bd895319730f9ae374099b713a386f1e

Sharing

Copy URL Twitter E-mail

General

Target

bd895319730f9ae374099b713a386f1e
Size

31KB
MD5

bd895319730f9ae374099b713a386f1e
SHA1

e413635acac2200c117fe6d0e992e0f14083d038
SHA256

ad21be0b8e950f780954e7f9b01ca5930b4607171ca133e4825b18e6c730c728
SHA512

20c7977ccbe8ad2d0134ea3766e7f2cff14d196b715364ce145573383cff565b0d325782bb26ad5407433ec0e8e52336ed02c98e7b834192f59f7b10f179cb64
SSDEEP

384:I6VyhwjrjJwc7+uM23iz3JtS4YC63i4HE9CKH/YYtyPGOOTTPxEU4/HIj/YMx6yk:I6Vyh6jZqfD6d53FM/vZOOff4O/12

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bd895319730f9ae374099b713a386f1e

Files

bd895319730f9ae374099b713a386f1e
.exe windows:5 windows x86 arch:x86

62e6f4553a8e502401340ff5af3067be

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DebugSetProcessKillOnExit
SwitchToFiber
GetConsoleAliasesLengthW
SetSystemTimeAdjustment
MoveFileA
GetConsoleTitleW
WriteConsoleInputVDMW
GetNumberOfConsoleMouseButtons
IsDBCSLeadByteEx
LZCopy
PeekConsoleInputA
GetConsoleMode
SetComputerNameExA
FindFirstChangeNotificationA
TerminateProcess
RtlFillMemory
SetConsoleCP
AttachConsole
PrivMoveFileIdentityW
OpenFileMappingA
CreateConsoleScreenBuffer
DisconnectNamedPipe
WriteProfileStringW
EnumSystemLanguageGroupsW
GetConsoleFontSize
FatalExit
IsBadWritePtr
HeapSummary
SetThreadAffinityMask
GetNumberOfConsoleFonts
FindCloseChangeNotification
OpenJobObjectW
GetConsoleProcessList
LockResource
PulseEvent
GetModuleHandleA
SetProcessWorkingSetSize
DeleteVolumeMountPointW
WaitNamedPipeW
WriteConsoleOutputA
lstrcpynW
GetVolumePathNamesForVolumeNameW
IsValidLanguageGroup
SetStdHandle
GetThreadLocale
WaitForDebugEvent
RegisterWaitForSingleObject
IsSystemResumeAutomatic
BaseCheckAppcompatCache
TerminateJobObject
WriteFile
_lread
GetWindowsDirectoryA
GetFileInformationByHandle
ReplaceFile
OpenSemaphoreW
CreateNamedPipeA
SetFirmwareEnvironmentVariableW
SetThreadPriority
DeleteFileA
GlobalHandle
BindIoCompletionCallback
UpdateResourceW
GetProfileSectionA
SetConsoleOS2OemFormat
WriteProcessMemory
Process32FirstW
FindNextVolumeW
SetConsoleActiveScreenBuffer
SetConsoleInputExeNameW
LockFileEx
ReadConsoleOutputCharacterW
CreateEventW
lstrcmp
SetConsoleIcon
FindNextFileW
GlobalLock
GetEnvironmentStringsW
ExitProcess
InitializeCriticalSectionAndSpinCount
RtlMoveMemory
GetNextVDMCommand
SetVolumeLabelA
EnumLanguageGroupLocalesW
GetConsoleCursorInfo
HeapSize
VirtualAlloc
WriteConsoleOutputAttribute
DosPathToSessionPathW
EnumerateLocalComputerNamesW
EnumTimeFormatsA
CancelIo
VirtualProtectEx
OpenSemaphoreA
CopyFileA
CopyLZFile
InitializeCriticalSection
SetConsoleInputExeNameA
ReadConsoleInputExA
MapViewOfFileEx
RemoveDirectoryW
WritePrivateProfileSectionA
EnumResourceTypesA
GetCalendarInfoA
LocalSize
GetCompressedFileSizeA
SearchPathA
GetConsoleAliasW
OpenProfileUserMapping
GetThreadPriorityBoost
GetOEMCP
DelayLoadFailureHook
GetCommandLineW
QueueUserAPC
GetVersionExA
FindNextVolumeA
SetLastConsoleEventActive
GetNumaAvailableMemoryNode
ReadConsoleA
GlobalFindAtomW
GetEnvironmentStringsA
GetCurrencyFormatA
CreateHardLinkA
GetConsoleInputExeNameA
GetThreadTimes
RemoveLocalAlternateComputerNameW
GetComputerNameW
GetEnvironmentVariableA
GetModuleHandleExA
GetFirmwareEnvironmentVariableA
DebugActiveProcess
GetNumaProcessorNode
FormatMessageA
FoldStringW
PostQueuedCompletionStatus
CreateFileA
SetMailslotInfo
ReadConsoleInputA
SetConsoleCtrlHandler
LocalReAlloc
lstrcpynA
SetVDMCurrentDirectories
GetFileAttributesExW

dhcpsapi

DhcpServerQueryAttribute
DhcpGetSuperScopeInfoV4
DhcpRpcFreeMemory
DhcpAddSubnetElementV4
DhcpServerQueryAttributes
DhcpSetOptionValues
DhcpRemoveOption
DhcpDeleteClientInfo
DhcpGetClientOptions
DhcpRemoveSubnetElementV5
DhcpEnumSubnetElements
DhcpAuditLogGetParams
DhcpGetClientInfo
DhcpDeleteServer
DhcpServerSetConfig
DhcpDeleteMScope
DhcpSetClientInfo
DhcpEnumSubnets
DhcpSetClientInfoV4
DhcpRemoveSubnetElement
DhcpScanMDatabase
DhcpEnumMScopeClients
DhcpEnumOptionValuesV5
DhcpEnumSubnetElementsV4
DhcpServerGetConfigV4
DhcpSetOptionValuesV5
DhcpEnumSubnetElementsV5

wtsapi32

WTSEnumerateServersW
WTSEnumerateProcessesA
WTSTerminateProcess
WTSQueryUserConfigW
WTSVirtualChannelPurgeOutput
WTSSendMessageA
WTSVirtualChannelOpen
WTSOpenServerA
WTSVirtualChannelPurgeInput
WTSWaitSystemEvent
WTSSetUserConfigW
WTSEnumerateSessionsA
WTSShutdownSystem
WTSQuerySessionInformationW
WTSQuerySessionInformationA
WTSVirtualChannelWrite
WTSSetSessionInformationW
WTSSendMessageW
WTSEnumerateServersA
WTSRegisterSessionNotification
WTSSetUserConfigA
WTSFreeMemory
WTSEnumerateSessionsW
WTSLogoffSession
WTSQueryUserToken
WTSUnRegisterSessionNotification
WTSVirtualChannelClose
WTSVirtualChannelQuery
WTSEnumerateProcessesW
WTSQueryUserConfigA
WTSCloseServer
WTSVirtualChannelRead
WTSSetSessionInformationA
WTSOpenServerW
WTSDisconnectSession

opengl32

glTexImage1D
GlmfEndPlayback
glGetTexImage
glTexCoord2dv
glFogiv
glMaterialiv
glRasterPos4i
glCopyTexSubImage1D
glTexCoord4d
glTexCoord1d
glRasterPos3fv
glStencilFunc
glVertex3i
glNormal3iv
GlmfBeginGlsBlock
glGetPixelMapusv
glIndexPointer
glColor3us
glRasterPos3d
glEnableClientState
glVertex4fv
glEvalCoord2f
wglSwapMultipleBuffers
glMultMatrixd
glPixelStorei
glGetLightfv
glVertex4iv
glMap2d
glDrawPixels
glColor4ui
glViewport
glTexEnvfv
glTexCoord3s
glCopyTexSubImage2D
glMaterialf
glEvalPoint1
glTexImage2D
glTexCoord1s
glGetClipPlane
glLoadMatrixd

shlwapi

SHRegEnumUSValueW
StrCmpLogicalW
PathRemoveExtensionW
StrNCatA
StrPBrkA
PathIsPrefixA
SHRegCreateUSKeyW
wvnsprintfW
StrFormatByteSizeA
StrCatW
PathFindExtensionW
StrCatBuffA
PathCompactPathA
PathIsDirectoryEmptyA
PathFindNextComponentA
SHRegDeleteEmptyUSKeyA
SHEnumKeyExW
StrRChrIA
StrStrNIW
PathIsFileSpecW
PathQuoteSpacesW
StrToIntA
UrlHashA
AssocQueryStringW
StrRStrIA
UrlCompareW
PathIsRelativeW
UrlCombineA
PathIsUNCServerShareA
SHDeleteKeyW
SHQueryInfoKeyA
StrRetToBufA
PathCompactPathExA
PathIsPrefixW
SHGetValueW
PathParseIconLocationW
PathUnmakeSystemFolderA
PathIsUNCServerA
StrPBrkW

localspl

SplCreateSpooler
SplGetPrinterDriverEx
DllMain
SplAddPortEx
SplGetPrinterData
SplSetPrinterExtraEx
SplGetPrinterExtraEx
SplAddPrinter
SplSetPrinter
ControlPrintProcessor
SplEnumPrinters
SplEnumPrintProcessorDatatypes
SplGetPrinterDriverDirectory
SplSetPrinterData
SplEnumForms
SplGetPrinterDriver
SplEnumPrinterDataEx
SplGetPrinterDataEx
SplDeletePrintProcessor
SplLoadLibraryTheCopyFileModule
SplAddForm
SplDeleteMonitor
SplEnumPorts
SplAddMonitor
InitializePrintProvidor
SplDeletePrinterKey
SplCloseSpooler
SplDeleteSpooler
SplDeletePrinter
SplSetPrinterDataEx
SplGetForm
SplAddPrintProcessor
SplCopyNumberOfFiles
SplSetPrinterExtra
SplEnumMonitors
SplPowerEvent
LclIsSessionZero
SplGetPrintProcessorDirectory
SplGetPrinterExtra
EnumPrintProcessorDatatypesW

setupapi

CM_Query_Arbitrator_Free_Size_Ex
SetupPromptForDiskW
SetupDiOpenDeviceInfoA
CM_Open_Class_Key_ExA
CM_Open_DevNode_Key
CM_Get_Device_ID_ExW
CM_Get_Log_Conf_Priority_Ex
CM_Modify_Res_Des_Ex
CM_Query_And_Remove_SubTree_ExA
CM_Enumerate_Classes
MyRealloc
pSetupMakeSurePathExists
CM_Set_HW_Prof_Ex
CM_Set_DevNode_Registry_PropertyA
CM_Request_Eject_PC
SetupGetInfFileListA
SetupDiGetClassDescriptionA
CM_Is_Dock_Station_Present_Ex
CM_Unregister_Device_InterfaceW
SetupQueueCopyIndirectW
SetupDiCreateDeviceInfoA
SetupDiGetClassImageListExW
SetupDeleteErrorW
SetupDiGetClassRegistryPropertyA
SetupQueryFileLogA

shell32

SHGetFileInfoW
Options_RunDLL
StrChrA
StrRStrA
SHBrowseForFolder
SHGetDataFromIDListW
SHEmptyRecycleBinA
DragFinish
StrRStrIW
SheChangeDirA
SHAppBarMessage
SHUpdateRecycleBinIcon
AppCompat_RunDLLW
ShellExecuteEx
SHFreeNameMappings
DllRegisterServer
SHPathPrepareForWriteA
ShellExecuteA
SHInvokePrinterCommandA
RegenerateUserEnvironment
StrRChrIA
SHEnumerateUnreadMailAccountsW
SHFileOperationA
OpenAs_RunDLLA
SHBindToParent
RealShellExecuteW
DllCanUnloadNow

wsock32

getnetbyname
WSACancelAsyncRequest
sendto
send
s_perror
inet_ntoa
getprotobynumber
socket
GetNameByTypeA
WSAIsBlocking
recv
EnumProtocolsA
ntohl
WSAGetLastError
WSAUnhookBlockingHook
getsockname
WSAAsyncGetProtoByNumber
NPLoadNameSpaces
setsockopt
getservbyname
ioctlsocket
WSACleanup
WSApSetPostRoutine
TransmitFile
GetServiceW
GetTypeByNameA
WSASetLastError
WSAAsyncGetHostByName
GetServiceA

hhsetup

?GetVersion@CCollection@@QAEKXZ
?AddChildFolder@CFolder@@QAEKPAV1@@Z
?AddRef@CCollection@@QAEXXZ
?GetLanguage@CFolder@@QAEGXZ
??0CLocation@@QAE@XZ
?GetTail@CFIFOString@@QAEKPAPAD@Z
?RemoveCollection@CCollection@@QAEKH@Z
?SetNextLocation@CLocation@@QAEXPAV1@@Z
?SetExTitlePtr@CFolder@@QAEXPAVCExTitle@@@Z
?SetSampleLocation@CCollection@@QAEXPBD@Z
?GetMasterCHM@CCollection@@QAEHPAPADPAG@Z
?GetSampleLocation@CCollection@@QAEPADXZ
?RemoveAll@CPointerList@@QAEXXZ
??4CFIFOString@@QAEAAV0@ABV0@@Z
?GetIdW@CTitle@@QAEPBGXZ
?GetRootFolder@CCollection@@QAEPAVCFolder@@XZ
?WriteFolder@CCollection@@AAEHPAPAVCFolder@@@Z
?FindTitle@CCollection@@QAEPAVCTitle@@PBGG@Z
?Next@CPointerList@@QAEPAUListItem@@PAU2@@Z
??1CCollection@@QAE@XZ
?Open@CCollection@@QAEKPBG@Z
?Dirty@CCollection@@QAEXXZ
?GetNextTitle@CTitle@@QAEPAV1@XZ
?SetLanguage@CFolder@@QAEXG@Z
?GetFindMergedCHMS@CCollection@@QAEHXZ

user32

SetScrollPos
IsIconic
MoveWindow

gdi32

RectVisible

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 444B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

62e6f4553a8e502401340ff5af3067be

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

dhcpsapi

wtsapi32

opengl32

shlwapi

localspl

setupapi

shell32

wsock32

hhsetup

user32

gdi32

Sections

.text Size: 13KB - Virtual size: 12KB

.rdata Size: 15KB - Virtual size: 14KB

.data Size: 1KB - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 444B

.text
Size: 13KB - Virtual size: 12KB

.rdata
Size: 15KB - Virtual size: 14KB

.data
Size: 1KB - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 444B