711430b01d74c24f3a6e5f57dd21f9cb11255c613a087b34cf35de18226b7f45

Sharing

Copy URL Twitter E-mail

General

Target

711430b01d74c24f3a6e5f57dd21f9cb11255c613a087b34cf35de18226b7f45
Size

7.5MB
MD5

8fc7316baeb351f0ab4bb5911a899f9c
SHA1

2b6ed5c09d9df66c1a844478495f44da68e310ca
SHA256

711430b01d74c24f3a6e5f57dd21f9cb11255c613a087b34cf35de18226b7f45
SHA512

9015b1331bcf662f142d8cecf7d5be3561b609bef8299819a05eec97ad19f40bb4712aac04f20dc5e5ef85c7102103c6089f0e4cd194d0ae3a366402f37642e4
SSDEEP

98304:+v+w9JSEasxhzOXE8/jMOwI6JPV/e8o3TFLOAkGkzdnEVomFHKnP:059JSEasLzEQOqJPVGXTFLOyomFHKnP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
711430b01d74c24f3a6e5f57dd21f9cb11255c613a087b34cf35de18226b7f45

Files

711430b01d74c24f3a6e5f57dd21f9cb11255c613a087b34cf35de18226b7f45
.exe windows:6 windows x64 arch:x64

5077c2946c58e44a041aa3e1b94122df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

winhttp

WinHttpCrackUrl

shlwapi

PathAddBackslashW
PathFileExistsW
PathFindExtensionW
PathIsDirectoryW
PathFindFileNameW
PathCombineW
PathCanonicalizeW
PathIsUNCW
PathStripToRootW
StrFormatKBSizeW
PathRemoveFileSpecW

kernel32

RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
TryEnterCriticalSection
QueryPerformanceFrequency
RtlPcToFileHeader
SwitchToThread
GetStringTypeW
GetCPInfo
LCMapStringW
SignalObjectAndWait
CreateTimerQueue
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
ResetEvent
EnumSystemLocalesW
IsValidLocale
GetTimeZoneInformation
GetConsoleCP
SetEnvironmentVariableW
SetStdHandle
HeapQueryInformation
VirtualQuery
VirtualAlloc
GetSystemInfo
GetCommandLineW
GetCommandLineA
SetConsoleCtrlHandler
ExitProcess
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
FreeLibraryAndExitThread
ExitThread
CreateThread
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwindEx
WaitForSingleObjectEx
GetTempFileNameW
FindResourceExW
GetWindowsDirectoryW
SystemTimeToTzSpecificLocalTime
GetFileTime
GetFileAttributesExW
FileTimeToLocalFileTime
SetErrorMode
SearchPathW
GetProfileIntW
GetTickCount
GetTempPathW
VirtualProtect
FileTimeToSystemTime
GlobalGetAtomNameW
DuplicateHandle
UnlockFile
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
FlushFileBuffers
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GetCurrentDirectoryW
GetFileSize
VerifyVersionInfoW
VerSetConditionMask
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
InitializeCriticalSection
CompareStringW
GlobalFindAtomW
GetSystemDirectoryW
EncodePointer
MulDiv
LocalFree
GetUserDefaultLCID
GlobalSize
GlobalFree
GlobalUnlock
FreeResource
GlobalAddAtomW
lstrcmpA
GlobalDeleteAtom
GlobalLock
GlobalAlloc
LoadLibraryExW
GetVersionExW
GetCurrentThread
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
OutputDebugStringA
ResumeThread
SetThreadPriority
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
LoadLibraryA
GetSystemTimeAsFileTime
QueryPerformanceCounter
ConvertThreadToFiber
ConvertFiberToThread
RtlVirtualUnwind
GetModuleHandleW
GetFileType
GetEnvironmentVariableW
FormatMessageW
CreateFiber
DeleteFiber
SwitchToFiber
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetModuleHandleExW
SystemTimeToFileTime
GetSystemTime
SetLastError
lstrcmpiW
FreeLibrary
GetCurrentProcessId
GetProcAddress
LoadLibraryW
Process32FirstW
Process32NextW
MultiByteToWideChar
CreateToolhelp32Snapshot
GetLogicalDriveStringsW
OpenProcess
GetModuleHandleA
K32GetProcessImageFileNameW
GetFileAttributesW
RemoveDirectoryW
TerminateProcess
GetCurrentProcess
QueryDosDeviceW
CreateProcessW
TerminateThread
SetEvent
Sleep
GetCurrentThreadId
GetPrivateProfileIntW
CreateDirectoryW
FindResourceW
LoadResource
LockResource
SizeofResource
WaitForSingleObject
MoveFileW
lstrcmpW
CopyFileW
WideCharToMultiByte
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
GetPrivateProfileStringW
CreateEventW
HeapSize
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
HeapFree
WritePrivateProfileStringW
lstrcpyW
GetLocalTime
CloseHandle
DeleteFileW
lstrcatW
GetDiskFreeSpaceExW
OutputDebugStringW
SetFileAttributesW
CreateFileW
FindClose
SetFilePointer
GetModuleFileNameW
WriteFile
GetStdHandle
lstrlenW
FindNextFileW
GetFileSizeEx
FindFirstFileW
ReadFile
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
RtlUnwind
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx
SetFilePointerEx

user32

GetMenuItemInfoW
DestroyMenu
SetRectEmpty
SendDlgItemMessageA
IsDialogMessageW
SetWindowTextW
CheckDlgButton
MoveWindow
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
GetWindow
GetTopWindow
GetClassLongPtrW
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
EqualRect
AdjustWindowRectEx
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
SetForegroundWindow
GetForegroundWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
SetFocus
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
IsChild
IsMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
SystemParametersInfoW
InvalidateRect
UpdateWindow
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
GetMenuDefaultItem
SetMenuDefaultItem
ModifyMenuW
LockWindowUpdate
EnableScrollBar
GetDoubleClickTime
DestroyAcceleratorTable
IntersectRect
EnableMenuItem
CheckMenuItem
EndPaint
BeginPaint
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
CopyRect
ReleaseDC
GetIconInfo
MapVirtualKeyW
GetKeyNameTextW
RemoveMenu
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringW
UnhookWindowsHookEx
PtInRect
ScreenToClient
ClientToScreen
GetDesktopWindow
SetActiveWindow
GetNextDlgTabItem
GetDlgItem
EndDialog
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetLastActivePopup
GetWindowLongW
IsWindowEnabled
SetCursor
ShowOwnedPopups
PostQuitMessage
SetLayeredWindowAttributes
LoadCursorW
EnumDisplayMonitors
SetParent
MonitorFromPoint
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DestroyIcon
LoadImageW
CopyImage
TrackMouseEvent
IsZoomed
CharUpperW
GetAsyncKeyState
SetClassLongPtrW
GetUpdateRect
RealChildWindowFromPoint
WaitMessage
UpdateLayeredWindow
MapDialogRect
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
LoadAcceleratorsW
CreateAcceleratorTableW
CopyAcceleratorTableW
SetCapture
ReleaseCapture
LoadMenuW
DeleteMenu
MessageBeep
WindowFromPoint
NotifyWinEvent
SetCursorPos
SetRect
UnionRect
BringWindowToTop
SubtractRect
GetClassNameW
CreatePopupMenu
RegisterClipboardFormatW
UnregisterClassW
EnableWindow
IsIconic
KillTimer
AppendMenuW
GetClientRect
LoadIconW
SetTimer
DrawIcon
GetSystemMetrics
SendMessageW
GetSystemMenu
PeekMessageW
PostMessageW
GetParent
EnumWindows
GetWindowThreadProcessId
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
GetMessageW
TranslateMessage
DispatchMessageW
IsWindowVisible
GetActiveWindow
GetKeyState
ValidateRect
GetCursorPos
SetWindowsHookExW
CallNextHookEx
RegisterWindowMessageW
DrawEdge
DrawFrameControl
GetFocus
DrawStateW
SetWindowRgn
RedrawWindow
GetWindowRect
CharUpperBuffW
TranslateAcceleratorW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
FrameRect
MapWindowPoints
GetSysColor
GetSysColorBrush
DrawFocusRect
FillRect
InflateRect
OffsetRect
IsRectEmpty
DrawIconEx
GetDC
IsClipboardFormatAvailable
PostThreadMessageW
GetNextDlgGroupItem
IsCharLowerW
MapVirtualKeyExW
DrawMenuBar
GetWindowRgn
DestroyCursor
CreateMenu
InvertRect
HideCaret
GetComboBoxInfo
TranslateMDISysAccel
DefMDIChildProcW
CopyIcon
DefFrameProcW

gdi32

SetBkColor
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextColor
SetTextAlign
GetObjectW
MoveToEx
TextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateFontIndirectW
SetRectRgn
DPtoLP
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesW
SelectPalette
RealizePalette
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateRoundRectRgn
Rectangle
GetRgnBox
OffsetRgn
RoundRect
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
EnumFontFamiliesExW
LPtoDP
ExtFloodFill
SetPaletteEntries
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
GetViewportOrgEx
GetWindowOrgEx
SetPixelV
GetTextFaceW
SelectObject
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
DeleteObject
CreatePatternBrush
CreatePen
CreateCompatibleDC
CreateBitmap
BitBlt
GetDeviceCaps
CreateDCW
CopyMetaFileW
GetTextMetricsW
Polyline
Polygon
CreatePolygonRgn
ExtTextOutW
PatBlt
GetTextExtentPoint32W
GetBkColor
Ellipse
CreateSolidBrush
CreateRectRgnIndirect
CreateRectRgn
CreateHatchBrush
CreateEllipticRgn
CombineRgn
GetTextCharsetInfo
GetTextColor
DeleteDC

msimg32

AlphaBlend
TransparentBlt

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

CryptEnumProvidersW
OpenProcessToken
ControlService
OpenSCManagerW
CloseServiceHandle
QueryServiceStatus
AdjustTokenPrivileges
LookupPrivilegeValueW
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenServiceW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource

shell32

DragFinish
SHFileOperationW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHBrowseForFolderW
SHGetDesktopFolder
SHAppBarMessage
SHGetFileInfoW
ShellExecuteW
DragQueryFileW
ord165

uxtheme

IsThemeBackgroundPartiallyTransparent
GetThemePartSize
GetWindowTheme
GetThemeSysColor
IsAppThemed
DrawThemeParentBackground
DrawThemeText
GetCurrentThemeName
GetThemeColor
DrawThemeBackground
CloseThemeData
OpenThemeData

ole32

IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoInitializeEx
OleLockRunning
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
CoDisconnectObject
CreateStreamOnHGlobal
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoCreateGuid
CoUninitialize
CoInitialize

oleaut32

VariantClear
VariantInit
SysAllocStringLen
SysFreeString
SysAllocString
VariantChangeType
VarBstrFromDate
LoadTypeLi
SysStringLen
SystemTimeToVariantTime
VariantCopy
VariantTimeToSystemTime

gdiplus

GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipSetInterpolationMode
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipDrawImageRectI
GdipGetImagePaletteSize

ws2_32

WSASetLastError
__WSAFDIsSet
closesocket
select
shutdown
WSASocketW
inet_pton
getaddrinfo
getpeername
send
socket
ntohs
connect
recv
getsockopt
freeaddrinfo
ioctlsocket
getnameinfo
setsockopt
WSAGetLastError
WSACleanup
WSAStartup

crypt32

CertFreeCertificateContext
CertOpenSystemStoreW
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty

bcrypt

BCryptGenRandom

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW

Sections

.text
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 71KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 200KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5077c2946c58e44a041aa3e1b94122df

Headers

DLL Characteristics

File Characteristics

Imports

winhttp

shlwapi

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

uxtheme

ole32

oleaut32

gdiplus

ws2_32

crypt32

bcrypt

oleacc

imm32

winmm

Sections

.text Size: 4.3MB - Virtual size: 4.3MB

.rdata Size: 1.4MB - Virtual size: 1.4MB

.data Size: 71KB - Virtual size: 121KB

.pdata Size: 200KB - Virtual size: 199KB

.rsrc Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 90KB - Virtual size: 89KB

.text
Size: 4.3MB - Virtual size: 4.3MB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 71KB - Virtual size: 121KB

.pdata
Size: 200KB - Virtual size: 199KB

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 90KB - Virtual size: 89KB