a5b754d8e93f4afe017a089807d8eecd2349d597deca24fc5211ee4cea14266b

Sharing

Copy URL Twitter E-mail

General

Target

a5b754d8e93f4afe017a089807d8eecd2349d597deca24fc5211ee4cea14266b
Size

3.7MB
MD5

33ede7707f2a537d8a86f260eca8c76b
SHA1

ae8826879be13f589fdfa9f958136f79cb5b750c
SHA256

a5b754d8e93f4afe017a089807d8eecd2349d597deca24fc5211ee4cea14266b
SHA512

a05c3369765684bbde62fce4252d028e9d21e70ef5000d3d445d2857ee2f9443b658c825a7ef826868933779d263fad4a975f54ca9a3376d8e95ec68ec9c7f33
SSDEEP

98304:r4epNYvUvfclli4B9AvZDbF5BfcJb6Yas6fOcDjt:49UXvZsnkt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a5b754d8e93f4afe017a089807d8eecd2349d597deca24fc5211ee4cea14266b

Files

a5b754d8e93f4afe017a089807d8eecd2349d597deca24fc5211ee4cea14266b
.exe windows:5 windows x86 arch:x86

6680a10fa489b88bd38939f70cbeaefb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\val_helper\build\bin\Release\val_helper_main.pdb

Imports

kernel32

OpenEventA
QueryPerformanceCounter
OutputDebugStringW
LoadLibraryW
GetCurrentDirectoryA
DuplicateHandle
CreateProcessA
CreatePipe
LocalFileTimeToFileTime
TerminateProcess
CloseHandle
GetLastError
Process32Next
GetPrivateProfileIntW
lstrlenW
lstrlenA
GenerateConsoleCtrlEvent
Module32First
GetVersionExA
CopyFileA
CreateDirectoryA
DeleteFileA
UnlockFileEx
UnlockFile
LockFileEx
SetEvent
GetCurrentProcess
LockFile
GetFullPathNameA
GetNumberOfConsoleInputEvents
PeekConsoleInputA
SetConsoleMode
ReadConsoleInputA
GetFileAttributesA
SetFileAttributesA
FindFirstFileExA
FileTimeToLocalFileTime
FileTimeToSystemTime
LocalAlloc
CreateFileMappingW
GlobalFree
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
CreateNamedPipeW
DisconnectNamedPipe
ConnectNamedPipe
ReleaseSemaphore
CancelIo
CreateSemaphoreW
GlobalMemoryStatusEx
GetLogicalDriveStringsA
GetDriveTypeA
GetDiskFreeSpaceExA
GetDriveTypeW
Sleep
GetCommandLineW
GetModuleFileNameW
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32First
OpenProcess
SetLastError
FlushConsoleInputBuffer
GetSystemTime
FindFirstFileA
FindNextFileA
GlobalMemoryStatus
ExpandEnvironmentStringsA
WaitForMultipleObjects
PeekNamedPipe
VerSetConditionMask
VerifyVersionInfoA
SleepEx
GetVersion
GetPrivateProfileStringA
LocalFree
AreFileApisANSI
GetTempPathW
FindNextFileW
FindFirstFileW
GetDiskFreeSpaceExW
SetFileAttributesW
SetFileTime
GetFileTime
GetFileAttributesExW
GetFileInformationByHandle
SetCurrentDirectoryW
CreateDirectoryExW
GetFullPathNameW
DeviceIoControl
RemoveDirectoryW
FindClose
SetFilePointerEx
InitializeCriticalSection
SetEnvironmentVariableA
CompareStringW
GetProcessHeap
CreateFileA
SetStdHandle
WriteConsoleW
InterlockedExchange
HeapReAlloc
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
SetConsoleCtrlHandler
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
FatalAppExitA
DeleteCriticalSection
GetStartupInfoW
GetFileType
MultiByteToWideChar
GetModuleFileNameA
OutputDebugStringA
InitializeCriticalSectionAndSpinCount
SetHandleCount
ExitProcess
HeapSize
HeapDestroy
HeapCreate
GetLocaleInfoW
GetStdHandle
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
GetCPInfo
ExitThread
GetDateFormatA
GetTimeFormatA
HeapAlloc
GetSystemTimeAsFileTime
HeapSetInformation
GetCommandLineA
LeaveCriticalSection
EnterCriticalSection
RaiseException
HeapFree
EncodePointer
DecodePointer
RtlUnwind
SwitchToThread
GetVersionExW
GlobalAlloc
GlobalLock
GlobalUnlock
GetTimeZoneInformation
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
GetModuleHandleW
DeleteFileW
InterlockedIncrement
GetExitCodeProcess
VirtualAlloc
GetSystemInfo
LoadLibraryA
GetModuleHandleA
GetProcAddress
FormatMessageA
SuspendThread
GetCurrentThread
WaitForSingleObject
ReleaseMutex
SetProcessWorkingSetSize
GetTickCount
CreateMutexA
QueryPerformanceFrequency
CreateEventA
WideCharToMultiByte
SetThreadAffinityMask
TerminateThread
ResetEvent
CreateThread
GetCurrentThreadId
CreateWaitableTimerA
SetWaitableTimer
Process32NextW
Process32FirstW
FreeLibrary
GetLocalTime
CreateEventW
GetPrivateProfileStringW
SetEndOfFile
WriteFile
SetFilePointer
ReadFile
GetFileSize
CreateFileW
CopyFileW
MoveFileExW
SetThreadPriority
GetProcessAffinityMask
GetCurrentDirectoryW
GetFileAttributesW
GetOverlappedResult
CreateDirectoryW
VirtualQuery
InterlockedCompareExchange
VirtualProtect
ResumeThread
FlushInstructionCache
SetThreadContext
GetThreadContext
VirtualFree
SetCurrentDirectoryA

shell32

SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateDirectoryExW
SHGetDesktopFolder
CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW

oleaut32

SysAllocStringLen
SysFreeString
SysStringLen
CreateErrorInfo
SetErrorInfo
VariantInit
VariantChangeType
GetErrorInfo
VariantClear
SysAllocString

advapi32

DeregisterEventSource
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ReportEventA
RegisterEventSourceA

version

GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoSizeW
VerQueryValueW

oleacc

AccessibleObjectFromEvent

rpcrt4

UuidCreate

psapi

GetModuleFileNameExW

shlwapi

PathIsRelativeW
PathRemoveFileSpecW

iphlpapi

GetAdaptersInfo

gdiplus

GdipDeleteBrush
GdipAlloc
GdipFree
GdipDeleteGraphics
GdipCreateFontFamilyFromName
GdipDeleteFont
GdipDisposeImage
GdipSaveImageToFile
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromScan0
GdipGetImageEncodersSize
GdipCreateSolidFill
GdipGetImageGraphicsContext
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipDrawString
GdipMeasureString
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipDrawImageRectI
GdipCreateFont
GdipCloneBrush
GdipGetImageEncoders

httpapi

HttpAddUrl
HttpInitialize
HttpCreateHttpHandle
HttpRemoveUrl
HttpTerminate
HttpSendHttpResponse
HttpReceiveHttpRequest

user32

CreateWindowExA
SetWindowLongA
RegisterClassExW
DefWindowProcA
SetCursor
UnregisterClassA
PostMessageA
IsClipboardFormatAvailable
GetClipboardData
DispatchMessageA
DestroyWindow
ReleaseDC
ClipCursor
DispatchMessageW
TranslateMessage
PeekMessageW
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW
MsgWaitForMultipleObjects
OffsetRect
SystemParametersInfoA
SetWindowTextW
SetWinEventHook
NotifyWinEvent
GetWindowTextA
FindWindowW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
SetForegroundWindow
BringWindowToTop
IsIconic
ShowWindow
GetWindowRect
IsRectEmpty
GetCursorPos
WindowFromPoint
GetClientRect
FindWindowExW
GetWindowLongA
GetSystemMetrics
SendInput
SendMessageTimeoutA
GetParent
FindWindowA
EnumWindows
IsWindowVisible
GetWindowTextW
GetWindow
IsWindow
GetClassNameW
SetWindowsHookExA
CallNextHookEx
PeekMessageA
GetMessageA
RegisterWindowMessageW
PostThreadMessageA
UnhookWindowsHookEx
SetTimer
KillTimer
GetDC

ws2_32

bind
getsockname
getsockopt
getpeername
closesocket
socket
connect
freeaddrinfo
setsockopt
accept
WSAIoctl
inet_ntoa
gethostbyname
ntohl
htonl
send
recv
WSAGetLastError
listen
ioctlsocket
gethostname
ntohs
shutdown
WSASetLastError
WSAStartup
WSACleanup
inet_addr
select
__WSAFDIsSet
htons
recvfrom
sendto
getaddrinfo

wldap32

ord32
ord27
ord35
ord30
ord26
ord33
ord79
ord301
ord41
ord50
ord60
ord143
ord211
ord22
ord200
ord46

normaliz

IdnToAscii
IdnToUnicode

gdi32

GetDeviceCaps
GetDIBits
GetObjectA
CreateCompatibleBitmap
DeleteObject

ole32

CoInitializeSecurity
CoSetProxyBlanket
CoTaskMemFree
OleInitialize
OleUninitialize
CoInitializeEx
CoUninitialize
CoCreateInstance
CoInitialize

winmm

timeBeginPeriod
timeKillEvent
timeSetEvent
timeGetDevCaps

comdlg32

GetOpenFileNameW

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 703KB - Virtual size: 703KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 131KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 247KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6680a10fa489b88bd38939f70cbeaefb

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shell32

oleaut32

advapi32

version

oleacc

rpcrt4

psapi

shlwapi

iphlpapi

gdiplus

httpapi

user32

ws2_32

wldap32

normaliz

gdi32

ole32

winmm

comdlg32

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 703KB - Virtual size: 703KB

.data Size: 131KB - Virtual size: 157KB

.rsrc Size: 247KB - Virtual size: 248KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 703KB - Virtual size: 703KB

.data
Size: 131KB - Virtual size: 157KB

.rsrc
Size: 247KB - Virtual size: 248KB