97338609e730eb6b330b8e362c05b035

Sharing

Copy URL Twitter E-mail

General

Target

97338609e730eb6b330b8e362c05b035
Size

420KB
MD5

97338609e730eb6b330b8e362c05b035
SHA1

72b0983d2de78bdf4f2816a52b826a086ec46ae1
SHA256

2c6db2a74407bfe7b19cf27527b1fdaa7633cf178a9407cc8dba26ef00bbe5c7
SHA512

f336fe51dcdf5865da994f10b2a63bf45caa9e15d2c3b569a5970e137ecd55a8962b64363d530ea8d010128c6f51bc5aac354c9f462ffa4dc80f38fe5c91cad5
SSDEEP

6144:5f4P3CU4DaR5F1CHf2L/N/L2q2FJUOE9fKsXC26xc12:GJlt1C/s/5LFoJWy8CWM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
97338609e730eb6b330b8e362c05b035

Files

97338609e730eb6b330b8e362c05b035
.exe windows:5 windows x86 arch:x86

26fd1634aefcefa3d30d56d2baeefc2f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

A_SHAInit
A_SHAUpdate
A_SHAFinal
MD5Final
MD5Update
MD5Init
I_ScSendTSMessage
RegSetKeySecurity
AddAccessAllowedAceEx
RegDeleteKeyW
RegOpenCurrentUser
CryptReleaseContext
CryptGetProvParam
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptSetHashParam
GetCurrentHwProfileW
CryptCreateHash
CryptAcquireContextW
CryptGenRandom
CryptDeriveKey
CryptSignHashW
CryptSetProvParam
CryptDestroyKey
CryptDecrypt
CryptEncrypt
CryptVerifySignatureW
CryptGetKeyParam
CryptGetUserKey
LsaNtStatusToWinError
CryptImportKey
LsaStorePrivateData
LsaRetrievePrivateData
RegCloseKey
RegQueryValueExW
RegOpenKeyW
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegOpenKeyExW
CreateProcessAsUserW
DuplicateTokenEx
CloseServiceHandle
ControlService
StartServiceW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
EqualSid
GetTokenInformation
RegSetValueExW
RegCreateKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegDeleteValueW
CredFree
CredDeleteW
CredEnumerateW
CopySid
GetSidLengthRequired
GetSidSubAuthority
GetSidSubAuthorityCount
GetUserNameW
OpenThreadToken
ReportEventW
RegisterEventSourceW
EnumServicesStatusW
ImpersonateLoggedOnUser
RegQueryValueExA
CheckTokenMembership
DeregisterEventSource
LsaGetUserName
RevertToSelf
LookupAccountSidW
IsValidSid
SetTokenInformation
LogonUserW
LookupAccountNameW
OpenProcessToken
SynchronizeWindows31FilesAndWindowsNTRegistry
QueryWindows31FilesMigration
AdjustTokenPrivileges
SystemFunction036
RegQueryInfoKeyA
RegEnumKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetKernelObjectSecurity
QueryServiceConfigW
RegNotifyChangeKeyValue
LsaClose
LsaFreeMemory
LsaQueryInformationPolicy
LsaOpenPolicy
AllocateLocallyUniqueId

authz

AuthzAccessCheck
AuthziFreeAuditEventType
AuthziInitializeAuditEvent
AuthziInitializeAuditParams
AuthziInitializeAuditEventType
AuthzFreeResourceManager
AuthzFreeAuditEvent
AuthziLogAuditEvent
AuthzInitializeResourceManager
AuthzFreeHandle

crypt32

CryptImportPublicKeyInfoEx
CertEnumCertificatesInStore
CertOpenStore
CertVerifySubjectCertificateContext
CertGetIssuerCertificateFromStore
CertAddCertificateContextToStore
CertFindExtension
CryptExportPublicKeyInfo
CertComparePublicKeyInfo
CertGetCertificateContextProperty
CryptDecryptMessage
CertCloseStore
CryptSignMessage
CryptImportPublicKeyInfo
CryptVerifyMessageSignature
CertCreateCertificateContext
CertDuplicateCertificateContext
CertSetCertificateContextProperty
CertFreeCertificateContext

gdi32

RemoveFontResourceW
AddFontResourceW

kernel32

LoadLibraryW
ReleaseSemaphore
CreateSemaphoreW
GetCurrentThread
WaitForSingleObjectEx
CreateThread
LoadResource
FindResourceW
SetThreadExecutionState
ResetEvent
GetComputerNameW
GetSystemDirectoryW
SetLastError
TransactNamedPipe
SetNamedPipeHandleState
GetTickCount
GetProfileStringW
GlobalGetAtomNameW
SetEnvironmentVariableW
VirtualLock
VirtualQuery
GetDriveTypeW
Beep
QueueUserWorkItem
LeaveCriticalSection
EnterCriticalSection
DisconnectNamedPipe
TerminateProcess
GetCurrentProcess
SearchPathW
lstrcatW
LocalReAlloc
ExpandEnvironmentStringsW
TerminateThread
ResumeThread
GetDiskFreeSpaceExW
GlobalMemoryStatusEx
DeleteFileW
WriteProfileStringW
ReadFile
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
SetThreadPriority
SetPriorityClass
MoveFileExW
WaitForMultipleObjectsEx
GetExitCodeProcess
GetProcAddress
InterlockedExchange
SetTimerQueueTimer
GetComputerNameA
VerifyVersionInfoW
VerSetConditionMask
WriteFile
WaitNamedPipeW
WaitForMultipleObjects
ConnectNamedPipe
DuplicateHandle
OpenProcess
GetOverlappedResult
GetVersionExA
lstrcmpW
UnregisterWait
CreateNamedPipeW
CreateRemoteThread
CreateActCtxW
GetModuleFileNameW
SetErrorMode
SetUnhandledExceptionFilter
GetPrivateProfileStringW
LocalSize
VirtualAlloc
VirtualQueryEx
GetEnvironmentVariableW
DebugBreak
CreateFileA
InitializeCriticalSection
ProcessIdToSessionId
FindClose
FindFirstFileW
SetInformationJobObject
AssignProcessToJobObject
TerminateJobObject
PostQueuedCompletionStatus
PulseEvent
GetQueuedCompletionStatus
CreateIoCompletionPort
CreateJobObjectW
ActivateActCtx
DeactivateActCtx
InterlockedCompareExchange
LoadLibraryA
GetModuleHandleA
GetStartupInfoA
FreeLibrary
SleepEx
GetModuleHandleW
GetShortPathNameW
lstrcpynW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetUserDefaultLCID
GetTimeFormatW
WTSGetActiveConsoleSessionId
GetCurrentProcessId
GetCurrentThreadId
GetVersionExW
FormatMessageW
lstrcmpiW
GetProfileIntW
lstrcpyW
lstrlenW
Sleep
LocalAlloc
CreateEventW
CreateWaitableTimerW
CreateMutexW
OpenEventW
RegisterWaitForSingleObject
WaitForSingleObject
CreateProcessW
SetWaitableTimer
ReleaseMutex
SetEvent
UnregisterWaitEx
CloseHandle
GlobalAlloc
GlobalFree
GetLastError
LocalFree
GetVolumeInformationW
GetDriveTypeA
GetLogicalDriveStringsA
lstrlenA
lstrcpyA
MultiByteToWideChar
GetACP
WideCharToMultiByte
SystemTimeToFileTime
GetSystemTime
HeapAlloc
GetProcessHeap
LoadLibraryExW
HeapFree
GetSystemDefaultUILanguage
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
lstrcmpiA
GetFileSize
GetSystemInfo
GetExitCodeThread
SetThreadAffinityMask
GetProcessAffinityMask
SizeofResource
LockResource
FindResourceExW
GetSystemDirectoryA
SetFilePointer
OpenMutexW
CreateFileW
GlobalMemoryStatus
lstrcmpA
DelayLoadFailureHook
BaseInitAppcompatCacheSupport
OpenProfileUserMapping
CloseProfileUserMapping
BaseCleanupAppcompatCacheSupport
DeleteCriticalSection
RtlUnwind
InitializeCriticalSectionAndSpinCount
CreateSemaphoreA
CreateEventA
ExitProcess
VirtualFree
VirtualProtect
FlushInstructionCache
GetSystemTimeAsFileTime

msvcrt

wcsstr
wcsncpy
atoi
_wcsicmp
memmove
wcschr
wcsncat
swprintf
swscanf
_local_unwind2
wcscmp
free
malloc
_c_exit
wcslen
_XcptFilter
_cexit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
_snwprintf
__p__fmode
__set_app_type
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
_itow
_wtol
_strnicmp
sscanf
sprintf
_except_handler3
_controlfp
wcsncmp
_ftol
ceil
_wcsupr
wcscpy
__p__commode
wcscat
_exit
wcstok

nddeapi

ord613
ord612
ord611
ord603

ntdll

NtPowerInformation
NtSetSystemPowerState
NtRaiseHardError
RtlDeleteCriticalSection
NtOpenSymbolicLinkObject
NtReplyPort
NtCompleteConnectPort
NtReplyWaitReceivePort
NtAcceptConnectPort
NtCreatePort
RtlConvertSidToUnicodeString
RtlFreeUnicodeString
NtLockProductActivationKeys
RtlTimeToTimeFields
NtUnmapViewOfSection
NtMapViewOfSection
NtOpenSection
NtQuerySymbolicLinkObject
NtQueryVolumeInformationFile
NtSetSecurityObject
RtlAdjustPrivilege
NtOpenFile
NtFsControlFile
RtlAllocateAndInitializeSid
RtlDestroyEnvironment
RtlFreeHeap
NtQueryInformationToken
NtShutdownSystem
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlCompareUnicodeString
RtlInitializeCriticalSection
RtlCreateEnvironment
RtlQueryEnvironmentVariable_U
RtlSetEnvironmentVariable
RtlAllocateHeap
RtlSubAuthoritySid
RtlInitializeSid
RtlLengthRequiredSid
RtlGetDaclSecurityDescriptor
RtlCopySid
RtlLengthSid
NtSetInformationThread
NtDuplicateToken
NtDuplicateObject
RtlEqualSid
RtlSetDaclSecurityDescriptor
RtlInitUnicodeString
NtOpenKey
NtQueryValueKey
NtClose
RtlOpenCurrentUser
RtlCreateSecurityDescriptor
RtlAddAce
RtlCreateAcl
RtlNtStatusToDosError
NtSetInformationProcess
NtCreateEvent
NtCreatePagingFile
RtlDosPathNameToNtPathName_U
NtQuerySystemInformation
NtOpenDirectoryObject
RtlRegisterWait
RtlTimeToSecondsSince1980
NtQuerySystemTime
NtPrivilegeObjectAuditAlarm
NtPrivilegeCheck
NtOpenThreadToken
NtOpenProcessToken
RtlUnhandledExceptionFilter
NtQueryInformationProcess
DbgBreakPoint
RtlCheckProcessParameters
RtlSetThreadIsCritical
RtlSetProcessIsCritical
RtlInitString
NtInitiatePowerAction
DbgPrint
NtFilterToken
NtQueryInformationJobObject
NtOpenEvent
RtlGetAce
RtlQueryInformationAcl
NtQuerySecurityObject
NtAllocateLocallyUniqueId

profmap

InitializeProfileMappingApi
RemapAndMoveUserW

psapi

GetModuleBaseNameW
EnumProcessModules
EnumProcesses

regapi

RegDefaultUserConfigQueryW
RegUserConfigQuery

rpcrt4

RpcRevertToSelf
RpcFreeAuthorizationContext
RpcGetAuthorizationContextForClient
RpcServerListen
RpcImpersonateClient
RpcServerRegisterIfEx
UuidCreate
RpcServerRegisterIf
I_RpcMapWin32Status
NdrServerCall2
RpcServerUseProtseqEpW

secur32

LsaLookupAuthenticationPackage
LsaCallAuthenticationPackage
LsaRegisterLogonProcess
GetUserNameExW

setupapi

SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList

sfc_os

SfcIsFileProtected

user32

CheckDlgButton
LoadCursorW
SetCursor
SetFocus
EnumWindows
UnhookWindowsHook
SetWindowsHookW
GetWindowTextW
CallNextHookEx
DialogBoxParamW
GetWindowPlacement
SetLastErrorEx
GetSystemMenu
DeleteMenu
SetWindowPlacement
SetUserObjectInformationW
GetAsyncKeyState
PostThreadMessageW
SetUserObjectSecurity
CreateDesktopW
KillTimer
GetMessageTime
SetTimer
wvsprintfW
UnregisterHotKey
DialogBoxIndirectParamW
OpenInputDesktop
GetUserObjectInformationW
CloseDesktop
RegisterDeviceNotificationW
SetThreadDesktop
CreateWindowExW
GetMessageW
TranslateMessage
RegisterWindowMessageW
RegisterClassW
IsDlgButtonChecked
FindWindowW
MessageBoxW
SendNotifyMessageW
PostQuitMessage
MsgWaitForMultipleObjects
GetWindowRect
GetSystemMetrics
PeekMessageW
DispatchMessageW
SetProcessWindowStation
UpdateWindow
ShowWindow
SetWindowPos
PostMessageW
ExitWindowsEx
EnumDisplayMonitors
SystemParametersInfoW
GetDlgItem
SendMessageW
CreateDialogParamW
DestroyWindow
GetWindowLongW
GetDlgItemTextW
EndDialog
SetWindowLongW
LoadStringW
SetWindowTextW
SetDlgItemTextW
wsprintfW
wsprintfA
CloseWindowStation
LoadImageW
GetKeyState
GetParent
RegisterLogonProcess
RecordShutdownReason
LoadLocalFonts
SetLogonNotifyWindow
UnlockWindowStation
LockWindowStation
GetDesktopWindow
CreateWindowStationW
OpenDesktopW
SwitchDesktop
DefWindowProcW
SetForegroundWindow
MBToWCSEx
SetWindowStationUser
UpdatePerUserSystemParameters
RegisterHotKey
ReplyMessage

userenv

ord131
ord117
GetAllUsersProfileDirectoryW
WaitForUserPolicyForegroundProcessing
ord140
WaitForMachinePolicyForegroundProcessing
ord118
ord150
ord152
UnregisterGPNotification
DestroyEnvironmentBlock
CreateEnvironmentBlock
RegisterGPNotification
GetUserProfileDirectoryW
ord130
LoadUserProfileW
UnloadUserProfile
ord151

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winsta

WinStationQueryLogonCredentialsW
_WinStationWaitForConnect
WinStationSetInformationW
_WinStationNotifyLogoff
_WinStationNotifyLogon
WinStationCheckLoopBack
WinStationShutdownSystem
_WinStationCallback
WinStationNameFromLogonIdW
WinStationDisconnect
_WinStationFUSCanRemoteUserDisconnect
WinStationConnectW
_WinStationNotifyDisconnectPipe
WinStationReset
WinStationQueryInformationW
WinStationGetMachinePolicy
WinStationEnumerate_IndexedW
WinStationIsHelpAssistantSession

ws2_32

WSACleanup
getaddrinfo
WSAStartup

Sections

.text
Size: 373KB - Virtual size: 372KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

26fd1634aefcefa3d30d56d2baeefc2f

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

authz

crypt32

gdi32

kernel32

msvcrt

nddeapi

ntdll

profmap

psapi

regapi

rpcrt4

secur32

setupapi

sfc_os

user32

userenv

version

winsta

ws2_32

Sections

.text Size: 373KB - Virtual size: 372KB

.data Size: 9KB - Virtual size: 19KB

.rsrc Size: 36KB - Virtual size: 36KB

.text
Size: 373KB - Virtual size: 372KB

.data
Size: 9KB - Virtual size: 19KB

.rsrc
Size: 36KB - Virtual size: 36KB