d09d69586290f96abd2c5677edcd626041327ea50f2f7fbfe8c3c345f1123855

Sharing

Copy URL Twitter E-mail

General

Target

d09d69586290f96abd2c5677edcd626041327ea50f2f7fbfe8c3c345f1123855
Size

10.0MB
MD5

a71f12bb97154a2ebf797a418e94e4e5
SHA1

5d208cd84f47e4a47693f1cd92c179aada409b10
SHA256

d09d69586290f96abd2c5677edcd626041327ea50f2f7fbfe8c3c345f1123855
SHA512

b9ebf254ffe8e91032f064c5a9cecfc58a398b1c0cd45faf0344750e5d6a22219d2fefb6b8654cfe831ea26f910b397db231687cfafc8fb126c0f6c13e389564
SSDEEP

196608:nqwwWfx70hBeHsnF43+On6kPaMEInP+8xgxwkSlwZBWRipUGA:P/x7GBeHEk+R590bwLWRMFA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d09d69586290f96abd2c5677edcd626041327ea50f2f7fbfe8c3c345f1123855

Files

d09d69586290f96abd2c5677edcd626041327ea50f2f7fbfe8c3c345f1123855
.exe windows:5 windows x86 arch:x86

2554b81d657693edf4a27d8d67ee1852

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

timeGetTime

kernel32

GetLastError
GetPrivateProfileStringW
WritePrivateProfileStringW
GetTickCount
GlobalFree
GlobalAlloc
GlobalUnlock
GlobalLock
GetCurrentProcessId
CreateThread
MoveFileExW
InitializeCriticalSection
DeleteCriticalSection
SetFilePointer
GetFileType
DuplicateHandle
DosDateTimeToFileTime
SetFileTime
CreateEventW
SetEvent
GetPrivateProfileStringA
ExitProcess
LoadLibraryExW
GetEnvironmentVariableA
GetCommandLineW
GetLocalTime
SetUnhandledExceptionFilter
GetSystemDefaultLangID
lstrcmpW
GetUserDefaultLCID
PostQueuedCompletionStatus
SetEndOfFile
QueueUserWorkItem
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
GetModuleHandleExA
InterlockedExchange
CreateIoCompletionPort
GetQueuedCompletionStatus
InterlockedExchangeAdd
CreateDirectoryA
SetFileAttributesA
CompareFileTime
GetFileTime
CreateFileA
GetModuleFileNameA
FormatMessageA
VerifyVersionInfoA
VerSetConditionMask
GetSystemDirectoryA
LoadLibraryA
GetModuleHandleA
Process32NextW
SleepEx
QueryPerformanceCounter
CreateToolhelp32Snapshot
WaitForMultipleObjects
GetStdHandle
ExpandEnvironmentStringsA
OpenProcess
RemoveDirectoryA
SetHandleInformation
ReadFile
GetTempPathW
GetTimeZoneInformation
SetEnvironmentVariableA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetStringTypeA
GetLocaleInfoA
GetCurrentDirectoryA
GetFullPathNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetStdHandle
IsValidCodePage
GetOEMCP
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetHandleCount
HeapCreate
HeapSize
GetStringTypeW
LCMapStringW
LCMapStringA
CompareStringW
GetCPInfo
CompareStringA
GetFileInformationByHandle
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetStartupInfoA
GetCommandLineA
ExitThread
GetFileAttributesW
MoveFileA
MoveFileW
HeapReAlloc
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
RtlUnwind
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
PeekNamedPipe
Process32FirstW
GetTempFileNameW
OutputDebugStringW
DebugBreak
lstrlenA
InterlockedIncrement
GetLogicalDriveStringsW
lstrcmpiW
QueryDosDeviceW
lstrlenW
lstrcpyW
lstrcatW
LocalAlloc
LocalFree
GetCurrentDirectoryW
SetCurrentDirectoryW
FreeResource
FindNextFileW
RemoveDirectoryW
FindFirstFileW
GetFileAttributesA
SetFileAttributesW
MultiByteToWideChar
WideCharToMultiByte
SystemTimeToFileTime
GetVersionExW
GetVolumeInformationW
CreatePipe
GetStartupInfoW
WaitForSingleObject
GetExitCodeProcess
GetSystemInfo
GlobalMemoryStatusEx
GetDiskFreeSpaceExW
FindFirstFileA
FindNextFileA
DeleteFileA
FindClose
GetModuleHandleW
GetModuleFileNameW
LoadLibraryW
GetProcAddress
CopyFileW
Sleep
GetDriveTypeW
CreateDirectoryW
DeleteFileW
GetACP
SetLastError
FreeLibrary
InterlockedDecrement
GetCurrentThreadId
FindResourceW
LoadResource
LockResource
CreateFileW
SizeofResource
WriteFile
CloseHandle
GetCurrentProcess
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
RaiseException
CreateProcessW
QueryPerformanceFrequency

user32

GetClientRect
SetWindowPos
GetWindowLongW
SetWindowLongW
IsWindow
PostMessageW
EnableWindow
GetWindowTextLengthW
DrawIcon
DrawIconEx
DrawTextW
GetKeyState
GetWindowTextW
SetWindowTextW
RegisterClipboardFormatW
WaitMessage
UnregisterClassA
SetTimer
KillTimer
SetFocus
DestroyWindow
CallWindowProcW
DefWindowProcW
GetWindowRect
ShowWindow
IsZoomed
ScreenToClient
GetDC
UpdateWindow
IsIconic
GetClassInfoExW
LoadCursorW
ReleaseDC
ChangeDisplaySettingsW
EnumDisplaySettingsW
PeekMessageW
RegisterClassExW
CreateWindowExW
SetForegroundWindow
InvalidateRect
SendMessageW
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetWindow
GetParent
SystemParametersInfoW
SetClassLongW
LoadImageW
GetSystemMetrics
OffsetRect
SetWindowRgn
GetMessagePos
PostQuitMessage
BeginPaint
EndPaint
DispatchMessageW
TranslateMessage
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
wvsprintfW
LoadStringW
CharNextW
FillRect
CopyRect
FindWindowW
PostThreadMessageW
RegisterWindowMessageW
TrackMouseEvent
GetQueueStatus
MsgWaitForMultipleObjectsEx
UnregisterClassW
GetFocus

gdi32

CreateCompatibleDC
DeleteObject
DeleteDC
StretchBlt
CombineRgn
CreateRectRgn
CreateRoundRectRgn
BitBlt
SelectObject
CreateFontW
GetTextExtentPoint32W
SetBkMode
CreateSolidBrush
CreatePen
LineTo
MoveToEx
Rectangle
RoundRect
SetTextColor
CreateCompatibleBitmap
GetObjectA
SetBkColor
SetViewportOrgEx
SetWindowOrgEx
GetObjectW

advapi32

SetNamedSecurityInfoW
GetLengthSid
AllocateAndInitializeSid
DuplicateTokenEx
SetTokenInformation
CreateProcessAsUserW
OpenProcessToken
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextA
CryptImportKey
CryptReleaseContext
CryptEncrypt
CryptDestroyKey
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegEnumValueW
RegCreateKeyExW
RegSetValueExW
GetNamedSecurityInfoW
SetEntriesInAclW
CreateWellKnownSid
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
FreeSid

shell32

SHGetSpecialFolderLocation
CommandLineToArgvW
SHFileOperationW
SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
ShellExecuteW
SHGetPathFromIDListW
SHGetMalloc
SHBrowseForFolderW

ole32

StringFromGUID2
CoInitializeEx
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CreateStreamOnHGlobal
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

VariantClear
VarUI4FromStr
SysAllocStringLen
SysFreeString
SysAllocString

shlwapi

PathIsDirectoryA
PathFindFileNameA
PathAppendA
PathCombineA
PathRemoveFileSpecA
PathFindExtensionW
PathCanonicalizeW
PathAddBackslashW
PathIsRootW
StrStrIW
StrCmpIW
PathFileExistsA
PathIsDirectoryW
PathFileExistsW

comctl32

InitCommonControlsEx

msimg32

TransparentBlt
AlphaBlend

opengl32

glGetString

gdiplus

GdipClonePath
GdipCloneBrush
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawImageRectI
GdipDrawString
GdipFillPath
GdipFillRectangleI
GdipDrawPath
GdipDrawRectangleI
GdipDrawLineI
GdipSetTextRenderingHint
GdipReleaseDC
GdipAddPathArcI
GdipAddPathLineI
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipCreateTexture2I
GdipCreateSolidFill
GdipSetImageAttributesColorKeys
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipDeleteFont
GdipDeletePath
GdipCreatePath
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeletePen
GdipCreatePen1
GdipTranslateTextureTransform
GdipDeleteBrush
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipDrawImageRectRectI
GdipCreateFromHDC
GdipGetImageHeight
GdipGetImageWidth
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipDeleteGraphics
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipDisposeImage
GdipAlloc
GdipFree

psapi

GetProcessImageFileNameW

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wininet

InternetSetOptionW
InternetCloseHandle
HttpQueryInfoW
InternetReadFile
InternetOpenUrlA
HttpSendRequestA
HttpOpenRequestW
InternetConnectW
InternetOpenA

dbghelp

MiniDumpWriteDump

ws2_32

getpeername
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
recvfrom
accept
listen
ioctlsocket
gethostname
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
send
recv
WSAStartup
WSACleanup
socket
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
sendto

wldap32

ord22
ord217
ord143
ord50
ord26
ord30
ord200
ord32
ord35
ord79
ord33
ord301
ord27
ord41
ord46
ord60
ord211

Sections

.text
Size: 790KB - Virtual size: 790KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 178KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 430.7MB - Virtual size: 430.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2554b81d657693edf4a27d8d67ee1852

Headers

DLL Characteristics

File Characteristics

Imports

winmm

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

opengl32

gdiplus

psapi

iphlpapi

version

wininet

dbghelp

ws2_32

wldap32

Sections

.text Size: 790KB - Virtual size: 790KB

.rdata Size: 178KB - Virtual size: 178KB

.data Size: 19KB - Virtual size: 43KB

.rsrc Size: 430.7MB - Virtual size: 430.7MB

.text
Size: 790KB - Virtual size: 790KB

.rdata
Size: 178KB - Virtual size: 178KB

.data
Size: 19KB - Virtual size: 43KB

.rsrc
Size: 430.7MB - Virtual size: 430.7MB