bcb5a6d80aa611d840adbef60edaf732

Sharing

Copy URL Twitter E-mail

General

Target

bcb5a6d80aa611d840adbef60edaf732
Size

352KB
MD5

bcb5a6d80aa611d840adbef60edaf732
SHA1

060a6d139b4ff8ebe437ffbaccd33446160b3bea
SHA256

e853cdaf6973f49aabc927547d2a5eb5c54fc3b3ad72db5c764be37066b45287
SHA512

3bf2414a8b369eac07037570ee49a5e5a858b15b3f4bd1998325f88d08308062746c2850566ced4be047e93e4048d8a4aaf8fb1f3c1c8dfb482a5eecdab84a31
SSDEEP

6144:X4wmPECOz9k04Qe+voSZwPixs+bCef5GxMeHSAJ9ZS:X4w+IR7DZ8ixtFcxMeHF9Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bcb5a6d80aa611d840adbef60edaf732

Files

bcb5a6d80aa611d840adbef60edaf732
.exe windows:4 windows x86 arch:x86

20d36dfcaa45d17ab3ff7c7ba1b5a8f4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
lstrcmpiW
WaitForSingleObject
CreateEventA
SetEvent
lstrcpyA
GetDriveTypeA
GetLastError
lstrcmpiA
CopyFileA
lstrcatA
lstrcmpW
lstrcpyW
DebugBreak
OutputDebugStringA
LocalFree
ReadFile
SetFilePointer
WriteFile
InitializeCriticalSection
DeleteCriticalSection
UnmapViewOfFile
GetFileSize
MapViewOfFile
GetVersionExA
RemoveDirectoryA
FindClose
DeleteFileA
FindNextFileA
SetLastError
GetFullPathNameA
FindFirstFileA
MoveFileA
GetPrivateProfileStringA
InterlockedIncrement
HeapDestroy
FreeLibrary
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcpynW
InterlockedDecrement
WideCharToMultiByte
RaiseException
InterlockedExchange
LocalAlloc
GetStartupInfoA
lstrcpynA
GetModuleHandleA
LoadLibraryA
GetProcAddress
GetModuleFileNameA
CreateFileA
GetFileTime
CloseHandle
lstrcmpA
FormatMessageA
FindResourceA
LoadResource
SizeofResource
LockResource
MultiByteToWideChar
GetCurrentProcess
FlushInstructionCache
GetSystemTime
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetDateFormatA
GetTimeFormatA
lstrlenA
GetTimeZoneInformation
GetLocalTime
CompareFileTime
SystemTimeToFileTime
FileTimeToSystemTime
MulDiv
GetModuleFileNameW
lstrlenW
CreateFileMappingA

user32

EnableWindow
RedrawWindow
CreateDialogParamA
DestroyIcon
InvalidateRgn
SetCapture
ReleaseCapture
CreateAcceleratorTableA
GetFocus
IsChild
FillRect
GetSysColor
GetWindowTextLengthA
MoveWindow
DrawAnimatedRects
CopyRect
GetMessageA
TranslateMessage
DispatchMessageA
SendMessageTimeoutA
GetClassInfoExA
RemoveMenu
PtInRect
LoadStringW
FindWindowExA
GetClassLongA
GetCursorPos
DestroyMenu
GetWindowPlacement
EnumChildWindows
GetClassNameA
IsWindowEnabled
EnableMenuItem
CheckMenuItem
IsWindowVisible
GetWindowLongA
GetWindow
GetWindowRect
SystemParametersInfoA
ShowOwnedPopups
IsIconic
SetForegroundWindow
GetClientRect
MapWindowPoints
SetWindowPos
PostQuitMessage
SetMenuDefaultItem
PostMessageA
PeekMessageA
SendMessageCallbackA
InvalidateRect
GetParent
SetDlgItemTextA
LoadMenuA
SetDlgItemTextW
wsprintfW
SetWindowTextA
SendMessageA
GetDlgItem
EndDialog
LoadImageA
RegisterWindowMessageA
MonitorFromPoint
GetMonitorInfoA
TrackPopupMenuEx
CreatePopupMenu
MessageBeep
LoadAcceleratorsA
ReleaseDC
GetDC
GetDlgItemTextA
LoadStringA
wsprintfA
GetWindowTextA
DialogBoxParamA
SetWindowLongA
MessageBoxA
WaitForInputIdle
SetCursor
ModifyMenuA
GetMenuStringA
CallWindowProcA
CharNextA
FindWindowA
IsWindow
TranslateAcceleratorA
IsDialogMessageA
LockWindowUpdate
SetFocus
AppendMenuA
GetDesktopWindow
LoadCursorA
RegisterClassExA
CreateWindowExA
ShowWindow
UpdateWindow
SetTimer
UpdateLayeredWindow
BeginPaint
EndPaint
DefWindowProcA
KillTimer
DestroyWindow
CreateIconIndirect
GetMenuItemInfoA
wvsprintfA
SetMenuItemInfoA
GetSubMenu
GetMenuItemCount
GetMenuState
DeleteMenu
GetActiveWindow

gdi32

GetStockObject
CreateSolidBrush
CreateCompatibleBitmap
SelectObject
BitBlt
CreateBitmap
CreateCompatibleDC
CreateDIBSection
DeleteDC
GetObjectA
GetDeviceCaps
DPtoLP
CreateFontIndirectA
DeleteObject

advapi32

RegCreateKeyExA
RegEnumKeyExA
RegEnumValueA
RegQueryInfoKeyA
RegOpenKeyExA
RegSetValueExW
RegCreateKeyExW
RegDeleteValueA
RegQueryValueExA
RegCloseKey
RegSetValueExA

shell32

SHAppBarMessage
Shell_NotifyIconA
ShellExecuteExA
FindExecutableA

ole32

CoTaskMemAlloc
OleLockRunning
CoTaskMemFree
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
OleUninitialize
OleInitialize
CoUninitialize
CoInitialize
CreateStreamOnHGlobal
StringFromCLSID

oleaut32

LoadRegTypeLi
SafeArrayGetLBound
SafeArrayGetUBound
DispCallFunc
DispInvoke
DispGetIDsOfNames
CreateDispTypeInfo
OleCreateFontIndirect
SysStringByteLen
VariantChangeType
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocStringLen
SysStringLen
VariantInit
VariantClear
SysAllocString
SysFreeString

newui

?SetBorderXP@@YGXPAUHWND__@@@Z
?LoadColorScheme@@YG_NPBDK@Z
?GlobalSubclassDialog@@YGXXZ
?SetSkinText@@YGHPAUHWND__@@IPBD@Z
?nuiCreateInstance@@YGPAXABU_GUID@@@Z
?ApplyColorScheme@@YGHPAUHWND__@@HK@Z
?SetWindowSkin@@YGHPAUHWND__@@PBD@Z
?AddSkinChild@@YGHPAUHWND__@@PBDI1@Z
?GetSkinChildBitmap@@YGPAUHBITMAP__@@PAUHWND__@@IK@Z
?FillBackground@@YGXPAUHWND__@@PAUHDC__@@0PBD@Z
?SkinShadowSettingsDlg@@YGPAUHWND__@@PAU1@@Z
?g_Colors@@3UCOLORS@@A
?CreateExplorerBarWindow@@YGPAUHWND__@@PAU1@IHHHH@Z

mexplorer

?ExplorerFT_UnInitializeComm@@YGXXZ
?ExplorerFT_IsConnected@@YGHXZ

bvrpctln

?SetUnzipBaseDir@@YGKPAUHZIP__@@PBD@Z
?GetZipItem@@YGKPAUHZIP__@@HPAUZIPENTRY@@@Z
?ZipAdd@@YGKPAUHZIP__@@PBD1@Z
?FormatZipMessage@@YGIPAUHZIP__@@KPADI@Z
?CloseZip@@YGKPAUHZIP__@@@Z
?CreateZip@@YGPAUHZIP__@@PBD0@Z
_Profile_SetRoot@4
_Profile_SetCompany@4
?OpenZip@@YGPAUHZIP__@@PBD0@Z
??1CProfile@@UAE@XZ
?GetString@CProfile@@QBEHPBD0PADI@Z
?FindSection@CProfile@@ABEPAUSection@1@PBD@Z
??0CProfile@@QAE@PBD_N@Z
ord2
?PocketHTML@@YGXPAUHWND__@@@Z
_Profile_GetBoolean@16
_Profile_SetBoolean@16
_Profile_SetInt@16
_Profile_GetInt@16
_Profile_GetRoot@0
_Profile_GetCompany@0
_Profile_SetBinary@20
MakeFullPathName
_InitSplitterWnd@0
?Infobox_Create@@YGPAUHWND__@@PAU1@PAUINFOBOX@@@Z
_Profile_GetBinary@20
?GetInt@CProfile@@QBEHPBDH@Z
?FindKey@CProfile@@ABEPAUKey@1@PBD@Z
?MessageBoxPlus@@YAHPAUMSGBOXPLUS@@ZZ
?GetInt@CProfile@@QBEHPBD0H@Z
?GetString@CProfile@@QBEHPBD00PADI@Z
_CenterWindow@4
_Profile_GetString@24
_Profile_SetString@16
?UnzipItem@@YGKPAUHZIP__@@HPBD@Z

modemwiz

?mwCreateInstance@@YGPAXABU_GUID@@@Z

modexch

ord6
ord4
ord5

wfp1n

ord174
ord39
ord196
ord54
ord38
ord175

syncengine

__WaitForAutoSyncEnding@4
__NotifySyncEngine@16
__UninitializeSyncEngine@0
__InitializeSyncEngine@0

rascnxmngr

_RasCM_EnumConnectionsEx@16

comctl32

ImageList_Add
ImageList_Create
ord6
InitCommonControlsEx
ImageList_Destroy
PropertySheetA
DestroyPropertySheetPage
CreatePropertySheetPageA

msvcrt

malloc
free
_mbschr
realloc
_strdup
__CxxFrameHandler
_purecall
_mbstok
_except_handler3
wcslen
_ismbcdigit
??3@YAXPAX@Z
memmove
??2@YAPAXI@Z
??1type_info@@UAE@XZ
atoi
_wcsnicmp
iswxdigit
_mbsstr
_mbscmp
_mbsrchr
_mbsnbicmp
_wtoi
?terminate@@YAXXZ
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_wcsicmp
_CxxThrowException
_stricmp

gdiplus

GdipGetImageWidth
GdipGetImageHeight
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateBitmapFromStream
GdipDisposeImage
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromFile
GdipAlloc
GdipFree
GdipCloneImage

shlwapi

PathAppendA
PathRemoveFileSpecA
StrCpyW
PathIsURLA
PathStripPathA
PathFindFileNameW
PathFileExistsA
PathFileExistsW
PathRenameExtensionW
PathFindFileNameA
SHGetValueA
StrTrimA
StrRChrA
StrCmpNIA
StrToIntW
StrTrimW
StrChrW
StrCmpNIW
SHDeleteEmptyKeyA
SHDeleteKeyA
UrlIsW
PathCreateFromUrlW
PathRemoveFileSpecW
PathRelativePathToA
PathAddBackslashA
PathRenameExtensionA
StrStrIA
PathAppendW

winmm

PlaySoundA

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

Sections

.text
Size: 140KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 176KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

20d36dfcaa45d17ab3ff7c7ba1b5a8f4

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

newui

mexplorer

bvrpctln

modemwiz

modexch

wfp1n

syncengine

rascnxmngr

comctl32

msvcrt

gdiplus

shlwapi

winmm

version

Sections

.text Size: 140KB - Virtual size: 138KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 8KB - Virtual size: 8KB

Shared Size: 4KB - Virtual size: 8B

.rsrc Size: 176KB - Virtual size: 172KB

.text
Size: 140KB - Virtual size: 138KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 8KB - Virtual size: 8KB

Shared
Size: 4KB - Virtual size: 8B

.rsrc
Size: 176KB - Virtual size: 172KB