89195d1c4a9cfeea18ee22d4c0a18e9ff3d84ea33be4fe3549ba7e5b425c46ac

Sharing

Copy URL Twitter E-mail

General

Target

89195d1c4a9cfeea18ee22d4c0a18e9ff3d84ea33be4fe3549ba7e5b425c46ac
Size

10.0MB
MD5

3484c2a018170f8be9b94db6dcaa4ae9
SHA1

ce2cc9a99b773c4e8076dea388a1864b556f9f27
SHA256

89195d1c4a9cfeea18ee22d4c0a18e9ff3d84ea33be4fe3549ba7e5b425c46ac
SHA512

2ca2600d4f7108be46a24bed66a0d351e4702dc4d78247220e95cca540caf8735c8b835e37acd99300a20713a57c84d55b361f922e2b93c172122ef3462ae012
SSDEEP

196608:UPOsyjVfzRODA2/yndfFIiojmtEUlnLf6E2EkMgJd+18BHKrkeN1CYoJ6Ugu1ZOv:UPOsyjVfzRODA2/yndfFIiojmtEUlnL7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
89195d1c4a9cfeea18ee22d4c0a18e9ff3d84ea33be4fe3549ba7e5b425c46ac

Files

89195d1c4a9cfeea18ee22d4c0a18e9ff3d84ea33be4fe3549ba7e5b425c46ac
.exe windows:5 windows x86 arch:x86

684bf5760839839873eea79aa0309ef7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

kernel32

CompareFileTime
FileTimeToSystemTime
GetProcAddress
VirtualAlloc
VirtualFree
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
Sleep
FlushFileBuffers
GetLocalTime
GetTickCount
GetModuleHandleA
GetVersionExW
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
lstrcmpiW
lstrcpyW
GetDiskFreeSpaceExW
CompareStringW
OpenProcess
TerminateProcess
GetExitCodeProcess
SetLastError
WaitForSingleObject
CreateProcessW
ExpandEnvironmentStringsW
GetFileAttributesW
CreateThread
InitializeCriticalSection
ReleaseMutex
DeviceIoControl
lstrcatW
CreateMutexA
GetPrivateProfileStringW
WritePrivateProfileStringW
DeleteFileA
MoveFileExW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
DecodePointer
InterlockedIncrement
InterlockedDecrement
TerminateThread
SetThreadPriority
SuspendThread
ResumeThread
GetCurrentThread
GetThreadPriority
GetSystemInfo
VirtualProtectEx
GetThreadContext
FlushInstructionCache
VirtualQuery
OpenThread
GetFileSizeEx
GetThreadSelectorEntry
LoadLibraryW
FindFirstFileExW
FindFirstFileExA
GetConsoleCP
SetEndOfFile
OutputDebugStringA
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetTimeFormatW
GetDateFormatW
ReadConsoleW
GetConsoleMode
GetStringTypeW
GetACP
ExitProcess
WriteConsoleW
GetModuleHandleExW
GetModuleFileNameA
GetFileType
InterlockedFlushSList
RtlUnwind
CreateMutexW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapWalk
HeapUnlock
HeapLock
SetFilePointerEx
LocalFileTimeToFileTime
SystemTimeToFileTime
CreateFileA
lstrcmpiA
lstrcmpA
FreeResource
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
LoadLibraryExA
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
GetCPInfo
GetCommandLineA
FreeLibrary
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetFileInformationByHandle
FindCloseChangeNotification
SetEnvironmentVariableW
SetStdHandle
FindFirstChangeNotificationW
FindNextFileW
FindFirstFileW
GetLogicalDriveStringsW
FindClose
MoveFileW
SearchPathW
DeleteFileW
WideCharToMultiByte
MultiByteToWideChar
WriteFile
SetFileAttributesW
GetStdHandle
GetLastError
GetFullPathNameW
RemoveDirectoryW
CreateDirectoryW
GetCurrentDirectoryW
GetWindowsDirectoryW
GetTempFileNameW
GetTempPathW
GetSystemDirectoryW
lstrlenW
SetFileTime
GetShortPathNameW
GetModuleFileNameW
SetConsoleCtrlHandler
FindResourceExW
FindResourceW
SizeofResource
LoadResource
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
LockResource
CreateFileW
CloseHandle
SetFilePointer
ReadFile
GetFileSize
FindNextFileA
IsValidCodePage
LoadLibraryExW
GetOEMCP

user32

GetSysColor
DrawFocusRect
ClientToScreen
SetCursor
EndPaint
BeginPaint
UpdateWindow
IsWindowEnabled
ReleaseCapture
FillRect
SetRectEmpty
UnregisterClassA
SetCapture
GetCapture
GetFocus
GetActiveWindow
SetFocus
GetDlgCtrlID
DialogBoxParamW
CreateDialogParamW
DefWindowProcW
PeekMessageW
DispatchMessageW
PtInRect
GetMessageW
wsprintfW
GetWindowThreadProcessId
FindWindowW
LoadImageW
LoadCursorW
GetClassNameW
OffsetRect
ChildWindowFromPoint
ScreenToClient
GetCursorPos
MessageBoxW
GetWindowTextLengthW
GetWindowTextW
InvalidateRect
SetWindowRgn
ReleaseDC
GetWindowDC
GetDC
DrawTextW
EnableWindow
KillTimer
SetTimer
CharNextW
GetDlgItemTextW
SetDlgItemTextW
DestroyWindow
PostQuitMessage
PostMessageW
ExitWindowsEx
GetMonitorInfoW
MonitorFromWindow
IsDialogMessageW
LoadStringW
GetWindow
GetParent
SetWindowLongW
GetWindowLongW
MapWindowPoints
AdjustWindowRectEx
GetWindowRect
GetClientRect
SetWindowTextW
GetMenu
GetDlgItem
EndDialog
SetWindowPos
ShowWindow
IsWindow
CreateWindowExW
UnregisterClassW
SendMessageW
CharToOemW
CharUpperW
SystemParametersInfoW
TranslateMessage
CallWindowProcW

gdi32

SetBkMode
GetStockObject
DeleteObject
GetObjectW
BitBlt
CreateDIBSection
SetStretchBltMode
StretchBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateRoundRectRgn
DeleteDC
SelectObject
SetTextColor
CreateFontIndirectW

advapi32

RegEnumKeyExW
RegDeleteKeyW
IsValidSid
GetTokenInformation
RegDeleteValueW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
StartServiceW
QueryServiceStatusEx
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
ChangeServiceConfigW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegEnumValueW
RegQueryInfoKeyW
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
AllocateAndInitializeSid
FreeSid
EqualSid

shell32

SHChangeNotify
SHGetPathFromIDListW
SHCreateDirectoryExW
SHFileOperationW
SHBrowseForFolderW
SHGetSpecialFolderLocation
ShellExecuteW
SHGetSpecialFolderPathW

ole32

CoInitializeEx
CoTaskMemRealloc
CoSetProxyBlanket
CoCreateInstance
CoTaskMemFree
CoInitializeSecurity
CoInitialize
CoTaskMemAlloc
CoUninitialize

oleaut32

SysAllocStringByteLen
VarUI4FromStr
SysFreeString
VariantCopy
VariantClear
VariantInit
SysAllocString

shlwapi

StrStrIA
PathFindFileNameW
PathIsDirectoryW
PathFileExistsA
SHSetValueA
SHGetValueA
StrToIntExW
PathFileExistsW
StrStrIW
StrCmpIW
PathRemoveBackslashW
PathRemoveFileSpecW
PathCombineW
SHDeleteKeyW

comctl32

_TrackMouseEvent
ImageList_Destroy
InitCommonControlsEx
ImageList_GetIconSize

setupapi

SetupIterateCabinetW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

crypt32

CertGetNameStringW

wininet

InternetReadFile
HttpQueryInfoW
InternetOpenUrlW
InternetOpenW
InternetCloseHandle

msimg32

AlphaBlend

Sections

.text
Size: 778KB - Virtual size: 777KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 158KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 41.9MB - Virtual size: 41.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

684bf5760839839873eea79aa0309ef7

Headers

DLL Characteristics

File Characteristics

Imports

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

setupapi

wintrust

crypt32

wininet

msimg32

Sections

.text Size: 778KB - Virtual size: 777KB

.rdata Size: 164KB - Virtual size: 164KB

.data Size: 158KB - Virtual size: 171KB

.rsrc Size: 41.9MB - Virtual size: 41.9MB

.text
Size: 778KB - Virtual size: 777KB

.rdata
Size: 164KB - Virtual size: 164KB

.data
Size: 158KB - Virtual size: 171KB

.rsrc
Size: 41.9MB - Virtual size: 41.9MB