Virtual size: 142.6MB

.reloc
Size: 59KB - Virtual size: 59KB