70b10d59de42f2e1e69d46cf502a04e44927a2dc90cb0973783168712b282f78

Sharing

Copy URL

Twitter E-mail

General

Target

70b10d59de42f2e1e69d46cf502a04e44927a2dc90cb0973783168712b282f78
Size

2.2MB
MD5

8a50dc57c2e2729e5b58aa42a910dab4
SHA1

b354ee13942f98823e2cca3dbdee639917012abd
SHA256

70b10d59de42f2e1e69d46cf502a04e44927a2dc90cb0973783168712b282f78
SHA512

242aa1bc392b6bf8c07a2726b501eee55bd696901667d6e8a6db6e4ff506da1edcb713a2b5aad0f3f60145e2d9e65b5682e586cbf847ccd43260491dd9c5ab9d
SSDEEP

49152:KhbYj8ktixCZG0clYadK6QQ6TkhYn5uXlRXH6br4NKeD1EFcIcmBHD5quqIA2M1q:ge/ZFQYalY5uXllZNKeD1KcItauqI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
70b10d59de42f2e1e69d46cf502a04e44927a2dc90cb0973783168712b282f78

Files

70b10d59de42f2e1e69d46cf502a04e44927a2dc90cb0973783168712b282f78
.exe windows:5 windows x86 arch:x86

cb5f88f8fb49064cd6a4ac60c799dec2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_ReplaceIcon
CreateToolbarEx
ord17
ImageList_Create
ord6
InitCommonControlsEx

winmm

timeKillEvent
PlaySoundA
timeGetTime
timeSetEvent

ws2_32

gethostname
getaddrinfo
getsockopt
freeaddrinfo
WSAGetLastError
WSACleanup
WSAStartup
accept
bind
listen
WSAAsyncSelect
ioctlsocket
__WSAFDIsSet
gethostbyname
select
shutdown
getpeername
setsockopt
closesocket
inet_addr
getsockname
send
socket
WSAStringToAddressA
ntohs
connect
inet_ntoa
htons
recv

kernel32

GetLocaleInfoW
GetUserDefaultUILanguage
InterlockedIncrement
GetCurrentThread
DuplicateHandle
GetLongPathNameW
ExpandEnvironmentStringsW
GetFullPathNameW
IsValidCodePage
GetLocaleInfoA
IsValidLocale
GetUserDefaultLCID
LocalAlloc
DeviceIoControl
CreateFileW
SetFilePointerEx
SetFileAttributesW
GetFileAttributesW
GetFileSizeEx
MapViewOfFile
UnmapViewOfFile
TryEnterCriticalSection
TerminateProcess
GetExitCodeProcess
SetLastError
GetLocalTime
LocalFileTimeToFileTime
GetDiskFreeSpaceExW
VirtualAlloc
CreateFileMappingW
CreateDirectoryW
RemoveDirectoryW
GetFileAttributesExW
FindFirstFileW
FindNextFileW
MoveFileExW
OpenFileMappingW
GetVersionExW
GetCommandLineW
ReleaseMutex
CreateMutexA
OpenEventA
GetLogicalDrives
GetDriveTypeW
GetSystemInfo
ReleaseSemaphore
IsBadReadPtr
GetVolumeNameForVolumeMountPointW
CreateEventW
GetCurrentProcessId
FormatMessageW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
FindFirstFileExA
WriteConsoleW
EnumSystemLocalesW
GetTimeFormatW
GetDateFormatW
GetACP
GetCurrentDirectoryA
SetCurrentDirectoryA
SetEnvironmentVariableW
SetEnvironmentVariableA
GetCurrentProcess
PeekNamedPipe
ReadConsoleW
GetConsoleMode
GetConsoleCP
SetStdHandle
GetTimeZoneInformation
VirtualQuery
VirtualProtect
FreeLibraryAndExitThread
ExitThread
GetModuleHandleExW
ExitProcess
LoadLibraryExW
RtlUnwind
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
LCMapStringW
CompareStringW
TlsFree
SwitchToThread
EncodePointer
GetStringTypeW
CreateSemaphoreA
TlsGetValue
TlsAlloc
SetThreadPriority
TlsSetValue
GetFileType
lstrcatA
lstrcpynA
DosDateTimeToFileTime
SetFileAttributesA
SetVolumeLabelA
GetVersion
GetVolumeInformationA
GetFullPathNameA
QueryPerformanceCounter
QueryPerformanceFrequency
ProcessIdToSessionId
QueryDosDeviceW
GetCurrentDirectoryW
GetTempPathW
GetModuleHandleW
CreateSemaphoreW
OpenProcess
MoveFileW
DeleteFileW
GetSystemWindowsDirectoryW
GetCurrentThreadId
GetVersionExA
InterlockedDecrement
GetSystemTimeAsFileTime
GetComputerNameA
AllocConsole
WriteConsoleA
GetStdHandle
LoadLibraryW
FreeEnvironmentStringsW
MultiByteToWideChar
GlobalSize
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
LoadLibraryA
CloseHandle
GetProcAddress
FreeLibrary
GetModuleFileNameA
FindFirstFileA
FindNextFileA
FindClose
GetTempPathA
CopyFileA
DeleteFileA
GetModuleHandleA
GetModuleFileNameW
CreateProcessW
SizeofResource
InterlockedExchange
HeapFree
EnterCriticalSection
WriteFile
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
WaitForSingleObject
ResumeThread
HeapSize
Sleep
HeapAlloc
GetLastError
CreateFileA
SetEvent
LockResource
HeapReAlloc
RaiseException
CreateThread
FindResourceExW
ResetEvent
LoadResource
FindResourceW
OutputDebugStringA
MulDiv
FlushFileBuffers
GetFileTime
CreateDirectoryA
lstrcmpiA
SystemTimeToFileTime
GetLogicalDriveStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
MoveFileExA
GetFileAttributesA
lstrlenA
SetEndOfFile
SetFilePointer
SetErrorMode
InitializeCriticalSection
SetFileTime
GetDriveTypeA
MoveFileA
CompareFileTime
ReadFile
lstrcpyA
GetPrivateProfileStringA
GetPrivateProfileIntA
WritePrivateProfileStringA
GetTickCount
CreateEventA
DecodePointer
FormatMessageA
GetProcessHeap
DeleteCriticalSection
LocalFree
Beep
HeapDestroy
SystemTimeToTzSpecificLocalTime

user32

MonitorFromPoint
EnumDisplayDevicesA
GetSystemMetrics
EnumDisplaySettingsExA
GetMonitorInfoA
SystemParametersInfoA
LoadMenuA
GetMenuItemID
LoadStringA
TrackPopupMenu
AllowSetForegroundWindow
wvsprintfA
CharToOemA
OemToCharA
RegisterClipboardFormatA
IsClipboardFormatAvailable
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetWindowLongA
SetWindowLongA
SendMessageA
SetForegroundWindow
SetDlgItemTextA
DialogBoxParamA
EndDialog
LoadImageA
CreateAcceleratorTableA
DestroyAcceleratorTable
TranslateAcceleratorA
GetDlgItem
TranslateMessage
DrawTextA
DestroyIcon
GetMenuItemCount
DispatchMessageA
ModifyMenuA
PtInRect
GetMenuStringA
GetDesktopWindow
ReleaseCapture
GetCaretBlinkTime
SetCapture
CallWindowProcA
GetParent
GetWindowTextLengthA
PeekMessageA
GetComboBoxInfo
EnableWindow
SetWindowTextA
GetWindowTextA
GetDlgItemTextA
SetDlgItemTextW
SetTimer
ShowWindow
SetWindowTextW
SetWindowPos
GetWindowRect
PostMessageW
EndPaint
BeginPaint
ReleaseDC
IsIconic
InvalidateRect
UpdateWindow
SetDlgItemInt
EnableMenuItem
GetSysColorBrush
PostQuitMessage
KillTimer
SetRect
GetClientRect
GetSubMenu
SetMenuDefaultItem
CheckMenuItem
AppendMenuA
GetDlgItemInt
LoadIconA
SetCaretBlinkTime
GetScrollInfo
ScreenToClient
GetKeyboardState
LoadBitmapA
SetWindowRgn
ToUnicode
VkKeyScanW
keybd_event
ToAscii
GetKeyState
GetForegroundWindow
SetWindowsHookExA
PostThreadMessageA
CallNextHookEx
GetMessageA
GetWindowThreadProcessId
SendDlgItemMessageA
SetCursor
DrawMenuBar
ScrollWindowEx
RegisterClassExA
RedrawWindow
SetCursorPos
GetTouchInputInfo
CloseTouchInputHandle
GetCursorPos
GetClipboardOwner
SetScrollInfo
GetSystemMenu
AdjustWindowRectEx
GetMessageExtraInfo
ShowScrollBar
GetFocus
LoadCursorA
LoadKeyboardLayoutA
wsprintfW
RegisterDeviceNotificationW
DestroyWindow
GetDC
SetClipboardViewer
MessageBoxW
PostMessageA
FillRect
GetKeyboardLayoutNameA
CreatePopupMenu
wsprintfA
UnregisterDeviceNotification
BringWindowToTop
SetFocus
CreateWindowExA
DestroyMenu
DefWindowProcA
RegisterClassA
UnregisterTouchWindow
MoveWindow
MessageBoxA
IsWindow
InvalidateRgn
RegisterWindowMessageA
RegisterTouchWindow
ChangeClipboardChain
SendNotifyMessageA

gdi32

RealizePalette
StretchBlt
SetDIBColorTable
CreateDIBSection
SetBrushOrgEx
CreateRectRgnIndirect
GetDeviceCaps
CreatePen
UpdateColors
SetBkMode
SetTextColor
CreatePolygonRgn
CreateFontA
SetROP2
CreateRectRgn
SelectPalette
CreatePalette
CreateSolidBrush
GetStockObject
LineTo
GetDIBits
DeleteObject
DeleteDC
CreateCompatibleDC
SelectObject
BitBlt
GetObjectA
CombineRgn
MoveToEx
SetStretchBltMode

comdlg32

CommDlgExtendedError
GetSaveFileNameA
GetOpenFileNameA

advapi32

GetSecurityDescriptorLength
RegSetValueA
RegCloseKey
RegCreateKeyA
RegOpenKeyExA
RegSetValueExA
GetSecurityDescriptorGroup
LookupPrivilegeValueA
GetSecurityDescriptorOwner
IsValidSecurityDescriptor
GetKernelObjectSecurity
SetKernelObjectSecurity
IsValidAcl
OpenProcessToken
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
ImpersonateLoggedOnUser
RevertToSelf
SetSecurityInfo
AddAccessAllowedAce
ConvertSidToStringSidW
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupAccountNameW
SetFileSecurityW
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
InitializeSecurityDescriptor
InitializeAcl
GetNamedSecurityInfoW
RegSetValueExW
RegDeleteValueW
RegCreateKeyExW
ConvertStringSidToSidW
DuplicateTokenEx
CreateProcessWithLogonW
CreateProcessAsUserW
LogonUserW
GetLengthSid
IsValidSid
SetTokenInformation
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
GetUserNameW
AdjustTokenPrivileges
RegQueryValueExA

shell32

ShellExecuteA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHFileOperationA
Shell_NotifyIconA
SHGetSpecialFolderPathA

shlwapi

PathFindExtensionA
PathFindExtensionW

gdiplus

GdipDeleteGraphics
GdipGetImageEncodersSize
GdipGetImageGraphicsContext
GdipCreateBitmapFromFileICM
GdipBitmapLockBits
GdipFree
GdipGetImagePixelFormat
GdipDisposeImage
GdipGetImagePalette
GdipAlloc
GdipBitmapUnlockBits
GdipCloneImage
GdipGetImagePaletteSize
GdipGetImageEncoders
GdipGetImageHeight
GdiplusShutdown
GdiplusStartup
GdipGetImageWidth
GdipCreateBitmapFromScan0
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipCreateBitmapFromFile

imm32

ImmAssociateContext

wtsapi32

WTSEnumerateSessionsW
WTSQuerySessionInformationW
WTSFreeMemory

rpcrt4

UuidToStringA
UuidCreate
RpcStringFreeA

setupapi

CM_Get_Device_Interface_List_SizeW
CM_Get_Device_Interface_ListW
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_ListW
CM_Get_Device_IDW
SetupDiRemoveDevice
SetupDiEnumDeviceInfo
CM_Get_DevNode_Status
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

dnsapi

DnsFree
DnsQuery_W

iphlpapi

GetIfEntry

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 263KB - Virtual size: 262KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 350KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 512B - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cb5f88f8fb49064cd6a4ac60c799dec2

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

winmm

ws2_32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

shlwapi

gdiplus

imm32

wtsapi32

rpcrt4

setupapi

userenv

dnsapi

iphlpapi

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 263KB - Virtual size: 262KB

.data Size: 13KB - Virtual size: 350KB

Shared Size: 512B - Virtual size: 1B

.rsrc Size: 160KB - Virtual size: 160KB

.reloc Size: 60KB - Virtual size: 60KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 263KB - Virtual size: 262KB

.data
Size: 13KB - Virtual size: 350KB

Shared
Size: 512B - Virtual size: 1B

.rsrc
Size: 160KB - Virtual size: 160KB

.reloc
Size: 60KB - Virtual size: 60KB