9b36f4e9691c3de14e93f7d67c579a63

Sharing

Copy URL Twitter E-mail

General

Target

9b36f4e9691c3de14e93f7d67c579a63
Size

2.6MB
MD5

9b36f4e9691c3de14e93f7d67c579a63
SHA1

8dc19214dad420c5e7a843bef5af9c61ff249ad3
SHA256

53ea6a63cef921fc2eeb8563da30748f58077e6cb385e2ba784f4ac5efce6057
SHA512

ad2dfd85c24867044ec1480946be1361badc7023cb44ff419642f5a459b6d4dd688879506e086c3fd6515717284c7394f730d750212f98481b05effc637b9b0a
SSDEEP

49152:/BJq35nLd+GqCFy4XhjV1HZCThAgHyKbSSh4qZDBC:l4XhjnHMhAiyKbBh4qZDBC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9b36f4e9691c3de14e93f7d67c579a63

Files

9b36f4e9691c3de14e93f7d67c579a63
.exe windows:5 windows x86 arch:x86

2751e7816dd6708cbaf63a9efe0045ad

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

getservbyport
ntohs
inet_addr
htonl
getservbyname
htons
WSAGetLastError
gethostbyname
ioctlsocket
gethostbyaddr
WSAAsyncSelect
recv
send
WSAStartup
socket
connect
closesocket
WSACleanup
gethostname
inet_ntoa
WSASetLastError
shutdown

winmm

joyGetPosEx
mciSendStringW
joyGetDevCapsW
waveOutGetVolume
mixerSetControlDetails
mixerOpen
mixerGetDevCapsW
mixerGetLineInfoW
mixerClose
mixerGetLineControlsW
waveOutSetVolume
mixerGetControlDetailsW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

comctl32

ImageList_Create
ImageList_GetIconSize
ImageList_AddMasked
ImageList_ReplaceIcon
CreateStatusWindowW
ImageList_Destroy

shlwapi

HashData

crypt32

CryptBinaryToStringA
CryptStringToBinaryW
CryptStringToBinaryA

psapi

GetModuleBaseNameW
GetProcessImageFileNameW
GetModuleFileNameExW

wininet

InternetOpenUrlW
InternetOpenW
InternetCloseHandle
InternetReadFileExA
InternetReadFile

kernel32

GetSystemTimeAsFileTime
VirtualProtect
InitializeCriticalSection
SetErrorMode
LoadLibraryW
AddVectoredExceptionHandler
GlobalLock
GlobalUnlock
WideCharToMultiByte
GetSystemDirectoryA
LoadLibraryA
FreeLibrary
GetCurrentThreadId
GetEnvironmentVariableW
SuspendThread
ResumeThread
EnterCriticalSection
LeaveCriticalSection
OpenThread
lstrcmpiW
GetStringTypeExW
CreateThread
SetThreadPriority
GetExitCodeThread
CloseHandle
CreateMutexW
GetLastError
GetModuleHandleW
MultiByteToWideChar
SystemTimeToFileTime
SetFilePointerEx
ReadFile
SetFilePointer
GlobalSize
lstrcpyA
lstrlenA
lstrcmpiA
lstrcmpA
LocalFileTimeToFileTime
CreateDirectoryA
CreateDirectoryW
IsBadReadPtr
CreateFileW
CreateFileA
WriteFile
SetFileTime
DuplicateHandle
LoadResource
LockResource
SizeofResource
GetCurrentDirectoryA
GetLocalTime
FileTimeToDosDateTime
GetFileInformationByHandle
GetFileSize
lstrlenW
FindFirstFileW
FindNextFileW
FindClose
GetCurrentProcess
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
SetLastError
FlushInstructionCache
GetTempPathA
HeapAlloc
HeapReAlloc
VirtualAlloc
VirtualFree
GetProcessHeap
HeapCreate
HeapFree
HeapDestroy
GetCommandLineW
WaitForSingleObject
GetThreadLocale
VirtualQuery
GetVersionExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetModuleFileNameW
GetFileAttributesW
OpenProcess
GetCurrentProcessId
GetFullPathNameW
LocalFree
GetShortPathNameW
FileTimeToLocalFileTime
SetEnvironmentVariableW
Beep
MoveFileW
OutputDebugStringW
CreateProcessW
GetExitCodeProcess
WriteProcessMemory
ReadProcessMemory
TerminateProcess
SetPriorityClass
GetDateFormatW
GetTimeFormatW
GetDiskFreeSpaceExW
SetVolumeLabelW
DeviceIoControl
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceW
GetCurrentDirectoryW
DeleteFileW
CopyFileW
SetFileAttributesW
GetFileSizeEx
GetSystemTime
GetSystemDefaultUILanguage
GetComputerNameW
GetSystemWindowsDirectoryW
GetTempPathW
TryEnterCriticalSection
QueryDosDeviceW
CompareStringW
RemoveDirectoryW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FormatMessageW
GetPrivateProfileStringW
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
WritePrivateProfileSectionW
HeapValidate
HeapSize
SetEndOfFile
GetACP
GetFileType
GetStdHandle
FileTimeToSystemTime
VirtualAllocEx
VirtualFreeEx
EnumResourceNamesW
LoadLibraryExW
RemoveVectoredExceptionHandler
ExitProcess
ExitThread
CheckRemoteDebuggerPresent
GetCurrentThread
GetProcAddress
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GlobalFree
_lclose
_lopen
_lread
GetProcessTimes
GetModuleFileNameA
GlobalAlloc
GetModuleHandleA
FindResourceW
GetCPInfo
SetCurrentDirectoryW
Sleep
GetTickCount
MulDiv
InitializeSListHead

user32

IsCharAlphaW
DestroyWindow
DestroyIcon
UnregisterClassW
DestroyAcceleratorTable
LoadCursorW
RegisterClassExW
CreateWindowExW
LoadAcceleratorsW
SetClipboardViewer
ChangeClipboardChain
LoadImageW
CharLowerA
CheckMenuItem
GetMenu
BlockInput
IsWindowVisible
SetWindowTextW
GetIconInfo
SetRect
DrawTextW
AdjustWindowRectEx
SystemParametersInfoW
GetClientRect
GetWindowRect
MoveWindow
EnumChildWindows
SetActiveWindow
VkKeyScanExW
SetWindowRgn
SetWindowPos
SetLayeredWindowAttributes
InvalidateRect
EnableWindow
GetWindowTextLengthW
EnumWindows
IsZoomed
IsIconic
EnumDisplayMonitors
GetMonitorInfoW
RegisterWindowMessageW
GetSysColor
GetSysColorBrush
DrawIconEx
FillRect
DefWindowProcW
SetForegroundWindow
DialogBoxParamW
SendDlgItemMessageW
GetDlgItem
SetDlgItemTextW
MessageBeep
ClientToScreen
GetCursorInfo
GetLastInputInfo
GetSystemMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuStringW
ExitWindowsEx
SetScrollInfo
ScrollWindow
SetMenu
FlashWindow
GetPropW
SetPropW
RemovePropW
MapWindowPoints
RedrawWindow
SetParent
GetClassInfoExW
GetAncestor
UpdateWindow
MapVirtualKeyExW
GetClassLongW
DefDlgProcW
CallWindowProcW
CheckRadioButton
IntersectRect
PtInRect
CreateDialogIndirectParamW
CreateAcceleratorTableW
InsertMenuItemW
SetMenuDefaultItem
RemoveMenu
SetMenuItemInfoW
IsMenu
GetMenuItemInfoW
CreateMenu
CreatePopupMenu
SetMenuInfo
AppendMenuW
DestroyMenu
TrackPopupMenuEx
GetDesktopWindow
CopyImage
CreateIconIndirect
CreateIconFromResourceEx
EnumClipboardFormats
GetWindow
BringWindowToTop
GetTopWindow
GetQueueStatus
UnhookWindowsHookEx
SetWindowsHookExW
PostThreadMessageW
IsCharAlphaNumericW
IsCharUpperW
IsCharLowerW
ToUnicodeEx
GetKeyboardLayout
CallNextHookEx
CharLowerW
ReleaseDC
GetDC
MessageBoxW
OpenClipboard
GetClipboardData
GetClipboardFormatNameW
CloseClipboard
SetClipboardData
EmptyClipboard
PostMessageW
FindWindowW
EndDialog
IsWindow
DispatchMessageW
TranslateMessage
ShowWindow
SetWindowLongW
ScreenToClient
IsDialogMessageW
WindowFromPoint
SendMessageW
IsWindowEnabled
GetWindowLongW
GetKeyState
TranslateAcceleratorW
KillTimer
PeekMessageW
GetFocus
GetClassNameW
GetWindowThreadProcessId
GetMessageW
SetTimer
GetScrollInfo
GetParent
GetDlgCtrlID
CharUpperW
IsClipboardFormatAvailable
GetKeyboardLayoutNameW
ActivateKeyboardLayout
GetGUIThreadInfo
GetWindowTextW
mouse_event
GetSystemMetrics
keybd_event
SetKeyboardState
GetKeyboardState
GetCursorPos
GetUpdateRect
MapVirtualKeyW
GetAsyncKeyState
AttachThreadInput
SendInput
UnregisterHotKey
RegisterHotKey
PostQuitMessage
GetMessagePos
SendMessageTimeoutW
CountClipboardFormats
GetForegroundWindow
SetFocus

gdi32

CreateDCW
DeleteDC
GetStockObject
SelectObject
GetObjectW
GetTextMetricsW
CreateSolidBrush
CreateEllipticRgn
CreateRoundRectRgn
CreateRectRgn
CreatePolygonRgn
CreateCompatibleDC
GetDIBits
GetSystemPaletteEntries
CreateCompatibleBitmap
BitBlt
GetPixel
FillRgn
GetClipBox
GetCharABCWidthsW
SetBkMode
CreatePatternBrush
SetBrushOrgEx
EnumFontFamiliesExW
CreateDIBSection
GdiFlush
CreateFontW
DeleteObject
GetDeviceCaps
GetTextFaceW
ExcludeClipRect
SetTextColor
SetBkColor
GetClipRgn

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

advapi32

CryptReleaseContext
CryptDestroyHash
CryptDeriveKey
CryptHashData
CryptCreateHash
CryptAcquireContextW
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
CloseServiceHandle
UnlockServiceDatabase
LockServiceDatabase
OpenSCManagerW
GetUserNameW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegConnectRegistryW
RegCloseKey
CryptDestroyKey

shell32

SHFileOperationW
SHGetDesktopFolder
SHEmptyRecycleBinW
DragQueryPoint
ExtractIconW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
SHGetFolderPathW
ShellExecuteExW
CommandLineToArgvW
Shell_NotifyIconW
DragFinish
DragQueryFileW

ole32

StringFromGUID2
CoGetObject
CLSIDFromProgID
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitialize
OleInitialize
CreateStreamOnHGlobal

oleaut32

SysAllocString
SysFreeString
SafeArrayDestroy
GetActiveObject
SysStringLen
SafeArrayCreate
VariantClear
VariantChangeType
SafeArrayCopy
VariantCopyInd
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayLock
SafeArrayPtrOfIndex
SafeArrayUnlock
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayUnaccessData
OleLoadPicture

vcruntime140

_CxxThrowException
__std_exception_destroy
__std_exception_copy
_except_handler4_common
wcsstr
strstr
strchr
wcschr
_purecall
wcsrchr
__std_terminate
__CxxFrameHandler3
memset
memcpy
_except_handler3
__RTDynamicCast
memmove

api-ms-win-crt-convert-l1-1-0

_wtoi
strtol
_i64tow
wcstol
wcstoul
_wcstoi64
_wtoi64
atof
_atoi64
atoi
_ultoa
_itoa
wcstombs
_wtof
strtoul
wcstod
_wcstoui64
_itow
_ultow

api-ms-win-crt-string-l1-1-0

tolower
wcsncmp
iswdigit
strcpy_s
iswxdigit
strcat_s
strncmp
wcsncpy
iswspace
_stricmp
towupper
_wcsupr
isdigit
toupper
_wcsnicmp
_isctype
_strnicmp
_wcsdup
isxdigit
_wcsicmp
strncpy_s
wcscspn

api-ms-win-crt-heap-l1-1-0

_callnewh
_expand
calloc
_set_new_mode
realloc
_msize
free
malloc

api-ms-win-crt-runtime-l1-1-0

exit
_controlfp_s
terminate
__p___argc
_register_thread_local_exe_atexit_callback
_c_exit
_exit
_initterm_e
_beginthreadex
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
__p___wargv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

fclose
fwrite
__p__commode
__acrt_iob_func
ftell
setvbuf
__stdio_common_vswprintf
fseek
_wfopen
__stdio_common_vsprintf
_set_fmode
__stdio_common_vsprintf_s
fread

api-ms-win-crt-utility-l1-1-0

qsort
rand
bsearch

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath

api-ms-win-crt-math-l1-1-0

_except1
__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

ADDFILE
ADDSCRIPT
AHKASSIGN
AHKEXEC
AHKEXECUTELINE
AHKFINDFUNC
AHKFINDLABEL
AHKFUNCTION
AHKGETVAR
AHKISUNICODE
AHKLABEL
AHKPAUSE
AHKPOSTFUNCTION
AddFile
AddScript
Addfile
Addscript
AhkAssign
AhkExec
AhkExecuteLine
AhkExecuteline
AhkFindFunc
AhkFindLabel
AhkFindfunc
AhkFindlabel
AhkFunction
AhkGetVar
AhkGetvar
AhkIsUnicode
AhkIsunicode
AhkLabel
AhkPause
AhkPostFunction
AhkPostfunction
Ahkassign
Ahkexec
AhkexecuteLine
Ahkexecuteline
AhkfindFunc
AhkfindLabel
Ahkfindfunc
Ahkfindlabel
Ahkfunction
AhkgetVar
Ahkgetvar
AhkisUnicode
Ahkisunicode
Ahklabel
Ahkpause
AhkpostFunction
Ahkpostfunction
addFile
addScript
addfile
addscript
ahkAssign
ahkExec
ahkExecuteLine
ahkExecuteline
ahkFindFunc
ahkFindLabel
ahkFindfunc
ahkFindlabel
ahkFunction
ahkGetVar
ahkGetvar
ahkIsUnicode
ahkIsunicode
ahkLabel
ahkPause
ahkPostFunction
ahkPostfunction
ahkassign
ahkexec
ahkexecuteLine
ahkexecuteline
ahkfindFunc
ahkfindLabel
ahkfindfunc
ahkfindlabel
ahkfunction
ahkgetVar
ahkgetvar
ahkisUnicode
ahkisunicode
ahklabel
ahkpause
ahkpostFunction
ahkpostfunction

Sections

.text
Size: 734KB - Virtual size: 733KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2751e7816dd6708cbaf63a9efe0045ad

Headers

File Characteristics

Imports

wsock32

winmm

version

comctl32

shlwapi

crypt32

psapi

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

vcruntime140

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 734KB - Virtual size: 733KB

.rdata Size: 167KB - Virtual size: 166KB

.data Size: 9KB - Virtual size: 28KB

.rsrc Size: 1.7MB - Virtual size: 1.7MB

.text
Size: 734KB - Virtual size: 733KB

.rdata
Size: 167KB - Virtual size: 166KB

.data
Size: 9KB - Virtual size: 28KB

.rsrc
Size: 1.7MB - Virtual size: 1.7MB