adf0fd295baa1b612c870663f0dfd6a9

Sharing

Copy URL Twitter E-mail

General

Target

adf0fd295baa1b612c870663f0dfd6a9
Size

344KB
MD5

adf0fd295baa1b612c870663f0dfd6a9
SHA1

5b7eb817781cbff38f8408c76c28d62ef71eec34
SHA256

cc7c2f6f97d6b9c460b61fdbfad4bfa85f061ad1eeec7def6787e9532932b678
SHA512

b7ed30ec8260d76d996225bd226187616c0ce6c536ba7167f64cce000e670d1a4cd8cdfa5f1e7cf6557ccc7da5f4361fbe0a6f9be9d2dc5cfc171441902f69f9
SSDEEP

6144:71SW/xoN5RvlxwTN54opjTfEmdOhKNMjTQVRG0ecaet93XheGRQfZjUD:pe9vlWTPz1NMXQV/aU93CuD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
adf0fd295baa1b612c870663f0dfd6a9

Files

adf0fd295baa1b612c870663f0dfd6a9
.exe regsvr32 windows:4 windows x86 arch:x86

ff68ac3ddbd266674c968c0337020071

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileAttributesW
SetFilePointer
SetFileTime
SetLastError
SetNamedPipeHandleState
SetThreadPriority
SetUnhandledExceptionFilter
SignalObjectAndWait
Sleep
SuspendThread
SwitchToThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
QueryPerformanceFrequency
UnhandledExceptionFilter
UnmapViewOfFile
UnregisterWait
SetEvent
VirtualAlloc
VirtualAllocEx
VirtualFree
VirtualProtectEx
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitNamedPipeW
WideCharToMultiByte
WriteFile
lstrcatW
lstrcmpiW
lstrlenW
QueryPerformanceCounter
PostQueuedCompletionStatus
OpenThread
OpenProcess
MultiByteToWideChar
MoveFileExW
Module32NextW
Module32FirstW
SetErrorMode
SetEnvironmentVariableW
SetEndOfFile
SetCurrentDirectoryW
ResumeThread
ResetEvent
RemoveDirectoryW
ReleaseSemaphore
ReleaseMutex
RegisterWaitForSingleObject
ReadProcessMemory
ReadFile
RaiseException
UnregisterWaitEx
QueueUserWorkItem
MapViewOfFile
LocalFree
LoadLibraryW
LoadLibraryExA
LoadLibraryA
LeaveCriticalSection
LCMapStringW
IsDebuggerPresent
InterlockedIncrement
InterlockedExchangeAdd
InterlockedExchange
InterlockedDecrement
InterlockedCompareExchange
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
HeapWalk
HeapUnlock
HeapFree
HeapAlloc
GlobalUnlock
GlobalSize
GlobalReAlloc
GlobalMemoryStatusEx
GlobalLock
GlobalFree
GlobalAlloc
GetWindowsDirectoryW
GetVersionExW
GetVersionExA
GetUserDefaultLangID
GetUserDefaultLCID
GetTimeFormatW
GetTimeFormatA
GetTickCount
GetThreadContext
GetTempPathW
GetSystemTimeAsFileTime
GetSystemTime
GetSystemInfo
GetSystemDirectoryW
GetSystemDefaultLangID
GetSystemDefaultLCID
GetStdHandle
GetShortPathNameW
GetQueuedCompletionStatus
GetProfileStringW
GetProcessTimes
GetProcessHeaps
GetProcessHeap
GetProcAddress
GetOverlappedResult
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
GetLongPathNameW
GetLogicalDriveStringsW
GetLocaleInfoW
GetLastError
GetFileSize
GetFileAttributesW
GetFileAttributesExW
GetExitCodeProcess
GetEnvironmentVariableW
GetDriveTypeW
GetDiskFreeSpaceExW
GetDateFormatW
GetDateFormatA
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCurrentDirectoryW
GetCommandLineW
GetACP
FreeLibrary
FormatMessageW
FormatMessageA
FindNextFileW
FindFirstFileW
FindClose
ExpandEnvironmentStringsW
EnterCriticalSection
DuplicateHandle
DisconnectNamedPipe
DeleteFileW
DeleteCriticalSection
DebugBreak
CreateToolhelp32Snapshot
CreateThread
CreateSemaphoreW
CreateSemaphoreA
CreateProcessW
CreateNamedPipeW
CreateMutexW
CreateIoCompletionPort
CreateFileW
CreateFileMappingW
CreateEventW
CreateEventA
CreateDirectoryW
CopyFileW
CopyFileExW
ConnectNamedPipe
CompareStringW
CloseHandle
CancelIo
TransactNamedPipe
AllocConsole

user32

ShowWindow
SystemParametersInfoA
SystemParametersInfoW
ToUnicodeEx
TrackPopupMenu
TranslateMessage
UnhookWindowsHookEx
UnloadKeyboardLayout
UnregisterClassW
UpdateLayeredWindow
UpdateWindow
ValidateRect
WaitMessage
WindowFromPoint
wsprintfW
SetCursorPos
SetCursor
SetClassLongW
SetClassLongA
SetCaretPos
SetCapture
SendMessageW
SendInput
ScreenToClient
ReplyMessage
RemovePropW
ReleaseDC
ReleaseCapture
RegisterWindowMessageW
RegisterClipboardFormatW
RegisterClassW
RegisterClassExW
RedrawWindow
PtInRect
PostThreadMessageA
PostQuitMessage
PostMessageW
PeekMessageW
PeekMessageA
OpenClipboard
OffsetRect
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MonitorFromWindow
MonitorFromRect
MessageBoxW
MessageBeep
MapWindowPoints
MapVirtualKeyExW
LoadKeyboardLayoutA
LoadImageW
LoadIconW
LoadCursorW
KillTimer
IsWindowVisible
ShowCaret
IsWindow
IsIconic
IsClipboardFormatAvailable
IsChild
InvalidateRect
IntersectRect
InflateRect
SetWindowTextA
InSendMessage
GetWindowThreadProcessId
GetWindowRgn
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindowLongA
GetWindow
GetUpdateRect
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetQueueStatus
GetPropW
GetParent
GetMonitorInfoW
GetMessageW
GetMessageTime
GetMessagePos
GetMessageExtraInfo
GetMessageA
GetMenu
GetLastInputInfo
GetKeyboardState
GetKeyboardLayoutNameW
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetIconInfo
GetGuiResources
GetGUIThreadInfo
GetForegroundWindow
GetFocus
GetDoubleClickTime
GetDlgItem
GetDesktopWindow
GetDC
GetCursorPos
GetClipboardData
ActivateKeyboardLayout
AdjustWindowRectEx
BeginPaint
CallNextHookEx
CallWindowProcW
ClientToScreen
CloseClipboard
CreateCaret
SetWindowsHookExW
IsWindowEnabled
SetWindowTextW
CreateIconIndirect
CreateWindowExA
CreateWindowExW
DdeAccessData
DdeCmpStringHandles
DdeCreateDataHandle
DdeCreateStringHandleA
DdeFreeStringHandle
DdeInitializeW
DdeNameService
DdeQueryStringW
DdeUnaccessData
SendMessageA
DdeUninitialize
DefWindowProcA
DefWindowProcW
SetWindowRgn
SetWindowPos
SetWindowLongW
SetWindowLongA
SetTimer
SetRectEmpty
SetRect
SetPropW
SetParent
SetKeyboardState
SetForegroundWindow
InSendMessageEx
SetFocus
DestroyCaret
DestroyIcon
DestroyWindow
DispatchMessageW
DrawEdge
DrawFocusRect
DrawFrameControl
EnableMenuItem
EnableWindow
EndPaint
EnumChildWindows
EnumDisplayDevicesW
EnumDisplayMonitors
EnumThreadWindows
EnumWindows
EqualRect
FillRect
FindWindowW
FlashWindowEx
FrameRect
GetActiveWindow
GetAncestor
GetCaretBlinkTime
GetClientRect
GetClassNameW
GetClassInfoW

gdi32

GetCurrentObject
GetDIBits
GetDeviceCaps
GetFontData
GetFontUnicodeRanges
GetGlyphIndicesW
GetGlyphOutlineW
GetGraphicsMode
GetICMProfileW
GetObjectW
GetOutlineTextMetricsA
GetRandomRgn
GetRegionData
GetStockObject
GetTextExtentExPointI
GetTextExtentPoint32W
GetTextMetricsA
GetViewportOrgEx
GetWorldTransform
IntersectClipRect
LineTo
ModifyWorldTransform
MoveToEx
OffsetRgn
PatBlt
PolyBezierTo
RemoveFontMemResourceEx
GetClipRgn
SaveDC
SelectClipPath
SelectClipRgn
SelectObject
SetBkColor
SetBkMode
SetBrushOrgEx
SetGraphicsMode
SetLayout
SetMapMode
SetMiterLimit
SetPixelFormat
SetPolyFillMode
SetStretchBltMode
SetTextAlign
SetTextColor
SetViewportOrgEx
SetWorldTransform
StartDocW
StartPage
StretchBlt
StretchDIBits
StrokePath
SwapBuffers
UnrealizeObject
WidenPath
GetClipBox
GetCharWidthI
GetCharWidth32A
GdiFlush
FillPath
ExtTextOutW
ExtSelectClipRgn
ExtEscape
ExtCreateRegion
ExtCreatePen
EnumFontFamiliesExW
EndPath
EndPage
EndDoc
DeleteObject
DeleteDC
CreateSolidBrush
CreateRectRgnIndirect
CreateRectRgn
CreatePatternBrush
CreateFontIndirectW
CreateDIBitmap
CreateDIBSection
CreateDCW
RestoreDC
AbortDoc
CreateCompatibleBitmap
CreateBitmap
CombineRgn
CloseFigure
ChoosePixelFormat
BitBlt
BeginPath
AddFontMemResourceEx
CreateCompatibleDC

winmm

waveOutReset
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutWrite
waveOutPause
waveOutOpen
waveOutGetPosition
waveOutClose
timeGetTime
timeEndPeriod
timeBeginPeriod
PlaySoundW
waveOutRestart

wsock32

htons
htonl
ntohs
ntohl

advapi32

RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegNotifyChangeKeyValue
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
QueryServiceStatus
OpenServiceW
OpenSCManagerW
OpenProcessToken
GetUserNameW
GetTokenInformation
GetNamedSecurityInfoW
FileEncryptionStatusW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
SetNamedSecurityInfoW

shell32

CommandLineToArgvW
SHAddToRecentDocs
SHBrowseForFolderW
SHGetFileInfoW
SHGetFolderPathW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
ShellExecuteExW
ShellExecuteW
DragQueryFileW

ole32

RegisterDragDrop
ReleaseStgMedium
RevokeDragDrop
OleUninitialize
PropVariantClear
OleQueryLinkFromData
OleInitialize
OleGetClipboard
OleFlushClipboard
OleDuplicateData
DoDragDrop
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoRegisterMessageFilter
CoLockObjectExternal
CoInitializeEx
CoCreateGuid
CoCreateInstance
CoInitialize
OleSetClipboard

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueA

winspool.drv

ClosePrinter
EnumPrintersW
OpenPrinterW
DocumentPropertiesW

comdlg32

GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError
PrintDlgW

imm32

ImmAssociateContext
ImmGetCompositionStringW
ImmGetContext
ImmGetDefaultIMEWnd
ImmGetOpenStatus
ImmGetProperty
ImmGetVirtualKey
ImmIsIME
ImmNotifyIME
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmSetOpenStatus
ImmGetCompositionStringA

shlwapi

PathAppendW
SHStrDupW

ws2_32

WSCEnumProtocols
WSCGetProviderPath

oleaut32

LoadRegTypeLi
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
VariantClear
VariantInit
DispGetIDsOfNames

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
FCoInitialized
FHevActivateApp
FHevAddToFileInfo
FHevRegister
FHevSetDefaultEditor
FHevUnregister
HevDestroyFileInfo
HevFCheckNonMSApp
HevFGetCreatorAppIcon
HevFGetCreatorAppName
HevFGetFileIcons
HevFGetProgIDFromFile
HevFIsHTMLOrMHTML
HevFQueryDefaultEditor
HevFSetExtraData
PHevCreateFileInfo
PHevCreateFileInfoFromURL
PwszHEVGetUrlIfInCache
WHevParseFile
WHeviAppFromProgId

Sections

.text
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ff68ac3ddbd266674c968c0337020071

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winmm

wsock32

advapi32

shell32

ole32

version

winspool.drv

comdlg32

imm32

shlwapi

ws2_32

oleaut32

Exports

Exports

Sections

.text Size: 236KB - Virtual size: 236KB

.rdata Size: 48KB - Virtual size: 48KB

.data Size: 24KB - Virtual size: 1.7MB

.idata Size: 16KB - Virtual size: 16KB

.rsrc Size: 16KB - Virtual size: 16KB

.text
Size: 236KB - Virtual size: 236KB

.rdata
Size: 48KB - Virtual size: 48KB

.data
Size: 24KB - Virtual size: 1.7MB

.idata
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 16KB - Virtual size: 16KB