c466d2cff60f101548c6ae4f75942248

Sharing

Copy URL Twitter E-mail

General

Target

c466d2cff60f101548c6ae4f75942248
Size

246KB
MD5

c466d2cff60f101548c6ae4f75942248
SHA1

adb86a669c40c610bb7bff0afc7fc894d058cb98
SHA256

9e3ef040e2de92718bc63ab82d768ba58f88532f0093447cbc1369d031384737
SHA512

5cb100af6ab788d34b92a9a1aba782052dcc29dc2d5279b44139b4e88429e1058311e1605b5ad69fca27e62002814fd06a4c79f8f19180f80807625c94f23322
SSDEEP

6144:0BjaJKZq8PwZ8woh8VPVlZmvJ12Pt3Aa:0B+J6sZ8wo27ZIJo13Aa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c466d2cff60f101548c6ae4f75942248

Files

c466d2cff60f101548c6ae4f75942248
.exe windows:6 windows x64 arch:x64

3460ae4ee3908ea7e80909ead0204ab1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

TabTip.pdb

Imports

user32

GetWindow
GetAncestor
GetDlgCtrlID
WaitForInputIdle
MapVirtualKeyW
MapVirtualKeyExW
GetKeyboardLayout
GetForegroundWindow
GetWindowThreadProcessId
SendInput
UnhookWinEvent
SetWinEventHook
SetThreadDesktop
FindWindowW
GetSystemMetrics
SetProcessDPIAware
CloseDesktop
OpenInputDesktop
GetUserObjectInformationW
CharNextW
KillTimer
SetTimer
PostMessageW
PostThreadMessageW
DispatchMessageW
TranslateMessage
GetMessageW
UnregisterClassA
GetClassNameW
CharUpperW
GetThreadDesktop

msvcrt

memcpy_s
_wcsicmp
wcsstr
free
_beginthreadex
_wcsnicmp
wcstol
malloc
__CxxFrameHandler3
memmove_s
memcmp
calloc
_purecall
towupper
wcsrchr
_itow
qsort
wcschr
iswspace
_errno
realloc
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_cexit
_vsnwprintf
_CxxThrowException
_exit
_XcptFilter
__wgetmainargs
__C_specific_handler
memset
_callnewh
wcsncmp
vswprintf_s
_vscwprintf
_wtoi
memcpy

ntdll

EtwEventRegister
EtwEventWrite
EtwEventUnregister
WinSqmAddToStream
NtQuerySystemInformation
RtlReportException
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
OpenProcessToken
GetCurrentThread
OpenThreadToken
GetCurrentThreadId
SetProcessShutdownParameters
CreateThread
CreateProcessAsUserW
GetExitCodeProcess
TerminateProcess
GetStartupInfoW
GetCurrentProcessId

api-ms-win-security-base-l1-1-0

InitializeSid
GetSidSubAuthority
CopySid
GetLengthSid
IsValidSid
EqualSid
InitializeAcl
AddAce
MakeAbsoluteSD
InitializeSecurityDescriptor
GetTokenInformation
DuplicateTokenEx
GetAclInformation
GetSecurityDescriptorOwner
SetSecurityDescriptorOwner
GetSecurityDescriptorGroup
SetSecurityDescriptorGroup
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetSidLengthRequired
GetSecurityDescriptorControl

kernel32

CreateTimerQueueTimer
GetTickCount
QueueUserWorkItem
CompareStringW
WaitForMultipleObjects
Sleep
GetFileTime
OpenEventW
CreateFileW
GetModuleHandleW
GetModuleFileNameW
HeapSetInformation
LoadLibraryExW
GetModuleHandleExW
RegisterWaitForSingleObject
RaiseException
GetProcAddress
lstrlenW
FreeLibrary
WaitForSingleObject
SetEvent
CreateEventW
GetLastError
CloseHandle
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
OpenProcess
CreateMutexW
DeleteTimerQueueTimer
K32EnumProcessModules
K32GetModuleFileNameExW
K32GetModuleBaseNameW
CompareFileTime
LoadLibraryW
GetVersionExA
HeapDestroy
HeapAlloc
UnregisterWait
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetSystemTimeAsFileTime
UnhandledExceptionFilter
OutputDebugStringA
GetCommandLineW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

ole32

CoInitializeEx
CoTaskMemFree
CoDisconnectObject
CoRevokeClassObject
CoRegisterClassObject
CoInitialize
CoResumeClassObjects
CoInitializeSecurity
CoEnableCallCancellation
CoDisableCallCancellation
CoCancelCall
CoCreateInstance
CoUninitialize

oleaut32

VarBstrCat
SysAllocStringLen
SafeArrayUnaccessData
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayGetVartype
SafeArrayCopy
SysAllocStringByteLen
SafeArrayCreate
SafeArrayDestroy
SafeArrayLock
SafeArrayUnlock
VarBstrCmp
VariantClear
VariantInit
SysStringLen
SafeArrayRedim
SysStringByteLen
LoadRegTypeLi
LoadTypeLi
SysAllocString
SysFreeString

oleacc

AccessibleObjectFromWindow

shlwapi

PathFileExistsW
SHCreateStreamOnFileEx

imm32

ImmDisableTextFrameService

slc

SLGetWindowsInformationDWORD

shell32

SHGetFolderPathW

comctl32

ord344

api-ms-win-core-localregistry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

api-ms-win-service-management-l1-1-0

OpenSCManagerW
CloseServiceHandle
StartServiceW
OpenServiceW

Sections

.text
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3460ae4ee3908ea7e80909ead0204ab1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

msvcrt

ntdll

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-base-l1-1-0

kernel32

version

ole32

oleaut32

oleacc

shlwapi

imm32

slc

shell32

comctl32

api-ms-win-core-localregistry-l1-1-0

api-ms-win-service-management-l1-1-0

Sections

.text Size: 139KB - Virtual size: 139KB

.data Size: 1KB - Virtual size: 4KB

.pdata Size: 8KB - Virtual size: 7KB

.rsrc Size: 67KB - Virtual size: 67KB

.reloc Size: 29KB - Virtual size: 30KB

.text
Size: 139KB - Virtual size: 139KB

.data
Size: 1KB - Virtual size: 4KB

.pdata
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 67KB - Virtual size: 67KB

.reloc
Size: 29KB - Virtual size: 30KB