4dcde2b3f93f066e282e4fd523e2fcccb8568e27f3f2dc67d37c78661253622f

Sharing

Copy URL

Twitter E-mail

General

Target

4dcde2b3f93f066e282e4fd523e2fcccb8568e27f3f2dc67d37c78661253622f
Size

6.6MB
MD5

6441b10bfbd90e23f71361f246784b64
SHA1

6c5fe91068858d02b42ba707fbcc4a4b29a727a0
SHA256

4dcde2b3f93f066e282e4fd523e2fcccb8568e27f3f2dc67d37c78661253622f
SHA512

c875991dbea7dbeb49c400df02f80315cc6a2b0eb106547bc9b6ce33dce6d016df06e514dace77bc10bfa4b257a40d6defae773cce7b9502452e3438a5c9f9ca
SSDEEP

98304:UbnNDrVpLwC/3x1BgzkYkEzCH4VRVL0g6AmrfqGV7Nrmjdtaoe87HZ:eNDf1OYSJNt6A3d5Z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4dcde2b3f93f066e282e4fd523e2fcccb8568e27f3f2dc67d37c78661253622f

Files

4dcde2b3f93f066e282e4fd523e2fcccb8568e27f3f2dc67d37c78661253622f
.exe windows:5 windows x86 arch:x86

db30392310ec56ec55c23cffc76a3f2f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
FindResourceW
LoadResource
LockResource
FreeResource
CreateTimerQueueTimer
GetModuleFileNameA
GetCurrentProcessId
GetCurrentDirectoryW
lstrcatW
WriteConsoleW
GetTimeZoneInformation
GetFileAttributesExW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
CloseHandle
CreateEventW
FindClose
FindNextFileW
GetOEMCP
IsValidCodePage
GetLogicalProcessorInformation
SignalObjectAndWait
SwitchToThread
TryEnterCriticalSection
SizeofResource
LoadLibraryExA
FindNextFileA
FindFirstFileExA
GetConsoleCP
FlushFileBuffers
SetStdHandle
GetStringTypeW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetConsoleMode
ReadConsoleInputA
SetConsoleCtrlHandler
ReadConsoleW
GetConsoleMode
GetACP
SystemTimeToTzSpecificLocalTime
VirtualProtect
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
VirtualQuery
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
ExitProcess
GetProcessHeap
SetEndOfFile
FindFirstFileW
lstrlenW
lstrcpyW
FreeLibrary
GetProcAddress
LoadLibraryA
GetCurrentDirectoryA
GetModuleFileNameW
GlobalMemoryStatusEx
GetCurrentProcess
GetSystemInfo
lstrcmpW
GetModuleHandleW
GetPrivateProfileStringW
QueryPerformanceCounter
QueryPerformanceFrequency
GetVersionExW
WriteFile
SetFilePointer
GetLocalTime
CreateFileW
DeleteFileW
GetLastError
GetExitCodeThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObject
WaitForMultipleObjects
Sleep
LoadLibraryW
lstrcmpiW
SetErrorMode
GetFileSize
ReadFile
GetFileTime
SetFileTime
CompareFileTime
SetFileAttributesW
GetFileAttributesW
CopyFileW
MoveFileW
SetFilePointerEx
GetTickCount
GetVolumeInformationW
SetThreadPriority
ResumeThread
GlobalAlloc
GlobalLock
GlobalUnlock
SetCurrentDirectoryW
MultiByteToWideChar
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
lstrcpyA
lstrcatA
lstrlenA
CreateDirectoryW
GetFullPathNameW
LocalFree
GetCurrentThread
GetTempPathW
GetWindowsDirectoryW
MulDiv
VirtualAlloc
VirtualFree
GetCurrentThreadId
ReleaseSemaphore
DuplicateHandle
lstrcpynW
CreateSemaphoreW
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
CreateThread
GetThreadPriority
GetUserDefaultUILanguage
FileTimeToLocalFileTime
FileTimeToSystemTime
SetCurrentDirectoryA
GetFileAttributesA
CreateFileA
CreateMutexW
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
GetLogicalDrives
GetDriveTypeW
GetDiskFreeSpaceW
GetDiskFreeSpaceExW
OpenProcess
ReadProcessMemory
WriteProcessMemory
GetSystemDirectoryW
OutputDebugStringW
OutputDebugStringA
GlobalFree
InitializeCriticalSectionEx
SleepEx
VerSetConditionMask
GetSystemDirectoryA
GetModuleHandleA
VerifyVersionInfoA
ExpandEnvironmentStringsA
GetStdHandle
GetFileType
PeekNamedPipe
SetLastError
FormatMessageA
GlobalMemoryStatus
FlushConsoleInputBuffer
GetSystemTime
SystemTimeToFileTime

user32

EnableMenuItem
GetWindowLongW
CallWindowProcW
PostMessageW
GetWindowRect
EndDialog
SetDlgItemTextW
SendDlgItemMessageW
LoadCursorW
SetDlgItemTextA
SetCursor
wsprintfW
InvalidateRect
MessageBoxW
GetDesktopWindow
CheckDlgButton
KillTimer
IsDlgButtonChecked
GetDlgItemTextW
SetWindowTextA
GetWindowTextA
SetTimer
GetDlgItemTextA
ShowWindow
SendMessageW
FillRect
CheckRadioButton
SetClassLongW
UpdateWindow
SetWindowPos
GetWindowTextW
SetWindowTextW
InsertMenuW
LoadIconW
CreateAcceleratorTableW
DestroyAcceleratorTable
SetMenuItemInfoW
DestroyIcon
CopyAcceleratorTableW
GetMessageW
TranslateMessage
DispatchMessageW
IsWindow
CreateDialogParamW
TranslateAcceleratorW
SetActiveWindow
MessageBoxA
IsDialogMessageW
DefWindowProcW
UnregisterClassW
CreateWindowExW
AdjustWindowRect
IsIconic
SetFocus
GetForegroundWindow
IsRectEmpty
SetRectEmpty
CloseClipboard
SetClipboardData
EmptyClipboard
IntersectRect
UnionRect
EqualRect
OffsetRect
AttachThreadInput
GetMenuItemCount
SetForegroundWindow
AdjustWindowRectEx
ClientToScreen
GetWindowThreadProcessId
SystemParametersInfoW
MoveWindow
GetWindow
PeekMessageW
PostThreadMessageW
GetQueueStatus
RegisterWindowMessageW
MsgWaitForMultipleObjects
SetMenu
RedrawWindow
LoadMenuW
DestroyMenu
RegisterClassExW
GetClassNameW
IsChild
SetCapture
ReleaseCapture
ShowCursor
ScreenToClient
WindowFromPoint
FindWindowW
wsprintfA
EnumWindows
ChangeDisplaySettingsW
ChangeDisplaySettingsExW
EnumDisplaySettingsW
EnumChildWindows
GetMenuItemInfoW
GetDlgCtrlID
LoadStringW
DdeInitializeW
DdeConnect
DdeDisconnect
DdeNameService
DdeClientTransaction
DdeCreateDataHandle
DdeGetData
DdeFreeDataHandle
DdeGetLastError
DdeCreateStringHandleW
DdeQueryStringW
DdeFreeStringHandle
DdeCmpStringHandles
GetProcessWindowStation
GetUserObjectInformationW
GetSubMenu
LoadAcceleratorsW
DeleteMenu
ModifyMenuW
ReleaseDC
GetDC
DialogBoxParamW
GetSystemMetrics
GetCursorPos
PtInRect
EnumDisplayMonitors
EndPaint
BeginPaint
SetCursorPos
LoadCursorFromFileW
PostQuitMessage
EnableWindow
SetWindowLongW
GetDlgItem
GetParent
LoadImageW
OpenClipboard
GetClassLongW
DestroyWindow
GetClientRect

gdi32

SetTextAlign
SetMapMode
SetBkColor
GetTextExtentPoint32W
GetTextExtentPoint32A
GetGlyphOutlineW
GetGlyphOutlineA
GetTextMetricsW
StretchBlt
SelectObject
DeleteDC
CreateCompatibleDC
StretchDIBits
GetStockObject
EnumFontFamiliesExW
CreateFontIndirectW
AddFontResourceA
GetDeviceCaps
CreateDIBSection
SetTextColor
DeleteObject
CreateSolidBrush
SetBkMode

advapi32

RegQueryValueExW
RegQueryValueExA
RegOpenKeyA
CryptSignHashA
CryptDestroyHash
RegOpenKeyExW
RegEnumKeyExW
DeregisterEventSource
RegisterEventSourceA
ReportEventA
CryptAcquireContextA
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
RegSetValueExW
RegCloseKey
RegCreateKeyExW
CryptEnumProvidersA

shell32

SHGetFolderPathW
ShellExecuteA
ShellExecuteExW
ShellExecuteW
SHGetFileInfoW
SHGetPathFromIDListW
SHBrowseForFolderW
ExtractIconExW
SHGetSpecialFolderPathW

ole32

CoFreeUnusedLibraries
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
CoInitialize
CoTaskMemFree
CreateStreamOnHGlobal

winmm

waveOutOpen
waveOutClose
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutWrite
waveOutPause
waveOutRestart
waveOutReset
mciSendCommandW
mciGetErrorStringW
timeGetDevCaps
waveOutGetNumDevs
timeBeginPeriod
timeEndPeriod
waveOutGetDevCapsW
timeKillEvent
timeSetEvent
joyGetNumDevs
joyGetDevCapsW
joyGetPosEx
joyReleaseCapture
joySetCapture
timeGetTime

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

comctl32

PropertySheetW
ord17
CreatePropertySheetPageW

imm32

ImmGetStatusWindowPos
ImmSetOpenStatus
ImmGetOpenStatus
ImmReleaseContext
ImmGetContext
ImmSetStatusWindowPos

ws2_32

WSAIoctl
getaddrinfo
freeaddrinfo
accept
listen
recvfrom
sendto
ioctlsocket
gethostname
setsockopt
shutdown
getsockopt
getsockname
bind
WSASetLastError
select
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup
getservbyname
gethostbyname
socket
send
recv
ntohs
htons
connect
closesocket
htonl
getpeername

wldap32

ord27
ord26
ord22
ord41
ord33
ord60
ord211
ord143
ord217
ord46
ord50
ord32
ord301
ord200
ord30
ord79
ord35

crypt32

CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetCertificateContextProperty

msvfw32

ICRemove
ICInstall

emotedriver

?EmoteCreate@@YAPAVIEmoteDevice@@ABUInitParam@1@@Z
?EmoteFilterTexture@@YAXPAEKP6AX0K@Z@Z

comdlg32

GetSaveFileNameW
GetOpenFileNameW

oleaut32

SysStringLen
VariantClear
VariantInit

gdiplus

GdipGetImageHeight
GdipCloneImage
GdipCreateBitmapFromStream
GdipAlloc
GdipDisposeImage
GdipFree
GdipBitmapGetPixel
GdiplusShutdown
GdiplusStartup
GdipGetImageWidth

Sections

.text
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 172KB - Virtual size: 573KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

db30392310ec56ec55c23cffc76a3f2f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

winmm

version

comctl32

imm32

ws2_32

wldap32

crypt32

msvfw32

emotedriver

comdlg32

oleaut32

gdiplus

Sections

.text Size: 5.1MB - Virtual size: 5.1MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 172KB - Virtual size: 573KB

_RDATA Size: 2KB - Virtual size: 2KB

.rsrc Size: 69KB - Virtual size: 68KB

.text
Size: 5.1MB - Virtual size: 5.1MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 172KB - Virtual size: 573KB

_RDATA
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 69KB - Virtual size: 68KB