2f07aa59ed59ca7573043c2fc434610bf987f13acb7745f2c65c1f4180ad1209

Sharing

Copy URL

Twitter E-mail

General

Target

2f07aa59ed59ca7573043c2fc434610bf987f13acb7745f2c65c1f4180ad1209
Size

4.8MB
MD5

36fc86093f1e5f9f599629167ea464bd
SHA1

5af66f1d27f49243f128f71454f458a0af5ba45c
SHA256

2f07aa59ed59ca7573043c2fc434610bf987f13acb7745f2c65c1f4180ad1209
SHA512

69e00f11e7b43ee3c7c0d0ad2df327504846cebc2656486806ec5bd23457dbf8f3cefe4cf55fbe299b3e74a8167c8b8e132298b529c4044318c28359746ac5e5
SSDEEP

98304:xw9h2dssoUWm2ANQ+r9+rXoHcSIjrxdj61:i9h2dssoUV2bQctnxN61

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f07aa59ed59ca7573043c2fc434610bf987f13acb7745f2c65c1f4180ad1209

Files

2f07aa59ed59ca7573043c2fc434610bf987f13acb7745f2c65c1f4180ad1209
.exe windows:5 windows x86 arch:x86

aeb60504157277657640c64c52d0c67b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
VirtualFree
GetCurrentDirectoryW
GetFileInformationByHandle
GetStdHandle
SetFileTime
SetFilePointer
SetEndOfFile
GetFileSize
CompareFileTime
GetModuleHandleA
LoadLibraryA
lstrlenA
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
InterlockedCompareExchange
IsBadReadPtr
GetSystemTime
GetVersionExA
GetLocalTime
GetVersionExW
GetTickCount
MulDiv
GetFullPathNameW
EnumResourceNamesW
EnumResourceTypesW
FreeResource
GetCurrentThreadId
GetCurrentProcess
HeapCreate
FlushInstructionCache
InterlockedDecrement
InterlockedIncrement
FreeLibrary
LoadLibraryW
GetDiskFreeSpaceExW
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindFirstFileExW
SetStdHandle
GetTimeZoneInformation
EnumSystemLocalesW
OpenProcess
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleCP
FlushFileBuffers
SetConsoleCtrlHandler
GetACP
ExitProcess
ExitThread
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
GetFileAttributesExW
GetCommandLineW
GetCommandLineA
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualProtect
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
SystemTimeToFileTime
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
DeleteFiber
SwitchToFiber
GetModuleHandleExW
SetConsoleMode
ReadConsoleW
ReadConsoleA
GetConsoleMode
GetEnvironmentVariableW
WaitForMultipleObjects
PeekNamedPipe
GetFileType
GetEnvironmentVariableA
WaitForSingleObject
MoveFileExA
VerifyVersionInfoW
VerSetConditionMask
SleepEx
FormatMessageA
SwitchToThread
InitializeSListHead
GetStartupInfoW
GetVolumePathNameW
TerminateProcess
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetFilePointerEx
FileTimeToSystemTime
SetFileAttributesW
GetSystemDirectoryW
SetLastError
GetFileSizeEx
ReadFile
CreateDirectoryW
SetCurrentDirectoryW
CreateMutexW
GetModuleFileNameW
lstrcmpW
lstrcpyW
WideCharToMultiByte
GetModuleHandleW
GetCurrentProcessId
GetProcAddress
FindResourceW
LoadResource
CloseHandle
DeleteFileW
LockResource
lstrcatW
Sleep
MultiByteToWideChar
GetFileAttributesW
CreateFileW
FindClose
RemoveDirectoryW
OutputDebugStringA
WriteFile
FindNextFileW
FindFirstFileW
SizeofResource
GetProcessHeap
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
SetEvent
GlobalUnlock
GlobalLock
GlobalAlloc
LocalFree
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
TlsAlloc
CreateEventW
InitializeCriticalSectionAndSpinCount
QueryPerformanceFrequency
QueryPerformanceCounter
EncodePointer
GetExitCodeThread
GetCurrentThread
WaitForSingleObjectEx
DuplicateHandle
TryEnterCriticalSection
FormatMessageW
OutputDebugStringW
IsDebuggerPresent
InitializeCriticalSectionEx
GetUserDefaultLCID
HeapFree

user32

SetFocus
GetDlgCtrlID
GetUserObjectInformationW
GetProcessWindowStation
DrawIconEx
GetWindowDC
UnregisterClassW
EnumWindows
GetPropW
PostMessageW
GetWindowThreadProcessId
IsIconic
SetForegroundWindow
FindWindowW
BringWindowToTop
ShowWindow
GetActiveWindow
GetCapture
DestroyIcon
OffsetRect
CopyRect
GetDlgItem
SystemParametersInfoW
ReleaseDC
MonitorFromRect
IsWindowVisible
SetWindowRgn
InvalidateRect
SetWindowTextW
GetWindowTextW
GetClientRect
CreateCaret
HideCaret
ShowCaret
ClientToScreen
IsWindowEnabled
KillTimer
SetTimer
ReleaseCapture
MessageBoxW
SetCapture
GetDC
GetWindowRect
SendMessageW
SendNotifyMessageW
DefWindowProcW
CallWindowProcW
RegisterClassExW
CreateWindowExW
IsWindow
DestroyWindow
IsZoomed
SetWindowPos
MoveWindow
SetLayeredWindowAttributes
InflateRect
TrackMouseEvent
CharUpperW
MapVirtualKeyA
CharLowerBuffW
GetForegroundWindow
CallMsgFilterW
CheckMenuRadioItem
GetMenuContextHelpId
SetMenuContextHelpId
GetMenuItemInfoW
SetMenuInfo
GetMenuInfo
TrackPopupMenu
DeleteMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
GetSubMenu
CheckMenuItem
DestroyMenu
CreatePopupMenu
IsMenu
SetCaretPos
SystemParametersInfoA
DrawTextW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetSystemMetrics
GetSysColor
EnableMenuItem
SetRect
WaitMessage
PostThreadMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
DestroyCursor
GetDesktopWindow
SetActiveWindow
EnableWindow
GetIconInfo
CharNextW
WindowFromPoint
GetClassNameW
GetCursorPos
EndPaint
BeginPaint
UpdateWindow
AnimateWindow
ScreenToClient
LoadImageW
CreateIconFromResource
LoadBitmapW
PtInRect
EqualRect
IsRectEmpty
UnionRect
IntersectRect
SetCursor
GetKeyState
GetFocus
PostQuitMessage
GetMonitorInfoW
MonitorFromWindow
LoadCursorW
GetWindow
SetParent
GetParent
SetWindowLongW
GetWindowLongW
MapWindowPoints
UpdateLayeredWindow

gdi32

SetGraphicsMode
SelectObject
DeleteDC
CreateCompatibleDC
CreateBitmap
EnumFontsW
DeleteObject
RectInRegion
ExcludeClipRect
BitBlt
GetClipBox
GetDeviceCaps
RemoveFontMemResourceEx
ExtCreateRegion
IntersectClipRect
SelectClipRgn
SetWorldTransform
CreateDIBSection
GetCurrentObject
GetViewportOrgEx
CreateFontIndirectW
GetStockObject
Rectangle
SetBkMode
GetObjectW
StretchBlt
SetViewportOrgEx
SetTextColor
SetTextAlign
GetTextMetricsW
ExtTextOutW
GetTextFaceW
CreateSolidBrush
EnumFontFamiliesExW
GetCharABCWidthsW
GetFontData
GetGlyphOutlineW
GetOutlineTextMetricsW
GetFontUnicodeRanges
GetGlyphIndicesW
GetTextExtentPointI
AddFontMemResourceEx
GdiFlush

advapi32

RegisterEventSourceW
ReportEventW
CryptGenRandom
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptSignHashW
CryptEnumProvidersW
CryptDestroyKey
CryptAcquireContextW
CryptDecrypt
CryptCreateHash
CryptDeriveKey
CryptHashData
CryptDestroyHash
DeregisterEventSource
CryptReleaseContext
RegCloseKey
RegDeleteKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyW
RegDeleteValueW
RegQueryValueExW

shell32

SHCreateDirectoryExW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHBrowseForFolderW
ShellExecuteW

ole32

CreateBindCtx
CLSIDFromProgID
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
IIDFromString
CoCreateGuid
CoInitialize
CoUninitialize
CoCreateInstance
RegisterDragDrop
OleLockRunning
CLSIDFromString
CoTaskMemFree

oleaut32

SysStringLen
SysAllocStringLen
SysFreeString
SysAllocString

shlwapi

PathRemoveFileSpecW
PathRemoveBackslashW
PathCombineW
StrToIntExW
PathFileExistsW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wldap32

ord216
ord14
ord219
ord145
ord46
ord73
ord208
ord41
ord117
ord26
ord27
ord127
ord167
ord142
ord79
ord133
ord147
ord301

crypt32

CertFindCertificateInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertOpenStore
CertOpenSystemStoreA
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext

imm32

ImmDestroyContext
ImmGetContext
ImmAssociateContext
ImmCreateContext
ImmReleaseContext

gdiplus

GdipBitmapLockBits
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectI
GdipGraphicsClear
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipAlloc

ws2_32

recvfrom
getnameinfo
ntohl
gethostname
sendto
shutdown
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
socket
WSAStartup
closesocket
recv
send
WSAGetLastError
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSASetLastError
WSAIoctl
WSACleanup
accept
htonl
listen
ioctlsocket

usp10

ScriptShape
ScriptItemize
ScriptFreeCache

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 92KB - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 37B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99.2MB - Virtual size: 99.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 231KB - Virtual size: 230KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aeb60504157277657640c64c52d0c67b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

wldap32

crypt32

imm32

gdiplus

ws2_32

usp10

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 1.0MB - Virtual size: 1.0MB

.data Size: 92KB - Virtual size: 195KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 37B

.rsrc Size: 99.2MB - Virtual size: 99.2MB

.reloc Size: 231KB - Virtual size: 230KB

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: 92KB - Virtual size: 195KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 37B

.rsrc
Size: 99.2MB - Virtual size: 99.2MB

.reloc
Size: 231KB - Virtual size: 230KB