51068f0b1566f30d019d49df5650ed9f

Sharing

Copy URL Twitter E-mail

General

Target

51068f0b1566f30d019d49df5650ed9f
Size

73KB
MD5

51068f0b1566f30d019d49df5650ed9f
SHA1

8081535dbd0c18dadb515b686c644a296a3af886
SHA256

753dec09b2fbb7f2aa32b5a126351f970cf1e37b47c04803209e1ac43b8e3e1d
SHA512

3d62f7bc61510ae2f4e7b27ab0c9508ef113c2b827e0689b3fdf78dbb2927fe7db3f21c4e46b2927df5b2f1bda071581275648ee6d4bb9d7ca6e08340a15505e
SSDEEP

1536:3WWlph0v4LgHkumqCsDOCfHRO9TNL6J04g7hcS5Ryd4vX:3rlph05EumH3kOBNLck1q4f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
51068f0b1566f30d019d49df5650ed9f

Files

51068f0b1566f30d019d49df5650ed9f
.exe windows:4 windows x86 arch:x86

af964bbe579dd83ab51598aa5cf1de79

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

OpenClipboard
GetWindowTextW
IsWindowEnabled
CreateMDIWindowW
UnhookWinEvent
WindowFromDC
GetUpdateRgn
CharUpperA
OpenDesktopA
MessageBoxExA
ShowWindow
TileChildWindows
UnhookWindowsHook
EndPaint
GetMenuStringA
RegisterClipboardFormatA
ChangeDisplaySettingsExA
SetClassLongW
CloseDesktop
GetWindowDC
SetCursor
SetWindowRgn
GetPriorityClipboardFormat
FreeDDElParam
DlgDirSelectComboBoxExA
PackDDElParam
VkKeyScanExA
GetScrollRange
GetClipboardViewer
SendIMEMessageExW
PeekMessageA
LoadImageW
ToAsciiEx
GetClipboardFormatNameW
MapVirtualKeyA
InsertMenuA
EnumPropsExW
MapVirtualKeyW
SetDlgItemInt
AdjustWindowRectEx
SetFocus
VkKeyScanW
RegisterWindowMessageA
CreateDesktopA
WINNLSEnableIME
FindWindowW
WinHelpW
GetWindowModuleFileNameW
ToUnicodeEx
GetDC
InSendMessage
KillTimer
GetMonitorInfoA
SetDebugErrorLevel
GetWindowLongW
PostMessageW
ShowCursor
RemovePropW
SetPropW
ScrollDC
GetWindowInfo
DdeCmpStringHandles
OpenDesktopW
ReleaseCapture
LoadBitmapA
GetSystemMetrics
CharNextExA
DefDlgProcW
CreateIconIndirect
MsgWaitForMultipleObjectsEx
SendNotifyMessageA
GetNextDlgGroupItem
MapWindowPoints
DrawCaption
UpdateWindow
CheckRadioButton
GetMenuItemID
UnhookWindowsHookEx

kernel32

SetThreadExecutionState
LCMapStringA
WriteConsoleInputW
SetMailslotInfo
ExpandEnvironmentStringsW
EnumDateFormatsA
LoadModule
UpdateResourceW
GetThreadContext
FindClose
GetCurrencyFormatW
GetProcessTimes
VirtualAlloc
SetHandleCount
SetFileApisToOEM
HeapWalk
EnumCalendarInfoA
GlobalWire
OpenSemaphoreW
FreeConsole
WaitForDebugEvent
VirtualProtect
GetWindowsDirectoryA
LocalShrink
SetErrorMode
GetPrivateProfileSectionW
GetBinaryType
WaitForSingleObjectEx
FoldStringA
GetShortPathNameA
CreateNamedPipeW
CreateFileMappingA
GetSystemInfo
GetModuleFileNameA
ReadConsoleOutputCharacterW
GetTempPathW
GetOverlappedResult
lstrcmp
CancelWaitableTimer
SizeofResource
CreateProcessA
VirtualProtectEx
LocalCompact
DeleteFileW
lstrcatA
SetThreadIdealProcessor
GetWriteWatch
VirtualFreeEx
IsDebuggerPresent
LocalFlags
SetFileTime
GetFullPathNameW
EnumResourceNamesW
EnumSystemLocalesW
DisableThreadLibraryCalls
FindFirstChangeNotificationA
SetProcessAffinityMask
HeapFree
GetExitCodeProcess
GetConsoleTitleA
EraseTape
IsBadStringPtrW
TlsAlloc
CreateFiber
Heap32ListNext
CreateSemaphoreA
SetLocaleInfoA
SetDefaultCommConfigW
PrepareTape
IsSystemResumeAutomatic
VirtualQuery
WriteFileEx
GetLogicalDrives
GetCommandLineA
SetProcessShutdownParameters
GetProcessHeaps
PulseEvent
GetAtomNameW
GetCommProperties
SetVolumeLabelA
GetModuleHandleW
LockFile
CancelIo

shlwapi

SHOpenRegStream2A
ColorRGBToHLS
PathRemoveFileSpecA
PathRenameExtensionW
UrlGetLocationA
StrCSpnIW
SHRegEnumUSValueW
SHRegDeleteEmptyUSKeyA
StrRChrW
PathIsUNCServerA
StrCpyNW
SHRegGetBoolUSValueA
PathFindFileNameA
StrToIntA
StrCatBuffW
PathFindExtensionA
AssocQueryStringW
SHEnumKeyExA
PathAppendW
PathFileExistsW
PathMakeSystemFolderW
StrCmpNIW
StrSpnA
SHCopyKeyW
UrlIsOpaqueA
ChrCmpIW
SHEnumKeyExW
AssocQueryStringA
StrIsIntlEqualW
PathIsNetworkPathW
SHStrDupW
PathIsDirectoryEmptyA
SHDeleteEmptyKeyA
PathUndecorateA
StrFormatByteSize64A
UrlUnescapeW
StrToIntExW
PathBuildRootA
UrlEscapeA
PathIsRelativeA
SHCreateShellPalette
UrlHashW
SHRegOpenUSKeyW
PathIsUNCServerShareA
PathStripToRootA
StrChrIW
IntlStrEqWorkerW
PathFindFileNameW
StrChrA
PathSetDlgItemPathW
PathRemoveBlanksA
PathCompactPathExW
UrlCombineW
SHQueryInfoKeyA
UrlIsNoHistoryA
PathGetDriveNumberW
PathGetCharTypeW
StrCmpNW
StrCmpNA
PathFileExistsA
PathCanonicalizeW
PathIsFileSpecA
UrlCanonicalizeA
SHOpenRegStreamW
SHAutoComplete
PathIsSameRootA
PathIsContentTypeW
PathAppendA
UrlGetPartA
SHRegWriteUSValueA
PathRelativePathToA
PathFindExtensionW
AssocQueryKeyA

ole32

WriteClassStg
CoGetStandardMarshal
CoFreeUnusedLibraries
StgCreateDocfile
OleCreateLinkFromDataEx
OleCreateStaticFromData
IsAccelerator
CreateClassMoniker
OleGetIconOfClass
CoGetInterfaceAndReleaseStream
UtConvertDvtd16toDvtd32
OleCreate
CoGetPSClsid
UpdateDCOMSettings
CreateDataCache
SetConvertStg
CoLockObjectExternal
CoTreatAsClass
OpenOrCreateStream
CoGetMarshalSizeMax
ReadClassStm
DllDebugObjectRPCHook
CoGetMalloc
CreateBindCtx
GetHGlobalFromStream
CoCopyProxy
StringFromGUID2
OleSetClipboard
CoMarshalHresult
OleSave
CoGetInstanceFromFile
StgSetTimes
WriteOleStg
StgGetIFillLockBytesOnFile
CoGetInstanceFromIStorage
OleLoadFromStream
StgIsStorageILockBytes
EnableHookObject
CreateObjrefMoniker
OleLoad
CreateOleAdviseHolder
PropVariantCopy
CoGetCurrentLogicalThreadId
CoImpersonateClient
WriteClassStm
CoCreateInstanceEx
CoSuspendClassObjects
CreateStreamOnHGlobal
CoGetTreatAsClass
OleMetafilePictFromIconAndLabel
WriteStringStream
StgCreateStorageEx
GetConvertStg
OleDuplicateData
OleRegEnumVerbs
OleGetAutoConvert
CoGetObject
CoIsOle1Class
OleQueryLinkFromData
ProgIDFromCLSID
CoSwitchCallContext
CoReleaseMarshalData
OleGetClipboard
CoRevokeClassObject
CreateAntiMoniker
CoQueryClientBlanket
StgOpenStorageEx
GetHGlobalFromILockBytes
OleRegEnumFormatEtc
CoLoadLibrary

advapi32

AccessCheckAndAuditAlarmW
RegUnLoadKeyW
CryptDestroyHash
BuildImpersonateTrusteeA
SetTokenInformation
GetAccessPermissionsForObjectW
OpenSCManagerA
CreateServiceA
GetPrivateObjectSecurity
CryptSetProviderExA
IsTextUnicode
CancelOverlappedAccess
RegQueryValueA
RegSaveKeyA
DestroyPrivateObjectSecurity
RegDeleteKeyW
BuildTrusteeWithSidW
IsValidSecurityDescriptor
GetUserNameW
CryptContextAddRef
GetNamedSecurityInfoA
GetOldestEventLogRecord
CryptEnumProviderTypesA
GetSecurityDescriptorOwner
CloseServiceHandle
CryptDeriveKey
CryptSetProviderW
UnlockServiceDatabase
GetNamedSecurityInfoW
GetSidSubAuthorityCount
SetKernelObjectSecurity
RegOpenKeyExA
RegEnumKeyExW
GetServiceKeyNameA
ObjectOpenAuditAlarmA
GetMultipleTrusteeA
InitializeSid
AccessCheckAndAuditAlarmA
CryptDuplicateKey
AdjustTokenPrivileges
RegConnectRegistryW
RegReplaceKeyW
EnumServicesStatusW
AreAnyAccessesGranted
ReportEventA
ControlService
RegNotifyChangeKeyValue
OpenBackupEventLogW
LookupAccountSidW
CryptVerifySignatureW
GetSidSubAuthority
RegSetValueW
RegCreateKeyExA
CryptGenRandom
SetServiceStatus
RegOpenKeyExW
GetExplicitEntriesFromAclW
ImpersonateSelf
SetSecurityInfo
BuildImpersonateTrusteeW
CryptDestroyKey
QueryServiceObjectSecurity
InitiateSystemShutdownA
LookupPrivilegeValueW
ObjectDeleteAuditAlarmW
BuildSecurityDescriptorA
CreateProcessAsUserW
CryptSignHashA
GetServiceDisplayNameW

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

af964bbe579dd83ab51598aa5cf1de79

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

shlwapi

ole32

advapi32

Sections

.text Size: 61KB - Virtual size: 61KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 8KB

.text
Size: 61KB - Virtual size: 61KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 8KB