fa9ab6f6a5c815e8d67533bc5a53ac1f83a557e9557f0b29d0c43c1a4fa6ad27

Sharing

Copy URL Twitter E-mail

General

Target

fa9ab6f6a5c815e8d67533bc5a53ac1f83a557e9557f0b29d0c43c1a4fa6ad27
Size

4.8MB
MD5

3d6689e306d110ee6bde7dc8d1e35c61
SHA1

5a342b93665f0d0de7ff13c568a5adc53e76355b
SHA256

fa9ab6f6a5c815e8d67533bc5a53ac1f83a557e9557f0b29d0c43c1a4fa6ad27
SHA512

69d5444d60bbf2a23cb1e78a22be6bbe30cfbb6880e94bc484d3433c735bbfc23ddd5efb4ee12e1d0c9e3936946c19c21721cffe7093d478914419bc891a5614
SSDEEP

98304:jO3vwbh7dXP9b5XWgTdAJfaeAisXsJkqlmgm322Ipzmr5OyvqnfXJZAQhiJy7b87:jIY1lbsZmj2pG4RnfXJzoJMM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa9ab6f6a5c815e8d67533bc5a53ac1f83a557e9557f0b29d0c43c1a4fa6ad27

Files

fa9ab6f6a5c815e8d67533bc5a53ac1f83a557e9557f0b29d0c43c1a4fa6ad27
.exe windows:5 windows x86 arch:x86

50217960d05364456d3f04365a9650c3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\PCProjects\Pakages\Pakage1.0\installVs2010\installer\Release\install.pdb

Imports

shlwapi

PathRemoveExtensionW
PathFindFileNameW
PathStripToRootW
PathIsUNCW
PathRemoveFileSpecW
PathFileExistsW
PathFindExtensionW

kernel32

SetHandleCount
HeapCreate
HeapDestroy
QueryPerformanceCounter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetStringTypeW
FatalAppExitA
GetCPInfo
GetACP
SetStdHandle
IsValidCodePage
GetTimeZoneInformation
GetEnvironmentStringsW
GetProcessHeap
WriteConsoleW
SetConsoleCtrlHandler
LCMapStringW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
VirtualQuery
VirtualAlloc
HeapSize
HeapQueryInformation
HeapReAlloc
ExitThread
FreeEnvironmentStringsW
GetStdHandle
SetCurrentDirectoryW
SetUnhandledExceptionFilter
ExitProcess
GetConsoleMode
GetConsoleCP
GetFileType
GetFullPathNameA
SetCurrentDirectoryA
GetCurrentDirectoryA
SetEnvironmentVariableA
GetDateFormatA
GetTimeFormatA
MoveFileA
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
RaiseException
InterlockedCompareExchange
RtlUnwind
DecodePointer
EncodePointer
GetStartupInfoW
HeapSetInformation
LocalLock
LocalUnlock
FindResourceExW
ReplaceFileW
GetUserDefaultLCID
VirtualProtect
SearchPathW
GetProfileIntW
GetTickCount
InitializeCriticalSectionAndSpinCount
GetNumberFormatW
GetWindowsDirectoryW
GetTempPathW
GetTempFileNameW
SetErrorMode
GetAtomNameW
GlobalGetAtomNameW
lstrcpyW
GlobalFlags
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
InterlockedIncrement
lstrlenA
GetFileTime
GetFileSizeEx
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileAttributesExW
GetShortPathNameW
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
MoveFileW
lstrcmpiW
GetThreadLocale
GetStringTypeExW
GlobalFindAtomW
CompareStringW
InterlockedDecrement
ReleaseActCtx
CreateActCtxW
FreeResource
GetCurrentProcessId
GlobalAddAtomW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
CreateEventW
SuspendThread
SetEvent
ResumeThread
SetThreadPriority
lstrcmpA
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringA
ActivateActCtx
DeactivateActCtx
lstrcmpW
InterlockedExchange
CopyFileW
GlobalSize
FormatMessageW
LocalFree
lstrlenW
MulDiv
SetFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
SystemTimeToFileTime
CreateFileA
SetVolumeLabelW
GetDiskFreeSpaceW
GetDriveTypeW
SetFileAttributesW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
ReleaseMutex
GetModuleFileNameA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetSystemDirectoryW
OpenProcess
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetFileAttributesW
GetCurrentProcess
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetSystemInfo
WideCharToMultiByte
CreateDirectoryW
CreateProcessW
GetVersionExW
SetLastError
EnumResourceTypesW
EnumResourceNamesW
EnumResourceLanguagesW
LoadLibraryW
FreeLibrary
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
FindFirstFileW
FindNextFileW
FindClose
DeleteFileA
GetFileAttributesA
SetFilePointer
ReadFile
WriteFile
CreateFileW
GetFileSize
DeleteFileW
MultiByteToWideChar
CreateThread
Sleep
FindResourceW
LoadResource
LockResource
SizeofResource
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetCommandLineW
CreateSemaphoreW
WaitForSingleObject
ReleaseSemaphore
CloseHandle
CreateMutexW
GetLastError
GetOEMCP

user32

GetTabbedTextExtentW
GetDCEx
EnumChildWindows
GetWindowRgn
WindowFromDC
DestroyCursor
MapDialogRect
SubtractRect
MapVirtualKeyExW
IsCharLowerW
GetDoubleClickTime
CharUpperBuffW
CopyIcon
RegisterClipboardFormatW
EmptyClipboard
CloseClipboard
SetClipboardData
OpenClipboard
GetUpdateRect
FrameRect
SendNotifyMessageW
IsClipboardFormatAvailable
SetMenuDefaultItem
PostThreadMessageW
InSendMessage
IsMenu
UpdateLayeredWindow
UnionRect
MonitorFromPoint
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcW
DefFrameProcW
GetNextDlgGroupItem
CopyImage
GetIconInfo
EnableScrollBar
HideCaret
InvertRect
GetMenuDefaultItem
UnpackDDElParam
ReuseDDElParam
GetMenuBarInfo
LoadImageW
InsertMenuItemW
TranslateAcceleratorW
LockWindowUpdate
BringWindowToTop
SetCursorPos
SetRect
CreateAcceleratorTableW
LoadAcceleratorsW
GetKeyboardState
GetKeyboardLayout
ToUnicodeEx
CopyAcceleratorTableW
DrawFocusRect
DrawFrameControl
DrawEdge
DrawIconEx
DrawStateW
MessageBeep
GetSystemMenu
SetClassLongW
GetAsyncKeyState
NotifyWinEvent
CreatePopupMenu
DestroyAcceleratorTable
SetParent
RedrawWindow
SetWindowRgn
IsZoomed
OffsetRect
IsRectEmpty
DestroyMenu
GetMenuItemInfoW
UnregisterClassW
GetDialogBaseUnits
IntersectRect
InflateRect
DestroyIcon
WaitMessage
ReleaseCapture
WindowFromPoint
SetCapture
SetLayeredWindowAttributes
EnumDisplayMonitors
SystemParametersInfoW
SetRectEmpty
KillTimer
SetTimer
InvalidateRect
RealChildWindowFromPoint
DeleteMenu
LoadCursorW
GetSysColorBrush
CharUpperW
MapVirtualKeyW
GetKeyNameTextW
LoadMenuW
RegisterWindowMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
GetMessagePos
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
DrawIcon
SendMessageW
IsIconic
GetWindowRect
GetClientRect
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
UpdateWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
CopyRect
PtInRect
SetWindowPlacement
GetWindowPlacement
DefWindowProcW
CallWindowProcW
GetMenu
GetWindowTextLengthW
GetWindowTextW
SetFocus
SetWindowPos
ScrollWindowEx
ShowWindow
GetDlgCtrlID
SetWindowTextW
IsDialogMessageW
IsDlgButtonChecked
SetDlgItemTextW
SetDlgItemInt
SendDlgItemMessageW
GetDlgItemTextW
GetDlgItemInt
CheckRadioButton
CheckDlgButton
GetWindow
UnhookWindowsHookEx
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
GetSysColor
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
LoadIconW
CreateMenu
GetSystemMetrics
PostMessageW
MoveWindow
SetWindowLongW
GetWindowLongW
EnableWindow
GetParent
PostMessageA
EndPaint
BeginPaint
MessageBoxW
ScreenToClient
wsprintfW
RemoveMenu
GetSubMenu
GetMenuItemCount
InsertMenuW
GetMenuItemID
AppendMenuW
GetMenuStringW
GetMenuState
PostQuitMessage
CheckMenuItem
EnableMenuItem
ModifyMenuW
GetFocus
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
PeekMessageW
GetKeyState
IsWindowVisible
GetActiveWindow
DispatchMessageW
TranslateMessage
GetMessageW
CallNextHookEx
SetWindowsHookExW
SetCursor
ShowOwnedPopups
IsWindowEnabled
GetLastActivePopup
GetWindowThreadProcessId
FillRect
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW

gdi32

Rectangle
EnumFontFamiliesExW
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
StartPage
EndPage
SetAbortProc
AbortDoc
RoundRect
GetNearestColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextAlign
GetTextFaceW
StretchBlt
CloseMetaFile
DeleteMetaFile
SetPixelV
PlayMetaFile
EnumMetaFile
GetObjectType
EndDoc
SetPixel
GetDIBits
SetDIBColorTable
GetRgnBox
OffsetRgn
GetSystemPaletteEntries
RealizePalette
GetNearestPaletteIndex
GetPaletteEntries
CreatePalette
Polygon
Ellipse
Polyline
CreateEllipticRgn
GetTextColor
GetBkColor
CreatePolygonRgn
CreateRoundRectRgn
CreateDIBSection
GetCurrentObject
StretchDIBits
GetCharWidthW
GetTextExtentPoint32W
DPtoLP
GetMapMode
CombineRgn
SetRectRgn
GetTextCharsetInfo
EnumFontFamiliesW
GetTextMetricsW
PlayMetaFileRecord
SelectPalette
GetStockObject
CreateCompatibleDC
CreatePatternBrush
CreateDIBPatternBrushPt
DeleteDC
ExtSelectClipRgn
PolyBezierTo
PolylineTo
PolyDraw
ArcTo
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
CreateCompatibleBitmap
CreateFontIndirectW
CreateDIBitmap
PatBlt
CreateRectRgnIndirect
CreateHatchBrush
ExtCreatePen
ExcludeClipRect
CreateMetaFileW
IntersectClipRect
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
StartDocW
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
SetColorAdjustment
SetArcDirection
SetLayout
GetLayout
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
CreateSolidBrush
CreateFontW
GetObjectW
DeleteObject
GetDeviceCaps
CopyMetaFileW
CreateDCW
CreateBitmap
SaveDC
RestoreDC
SetBkColor
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextColor
SetGraphicsMode
SetWorldTransform
ModifyWorldTransform
SetMapMode
GetClipBox
CreatePen

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter
GetJobW

advapi32

RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegEnumValueA
RegOpenKeyW
RegCreateKeyExA
GetFileSecurityW
SetFileSecurityW
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegSetValueW
RegEnumKeyExA
RegSaveKeyA
RegRestoreKeyA
RegQueryValueExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA

shell32

ShellExecuteExW
SHGetMalloc
SHAppBarMessage
SHGetDesktopFolder
DragQueryFileW
DragFinish
ExtractIconW
SHAddToRecentDocs
SHGetFileInfoW
SHGetSpecialFolderPathW
ShellExecuteExA
ShellExecuteW
SHGetSpecialFolderLocation
SHChangeNotify
SHBrowseForFolderW
SHGetPathFromIDListW

comctl32

ImageList_GetIconSize
ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_Create
ImageList_GetImageCount
ImageList_Destroy
ImageList_AddMasked
ImageList_Remove
ImageList_DrawEx

ole32

StgOpenStorageOnILockBytes
StgCreateDocfile
CoInitializeEx
CLSIDFromString
StringFromGUID2
CoDisconnectObject
CoCreateGuid
OleDuplicateData
CoTreatAsClass
StringFromCLSID
CreateILockBytesOnHGlobal
RevokeDragDrop
CreateBindCtx
ReadClassStg
ReadFmtUserTypeStg
CoLockObjectExternal
RegisterDragDrop
OleQueryCreateFromData
CreateFileMoniker
StgOpenStorage
StgIsStorageFile
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleLockRunning
OleSetMenuDescriptor
OleSetClipboard
OleIsCurrentClipboard
OleFlushClipboard
DoDragDrop
PropVariantCopy
StgCreateDocfileOnILockBytes
OleSave
WriteClassStm
OleSaveToStream
OleCreateFromData
OleCreateLinkFromData
OleCreateStaticFromData
OleCreate
OleLoad
GetHGlobalFromILockBytes
OleSetContainedObject
OleCreateFromFile
CLSIDFromProgID
CoRegisterMessageFilter
CoRevokeClassObject
CoRegisterClassObject
CoGetClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateDataAdviseHolder
CreateOleAdviseHolder
CoGetMalloc
GetRunningObjectTable
OleIsRunning
OleGetClipboard
OleRun
OleRegGetMiscStatus
OleRegEnumVerbs
OleQueryLinkFromData
CoTaskMemAlloc
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
CoUninitialize
CoInitialize
CoCreateInstance
CreateGenericComposite
CreateItemMoniker
GetHGlobalFromStream
OleGetIconOfClass
ReleaseStgMedium
OleCreateLinkToFile
CreateStreamOnHGlobal

oleaut32

VarBstrFromDate
VarDecFromStr
VarBstrFromDec
VarBstrFromCy
VarCyFromStr
SysReAllocStringLen
VarDateFromStr
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroyDescriptor
SafeArrayDestroy
SafeArrayUnlock
SysFreeString
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
SafeArrayLock
VariantClear
VariantChangeType
VariantInit
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SysStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
SafeArrayRedim
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayCopy
SafeArrayGetElement
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayDestroyData

oledlg

OleUIBusyW

gdiplus

GdipFree
GdipLoadImageFromStream
GdipDrawImageI
GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipSetInterpolationMode
GdipCreateBitmapFromHBITMAP
GdipDrawImageRectI
GdipCreateFromHDC
GdipDeleteGraphics
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipDisposeImage
GdipLoadImageFromStreamICM
GdipAlloc

ws2_32

gethostbyname
__WSAFDIsSet
inet_ntoa
WSAStartup
socket
htons
getsockopt
connect
recv
send
closesocket
select

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

imagehlp

MakeSureDirectoryPathExists

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundW

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 550KB - Virtual size: 549KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 180KB - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

50217960d05364456d3f04365a9650c3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

ole32

oleaut32

oledlg

gdiplus

ws2_32

version

imagehlp

oleacc

imm32

winmm

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

.rdata Size: 550KB - Virtual size: 549KB

.data Size: 35KB - Virtual size: 69KB

.rsrc Size: 2.8MB - Virtual size: 2.8MB

.reloc Size: 180KB - Virtual size: 179KB

.text
Size: 2.3MB - Virtual size: 2.3MB

.rdata
Size: 550KB - Virtual size: 549KB

.data
Size: 35KB - Virtual size: 69KB

.rsrc
Size: 2.8MB - Virtual size: 2.8MB

.reloc
Size: 180KB - Virtual size: 179KB