cff0dccc13f9ae9ae3c3b207a16cc2c1f8389b81f5c71fa5c56fe59987408a94

Sharing

Copy URL Twitter E-mail

General

Target

cff0dccc13f9ae9ae3c3b207a16cc2c1f8389b81f5c71fa5c56fe59987408a94
Size

3.5MB
MD5

c854551d07007a5b5de73fa682751b8b
SHA1

c62615e4c95aa25895f611a4c8fad88b8dfd8fe7
SHA256

cff0dccc13f9ae9ae3c3b207a16cc2c1f8389b81f5c71fa5c56fe59987408a94
SHA512

db154a9d4cbf4136b6cf3fe62c3a2d8db3d665f3d22c22bc52e3fbf41806a14a041c7d56f636c9335a3c256e6b2a86a0a77e5787afe0073ba83e2fdb341938e1
SSDEEP

98304:8oqI9Hlft1i6sQtWPHIqhzOTGv7fG1wQ69DiEoN3YNEj5KAE0FaoPiNNzh1:JqI9NQhFvTG1wQ69DiEoNPFaoPiNNV1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cff0dccc13f9ae9ae3c3b207a16cc2c1f8389b81f5c71fa5c56fe59987408a94

Files

cff0dccc13f9ae9ae3c3b207a16cc2c1f8389b81f5c71fa5c56fe59987408a94
.exe windows:5 windows x86 arch:x86

58ff09aea0461d25521893bc45d9b481

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareStringW
SetEnvironmentVariableA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoW
WriteConsoleW
SetHandleCount
LCMapStringW
GetConsoleMode
GetConsoleCP
GetStringTypeW
GetStdHandle
HeapCreate
IsProcessorFeaturePresent
IsValidCodePage
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapSize
HeapQueryInformation
GetFileType
SetStdHandle
VirtualQuery
GetSystemInfo
VirtualAlloc
ExitProcess
RaiseException
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetCommandLineA
ExitThread
HeapReAlloc
GetDateFormatA
GetTimeFormatA
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
FindResourceExW
GetUserDefaultLCID
VirtualProtect
SearchPathA
GetProfileIntA
GetNumberFormatA
GetWindowsDirectoryA
GetTempFileNameA
SetErrorMode
GetFileSizeEx
GetFileAttributesExA
GetOEMCP
GetCPInfo
GetACP
GlobalFlags
GetVolumeInformationA
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
GetModuleFileNameW
ReleaseActCtx
CreateActCtxW
GlobalGetAtomNameA
GlobalFindAtomA
LoadLibraryW
lstrcmpW
GlobalSize
lstrlenW
GetThreadLocale
GlobalAddAtomA
SuspendThread
SetThreadPriority
GetPrivateProfileIntA
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoA
CompareStringA
ActivateActCtx
DeactivateActCtx
InterlockedExchange
lstrcmpA
GetModuleHandleW
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
InterlockedIncrement
ResetEvent
GlobalAlloc
ResumeThread
GlobalFree
MulDiv
GlobalUnlock
GlobalLock
CreateEventA
SetEvent
HeapFree
GetProcessHeap
HeapAlloc
SetFilePointer
TerminateThread
GetExitCodeThread
SystemTimeToFileTime
CreateToolhelp32Snapshot
Process32Next
Process32First
WritePrivateProfileStringA
GetPrivateProfileStringA
GetFileSize
CopyFileA
FileTimeToSystemTime
FileTimeToLocalFileTime
SetCurrentDirectoryA
SetFileAttributesA
RemoveDirectoryA
GetCurrentDirectoryA
SetLastError
FindClose
FindNextFileA
FindFirstFileA
ReadFile
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetFileTime
CreateDirectoryA
lstrcmpiA
lstrcpyA
GetFileAttributesA
GetFullPathNameA
lstrlenA
LocalFree
FormatMessageA
CreateThread
GetCurrentProcessId
GetLocalTime
DeleteFileA
WriteFile
CreateFileA
FreeResource
FindResourceA
MultiByteToWideChar
GetVersionExA
GetTimeZoneInformation
GetTickCount
FreeLibrary
LoadLibraryA
GetCurrentProcess
GetModuleHandleA
GetProcAddress
WaitForSingleObject
GetExitCodeProcess
GetModuleFileNameA
GetLastError
GetTempPathA
CreateProcessA
WinExec
Sleep
DeleteCriticalSection
InitializeCriticalSection
FindResourceW
CloseHandle
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
CreateFileW

user32

SetPropA
GetPropA
RemovePropA
GetForegroundWindow
BeginDeferWindowPos
EndDeferWindowPos
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
ScrollWindow
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
ScreenToClient
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
CallWindowProcA
GetMenu
GetMenuStringA
AppendMenuA
InsertMenuA
GetMenuItemCount
RemoveMenu
GetWindowTextLengthA
MoveWindow
SetWindowLongA
SetWindowTextA
SendDlgItemMessageA
CheckDlgButton
PtInRect
GetDlgCtrlID
CharNextA
GetLastActivePopup
ShowOwnedPopups
SetWindowsHookExA
CallNextHookEx
GetMessageA
ValidateRect
GetMenuCheckMarkDimensions
GetMenuState
EnableMenuItem
CheckMenuItem
MessageBeep
IsChild
GetTopWindow
GetNextDlgGroupItem
CreateDialogIndirectParamA
GetDlgItem
EndDialog
SetWindowContextHelpId
MapDialogRect
RegisterClipboardFormatA
PostQuitMessage
ReleaseCapture
SetFocus
GetDesktopWindow
GetFocus
SetCapture
InvalidateRgn
EqualRect
IntersectRect
IsRectEmpty
IsWindowEnabled
CopyAcceleratorTableA
UpdateWindow
GetIconInfo
DrawStateA
DrawFocusRect
OffsetRect
InflateRect
FrameRect
TrackPopupMenuEx
WindowFromPoint
ClientToScreen
SetCursor
GetParent
GetNextDlgTabItem
DestroyCursor
CopyRect
GetSysColor
GetClassLongA
GetCapture
WinHelpA
FillRect
InvalidateRect
GetKeyboardLayout
GetKeyboardState
LoadIconW
SendMessageA
GetClientRect
ReleaseDC
GetDC
SetRect
ShowWindow
SetParent
SystemParametersInfoA
GetClassNameA
DefWindowProcA
GetMenuItemID
TrackPopupMenu
DestroyMenu
LoadMenuA
IsWindow
KillTimer
SetTimer
LoadIconA
DestroyIcon
LoadImageA
DestroyWindow
CreateWindowExA
RegisterWindowMessageA
GetWindowTextA
GetWindow
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
GetWindowDC
BeginPaint
EndPaint
GetMenuItemInfoA
CharUpperA
LoadCursorW
LoadCursorA
WaitMessage
DeleteMenu
RealChildWindowFromPoint
SetRectEmpty
EnumDisplayMonitors
SetLayeredWindowAttributes
GetSysColorBrush
FindWindowA
GetWindowThreadProcessId
GetWindowLongA
EnumWindows
DispatchMessageA
TranslateMessage
IsDialogMessageA
PeekMessageA
GetKeyState
GetAsyncKeyState
EnableWindow
GetCursorPos
PostThreadMessageA
UnregisterClassA
TranslateAcceleratorA
BringWindowToTop
CreatePopupMenu
InsertMenuItemA
LoadAcceleratorsA
GetWindowRect
LoadAcceleratorsW
CreateAcceleratorTableA
SetCursorPos
LockWindowUpdate
GetMenuDefaultItem
InvertRect
IsIconic
GetSystemMetrics
DrawIcon
GetActiveWindow
PostMessageA
MessageBoxA
SetWindowPos
SetActiveWindow
SetForegroundWindow
LoadMenuW
GetSubMenu
IsWindowVisible
ModifyMenuA
SetMenuItemInfoA
LoadBitmapW
SetMenuItemBitmaps
SetMenuDefaultItem
HideCaret
EnableScrollBar
CopyImage
GetKeyNameTextA
UnionRect
DefFrameProcA
DefMDIChildProcA
DrawMenuBar
TranslateMDISysAccel
MonitorFromPoint
UpdateLayeredWindow
IsMenu
CreateMenu
IsClipboardFormatAvailable
MapVirtualKeyA
GetUpdateRect
OpenClipboard
SetClipboardData
CloseClipboard
EmptyClipboard
LoadImageW
CopyIcon
CharUpperBuffA
GetDoubleClickTime
IsCharLowerA
MapVirtualKeyExA
SubtractRect
GetWindowRgn
ToAsciiEx
DrawFrameControl
DrawEdge
DrawIconEx
GetSystemMenu
SetClassLongA
NotifyWinEvent
DestroyAcceleratorTable
RedrawWindow
SetWindowRgn
IsZoomed
UnpackDDElParam
ReuseDDElParam

gdi32

PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
CreatePatternBrush
SelectPalette
GetObjectType
CreatePen
CreateHatchBrush
GetTextExtentPoint32A
SetRectRgn
CombineRgn
GetMapMode
PatBlt
DPtoLP
CreateDIBitmap
GetTextMetricsA
EnumFontFamiliesA
GetTextCharsetInfo
CreateDIBSection
CreateRoundRectRgn
CreateEllipticRgn
Polyline
Ellipse
Polygon
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
OffsetRgn
SetDIBColorTable
StretchBlt
SetPixel
Rectangle
EnumFontFamiliesExA
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
GetTextFaceA
SetPixelV
GetPixel
GetWindowExtEx
GetViewportExtEx
CreateRectRgn
SelectClipRgn
SetLayout
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
CreateDCA
CopyMetaFileA
GetTextColor
GetBkColor
GetRgnBox
CreateRectRgnIndirect
GetObjectA
SetTextColor
SetBkColor
CreateBitmap
CreateFontIndirectA
CreateCompatibleBitmap
BitBlt
CreateSolidBrush
DeleteObject
DeleteDC
SelectObject
GetDeviceCaps
CreatePolygonRgn
CreateCompatibleDC
GetStockObject

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

CryptGetProvParam
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
CryptReleaseContext
RegCreateKeyExA
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyExA
RegEnumValueA
CloseServiceHandle
EnumServicesStatusA
OpenSCManagerA
CryptAcquireContextA
RegEnumKeyA
RegQueryValueA

shell32

DragQueryFileA
ShellExecuteExA
SHGetFolderPathA
SHGetSpecialFolderPathA
SHFileOperationA
SHBrowseForFolderA
ShellExecuteA
Shell_NotifyIconA
SHGetPathFromIDListA
SHGetDesktopFolder
SHGetSpecialFolderLocation
DragFinish
SHGetFileInfoA
SHAppBarMessage

comctl32

_TrackMouseEvent
ImageList_GetIconSize
InitCommonControlsEx

shlwapi

PathFindExtensionA
PathFindFileNameA
UrlUnescapeA
PathStripToRootA
PathIsUNCA
PathRemoveFileSpecW

ole32

OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleLockRunning
DoDragDrop
CoRegisterMessageFilter
OleFlushClipboard
OleGetClipboard
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
CoCreateGuid
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoTaskMemFree
CoTaskMemAlloc
OleIsCurrentClipboard
CoRevokeClassObject
OleDuplicateData
OleUninitialize
OleInitialize
CLSIDFromString
CreateStreamOnHGlobal
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
CoFreeUnusedLibraries
CoUninitialize
CoInitialize
ReleaseStgMedium
CLSIDFromProgID

oleaut32

SysFreeString
VariantClear
VariantInit
SysAllocStringLen
VarBstrFromDate
VariantChangeType
OleCreateFontIndirect
SysAllocString
SafeArrayDestroy
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
OleLoadPicture
VariantCopy
SysStringByteLen
SysAllocStringByteLen

oledlg

ord8

gdiplus

GdipDrawImageI
GdipGetImageGraphicsContext
GdipAlloc
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipDisposeImage
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipFree
GdipDeleteGraphics

crypt32

CertOpenStore
CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertCloseStore
CertFreeCertificateContext
CertCreateCertificateContext
CertFindCertificateInStore
CertAddCertificateContextToStore

wininet

InternetSetFilePointer
InternetGetLastResponseInfoA
InternetQueryDataAvailable
InternetCrackUrlA
InternetQueryOptionA
InternetSetStatusCallback
HttpQueryInfoA
HttpEndRequestA
InternetWriteFile
HttpSendRequestExA
InternetSetCookieA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetAttemptConnect
InternetConnectA
FindNextUrlCacheEntryA
FindFirstUrlCacheEntryA
HttpSendRequestA
InternetReadFile
InternetOpenUrlA
InternetCanonicalizeUrlA
InternetGetConnectedState
InternetOpenA
InternetCloseHandle
DeleteUrlCacheEntry

iphlpapi

GetPerAdapterInfo
GetAdaptersInfo
GetNetworkParams

ws2_32

WSAStartup
WSACleanup
inet_ntoa
socket
htons
closesocket
WSAGetLastError
inet_addr
connect
gethostname
gethostbyname

rpcrt4

UuidFromStringA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

imm32

ImmGetOpenStatus
ImmReleaseContext
ImmGetContext

winmm

PlaySoundA

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 304KB - Virtual size: 304KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20.7MB - Virtual size: 20.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 229KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

58ff09aea0461d25521893bc45d9b481

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

gdiplus

crypt32

wininet

iphlpapi

ws2_32

rpcrt4

version

oleacc

imm32

winmm

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 304KB - Virtual size: 304KB

.data Size: 32KB - Virtual size: 95KB

.rsrc Size: 20.7MB - Virtual size: 20.7MB

.reloc Size: 229KB - Virtual size: 229KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 304KB - Virtual size: 304KB

.data
Size: 32KB - Virtual size: 95KB

.rsrc
Size: 20.7MB - Virtual size: 20.7MB

.reloc
Size: 229KB - Virtual size: 229KB