bf3b9fc5b34d5bd6883d01d88239e3f8

Sharing

Copy URL Twitter E-mail

General

Target

bf3b9fc5b34d5bd6883d01d88239e3f8
Size

856KB
MD5

bf3b9fc5b34d5bd6883d01d88239e3f8
SHA1

2fc0faaf79faaaed48bf3c882558d925133a94fd
SHA256

14b509b0bd96baafe490824fcab46117925ee05f701ee8691cdd4707f934a13c
SHA512

efc1e53b24898957141710635024fd6090469af8a88c71592115cc13d14f045bfb85ab95c377a70393b297d1e5f990be5468b8e22cd0e355b6636c67c25f62d2
SSDEEP

12288:An1cI2jjcScZqFkWpSebQbpIpYVwj8xVVyvZNcQ:4KdE1ZkMyQpIpYVwEVVaD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bf3b9fc5b34d5bd6883d01d88239e3f8

Files

bf3b9fc5b34d5bd6883d01d88239e3f8
.exe windows:5 windows x86 arch:x86

67096020ff234e1650bd2be41f455ea4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

setup_wm.pdb

Imports

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetEvent
EnterCriticalSection
LeaveCriticalSection
ResetEvent
DeleteCriticalSection
CreateEventW
WaitForSingleObject
InitializeCriticalSection
LoadLibraryExW
FreeLibrary
LoadLibraryW
GetProcAddress
CreateMutexW
ReleaseMutex
MoveFileExW
GetModuleFileNameA
FindFirstFileA
FindClose
CreateFileA
ReadFile
GetWindowsDirectoryW
CopyFileW
DeleteFileW
GetTempPathW
GetSystemWindowsDirectoryW
GetSystemDirectoryW
GetCurrentDirectoryW
CreateFileW
MoveFileW
GetModuleFileNameW
GetCommandLineW
lstrcpynW
CompareStringW
GetExitCodeThread
QueryDosDeviceW
GetVersion
GetDriveTypeW
SetErrorMode
GetLocaleInfoW
GetUserDefaultLangID
DeviceIoControl
LoadLibraryA
GetProcessHeap
HeapAlloc
HeapFree
GetProfileStringW
WriteProfileStringW
GlobalAlloc
GlobalLock
GlobalUnlock
CreateThread
lstrlenA
DeleteFileA
InterlockedDecrement
InterlockedIncrement
ExpandEnvironmentStringsW
GetLongPathNameW
OpenEventW
WritePrivateProfileStringW
GetLocalTime
lstrlenW
LocalAlloc
LocalFree
Sleep
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SetFilePointer
SetEndOfFile
GlobalFree
WideCharToMultiByte
GetSystemDefaultLangID
FindFirstFileW
FindNextFileW
GetShortPathNameW
GetWindowsDirectoryA
GetModuleHandleA
CreateProcessW
WaitForMultipleObjects
GetExitCodeProcess
GetDiskFreeSpaceExW
SetFileAttributesW
GetFileTime
FileTimeToSystemTime
GetTimeZoneInformation
GetModuleHandleW
GetVersionExA
GetVersionExW
GetFileAttributesW
GetFileAttributesA
SetCurrentDirectoryW
GetSystemDefaultLCID
GetUserGeoID
GetTempPathA
CreateDirectoryW
RemoveDirectoryW
GetPrivateProfileStringW
SetLastError
GetFileSize
WriteFile
MultiByteToWideChar
GetStartupInfoA
CloseHandle
GetLastError

msvcrt

wcsrchr
wcsstr
wcschr
??2@YAPAXI@Z
??3@YAXPAX@Z
_wcsicmp
wcslen
swscanf
_wcslwr
_beginthreadex
_wtol
_wcsnicmp
_vsnprintf
_endthread
_c_exit
_exit
_XcptFilter
_cexit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__dllonexit
_onexit
wcsncpy
_snwprintf
iswspace
wcsncmp
wcspbrk
iswdigit
towupper
iswalpha
strpbrk
_strlwr
_stricmp
iswalnum
_wcsupr
ceil
wcstol
calloc
strchr
memmove
wcscmp
malloc
free
_itow
wcstok
_vsnwprintf
strrchr
strstr
_purecall
_wtoi
time

advapi32

RegCreateKeyExW
LookupPrivilegeValueW
InitiateSystemShutdownExW
CloseServiceHandle
QueryServiceStatus
EnumDependentServicesW
ControlService
OpenServiceW
OpenSCManagerW
StartServiceW
CreateServiceW
DeleteService
QueryServiceConfigW
RegOpenKeyExA
OpenProcessToken
RegEnumKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumValueW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
AdjustTokenPrivileges
RegQueryValueExW
RegCloseKey
RegQueryValueExA
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation

gdi32

SelectObject
SetMapMode
CreateCompatibleDC
GetStockObject
GetDeviceCaps
CreateSolidBrush
SetTextColor
GetObjectW
SetBkColor
DeleteObject
CreateFontIndirectW
PatBlt
CreatePen
GetTextMetricsW
CreateFontA
GetTextFaceA
ExtTextOutW
SetBkMode
DeleteDC

user32

PeekMessageW
PostThreadMessageW
SetCursor
CallWindowProcW
DrawTextW
LoadCursorW
DestroyCursor
GetScrollInfo
SetScrollInfo
ScrollWindow
GetActiveWindow
GetMessageW
IsDialogMessageW
TranslateMessage
DispatchMessageW
LoadIconW
UpdateWindow
IsWindow
BeginPaint
CreateDialogParamW
LoadImageW
GetWindowLongW
SetWindowLongW
EndPaint
PostQuitMessage
InvalidateRect
GetSystemMetrics
SendDlgItemMessageW
DestroyWindow
CreateWindowExW
SetWindowTextA
FindWindowExW
GetSystemMenu
EnableMenuItem
MessageBoxW
ScreenToClient
SetWindowPos
PostMessageW
EnableWindow
LoadStringW
SetWindowTextW
ShowWindow
GetDlgItem
GetDC
DrawFocusRect
ReleaseDC
DefWindowProcW
GetWindowRect
GetParent
MapWindowPoints
MoveWindow
SetFocus
SendMessageW
FindWindowW
GetDesktopWindow
RegisterClassW
MsgWaitForMultipleObjects
UnregisterClassW
CharNextA
IsCharAlphaW
SetTimer
KillTimer
GetClientRect
LoadStringA

ole32

CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoCreateInstance
CLSIDFromString
OleInitialize
OleUninitialize

comctl32

InitCommonControlsEx

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
SHGetFolderLocation
ShellExecuteW
SHChangeNotify
ShellExecuteExW
CommandLineToArgvW

wininet

InternetCrackUrlW

setupapi

SetupCloseInfFile
SetupFindNextLine
SetupGetStringFieldW
SetupGetLineCountW
SetupFindFirstLineW
SetupGetLineTextW
SetupGetBinaryField
SetupInstallFromInfSectionW
SetupIterateCabinetA

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust
WTHelperGetProvSignerFromChain

wsock32

getsockopt
__WSAFDIsSet
WSACancelAsyncRequest
WSAGetLastError
connect
htons
inet_ntoa
socket
ioctlsocket
select
WSAStartup
WSACleanup
WSAAsyncGetHostByName
closesocket

urlmon

ObtainUserAgentString
UrlMkSetSessionOption

shlwapi

PathAddBackslashW
PathAddBackslashA
PathFindExtensionW
PathFindFileNameW
SHDeleteKeyW
PathGetCharTypeA
PathGetCharTypeW

crypt32

CertVerifyCertificateChainPolicy

oleaut32

SysAllocString
SysStringLen
SysAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SysFreeString
VariantInit
VariantClear

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

mpr

WNetCancelConnection2W
WNetAddConnection2W
WNetGetConnectionW

Sections

.text
Size: 300KB - Virtual size: 298KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 484KB - Virtual size: 482KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.kdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

67096020ff234e1650bd2be41f455ea4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcrt

advapi32

gdi32

user32

ole32

comctl32

shell32

wininet

setupapi

wintrust

wsock32

urlmon

shlwapi

crypt32

oleaut32

version

mpr

Sections

.text Size: 300KB - Virtual size: 298KB

.data Size: 12KB - Virtual size: 17KB

.rsrc Size: 484KB - Virtual size: 482KB

.kdata Size: 56KB - Virtual size: 56KB

.text
Size: 300KB - Virtual size: 298KB

.data
Size: 12KB - Virtual size: 17KB

.rsrc
Size: 484KB - Virtual size: 482KB

.kdata
Size: 56KB - Virtual size: 56KB