48ab2f8453be371c03cc66a2afbb1131

Sharing

Copy URL

Twitter E-mail

General

Target

48ab2f8453be371c03cc66a2afbb1131
Size

415KB
MD5

48ab2f8453be371c03cc66a2afbb1131
SHA1

426ea244f4213a76cc97060d2911053896e40c3a
SHA256

e82693b6585d9b0b7b81b731897cc873b585f22b4e4991a3d07ddd1652261f31
SHA512

386317fe97837ae3196bc10366f32d9e251a999f9aa0fb6f1349db861deecb5c408b50120cc624480a95213cee4ea09daa3e2c15e2f571d51bedb8a399f2e485
SSDEEP

12288:Va9C4Qeb3m9k+L3hH+WfFbEc0UtFDTM2:ViGeK9k+LkebSw42

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48ab2f8453be371c03cc66a2afbb1131

Files

48ab2f8453be371c03cc66a2afbb1131
.exe windows:5 windows x86 arch:x86

a9249b916ca3f9099a52488e68b47473

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

abort
_wtoi
_ftol
wcsncpy
__CxxFrameHandler
vswprintf
sprintf
_CxxThrowException
tolower
realloc
memset
fread
strncpy
_vscwprintf
_setjmp3
longjmp
_mbsstr
time
fprintf
_iob
strtod
_CIpow
_wcsnicmp
_wcsicmp
wcscmp
wcsspn
wcscspn
_strlwr
strtok
??1type_info@@UAE@XZ
_controlfp
_onexit
__dllonexit
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
memmove
wcslen
_wcslwr
wcsrchr
malloc
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
free
?terminate@@YAXXZ
_except_handler3

advapi32

OpenThreadToken
ImpersonateSelf
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegDeleteKeyW
RegEnumKeyW
RegQueryInfoKeyW
RegDeleteValueA
RegDeleteValueW
RegQueryValueExA
RegQueryValueExW
RegSetValueExA
RegSetValueExW
RegCreateKeyExW
RegFlushKey
OpenProcessToken
RegCloseKey
RegOpenKeyExW
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
FreeSid
RevertToSelf
AccessCheck
IsValidSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
RegEnumKeyA

kernel32

GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
GetStartupInfoA
GetModuleHandleA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
IsValidLocale
LoadLibraryA
GetCurrentProcessId
GetUserDefaultLCID
lstrcpynA
GetCurrentDirectoryW
GetWindowsDirectoryW
SetCurrentDirectoryW
GetDateFormatW
GetTimeFormatW
GetSystemTimeAsFileTime
GetLocalTime
SystemTimeToFileTime
ExpandEnvironmentStringsW
FindFirstFileW
GetTempPathW
GetTempFileNameW
GetModuleFileNameW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
FormatMessageW
GetSystemDefaultUILanguage
GlobalMemoryStatus
CreateDirectoryW
GlobalFree
GetFileAttributesW
MulDiv
CreateEventA
SetUnhandledExceptionFilter
GetCommandLineW
GetModuleHandleW
WideCharToMultiByte
VirtualAlloc
VirtualFree
GetTempFileNameA
GetWindowsDirectoryA
FileTimeToSystemTime
ExpandEnvironmentStringsA
SearchPathA
GetTempPathA
GetFileAttributesA
CopyFileA
CreateFileA
DeleteFileA
CompareFileTime
CompareStringA
GetLocaleInfoW
FormatMessageA
GetSystemTime
IsBadStringPtrA
IsBadStringPtrW
IsBadWritePtr
ResumeThread
TerminateThread
WaitForMultipleObjects
GetSystemDefaultLCID
lstrcpyW
SetLastError
FlushInstructionCache
lstrcmpiA
lstrcmpA
SetFilePointer
MoveFileExW
SetErrorMode
CreateFileMappingA
CreateMutexA
DuplicateHandle
CreateProcessW
ReleaseMutex
GlobalLock
GlobalUnlock
VirtualQuery
GetSystemInfo
GetVersion
VirtualProtect
FindClose
MoveFileW
LocalAlloc
IsDBCSLeadByteEx
GlobalAlloc
SetThreadLocale
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
LocalFree
OpenEventW
SetEvent
ResetEvent
DeleteFileW
CompareStringW
WriteFile
ReadFile
lstrcpynW
lstrcmpW
lstrlenW
lstrcmpiW
CreateFileW
GetLastError
GetFileSize
MultiByteToWideChar
LoadLibraryW
GetProcAddress
FreeLibrary
GetTickCount
lstrlenA
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
Sleep
CreateEventW
CreateThread
InterlockedDecrement
InterlockedIncrement
WaitForSingleObject
CloseHandle
DeleteCriticalSection
InitializeCriticalSection
GetCurrentThread
FindResourceA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
RaiseException
GetVersionExW

gdi32

CreatePalette
Ellipse
GetClipRgn
CreateRectRgn
SelectClipRgn
CreateDCW
LPtoDP
SaveDC
SetWindowOrgEx
SetViewportOrgEx
GetSystemPaletteEntries
GetPaletteEntries
BitBlt
CreateCompatibleBitmap
LineTo
MoveToEx
CreatePen
SetDIBits
GetDIBits
EnumFontFamiliesExW
CreateFontIndirectW
DPtoLP
SetBkMode
GetTextExtentPoint32W
FillRgn
CreatePolygonRgn
GetTextMetricsW
Polygon
CreateBitmap
IntersectClipRect
GetClipBox
SetTextAlign
GetTextAlign
ExcludeClipRect
Rectangle
GetMapMode
SetMapMode
GetViewportExtEx
GetWindowExtEx
CreateRectRgnIndirect
RestoreDC
GetStockObject
GetLayout
SetLayout
StretchBlt
GetDIBColorTable
SetTextColor
SetBkColor
CreateHalftonePalette
SelectPalette
RealizePalette
CreateSolidBrush
DeleteObject
GetDeviceCaps
CreateDIBSection
GetObjectW
SetDIBColorTable
SelectObject
DeleteDC
CreateCompatibleDC

user32

CreateWindowExW
CharUpperA
GetClassInfoExA
RegisterClassExA
CreateWindowExA
LoadMenuW
GetDlgItemInt
SetDlgItemInt
CheckRadioButton
LoadIconW
CheckDlgButton
LoadBitmapW
CreateDialogParamW
GetWindowLongA
SetWindowLongA
IsDlgButtonChecked
CloseWindow
GetDlgCtrlID
DrawEdge
GetLastActivePopup
GetAsyncKeyState
GetScrollInfo
CreateAcceleratorTableW
CharNextW
GetClassNameW
DestroyAcceleratorTable
InvalidateRgn
SetCapture
GetWindowTextW
SetWindowTextW
SetDlgItemTextW
ScreenToClient
LoadStringA
ModifyMenuW
SetCursorPos
MessageBoxW
IsDialogMessageW
MessageBeep
SetWindowPos
SetRectEmpty
CreatePopupMenu
BeginDeferWindowPos
EndDeferWindowPos
LoadBitmapA
RegisterClassW
RegisterWindowMessageW
GetDoubleClickTime
SetMenuDefaultItem
MoveWindow
GetForegroundWindow
TrackPopupMenuEx
DestroyIcon
LoadImageA
TrackPopupMenu
GetSysColor
DrawTextW
GetSystemMetrics
SetParent
LoadIconA
LoadMenuA
SetMenu
SetWindowPlacement
UpdateWindow
AdjustWindowRect
LoadCursorA
SetCursor
RedrawWindow
DialogBoxParamW
GetDlgItemTextW
GetDlgItem
EndDialog
EnableWindow
SendMessageW
GetKeyState
GetFocus
GetNextDlgTabItem
CheckMenuItem
GetMenuItemID
GetMenuItemCount
EnableMenuItem
RemoveMenu
InsertMenuItemW
CheckMenuRadioItem
DeleteMenu
SetMenuItemInfoW
GetCursorPos
GetMenu
GetSubMenu
IsMenu
GetMenuItemInfoW
DestroyMenu
GetParent
FindWindowExW
GetWindowRect
DrawAnimatedRects
IsZoomed
IsWindow
ShowWindow
IsWindowVisible
GetWindowPlacement
SetPropA
GetPropA
CallWindowProcW
RemovePropA
SetForegroundWindow
InvalidateRect
GetSysColorBrush
FillRect
GetClientRect
GetDC
ReleaseDC
SetFocus
OpenInputDesktop
GetUserObjectInformationW
CloseDesktop
FindWindowW
CharPrevW
PostQuitMessage
GetClassInfoExW
RegisterClassExW
ReleaseCapture
DestroyWindow
DefWindowProcW
LoadStringW
GetWindowLongW
SetWindowLongW
KillTimer
SetTimer
PostMessageW
PostThreadMessageW
GetMessageW
TranslateMessage
DispatchMessageW
UnregisterClassW
IsClipboardFormatAvailable
GetDialogBaseUnits
DrawMenuBar
IsIconic
FlashWindow
GetMenuState
wsprintfW
IsChild
EqualRect
IsWindowEnabled
EnumChildWindows
MessageBoxIndirectW
EndPaint
BeginPaint
SystemParametersInfoW
SendDlgItemMessageW
PeekMessageW
LoadCursorW
GetWindowDC
LoadImageW
DrawFocusRect
InflateRect
OffsetRect
DeferWindowPos
GetUpdateRect
GetWindow
PtInRect
GetWindowTextLengthW
GetDesktopWindow
UnhookWindowsHookEx
GetLastInputInfo
CallNextHookEx
SetWindowsHookExW
MapWindowPoints
ClientToScreen
SetRect
AdjustWindowRectEx
MsgWaitForMultipleObjects
GetMessageTime
IntersectRect
WindowFromDC
ValidateRect
UnionRect
SetWindowRgn

ole32

StgOpenStorageOnILockBytes
IIDFromString
CoInitialize
CoUninitialize
StringFromCLSID
CoGetClassObject
OleLockRunning
OleFlushClipboard
OleRegGetMiscStatus
CreateOleAdviseHolder
OleRegGetUserType
OleRegEnumVerbs
OleSaveToStream
WriteClassStm
OleLoadFromStream
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
OleCreateStaticFromData
OleRun
DoDragDrop
CoTaskMemAlloc
CoCreateGuid
CoTaskMemFree
StringFromGUID2
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
RegisterDragDrop
RevokeDragDrop
CoCreateInstance
CoRegisterClassObject
CoRevokeClassObject
OleUninitialize
OleInitialize
GetHGlobalFromILockBytes

oleaut32

SysStringLen
SysAllocStringLen
LoadRegTypeLi
SafeArrayGetElement
SafeArrayGetUBound
SysAllocString
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit
VariantCopy
VariantChangeType
VariantClear
SysFreeString
SafeArrayGetLBound
CreateStdDispatch
VarCmp
SysStringByteLen
SafeArrayDestroy
OleCreateFontIndirect
LoadTypeLi
OleCreatePropertyFrame
SysAllocStringByteLen
SafeArrayCreateVector

comdlg32

GetOpenFileNameW
GetSaveFileNameW
ChooseFontW

shell32

ShellExecuteW
DragQueryFileW
SHGetFolderPathW
Shell_NotifyIconW
Shell_NotifyIconA
SHAppBarMessage
DragFinish
DragAcceptFiles
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetMalloc
ShellExecuteExW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
VerQueryValueW

winmm

PlaySoundW
waveInGetNumDevs
waveOutGetNumDevs

shlwapi

StrCmpIW
SHGetValueW
StrCmpNW
StrChrW
StrStrW
StrToIntExW
StrStrIW
StrCatBuffW
StrPBrkW
wnsprintfW
StrTrimW
StrRChrW
wnsprintfA
StrChrA
StrStrA
StrStrIA
StrCmpNA
ord176
StrTrimA
StrCatBuffA
StrRChrA
StrCpyNW
SHGetInverseCMAP
StrCmpNIW

gdiplus

GdipFree
GdipDeleteGraphics
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdiplusStartup
GdipDrawImageI
GdipGetImageGraphicsContext
GdipAlloc
GdipCloneImage
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdiplusShutdown

msimg32

AlphaBlend
TransparentBlt

wininet

InternetReadFile
InternetOpenUrlW
InternetSetStatusCallbackW
InternetOpenW
HttpQueryInfoW
InternetCloseHandle
InternetCrackUrlW
ResumeSuspendedDownload
HttpSendRequestW
GetUrlCacheEntryInfoW
InternetOpenA
InternetConnectW
InternetSetOptionW
HttpOpenRequestW
InternetSetOptionA
InternetCanonicalizeUrlW

cryptdll

MD5Init
MD5Final
MD5Update

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.uu5s
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.0_s0
Size: 512B - Virtual size: 182B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.8__09
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.65__s
Size: 512B - Virtual size: 178B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.0kk5s
Size: 512B - Virtual size: 190B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.llv1
Size: 362KB - Virtual size: 362KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.775s
Size: 512B - Virtual size: 142B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.785s
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

._05s
Size: 512B - Virtual size: 174B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.85js0
Size: 512B - Virtual size: 174B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.85j00
Size: 512B - Virtual size: 174B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.85sj1
Size: 512B - Virtual size: 174B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.kajq
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.kjoq
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.kjj0q
Size: 512B - Virtual size: 182B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.n_m
Size: 512B - Virtual size: 202B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.o__p
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 266B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a9249b916ca3f9099a52488e68b47473

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

gdi32

user32

ole32

oleaut32

comdlg32

shell32

version

winmm

shlwapi

gdiplus

msimg32

wininet

cryptdll

iphlpapi

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 17KB - Virtual size: 16KB

.data Size: 2KB - Virtual size: 1KB

.uu5s Size: 512B - Virtual size: 172B

.0_s0 Size: 512B - Virtual size: 182B

.8__09 Size: 512B - Virtual size: 168B

.65__s Size: 512B - Virtual size: 178B

.0kk5s Size: 512B - Virtual size: 190B

.llv1 Size: 362KB - Virtual size: 362KB

.775s Size: 512B - Virtual size: 142B

.785s Size: 512B - Virtual size: 164B

._05s Size: 512B - Virtual size: 174B

.85js0 Size: 512B - Virtual size: 174B

.85j00 Size: 512B - Virtual size: 174B

.85sj1 Size: 512B - Virtual size: 174B

.kajq Size: 512B - Virtual size: 156B

.kjoq Size: 512B - Virtual size: 152B

.kjj0q Size: 512B - Virtual size: 182B

.n_m Size: 512B - Virtual size: 202B

.o__p Size: 512B - Virtual size: 148B

.rsrc Size: 16KB - Virtual size: 15KB

.reloc Size: 512B - Virtual size: 266B

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 17KB - Virtual size: 16KB

.data
Size: 2KB - Virtual size: 1KB

.uu5s
Size: 512B - Virtual size: 172B

.0_s0
Size: 512B - Virtual size: 182B

.8__09
Size: 512B - Virtual size: 168B

.65__s
Size: 512B - Virtual size: 178B

.0kk5s
Size: 512B - Virtual size: 190B

.llv1
Size: 362KB - Virtual size: 362KB

.775s
Size: 512B - Virtual size: 142B

.785s
Size: 512B - Virtual size: 164B

._05s
Size: 512B - Virtual size: 174B

.85js0
Size: 512B - Virtual size: 174B

.85j00
Size: 512B - Virtual size: 174B

.85sj1
Size: 512B - Virtual size: 174B

.kajq
Size: 512B - Virtual size: 156B

.kjoq
Size: 512B - Virtual size: 152B

.kjj0q
Size: 512B - Virtual size: 182B

.n_m
Size: 512B - Virtual size: 202B

.o__p
Size: 512B - Virtual size: 148B

.rsrc
Size: 16KB - Virtual size: 15KB

.reloc
Size: 512B - Virtual size: 266B