0c59c6f9634d61fd8cc41d82c7e244761d18270edd561f62669f5c385045ec2c

Sharing

Copy URL

Twitter E-mail

General

Target

0c59c6f9634d61fd8cc41d82c7e244761d18270edd561f62669f5c385045ec2c
Size

1.6MB
MD5

f0a7d3450523c76e26ac65850fc1d0c9
SHA1

46a755920478844aac00aeee7edf1f31b944968f
SHA256

0c59c6f9634d61fd8cc41d82c7e244761d18270edd561f62669f5c385045ec2c
SHA512

d27831a2d7bfcab134eaeabe53cd4392559840951d546b1b029452d8a48e7cc91ed22864ff8cb6174b39779d3064a303137f7d9c476a9e8bf1738fa4a794466b
SSDEEP

49152:4SDeor7f3LFjyhWmFdoKFYXI0wPNwgNglvIDzw5u:4SSgL35WRWKFYX4qmglgJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Lib/Graphics.dll
unpack001/Start.exe

Files

0c59c6f9634d61fd8cc41d82c7e244761d18270edd561f62669f5c385045ec2c
.zip
Lib/Graphics.dll
.dll windows:5 windows x86 arch:x86

0789e2bdedf2bba6a4c2351b9a9a95ef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetStringTypeW
LCMapStringW
LoadLibraryW
lstrlenA
lstrcpyA
lstrcmpA
WriteFile
GetProcAddress
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
LoadLibraryA
MultiByteToWideChar
FreeLibrary
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
EnterCriticalSection
LeaveCriticalSection
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
DecodePointer
EncodePointer
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStdHandle
GetModuleFileNameW
Sleep
GetModuleHandleW
ExitProcess
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
SetHandleCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
RtlUnwind

user32

OffsetRect
UnionRect
IntersectRect
InvalidateRect
GetDC
ReleaseDC
IsRectEmpty
SetRect

gdi32

SetBkColor
SetTextColor
TextOutA
GetTextExtentPoint32A
CreateFontIndirectA
CreateDIBSection
CreateCompatibleDC
SelectObject
DeleteDC
DeleteObject
BitBlt
StretchBlt
SetStretchBltMode
SetBkMode

Exports

Exports

ClearDirtyRect
ClearScreen
CreateMojiSurface
DIBitmapClear
DIBitmapCopy
DIBitmapCreate
DIBitmapDraw
DIBitmapRelease
ExitSystem
GetDIBitmapDC
GetDIBitmapHBITMAP
GetDIBitmapSize
GetErrorMessage
GetScreen
GetScreenMagFiltering
GetScreenMinFiltering
GetScreenSize
GetSurfacePitch
GetSurfacePixel
GetSurfacePixelSize
GetSurfacePtr
GetSurfaceSize
GetTextDrawRect
GetTextLength
InitSystem
InvalidatedRect
IsScreenMagMinFiltering
RenderReset
RenderSceen
RenderSceenHDC
ScreenResize
SetScreenMagFiltering
SetScreenMinFiltering
SetTextBasePos
SetTextFirstName
SetTextSecondName
SurfaceAddColor
SurfaceAddSubSurface
SurfaceBackup
SurfaceBlendBlt
SurfaceBlendDraw
SurfaceBlt
SurfaceBlur
SurfaceClear
SurfaceClearWithoutAlpha
SurfaceCopyBlt
SurfaceCopyDraw
SurfaceCreate
SurfaceDraw
SurfaceFilter
SurfaceFilter2
SurfaceFlush
SurfaceGaussBlur
SurfaceLoadALP
SurfaceLoadANM
SurfaceLoadBMP
SurfaceMosaic
SurfaceMulAlpha
SurfaceMulColor
SurfaceRelease
SurfaceSave
SurfaceSubColor
SurfaceUniversalBlt
TextBlt
TextBltAll
TextCreateFont
TextDraw
TextDrawAll
TextInitialize

Sections

.text
Size: 304KB - Virtual size: 303KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Start.exe
.exe windows:5 windows x86 arch:x86

06ead0570d42f6941b910c38c969c1e2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsDBCSLeadByte
CreateFileA
WriteFile
lstrcpyA
GetFileAttributesA
ReadFile
SetFilePointer
SetEndOfFile
GetFileSize
SetLastError
GetVersionExA
FreeLibrary
FindResourceA
LoadLibraryExA
GetModuleFileNameA
FreeResource
lstrcpynA
Sleep
GetTickCount
LoadLibraryA
GetCurrentDirectoryA
FileTimeToSystemTime
FileTimeToLocalFileTime
FindClose
FindFirstFileA
DeleteFileA
GetPrivateProfileStringA
CreateDirectoryA
GetTempFileNameA
GetTempPathA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
LCMapStringW
ExitProcess
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapCreate
lstrcmpiA
GetModuleFileNameW
GetStdHandle
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetSystemTimeAsFileTime
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualProtect
RtlUnwind
EncodePointer
DecodePointer
HeapSize
HeapReAlloc
HeapDestroy
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
GetCurrentProcessId
LoadLibraryW
GetConsoleCP
GetConsoleMode
GetStringTypeW
SetStdHandle
WriteConsoleW
lstrlenA
InterlockedDecrement
InterlockedIncrement
GetModuleHandleA
GetProcAddress
lstrlenW
CreateFileW
QueryPerformanceCounter
FlushFileBuffers
CompareStringW
SetEnvironmentVariableA
MultiByteToWideChar
CreateMutexA
InitializeCriticalSection
WideCharToMultiByte
WaitForSingleObject
ReleaseMutex
CloseHandle
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
LeaveCriticalSection
EnterCriticalSection
RaiseException

user32

IsDialogMessageA
SetCursor
GetCursor
GetCursorPos
IntersectRect
SetRect
WINNLSEnableIME
CloseWindow
GetSystemMetrics
AdjustWindowRectEx
GetMessagePos
IsWindowEnabled
GetSysColor
GetFocus
CreateDialogParamA
FindWindowA
GetKeyState
EnableWindow
CheckDlgButton
GetDlgItem
GetDC
ScreenToClient
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
PtInRect
MessageBeep
GetSubMenu
CheckMenuRadioItem
LoadMenuA
SetRectEmpty
GetActiveWindow
TrackPopupMenu
IsIconic
OpenIcon
GetMenuItemCount
EnableMenuItem
AppendMenuA
LoadStringW
PostQuitMessage
SetFocus
LoadStringA
SetMenuDefaultItem
GetMenuItemInfoA
EqualRect
IsWindowVisible
ValidateRect
ClientToScreen
SetWindowPlacement
GetWindowPlacement
RemoveMenu
TrackPopupMenuEx
CreatePopupMenu
InvalidateRect
DestroyMenu
MonitorFromPoint
SetMenuItemInfoA
IsMenu
TranslateAcceleratorA
CreateWindowExA
DialogBoxParamA
GetParent
GetWindow
GetWindowRect
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
SetDlgItemTextA
EndDialog
EndPaint
BeginPaint
GetClientRect
MessageBoxA
EnumDisplaySettingsA
SendMessageA
UnionRect
IsRectEmpty
CopyRect
SetWindowPos
GetClassInfoExA
LoadCursorA
LoadImageA
RegisterClassExA
DestroyWindow
CallWindowProcA
GetWindowLongA
CharNextA
DefWindowProcA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
OffsetRect
ShowWindow
PostMessageA
SetWindowLongA
IsWindow
UnregisterClassA

gdi32

GetObjectA
CreateFontIndirectA
SetTextColor
SetBkMode
GetStockObject
DeleteObject
CreateSolidBrush
CreatePen
SelectObject
Rectangle
BitBlt
DeleteDC

advapi32

RegCreateKeyExA
RegOpenKeyExA
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegQueryInfoKeyW
RegEnumKeyExA
RegDeleteKeyA

ole32

CoUninitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoInitialize

oleaut32

VarUI4FromStr

comctl32

PropertySheetA
CreatePropertySheetPageA
ImageList_LoadImageA
DestroyPropertySheetPage
InitCommonControlsEx

imagehlp

MakeSureDirectoryPathExists

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

winmm

timeEndPeriod
timeGetTime
timeBeginPeriod
timeGetDevCaps

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 196KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 71KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 509KB - Virtual size: 509KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
message.dat
说明.txt

Sharing

General

Malware Config

Signatures

Files

0789e2bdedf2bba6a4c2351b9a9a95ef

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 304KB - Virtual size: 303KB

.rdata Size: 32KB - Virtual size: 32KB

.data Size: 6KB - Virtual size: 143KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 17KB - Virtual size: 16KB

06ead0570d42f6941b910c38c969c1e2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

comctl32

imagehlp

version

winmm

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 196KB - Virtual size: 196KB

.data Size: 71KB - Virtual size: 81KB

.rsrc Size: 509KB - Virtual size: 509KB

.text
Size: 304KB - Virtual size: 303KB

.rdata
Size: 32KB - Virtual size: 32KB

.data
Size: 6KB - Virtual size: 143KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 17KB - Virtual size: 16KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 196KB - Virtual size: 196KB

.data
Size: 71KB - Virtual size: 81KB

.rsrc
Size: 509KB - Virtual size: 509KB