b56479320290bb64ee80f2f396b5e084d88551698fa87133166c6b0f41d529b3

Sharing

Copy URL Twitter E-mail

General

Target

b56479320290bb64ee80f2f396b5e084d88551698fa87133166c6b0f41d529b3
Size

10.0MB
MD5

5893a24459b28ca988cc51f9a0e21c9a
SHA1

d30a042000a83b165132b63d31acfbbeedfa6879
SHA256

b56479320290bb64ee80f2f396b5e084d88551698fa87133166c6b0f41d529b3
SHA512

e33f9c2a62f569805bb2da568a22548d0040d3941839362438762e5adb594afef0095c64806f2eca33cd1d55ed4566de88e7aa7ff2faba7d6c912411534a350f
SSDEEP

196608:V6wKsPBza27R3N9MpeEGN6J1FGf/5IcCiDUw7Wc7zS0wQ6OIWXks:VdvPBzjhkKfR/Uwyc7u0/6Onn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b56479320290bb64ee80f2f396b5e084d88551698fa87133166c6b0f41d529b3

Files

b56479320290bb64ee80f2f396b5e084d88551698fa87133166c6b0f41d529b3
.exe windows:6 windows x86 arch:x86

c6fed81ab694d2cd4a76e51c4f8c2f37

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSASetLastError
WSAGetLastError
inet_addr
WSACleanup
__WSAFDIsSet
select
shutdown
WSASocketW
inet_pton
getaddrinfo
WSAStartup
getpeername
getsockname
send
socket
ntohs
connect
recv
getsockopt
freeaddrinfo
ioctlsocket
getnameinfo
setsockopt
closesocket

iphlpapi

GetIpForwardTable
GetAdaptersInfo

kernel32

GetNativeSystemInfo
GetCurrentProcessId
GetModuleHandleW
IsWow64Process
InitializeCriticalSectionEx
RaiseException
DecodePointer
OutputDebugStringA
CreateMutexW
GetTickCount
OutputDebugStringW
FindFirstFileW
FindNextFileW
RemoveDirectoryW
DeleteFileW
GetSystemInfo
LoadLibraryExW
SizeofResource
SetFilePointer
SetFileAttributesW
LoadResource
FindResourceW
GetFileSize
GetDiskFreeSpaceW
MoveFileExW
LocalFree
GetFileType
GetSystemTime
SystemTimeToFileTime
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
GetModuleHandleExW
GetStdHandle
GetEnvironmentVariableW
ConvertFiberToThread
ConvertThreadToFiber
QueryPerformanceCounter
GetSystemTimeAsFileTime
LoadLibraryA
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
TerminateProcess
GetCurrentProcess
GetACP
FindClose
GetPrivateProfileStringW
GetPrivateProfileIntW
GetFileTime
WideCharToMultiByte
SetFilePointerEx
FileTimeToLocalFileTime
FileTimeToSystemTime
MultiByteToWideChar
CreateFileW
SetEndOfFile
GetModuleFileNameW
WriteFile
SetLastError
GetFileSizeEx
ReadFile
CreateDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
GetVersionExW
LCMapStringEx
WaitForSingleObjectEx
AcquireSRWLockExclusive
CreateEventA
DeleteCriticalSection
CloseHandle
ReleaseSRWLockExclusive
SetEvent
GetLastError
Sleep
WaitForSingleObject
InitializeCriticalSection
InitializeSRWLock
InitOnceBeginInitialize
LeaveCriticalSection
EnterCriticalSection
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetModuleHandleA
EncodePointer
CompareStringEx
GetCPInfo
GetLocaleInfoEx
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
GetDateFormatW
RtlUnwind
CreateThread
ExitThread
InitOnceComplete
GlobalSize
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalFree
VerSetConditionMask
VerifyVersionInfoW
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
TerminateThread
SetThreadPriority
ResetEvent
CreateEventW
VirtualQuery
QueryPerformanceFrequency
LocalFileTimeToFileTime
TryEnterCriticalSection
GetSystemDirectoryW
GetCurrentDirectoryW
GetFileAttributesW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
FreeLibraryAndExitThread
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
ExitProcess
SetConsoleCtrlHandler
HeapAlloc
HeapFree
EnumSystemLocalesW
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetFileAttributesExW
GetTimeZoneInformation
GetFullPathNameW
SetStdHandle
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
HeapSize
WriteConsoleW

user32

SetWindowTextW
InvalidateRect
IsWindowVisible
ScreenToClient
GetKeyState
GetCursorPos
GetFocus
SetCapture
GetDC
BeginPaint
EndPaint
SetFocus
GetWindow
GetWindowLongW
IsWindow
SetWindowLongW
GetClassInfoExW
GetPropW
ShowWindow
SetPropW
CallWindowProcW
SendMessageW
ReleaseCapture
MoveWindow
RegisterClassW
LoadCursorW
GetSystemMetrics
UnregisterClassW
SetWindowPos
GetClientRect
IsRectEmpty
IntersectRect
UpdateLayeredWindow
PtInRect
OffsetRect
SetCursor
ClientToScreen
GetSysColor
GetAsyncKeyState
CharNextW
OpenClipboard
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
EmptyClipboard
SetClipboardData
IsZoomed
MonitorFromPoint
GetWindowPlacement
MonitorFromRect
SetWindowRgn
InflateRect
UnionRect
PostQuitMessage
FindWindowW
GetDesktopWindow
MapWindowPoints
GetParent
DrawTextW
PostThreadMessageW
EnableWindow
GetProcessWindowStation
LoadImageW
IsIconic
GetUserObjectInformationW
MonitorFromWindow
GetMonitorInfoW
SetForegroundWindow
ReleaseDC
KillTimer
TranslateMessage
GetQueueStatus
CallMsgFilterW
MsgWaitForMultipleObjectsEx
PeekMessageW
GetWindowRect
SetTimer
DispatchMessageW
RegisterClassExW
WaitMessage
CreateWindowExW
DestroyWindow
PostMessageW
GetUpdateRect
MessageBoxW
DefWindowProcW

advapi32

RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
GetSecurityInfo
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
RegCloseKey
RegOpenKeyExW
RegSetValueExW

shell32

SHChangeNotify
SHGetFolderPathW
SHBrowseForFolderW
ShellExecuteW
SHGetPathFromIDListW
SHGetSpecialFolderPathW

ole32

CoCreateGuid
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
CreateStreamOnHGlobal

oleaut32

SafeArrayPutElement
SafeArrayGetElemsize
SafeArrayGetElement
SysAllocString
SafeArrayCreateVector
SafeArrayDestroy

shlwapi

PathFileExistsW
PathIsRelativeW

winmm

timeKillEvent
timeSetEvent
timeGetTime

comctl32

_TrackMouseEvent
ord17

gdiplus

GdiplusStartup
GdipScaleMatrix
GdipMeasureString
GdipBitmapApplyEffect
GdipSetEffectParameters
GdipDeleteEffect
GdipCreateEffect
GdipSetClipRegion
GdipDeleteRegion
GdipCreateRegionPath
GdipSetPathGradientPresetBlend
GdipSetPathGradientWrapMode
GdipCreatePathGradientFromPath
GdipAddPathLine
GdipAddPathArc
GdipDrawPath
GdipFillEllipseI
GdipDrawEllipseI
GdipDrawString
GdipFillPath
GdipGetFontStyle
GdipGetFontSize
GdipAddPathString
GdipGetFamily
GdipDeleteFontFamily
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipCloneStringFormat
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipGetFontCollectionFamilyCount
GdipNewInstalledFontCollection
GdipDrawRectangleI
GdipDrawBezierI
GdipDrawLineI
GdipFillRectangle
GdipDeletePath
GdipTransformPath
GdipIsOutlineVisiblePathPointI
GdipIsVisiblePathPointI
GdipGetPathWorldBoundsI
GdipAddPathPolygonI
GdipAddPathPieI
GdipAddPathArcI
GdipAddPathEllipseI
GdipAddPathRectangleI
GdipAddPathCurveI
GdipAddPathBezierI
GdipAddPathLine2I
GdipAddPathLineI
GdipClosePathFigure
GdipStartPathFigure
GdipGetPathFillMode
GdipSetPathFillMode
GdipResetPath
GdipClonePath
GdipCreatePath
GdipCreateTexture
GdipCreateBitmapFromHBITMAP
GdipGetPenDashStyle
GdipSetPenDashStyle
GdipGetPenLineJoin
GdipSetPenLineJoin
GdipGetPenDashCap197819
GdipGetPenEndCap
GdipGetPenStartCap
GdipSetPenDashCap197819
GdipSetPenEndCap
GdipSetPenStartCap
GdipSetPenColor
GdipGetPenWidth
GdipSetPenWidth
GdipClonePen
GdipLoadImageFromFile
GdipImageRotateFlip
GdipDrawImageRect
GdipCreatePen2
GdipSetLineBlend
GdipCreateLineBrushFromRect
GdipDrawArc
GdipDeletePen
GdipCreatePen1
GdipSetSmoothingMode
GdiplusShutdown
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipCreateHBITMAPFromBitmap
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipDrawImageRectRect
GdipCreateFromHDC
GdipDrawImage
GdipSetWorldTransform
GdipRotateMatrix
GdipTranslateMatrix
GdipGetWorldTransform
GdipDeleteMatrix
GdipCreateMatrix
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromScan0
GdipGetImageHeight
GdipGetImageWidth
GdipCloneBrush
GdipAlloc
GdipFree
GdipDeleteBrush
GdipCreateSolidFill
GdipCreateFontFromDC

imm32

ImmGetOpenStatus
ImmSetOpenStatus
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

msimg32

AlphaBlend

crypt32

CertFindCertificateInStore
CertFreeCertificateContext
CertEnumCertificatesInStore
CertOpenStore
CertOpenSystemStoreW
CertCloseStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty

uiautomationcore

UiaHostProviderFromHwnd
UiaRaiseAutomationPropertyChangedEvent
UiaClientsAreListening
UiaReturnRawElementProvider
UiaRaiseAutomationEvent

bcrypt

BCryptGenRandom

gdi32

AddFontMemResourceEx
AddFontResourceExW
StretchBlt
CreateCompatibleDC
ExtSelectClipRgn
DeleteDC
GetDIBits
CreateDCW
CreateRoundRectRgn
GetDeviceCaps
BitBlt
SelectObject
DeleteObject
CreateFontIndirectW
GetStockObject
GetObjectW
SaveDC
CreateDIBSection
GetTextExtentPoint32W
GetObjectA
SetTextColor
SetBkMode
SetStretchBltMode
SetWindowOrgEx
GetWindowOrgEx
RestoreDC
CreateRectRgnIndirect

comdlg32

GetSaveFileNameW
GetOpenFileNameW

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 726KB - Virtual size: 725KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 45KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 81.9MB - Virtual size: 81.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c6fed81ab694d2cd4a76e51c4f8c2f37

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

iphlpapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

winmm

comctl32

gdiplus

imm32

msimg32

crypt32

uiautomationcore

bcrypt

gdi32

comdlg32

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 726KB - Virtual size: 725KB

.data Size: 45KB - Virtual size: 130KB

.rsrc Size: 81.9MB - Virtual size: 81.9MB

.reloc Size: 110KB - Virtual size: 109KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 726KB - Virtual size: 725KB

.data
Size: 45KB - Virtual size: 130KB

.rsrc
Size: 81.9MB - Virtual size: 81.9MB

.reloc
Size: 110KB - Virtual size: 109KB