3ce0a77699e792839be467ef5a5925a9

Sharing

Copy URL

Twitter E-mail

General

Target

3ce0a77699e792839be467ef5a5925a9
Size

332KB
MD5

3ce0a77699e792839be467ef5a5925a9
SHA1

d83589009561d10b94ae5337a9bd2b0c1c49ca05
SHA256

6a13edbb984930bd83aea18911e78d987b08c805b5ee80d75c5f9ddad4122b6a
SHA512

c40f5fa5a392f150c78ac471a80fb38dad45f803dbbcc1f2e2ca5d244b7768b4ce4f76bad1e3e83636aab72de3a2acb7d99368b162db4b930b11715588ba670e
SSDEEP

6144:N33iBJ5BISNIdHo07BR+Hgi59m9YP2dFlxaIfP6DsQzIZV:N33S5B4F7BigiHm2P2PSDsnZV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3ce0a77699e792839be467ef5a5925a9

Files

3ce0a77699e792839be467ef5a5925a9
.exe windows:4 windows x86 arch:x86

3403f226111e6fa8c295b21406c184cc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

htons
htonl
getsockopt
getsockname
getservbyport
getservbyname
getpeername
gethostname
gethostbyname
inet_addr
ioctlsocket
listen
WSACleanup
gethostbyaddr
connect
closesocket
bind
accept
__WSAFDIsSet
WSAStartup
WSASocketW
WSASetLastError
WSASend
WSAResetEvent
WSARecv
WSAGetOverlappedResult
WSAGetLastError
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
inet_ntoa
socket
shutdown
setsockopt
sendto
send
select
recvfrom
recv
ntohs
ntohl

user32

SetClipboardData
SetClassLongW
SetCapture
SendInput
ScrollDC
ScreenToClient
RemovePropW
ReleaseDC
ReleaseCapture
RegisterWindowMessageW
RegisterClipboardFormatW
RegisterClassExW
RedrawWindow
RealGetWindowClassW
PostQuitMessage
PostMessageW
PeekMessageW
OpenClipboard
MsgWaitForMultipleObjectsEx
MonitorFromWindow
MessageBoxW
MessageBeep
MapWindowPoints
LoadKeyboardLayoutW
LoadImageW
LoadCursorW
KillTimer
CallNextHookEx
CallWindowProcW
SetCursor
CreateIconIndirect
CreatePopupMenu
CreateWindowExW
DefWindowProcA
DefWindowProcW
DestroyIcon
DestroyWindow
DispatchMessageW
DrawEdge
DrawFocusRect
DrawFrameControl
DrawIconEx
DrawTextW
EmptyClipboard
EnumDisplayMonitors
EnumDisplaySettingsW
EnumThreadWindows
FillRect
FrameRect
GetAsyncKeyState
GetCaretBlinkTime
GetClassNameW
GetClipboardData
GetCursor
GetDC
GetFocus
GetForegroundWindow
GetGuiResources
GetKeyState
CallMsgFilterW
SetFocus
SetParent
SetPropW
SetTimer
SetWindowLongA
SetWindowLongW
SetWindowPos
SetWindowRgn
SetWindowsHookExW
SystemParametersInfoW
TrackMouseEvent
TrackPopupMenu
TranslateMessage
UnhookWindowsHookEx
UnregisterClassA
UnregisterClassW
WaitMessage
CloseClipboard
GetKeyboardLayout
GetMessageTime
GetMonitorInfoW
GetParent
GetPropW
GetQueueStatus
GetSysColor
GetSysColorBrush
IsWindow
IsClipboardFormatAvailable
InvertRect
InvalidateRect
InsertMenuItemW
InflateRect
GetWindowThreadProcessId
GetWindowRect
GetWindowLongW
GetSystemMetrics

kernel32

lstrcmpiA
WriteFile
WriteConsoleW
WriteConsoleA
WideCharToMultiByte
WaitForSingleObject
VirtualProtect
VirtualFree
VirtualAlloc
UnregisterWaitEx
UnmapViewOfFile
UnlockFile
UnhandledExceptionFilter
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
TerminateProcess
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
SuspendThread
Sleep
SizeofResource
SetUnhandledExceptionFilter
SetThreadPriority
SetStdHandle
SetLastError
SetHandleCount
SetFilePointerEx
SetFilePointer
SetFileAttributesA
SetEvent
SetEnvironmentVariableA
SetEndOfFile
SetCurrentDirectoryW
RtlUnwind
ResumeThread
ResetEvent
RemoveDirectoryW
ReleaseSemaphore
ReleaseMutex
RegisterWaitForSingleObject
ReadFile
RaiseException
QueueUserWorkItem
AreFileApisANSI
CancelIo
CloseHandle
CompareStringA
CompareStringW
CreateDirectoryA
CreateDirectoryW
CreateEventW
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateIoCompletionPort
CreateMutexW
CreateProcessW
CreateSemaphoreA
CreateSemaphoreW
CreateThread
DeleteCriticalSection
DeleteFileA
DeleteFileW
DuplicateHandle
EnterCriticalSection
EnumSystemLocalesA
ExitProcess
ExitThread
ExpandEnvironmentStringsW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileW
FindResourceW
FlushFileBuffers
FormatMessageA
FormatMessageW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetComputerNameA
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCurrencyFormatW
GetCurrentDirectoryA
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDiskFreeSpaceA
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDriveTypeA
GetDriveTypeW
GetEnvironmentStringsA
GetEnvironmentStringsW
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetFileType
GetFullPathNameA
GetFullPathNameW
GetLastError
GetLocaleInfoA
GetLocaleInfoW
GetLogicalDriveStringsW
GetLogicalDrives
GetLongPathNameW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetNumberFormatW
GetOEMCP
GetPrivateProfileStringW
GetProcAddress
GetProcessHeap
GetQueuedCompletionStatus
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempFileNameW
GetTempPathA
GetTempPathW
GetThreadContext
GetThreadLocale
GetThreadTimes
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetUserDefaultLangID
GetVersionExA
GetVersionExW
GetVolumeInformationA
GetWindowsDirectoryW
GlobalAddAtomW
GlobalAlloc
GlobalDeleteAtom
GlobalFree
GlobalLock
GlobalMemoryStatus
GlobalMemoryStatusEx
GlobalSize
GlobalUnlock
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
InterlockedIncrement
IsBadWritePtr
IsDebuggerPresent
IsValidCodePage
IsValidLocale
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalAlloc
LocalFileTimeToFileTime
LocalFree
LockFile
LockFileEx
LockResource
MapViewOfFile
MoveFileA
MoveFileExW
MultiByteToWideChar
OpenThread
OutputDebugStringA
PeekNamedPipe
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency

crypt32

CertSerializeCertificateStoreElement
CertAddCertificateContextToStore
CertAddEncodedCertificateToStore
CertAddSerializedElementToStore
CertCloseStore
CertDuplicateCertificateContext
CertFindChainInStore
CertFindExtension
CertFreeCertificateChain
CertFreeCertificateContext
CryptHashCertificate
CryptDecodeObjectEx
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertOpenSystemStoreW
CertOpenStore
CertNameToStrW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

ole32

CoCreateGuid
CoCreateInstance
CoInitialize
CoUninitialize
OleInitialize
OleUninitialize
RegisterDragDrop
ReleaseStgMedium
RevokeDragDrop
StringFromGUID2

shell32

CommandLineToArgvW
DragQueryFileW
SHFileOperationW
SHGetFolderPathW
SHGetSpecialFolderPathW
ShellExecuteW
DragFinish

shlwapi

PathFindExtensionW
PathFileExistsA
PathFindFileNameW
PathGetCharTypeW
PathIsUNCA
PathIsUNCW
PathRemoveExtensionW
UrlCreateFromPathA
PathFileExistsW
UrlCreateFromPathW

comdlg32

PrintDlgExW
GetSaveFileNameW

winspool.drv

GetPrinterW
OpenPrinterW
ClosePrinter
ord203

advapi32

AllocateAndInitializeSid
UnregisterTraceGuids
CopySid
FreeSid
GetLengthSid
GetTokenInformation
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
InitializeSecurityDescriptor
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExA
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExA
RegQueryValueExW
RegisterTraceGuidsW
SetSecurityDescriptorDacl
TraceEvent

gdi32

SelectClipRgn
SaveDC
RestoreDC
RemoveFontMemResourceEx
Rectangle
PolyBezier
PathToRegion
GetTextMetricsW
GetTextFaceW
GetTextColor
GetStretchBltMode
GetStockObject
GetOutlineTextMetricsW
GetObjectW
GetGlyphOutlineW
GetGlyphIndicesW
GetFontUnicodeRanges
GetFontData
GetDeviceCaps
GetCurrentObject
GetCharWidthI
GdiFlush
SelectObject
ExtCreatePen
EnumFontFamiliesExW
EndPath
EndPage
EndDoc
DeleteObject
DeleteDC
CreateSolidBrush
CreateRectRgnIndirect
CreateRectRgn
CreatePen
CreateFontW
CreateFontIndirectW
CreateDIBSection
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
CreateBitmap
CombineRgn
BitBlt
BeginPath
AddFontMemResourceEx
AbortPath
SetAbortProc
SetArcDirection
SetBkColor
SetBkMode
SetBrushOrgEx
SetDCBrushColor
SetDCPenColor
SetDIBits
SetGraphicsMode
SetMiterLimit
SetPolyFillMode
SetROP2
SetRectRgn
SetStretchBltMode
SetTextColor
SetWorldTransform
StartDocW
StartPage
StretchDIBits
StrokeAndFillPath
StrokePath
ExtTextOutW

comctl32

InitCommonControlsEx

Exports

Exports

cef_browser_create
cef_browser_create_sync
cef_bsupports_mime_type
cef_clear_htmlcache
cef_delete_all_cookies
cef_delete_cookie
cef_do_message_loop_work
cef_initialize
cef_post_data_create
cef_post_data_element_create
cef_register_extension
cef_register_plugin
cef_register_scheme
cef_request_create
cef_set_cookie
cef_shutdown
cef_stream_reader_create_for_data
cef_stream_reader_create_for_file
cef_stream_reader_create_for_handler
cef_stream_writer_create_for_file
cef_stream_writer_create_for_handler
cef_string_alloc
cef_string_alloc_length
cef_string_free
cef_string_length
cef_string_list_alloc
cef_string_list_append
cef_string_list_clear
cef_string_list_free
cef_string_list_size
cef_string_list_value
cef_string_map_alloc
cef_string_map_append
cef_string_map_clear
cef_string_map_find
cef_string_map_free
cef_string_map_key
cef_string_map_size
cef_string_map_value
cef_string_realloc
cef_string_realloc_length
cef_v8value_create_array
cef_v8value_create_bool
cef_v8value_create_double
cef_v8value_create_function
cef_v8value_create_int
cef_v8value_create_null
cef_v8value_create_object
cef_v8value_create_string
cef_v8value_create_undefined

Sections

.text
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 80KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3403f226111e6fa8c295b21406c184cc

Headers

File Characteristics

Imports

ws2_32

user32

kernel32

crypt32

version

ole32

shell32

shlwapi

comdlg32

winspool.drv

advapi32

gdi32

comctl32

Exports

Exports

Sections

.text Size: 100KB - Virtual size: 100KB

.rdata Size: 112KB - Virtual size: 112KB

.data Size: 80KB - Virtual size: 1.7MB

.idata Size: 16KB - Virtual size: 16KB

.rsrc Size: 20KB - Virtual size: 20KB

.text
Size: 100KB - Virtual size: 100KB

.rdata
Size: 112KB - Virtual size: 112KB

.data
Size: 80KB - Virtual size: 1.7MB

.idata
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 20KB - Virtual size: 20KB