winflash[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

winflash.exe
Size

16.0MB
MD5

e54906dacb0dfcb60b7623a1afff0be9
SHA1

950b9b57f0e76c454246e188af9e91a482385323
SHA256

0b2955a5fa55e376f8565abcbb2365fa8f2544fea6b6ebc01839260822bd2c28
SHA512

0e76da01dc8b25888a9ad0c623cc0a2df7b3b160dd7314eb5b19e580b1e39db84ea5d7c5bb632526428660665b1c9ce97e062ef782bda49876569a052db928fb
SSDEEP

393216:pv/GtIxOF/1m1xnux3l5AKZXqWC4YO+xPt14znvuU80:Z/+IxytYwAKZ6RO+n14znvuU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
winflash.exe

Files

winflash.exe
.exe windows:6 windows x86 arch:x86

1361c0bb503fa117d44d4a59720bab46

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHAppBarMessage
SHGetDesktopFolder
SHGetSpecialFolderLocation
DragFinish
DragQueryFileA
SHGetFileInfoA
SHGetFolderPathA
SHGetPathFromIDListA
SHBrowseForFolderA
ShellExecuteA

kernel32

FindResourceExW
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
GetModuleHandleExW
AreFileApisANSI
GetSystemTimeAsFileTime
GetCommandLineA
GetSystemInfo
VirtualAlloc
VirtualQuery
ExitThread
HeapQueryInformation
SetStdHandle
GetFileType
GetConsoleCP
SearchPathA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
GetStdHandle
GetUserDefaultLCID
SetFilePointerEx
ReadConsoleW
GetTimeZoneInformation
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetDriveTypeW
GetStringTypeW
LCMapStringW
IsValidLocale
EnumSystemLocalesW
WriteConsoleW
OutputDebugStringW
GetCurrentDirectoryW
CreateFileW
SetEnvironmentVariableA
GetProfileIntA
GetTickCount
SetConsoleMode
ReadConsoleInputA
lstrlenA
IsValidCodePage
VirtualProtect
GetTempFileNameA
GetFileTime
GetFileSizeEx
GetFileAttributesExA
GetCPInfo
GetOEMCP
GetFileAttributesA
VerifyVersionInfoA
lstrcpyA
VerSetConditionMask
GetACP
lstrcmpiA
DuplicateHandle
UnlockFile
SetFilePointer
SetEndOfFile
LockFile
GetFullPathNameA
GetFileSize
FlushFileBuffers
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
GlobalFlags
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
SetErrorMode
FileTimeToSystemTime
FindNextFileA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetSystemDirectoryW
EncodePointer
InitializeCriticalSectionAndSpinCount
FindResourceA
LoadLibraryW
GetModuleFileNameW
FreeResource
OutputDebugStringA
ResumeThread
SetThreadPriority
GlobalAddAtomA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetModuleHandleW
CompareStringA
lstrcmpA
GlobalDeleteAtom
LoadLibraryExW
GetCurrentThreadId
GetCurrentThread
CopyFileA
FormatMessageA
MulDiv
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
SetLastError
GetCurrentProcessId
MultiByteToWideChar
CreatePipe
GetStartupInfoA
FindNextVolumeA
GetDiskFreeSpaceExA
FindFirstVolumeA
GetVolumePathNamesForVolumeNameA
CreateProcessA
SetVolumeMountPointA
GetVolumeInformationA
GetDriveTypeA
GetLogicalDrives
WaitForSingleObject
SetFirmwareEnvironmentVariableA
FindVolumeClose
SetVolumeLabelA
ExitProcess
DeleteCriticalSection
DecodePointer
LockResource
EnterCriticalSection
HeapSize
RaiseException
InitializeCriticalSectionEx
LeaveCriticalSection
SizeofResource
GetFirmwareEnvironmentVariableA
WideCharToMultiByte
GetProcessHeap
HeapFree
DeleteVolumeMountPointA
HeapAlloc
LoadResource
FindResourceW
HeapReAlloc
SetCurrentDirectoryA
GetSystemPowerStatus
GetSystemFirmwareTable
CreateNamedPipeA
WriteFile
ReadFile
LocalFree
CreateThread
GetWindowsDirectoryA
GetSystemDirectoryA
CreateFileA
DeviceIoControl
CloseHandle
SetConsoleCtrlHandler
GetTempPathA
LoadLibraryA
SetThreadExecutionState
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
FreeLibrary
GetVersionExA
GetCurrentProcess
CreateMutexA
GetLastError
DeleteFileA
CreateDirectoryA
GetCurrentDirectoryA
Sleep
GetConsoleMode

user32

GetWindowRgn
GetUpdateRect
IsClipboardFormatAvailable
TranslateMDISysAccel
DefMDIChildProcA
DefFrameProcA
DrawMenuBar
FrameRect
CharUpperBuffA
MapVirtualKeyExA
IsCharLowerA
PostThreadMessageA
GetComboBoxInfo
RegisterClipboardFormatA
ModifyMenuA
SetMenuDefaultItem
CopyIcon
GetDoubleClickTime
SetClassLongA
LockWindowUpdate
SetParent
SetRect
SetCursorPos
GetSystemMenu
LoadMenuW
IsZoomed
TrackMouseEvent
CopyAcceleratorTableA
DestroyAcceleratorTable
CreateAcceleratorTableA
LoadAcceleratorsW
ToAsciiEx
GetKeyboardState
GetKeyboardLayout
NotifyWinEvent
InvertRect
HideCaret
GetMenuDefaultItem
ReuseDDElParam
UnpackDDElParam
InsertMenuItemA
CreatePopupMenu
LoadMenuA
TranslateAcceleratorA
LoadAcceleratorsA
BringWindowToTop
GetMenuItemInfoA
MonitorFromPoint
EnableScrollBar
DestroyMenu
GetAsyncKeyState
UpdateLayeredWindow
IsMenu
UnionRect
SetWindowRgn
DrawFrameControl
DrawEdge
LoadImageW
DrawStateA
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
EnumDisplayMonitors
SetLayeredWindowAttributes
IntersectRect
CharUpperA
LoadCursorW
WaitMessage
DeleteMenu
RealChildWindowFromPoint
GetSysColorBrush
IsDialogMessageA
SetWindowTextA
CheckDlgButton
GetDlgItemTextA
MoveWindow
ShowWindow
GetMonitorInfoA
DestroyCursor
WinHelpA
GetScrollInfo
SetScrollInfo
UnhookWindowsHookEx
GetWindow
GetTopWindow
GetClassNameA
GetClassLongA
SetWindowLongA
EqualRect
MapWindowPoints
AdjustWindowRectEx
GetWindowRect
GetWindowTextLengthA
GetWindowTextA
RemovePropA
GetPropA
SetPropA
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
SetForegroundWindow
GetForegroundWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
SetFocus
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
IsChild
GetClassInfoExA
GetClassInfoA
RegisterClassA
CallWindowProcA
GetMessageTime
GetMessagePos
RegisterWindowMessageA
GetIconInfo
DrawIconEx
CopyImage
LoadImageA
DestroyIcon
LoadIconA
PtInRect
IsRectEmpty
OffsetRect
InflateRect
SetRectEmpty
DrawFocusRect
MessageBoxA
wsprintfA
ExitWindowsEx
SystemParametersInfoA
BlockInput
WindowFromPoint
InvalidateRect
ReleaseCapture
SetCapture
GetNextDlgGroupItem
FillRect
GetSysColor
ScreenToClient
ClientToScreen
EndPaint
BeginPaint
GetWindowDC
TabbedTextOutA
GrayStringA
DrawTextExA
DrawTextA
SendDlgItemMessageA
CopyRect
ReleaseDC
GetDC
MapVirtualKeyA
GetKeyNameTextA
SetActiveWindow
GetNextDlgTabItem
GetDlgItem
EndDialog
CreateDialogIndirectParamA
DestroyWindow
MapDialogRect
CreateMenu
MonitorFromWindow
SubtractRect
GetMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA
RegisterClassExA
CreateWindowExA
UnregisterClassA
LoadCursorA
EnableWindow
UpdateWindow
GetSystemMetrics
PostMessageA
GetDesktopWindow
RedrawWindow
PeekMessageA
LoadIconW
SendMessageA
GetClientRect
DrawIcon
KillTimer
IsIconic
PostQuitMessage
SetTimer
SetCursor
IsWindowEnabled
GetWindowLongA
GetParent
GetWindowThreadProcessId
GetLastActivePopup
GetMenuStringA
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuA
AppendMenuA
RemoveMenu
GetFocus
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoA
LoadBitmapW
ShowOwnedPopups
IsWindowVisible
GetActiveWindow
GetKeyState
ValidateRect
GetCursorPos
SetWindowsHookExA
CallNextHookEx
IsWindow
MessageBeep

gdi32

GetTextMetricsA
CombineRgn
SetRectRgn
DPtoLP
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesA
GetTextCharsetInfo
RealizePalette
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetBkColor
GetTextColor
CreatePolygonRgn
Polygon
Polyline
Rectangle
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
CreateRoundRectRgn
GetRgnBox
OffsetRgn
CreateFontIndirectA
EnumFontFamiliesExA
RoundRect
ExtFloodFill
SetPaletteEntries
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
GetWindowOrgEx
LPtoDP
GetViewportOrgEx
SetPixelV
GetTextFaceA
MoveToEx
GetObjectA
GetTextExtentPoint32A
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
ExtTextOutA
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateCompatibleDC
BitBlt
PatBlt
CreateRectRgnIndirect
CreateBitmap
GetDeviceCaps
CreateDCA
CopyMetaFileA
CreateFontA
DeleteDC
SetTextAlign
SetTextColor
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetBkMode
SetBkColor
SelectPalette
SelectObject
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
DeleteObject
CreateSolidBrush
TextOutA

msimg32

TransparentBlt
AlphaBlend

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegSetValueExA
RegEnumKeyExA
RegEnumValueA
RegQueryValueA
RegEnumKeyA
RegDeleteValueA
RegDeleteKeyA
RegQueryValueExA
CloseServiceHandle
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
StartServiceA
OpenServiceA
OpenSCManagerA
DeleteService
CreateServiceA
ControlService

comctl32

InitCommonControlsEx

shlwapi

PathRemoveFileSpecW
PathStripToRootA
PathIsUNCA
PathFindFileNameA
PathFindExtensionA
StrFormatKBSizeA

uxtheme

GetThemePartSize
GetWindowTheme
DrawThemeText
DrawThemeParentBackground
OpenThemeData
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
IsAppThemed

ole32

OleLockRunning
DoDragDrop
CreateStreamOnHGlobal
CoDisconnectObject
CoInitialize
CoCreateGuid
ReleaseStgMedium
CoTaskMemFree
CoTaskMemAlloc
CoInitializeEx
CoInitializeSecurity
CoUninitialize
CoSetProxyBlanket
CoCreateInstance
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleDuplicateData
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard

oleaut32

VariantInit
SafeArrayGetElement
SafeArrayPutElement
SysFreeString
SysAllocStringByteLen
SysAllocStringLen
VariantChangeType
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayCreate
VariantCopy
VarBstrFromDate
LoadTypeLi
SafeArrayDestroy
VariantClear
SysAllocString

gdiplus

GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipDrawImageRectI

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmGetContext
ImmGetOpenStatus
ImmReleaseContext

winmm

PlaySoundA

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 351KB - Virtual size: 351KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 217KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 142KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1361c0bb503fa117d44d4a59720bab46

Headers

DLL Characteristics

File Characteristics

Imports

shell32

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

comctl32

shlwapi

uxtheme

ole32

oleaut32

gdiplus

oleacc

imm32

winmm

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 351KB - Virtual size: 351KB

.data Size: 28KB - Virtual size: 113KB

.rsrc Size: 217KB - Virtual size: 216KB

.reloc Size: 142KB - Virtual size: 142KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 351KB - Virtual size: 351KB

.data
Size: 28KB - Virtual size: 113KB

.rsrc
Size: 217KB - Virtual size: 216KB

.reloc
Size: 142KB - Virtual size: 142KB