6c17c7c2445e1c69c8ae1ac269aad677d5cbedb6b2445bb5c76922b4a12f8168

Sharing

Copy URL Twitter E-mail

General

Target

6c17c7c2445e1c69c8ae1ac269aad677d5cbedb6b2445bb5c76922b4a12f8168
Size

5.3MB
MD5

00c469e36fe358f2bdf6c91f261a1db9
SHA1

2122d80f21aebe802c1589a7cdbf18fbf4ba3450
SHA256

6c17c7c2445e1c69c8ae1ac269aad677d5cbedb6b2445bb5c76922b4a12f8168
SHA512

d78de214a238b968b026558e1c35f52bdf842cb42b2f79c0b9a80e1a6afce2114adbb714862c20e51c5c0513ff8d4e68071a61125076cf5de2aab7494ee9be22
SSDEEP

98304:GuIt2VDfGwKif+LUQelFLOAkGkzdnEVomFHKnP:Gft6+pYnlFLOyomFHKnP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6c17c7c2445e1c69c8ae1ac269aad677d5cbedb6b2445bb5c76922b4a12f8168

Files

6c17c7c2445e1c69c8ae1ac269aad677d5cbedb6b2445bb5c76922b4a12f8168
.exe windows:5 windows x64 arch:x64

0730bf40692226cf883990353d560904

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Works\SEP\branches_release\1.10\bin\Release\x64\MgcSweeper64.pdb

Imports

kernel32

SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleCP
ExitProcess
GetStdHandle
SetStdHandle
VirtualAlloc
HeapQueryInformation
FreeLibraryAndExitThread
ExitThread
PeekNamedPipe
GetFileType
GetDriveTypeW
GetCommandLineW
GetCommandLineA
RtlUnwindEx
RtlPcToFileHeader
GetCPInfo
LCMapStringW
GetStringTypeW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
WriteConsoleW
VirtualFree
QueryPerformanceFrequency
DefineDosDeviceW
RtlCaptureContext
ResetEvent
GetWindowsDirectoryW
SearchPathW
GetProfileIntW
GetFileTime
SetErrorMode
VirtualProtect
GlobalGetAtomNameW
lstrcmpiW
DuplicateHandle
GetVolumeInformationW
FindFirstFileW
FindClose
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
GlobalSize
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
MulDiv
GlobalFree
GlobalUnlock
GlobalFlags
GlobalFindAtomW
FreeResource
EncodePointer
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GetModuleHandleExW
VerifyVersionInfoW
lstrcpyW
VerSetConditionMask
GlobalAddAtomW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpW
GlobalDeleteAtom
GlobalLock
GlobalAlloc
GetCurrentThread
ResumeThread
SetThreadPriority
GetCurrentDirectoryW
GetTimeZoneInformation
VirtualQuery
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetFileSize
LockFileEx
LocalFree
CreateFileMappingA
UnlockFile
HeapCompact
LoadLibraryW
GetSystemInfo
DeleteFileA
WaitForSingleObjectEx
LoadLibraryA
CreateFileA
FlushViewOfFile
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
UnmapViewOfFile
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
LockFile
GetDiskFreeSpaceW
GetFullPathNameW
HeapCreate
AreFileApisANSI
FileTimeToLocalFileTime
lstrcmpA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetUserDefaultLangID
CreateIoCompletionPort
PostQueuedCompletionStatus
GetVersionExW
WaitForMultipleObjectsEx
GetQueuedCompletionStatus
GetEnvironmentVariableA
ExpandEnvironmentStringsW
SetFilePointer
SetLastError
CreateThread
SetEvent
OutputDebugStringW
CreateEventW
CancelWaitableTimer
InitializeCriticalSection
WaitForMultipleObjects
CreateWaitableTimerW
SetWaitableTimer
TryEnterCriticalSection
LoadLibraryExW
FormatMessageW
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
GetFileAttributesW
WriteFile
GetFileSizeEx
ReadFile
GetCurrentProcessId
GetCurrentThreadId
FindResourceW
LoadResource
FindResourceExW
CloseHandle
LockResource
CreateFileW
DeviceIoControl
OutputDebugStringA
GetCurrentProcess
SizeofResource
MoveFileW
GetTempFileNameW
CopyFileW
MoveFileExW
GetProcAddress
DeleteFileW
WaitForSingleObject
InitializeCriticalSectionEx
GetModuleFileNameW
GetSystemDirectoryW
GetModuleHandleW
Sleep
FreeLibrary
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
DecodePointer
GetLastError
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetACP

user32

CreateAcceleratorTableW
LoadAcceleratorsW
MapVirtualKeyW
GetKeyboardState
GetAsyncKeyState
GetKeyboardLayout
ToUnicodeEx
WindowFromPoint
ReleaseCapture
SetCapture
WaitMessage
CharUpperW
DestroyIcon
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
InvalidateRect
KillTimer
SetTimer
DeleteMenu
CopyImage
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuState
GetMenuStringW
ReleaseDC
GetDC
RealChildWindowFromPoint
GetDesktopWindow
ClientToScreen
IsDialogMessageW
SetWindowTextW
CheckDlgButton
MoveWindow
ShowWindow
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
LoadIconW
GetWindow
GetTopWindow
GetClassNameW
GetClassLongPtrW
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
PtInRect
EqualRect
DestroyAcceleratorTable
AdjustWindowRectEx
GetDoubleClickTime
GetIconInfo
CopyIcon
SendMessageW
GetFocus
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetWindowTextLengthW
GetWindowTextW
RemovePropW
SetCursorPos
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
EndPaint
BeginPaint
GetMenuItemInfoW
GetForegroundWindow
SetActiveWindow
UpdateWindow
TrackPopupMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
SetMenu
GetMenu
GetCapture
SetFocus
GetDlgCtrlID
GetDlgItem
IsIconic
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
DestroyWindow
IsChild
EnableScrollBar
SetRect
SetParent
BringWindowToTop
CreatePopupMenu
LockWindowUpdate
SetClassLongPtrW
MonitorFromPoint
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
LoadImageW
UnionRect
CopyAcceleratorTableW
TrackMouseEvent
IsZoomed
LoadMenuW
GetSystemMenu
MessageBeep
IntersectRect
ScreenToClient
NotifyWinEvent
GetMenuCheckMarkDimensions
SetMenuItemInfoW
GetParent
LoadBitmapW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
IsWindowVisible
GetActiveWindow
GetKeyState
ValidateRect
GetCursorPos
SetWindowsHookExW
CallNextHookEx
PostMessageW
PostQuitMessage
ShowOwnedPopups
SetCursor
wsprintfW
EnableWindow
IsWindowEnabled
MessageBoxW
GetWindowLongW
GetWindowThreadProcessId
GetLastActivePopup
DefWindowProcW
GetClassInfoW
SetLayeredWindowAttributes
GetSystemMetrics
GetClientRect
MapWindowPoints
GetSysColor
GetSysColorBrush
SetRectEmpty
CopyRect
LoadCursorW
SystemParametersInfoW
GetMonitorInfoW
EnumDisplayMonitors
DestroyMenu
GetPropW
RegisterWindowMessageW
DrawEdge
DrawFrameControl
DrawStateW
SetWindowRgn
RedrawWindow
GetWindowRect
DrawFocusRect
FillRect
InflateRect
OffsetRect
IsRectEmpty
DrawIconEx
GetMenuDefaultItem
SetMenuDefaultItem
ModifyMenuW
GetUpdateRect
UnhookWindowsHookEx
GetMessagePos
GetMessageTime
CallWindowProcW
RegisterClassW
GetClassInfoExW
CreateWindowExW
IsWindow
IsMenu
UnregisterClassW
SendDlgItemMessageA
CreateDialogIndirectParamW
EndDialog
GetNextDlgTabItem
MapDialogRect
TranslateAcceleratorW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
IsCharLowerW
GetKeyNameTextW
MapVirtualKeyExW
RegisterClipboardFormatW
CharUpperBuffW
UpdateLayeredWindow
FrameRect
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
IsClipboardFormatAvailable
SubtractRect
PostThreadMessageW
CreateMenu
GetNextDlgGroupItem
GetComboBoxInfo
DestroyCursor
GetWindowRgn
DrawIcon
HideCaret
InvertRect
SetForegroundWindow

gdi32

SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
MoveToEx
TextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateRoundRectRgn
CreateDIBSection
SetRectRgn
DPtoLP
SelectPalette
RealizePalette
SetPixel
StretchBlt
SetDIBColorTable
Rectangle
GetRgnBox
OffsetRgn
RoundRect
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
EnumFontFamiliesExW
ExtFloodFill
SetPaletteEntries
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
GetWindowOrgEx
LPtoDP
GetViewportOrgEx
SetPixelV
GetTextFaceW
SelectObject
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
CreateDCW
CopyMetaFileW
SetTextColor
SetBkColor
Polyline
Polygon
CreatePolygonRgn
ExtTextOutW
PatBlt
GetTextExtentPoint32W
GetTextColor
GetBkColor
Ellipse
CreateRectRgn
CreateHatchBrush
CreateEllipticRgn
CombineRgn
GetObjectW
GetTextMetricsW
GetTextCharsetInfo
GetStockObject
GetDeviceCaps
EnumFontFamiliesW
DeleteObject
CreateSolidBrush
CreatePatternBrush
CreatePen
CreateFontIndirectW
CreateDIBitmap
DeleteDC
CreateBitmap
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateRectRgnIndirect

msimg32

AlphaBlend
TransparentBlt

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

QueryServiceStatus
OpenServiceW
RegOpenKeyExW
OpenProcessToken
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW
OpenSCManagerW
CloseServiceHandle
RegCloseKey
AdjustTokenPrivileges
LookupPrivilegeValueW
RegDeleteValueW
EqualSid
QueryServiceStatusEx
RegEnumValueW
RegQueryValueW
RegEnumKeyW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
LookupAccountSidW
CryptReleaseContext
DeleteService
ControlService
StartServiceW
RegQueryValueExW

shell32

DragFinish
DragQueryFileW
SHAppBarMessage
SHGetFileInfoW
SHGetDesktopFolder
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteW

shlwapi

PathRemoveFileSpecW
PathStripToRootW
PathIsUNCW
PathFindFileNameW
PathFindExtensionW
StrFormatKBSizeW

uxtheme

GetWindowTheme
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
DrawThemeParentBackground
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
DrawThemeText
GetThemeSysColor

ole32

CoSetProxyBlanket
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
DoDragDrop
CoInitializeEx
CreateStreamOnHGlobal
CoDisconnectObject
ReleaseStgMedium
OleDuplicateData
CoTaskMemAlloc
CoInitialize
CoCreateInstance
CoCreateGuid
CoUninitialize
CoTaskMemFree
CoInitializeSecurity

oleaut32

LoadTypeLi
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen
SysStringLen
SysFreeString
SysAllocString
SystemTimeToVariantTime
SafeArrayGetElement
VariantCopy
VarBstrFromDate
VariantTimeToSystemTime

gdiplus

GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetInterpolationMode
GdipDrawImageRectI
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipAlloc
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDrawImageI
GdipGetImageHeight
GdiplusShutdown

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

crypt32

CryptMsgClose
CertFreeCertificateContext
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringW
CryptDecodeObject

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

imm32

ImmGetContext
ImmGetOpenStatus
ImmReleaseContext

winmm

PlaySoundW

fltlib

FilterSendMessage
FilterConnectCommunicationPort
FilterGetMessage
FilterReplyMessage
FilterUnload

wintrust

WinVerifyTrust

setupapi

InstallHinfSectionW

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 765KB - Virtual size: 765KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 66KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.giats
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0730bf40692226cf883990353d560904

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

gdiplus

version

crypt32

oleacc

imm32

winmm

fltlib

wintrust

setupapi

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.rdata Size: 765KB - Virtual size: 765KB

.data Size: 66KB - Virtual size: 117KB

.pdata Size: 123KB - Virtual size: 122KB

.gfids Size: 105KB - Virtual size: 104KB

.giats Size: 512B - Virtual size: 16B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 62KB - Virtual size: 62KB

.text
Size: 2.9MB - Virtual size: 2.9MB

.rdata
Size: 765KB - Virtual size: 765KB

.data
Size: 66KB - Virtual size: 117KB

.pdata
Size: 123KB - Virtual size: 122KB

.gfids
Size: 105KB - Virtual size: 104KB

.giats
Size: 512B - Virtual size: 16B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 62KB - Virtual size: 62KB