3e71495a986ffbb5b727607e28e0b5ef

Sharing

Copy URL Twitter E-mail

General

Target

3e71495a986ffbb5b727607e28e0b5ef
Size

4.9MB
MD5

3e71495a986ffbb5b727607e28e0b5ef
SHA1

b0c22a175fceb13e664b5b228e0273c774f68695
SHA256

ff600ed7bef7a505706da2d79bb363fe070ab9afa8e70cb3477e4240fe5eb8e5
SHA512

070f621993fbcd601549b5d929186b1c1d6c921eb8906f4a20cdfa5ca0c0ea5ba1cdcb933734d2a580a4502e75841c3fccffacbc0003dbf7e3e9e378a5dd9ed1
SSDEEP

98304:2/vUVOt2z7f6z89m61mHh6gjSMd3/ST4PU7M+T4PU7M3/YhG93d:dTf489m6UHn/IGX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e71495a986ffbb5b727607e28e0b5ef

Files

3e71495a986ffbb5b727607e28e0b5ef
.exe windows:6 windows x86 arch:x86

2d0faa6ddee90e56bba784c07254d2a9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SystemTimeToFileTime
LockFileEx
UnlockFile
HeapCompact
GetSystemInfo
DeleteFileA
WaitForSingleObjectEx
LoadLibraryA
CreateFileA
FlushViewOfFile
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
HeapValidate
UnlockFileEx
SetEndOfFile
GetFullPathNameA
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
HeapCreate
AreFileApisANSI
InitializeCriticalSection
TryEnterCriticalSection
GetSystemFirmwareTable
QueryDosDeviceW
TerminateProcess
VirtualAlloc
VirtualFree
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetEnvironmentVariableW
GetDriveTypeW
GetLogicalDrives
GetWindowsDirectoryW
GetNativeSystemInfo
IsWow64Process
ResumeThread
FreeResource
VerSetConditionMask
lstrcpynW
VerifyVersionInfoW
lstrcmpiA
GetCurrentDirectoryW
LocalFileTimeToFileTime
SetFileTime
GetFileInformationByHandle
GetLocalTime
CreateEventW
ResetEvent
SetEvent
GetCommandLineW
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTickCount
ReadConsoleW
GetConsoleMode
GetSystemTime
EnumSystemLocalesW
GetUserDefaultLCID
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
GetFileType
GetStdHandle
ExitThread
ExitProcess
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
VirtualProtect
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
ChangeTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
GetProcessTimes
CreateSemaphoreW
ReleaseSemaphore
GetModuleHandleA
GetModuleFileNameA
CreateFileMappingA
GetFileSizeEx
GetStartupInfoW
UnhandledExceptionFilter
LCMapStringW
CompareStringW
GetCPInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetFilePointerEx
FindFirstFileExW
GetModuleHandleExW
QueueUserWorkItem
SwitchToThread
DuplicateHandle
QueryPerformanceFrequency
GetStringTypeW
LoadLibraryExA
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
IsDebuggerPresent
Sleep
WideCharToMultiByte
GetConsoleCP
FormatMessageA
LocalAlloc
GetComputerNameW
GetSystemDirectoryW
GetVolumeInformationW
DeleteTimerQueueTimer
CreateTimerQueueTimer
TerminateThread
WTSGetActiveConsoleSessionId
lstrcmpW
MultiByteToWideChar
OutputDebugStringW
FlushFileBuffers
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
MulDiv
GlobalHandle
SetCurrentDirectoryW
CreateNamedPipeW
DisconnectNamedPipe
ConnectNamedPipe
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
VirtualQuery
GetCurrentThread
lstrcmpiW
LoadLibraryW
LoadLibraryExW
FreeLibrary
GetPhysicallyInstalledSystemMemory
GetCurrentThreadId
GetCurrentProcessId
CreateMutexW
IsValidLocale
QueryPerformanceCounter
GetPrivateProfileStringW
MoveFileExW
MoveFileW
CopyFileW
lstrlenW
SetLastError
SetFileAttributesW
RemoveDirectoryW
GetFullPathNameW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
SetUnhandledExceptionFilter
GetLocaleInfoW
LocalFree
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleFileNameW
FindResourceExW
GetVersionExW
OpenProcess
GetCurrentProcess
GetTempPathW
GetTempFileNameW
DeleteFileW
GetLongPathNameW
WaitForMultipleObjects
GetProcAddress
GetModuleHandleW
WriteFile
SetFilePointer
ReadFile
GetFileSize
CreateFileW
GetSystemTimeAsFileTime
CreateDirectoryW
lstrcpyW
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
CloseHandle
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileAttributesExW
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
SetStdHandle
DecodePointer

user32

OpenClipboard
CloseClipboard
GetWindow
ExitWindowsEx
GetTopWindow
GetClassNameW
PostMessageW
UnregisterClassW
GetWindowThreadProcessId
LoadStringW
SendMessageW
GetCursorPos
FindWindowA
CreateDialogIndirectParamW
MonitorFromPoint
GetWindowDC
SetActiveWindow
TrackPopupMenu
GetSubMenu
DestroyMenu
SetTimer
SendDlgItemMessageW
SetClipboardData
EmptyClipboard
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
PostThreadMessageW
PostQuitMessage
DestroyWindow
ShowWindow
BringWindowToTop
CreateDialogParamW
CharNextW
GetKeyState
GetSystemMetrics
SetForegroundWindow
GetClientRect
GetWindowLongW
SetWindowLongW
IsWindow
IsWindowVisible
DialogBoxParamW
SwitchToThisWindow
GetDesktopWindow
MessageBoxW
RegisterWindowMessageW
DefWindowProcW
CallWindowProcW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
IsChild
MoveWindow
SetWindowPos
DialogBoxIndirectParamW
GetDlgItem
SetFocus
GetFocus
SetCapture
ReleaseCapture
CreateAcceleratorTableW
DestroyAcceleratorTable
GetDC
ReleaseDC
BeginPaint
EndPaint
InvalidateRect
InvalidateRgn
RedrawWindow
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
ClientToScreen
ScreenToClient
GetSysColor
FillRect
GetParent
LoadCursorW
EndDialog
wsprintfW
GetWindowRect
MapWindowPoints
MonitorFromWindow
GetMonitorInfoW
GetActiveWindow
SetWindowContextHelpId
LoadImageW
MapDialogRect
SetParent
RegisterClassW
UpdateWindow
FindWindowW
LoadMenuW
GetClassLongW
SetCursor
EnableWindow
GetDlgCtrlID
KillTimer

gdi32

CreateSolidBrush
CreateCompatibleBitmap
BitBlt
DeleteObject
GetObjectW
GetDeviceCaps
CreateDIBSection
SelectObject
CreateCompatibleDC
AddFontResourceW
DeleteDC
GetStockObject
CreateFontIndirectW
DPtoLP
SetBkMode
SetTextColor
SetBkColor
SetDIBColorTable
ExtTextOutW

shell32

CommandLineToArgvW
SHFileOperationW
SHGetFolderPathW
SHGetMalloc
SHGetDesktopFolder
Shell_NotifyIconW
ShellExecuteW

ole32

OleUninitialize
OleLockRunning
StringFromGUID2
OleRun
CoInitializeSecurity
CoSetProxyBlanket
CoInitializeEx
StringFromCLSID
CoCreateGuid
CoTaskMemFree
CoUninitialize
CoCreateInstance
CoInitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemRealloc
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
OleInitialize

oleaut32

VariantChangeType
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
VariantClear
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
SysAllocString
VarUI4FromStr
SysFreeString
VariantInit
DispCallFunc
GetErrorInfo
SysStringLen

advapi32

RegCreateKeyExW
AddAce
RegSetValueExW
RegOpenKeyExW
LookupPrivilegeValueW
GetTokenInformation
DuplicateTokenEx
AdjustTokenPrivileges
OpenProcessToken
RegCloseKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
MapGenericMask
GetFileSecurityW
AccessCheck
RegDeleteKeyW
GetLengthSid
GetSidLengthRequired
GetSidSubAuthority
InitializeAcl
InitializeSid
IsValidSid
SetNamedSecurityInfoW
ChangeServiceConfig2W
CloseServiceHandle
ControlService
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
RegDeleteValueW
RegEnumKeyExW
RegQueryInfoKeyW
ConvertSidToStringSidW
RegQueryValueExW
CreateProcessAsUserW
ImpersonateLoggedOnUser
SetTokenInformation
RegisterServiceCtrlHandlerW
SetServiceStatus
StartServiceCtrlDispatcherW
LookupAccountNameW
SystemFunction036
GetAclInformation
GetSecurityDescriptorControl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorSacl
InitializeSecurityDescriptor
MakeAbsoluteSD
SetSecurityDescriptorDacl
RegEnumValueW
SetSecurityInfo
GetAce
GetNamedSecurityInfoW
EnumServicesStatusExW
QueryServiceConfigW
QueryServiceConfig2W
FreeSid
ConvertStringSidToSidW
RegEnumKeyA
RegOpenKeyExA
RegQueryValueExA
EnumServicesStatusW
QueryServiceStatusEx
StartServiceW
CopySid
QueryServiceStatus
EqualSid
LookupAccountSidW

comctl32

_TrackMouseEvent
InitCommonControlsEx

uxtheme

SetWindowTheme

gdiplus

GdipAlloc
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipStartPathFigure
GdipGetImagePalette
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDrawString
GdipGetFontSize
GdipGetFontStyle
GdipGetFamily
GdipDeleteFont
GdipCreateFont
GdipGetFamilyName
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipFillPath
GdipFillRectangleI
GdipGraphicsClear
GdipDrawPath
GdipDrawRectangleI
GdipSetSmoothingMode
GdipCreateBitmapFromGraphics
GdipLoadImageFromStream
GdipSetPenColor
GdipDeletePen
GdipCreatePen1
GdipCreateLineBrushFromRectI
GdipSetSolidFillColor
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipAddPathArcI
GdipClosePathFigure
GdipGetImagePaletteSize
GdipDeletePath
GdipCreatePath
GdipDrawImageRectI
GdipCreateFromHDC
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipLoadImageFromStreamICM
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdiplusShutdown

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

wininet

InternetGetCookieW
InternetSetCookieW

userenv

CreateEnvironmentBlock
UnloadUserProfile

dbghelp

SymGetOptions
SymCleanup
SymFunctionTableAccess64
SymGetModuleBase64
SymInitialize
SymSetOptions
MakeSureDirectoryPathExists
StackWalk64

rpcrt4

UuidToStringW
UuidCreate
RpcStringFreeW

crypt32

CryptMsgClose
CryptMsgGetParam
CertCloseStore
CryptQueryObject

imagehlp

UnMapAndLoad
MapAndLoad

winhttp

WinHttpQueryHeaders
WinHttpSetTimeouts
WinHttpReadData
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpCrackUrl
WinHttpOpenRequest
WinHttpSetOption
WinHttpReceiveResponse
WinHttpSetStatusCallback
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect

ws2_32

socket
send
recv
inet_addr
htons
connect
gethostbyname
inet_ntoa
closesocket
WSAStartup

psapi

GetDeviceDriverBaseNameW
EnumDeviceDrivers
GetProcessImageFileNameW

mpr

WNetGetProviderNameA

shlwapi

PathFileExistsW

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 819KB - Virtual size: 819KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2d0faa6ddee90e56bba784c07254d2a9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

comctl32

uxtheme

gdiplus

version

wininet

userenv

dbghelp

rpcrt4

crypt32

imagehlp

winhttp

ws2_32

psapi

mpr

shlwapi

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rdata Size: 1.6MB - Virtual size: 1.6MB

.data Size: 76KB - Virtual size: 95KB

.rsrc Size: 819KB - Virtual size: 819KB

.reloc Size: 100KB - Virtual size: 100KB

.text
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 1.6MB - Virtual size: 1.6MB

.data
Size: 76KB - Virtual size: 95KB

.rsrc
Size: 819KB - Virtual size: 819KB

.reloc
Size: 100KB - Virtual size: 100KB