d5a7ba6406e166dc583859bdebddca764662b8fa6ebd967e70181aef231d0f0d

Sharing

Copy URL

Twitter E-mail

General

Target

d5a7ba6406e166dc583859bdebddca764662b8fa6ebd967e70181aef231d0f0d
Size

2.7MB
MD5

b08df6fcf8a6d7b7cae9fe77137476a5
SHA1

21de94d07adabcd45f68ad8461fd94b435e058cb
SHA256

d5a7ba6406e166dc583859bdebddca764662b8fa6ebd967e70181aef231d0f0d
SHA512

1b164328fee82717fd9cb0eb12ff2ee46192129b2de272f795755533a8e430d05679c34bbe7beb7634a7ed547f703dea24b98c4dc80395c7b28abfb15d9f085e
SSDEEP

49152:YlJ3+cr+d2KM8KQ8RRGVJu6kiGoMil7YQgoF9Gz4NFGov/++do:e3KMiEC9G0NFGov/++

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d5a7ba6406e166dc583859bdebddca764662b8fa6ebd967e70181aef231d0f0d

Files

d5a7ba6406e166dc583859bdebddca764662b8fa6ebd967e70181aef231d0f0d
.exe windows:6 windows x64 arch:x64

96f9c6dd6d7f5522adbe99713d391a99

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

PostQueuedCompletionStatus
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
CreateMutexW
CreateEventW
CancelWaitableTimer
WaitForMultipleObjects
GetProcessTimes
ExitProcess
GetThreadPriorityBoost
GetThreadPriority
GetProcessVersion
SetPriorityClass
GetPriorityClass
GetProcessId
GetThreadContext
FlushInstructionCache
GetThreadTimes
OpenProcess
IsProcessorFeaturePresent
GetProcessHandleCount
GetProcessPriorityBoost
SetProcessPriorityBoost
GetThreadIOPendingFlag
GetSystemInfo
SetSystemTimeAdjustment
CreateFileMappingW
FlushViewOfFile
SetProcessWorkingSetSize
GetWriteWatch
ResetWriteWatch
CreateMemoryResourceNotification
IsProcessInJob
AssignProcessToJobObject
SetInformationJobObject
DisableThreadLibraryCalls
FreeResource
GetModuleFileNameA
GetModuleFileNameW
LockResource
GlobalSize
GlobalUnlock
GlobalCompact
GlobalUnfix
GlobalUnWire
LocalUnlock
LocalShrink
LocalCompact
GetProcessAffinityMask
GetProcessIoCounters
ConvertFiberToThread
CreateFiberEx
CreateFiber
ConvertThreadToFiber
PulseEvent
GlobalDeleteAtom
InitAtomTable
DeleteAtom
SetHandleCount
SetMessageWaitingIndicator
ClearCommBreak
ClearCommError
EscapeCommFunction
GetCommMask
GetCommModemStatus
GetCommTimeouts
TransmitCommChar
PrepareTape
EraseTape
CreateTapePartition
GetTapeStatus
EncodeSystemPointer
GetMailslotInfo
SetMailslotInfo
AddAtomW
GetNamedPipeHandleStateA
MapUserPhysicalPagesScatter
CreateIoCompletionPort
CloseHandle
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
HeapReAlloc
HeapSize
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindClose
HeapFree
HeapAlloc
GetModuleHandleExW
TerminateProcess
GetCurrentProcess
WriteFile
RtlPcToFileHeader
RaiseException
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetLastError
RtlUnwindEx
GetModuleHandleW
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
DecodePointer
EncodePointer
SetFileValidData
SetFilePointer
SetEndOfFile
GetLogicalDrives
GetFileTime
GetFileType
GetFileSizeEx
GetFileInformationByHandle
GetFileAttributesExW
FlushFileBuffers
FindNextChangeNotification
GetProcessHeap
GetNamedPipeHandleStateW
GetNamedPipeInfo
PeekNamedPipe
DisconnectNamedPipe
SetLastError
SetHandleInformation
WriteConsoleW
FindFirstFileExW
CreateFileW
SetStdHandle
GetStdHandle
HeapCreate
MultiByteToWideChar
DecodeSystemPointer
MulDiv
WideCharToMultiByte

user32

DestroyWindow
SetWindowPos
CheckRadioButton
CloseClipboard
IsDialogMessageA
DestroyIcon
RedrawWindow
SetTimer
GetDlgItemTextA
TranslateAcceleratorA
OpenClipboard
IsWindow
GetActiveWindow
GetSubMenu
wsprintfA
TrackPopupMenu
DestroyCursor
GetWindowPlacement
DialogBoxParamA
CreatePopupMenu
GetSystemMetrics
EndDialog
ChildWindowFromPoint
PostMessageA
SetActiveWindow
LoadCursorA
GetMenu
GetWindowRect
DispatchMessageA
CheckMenuRadioItem
GetMessageA
GetSystemMenu
CharLowerBuffA
EnableWindow
CallWindowProcA
DestroyAcceleratorTable
SetMenuItemInfoA
IsMenu
SetWindowLongA
GetCursorPos
DefDlgProcA
InvalidateRect
InsertMenuItemA
FindWindowA
SetDlgItemInt
EnableMenuItem
GetSysColorBrush
PostQuitMessage
CheckDlgButton
KillTimer
UnregisterClassA
GetDlgItem
GetClientRect
CheckMenuItem
RemoveMenu
AppendMenuA
CharUpperA
LoadIconA
CreateDialogParamA
SetCursor
SetClipboardData
SendMessageA
SetDlgItemTextA
GetClassInfoA
SendDlgItemMessageA
GetClipboardData
TranslateMessage
SetFocus
DestroyMenu
RegisterClassA
IsDlgButtonChecked
EnumClipboardFormats
MoveWindow
GetSysColor
MessageBoxA
SetWindowTextA
wvsprintfA
SetWindowPlacement
GetWindowLongA
LoadAcceleratorsA
GetWindowTextA
EmptyClipboard
ClientToScreen

gdi32

GetObjectA
DeleteObject
CreateFontIndirectA
SetBkMode
SetTextColor
GetStockObject
SelectObject

winspool.drv

EnumPrinterDataW
GetPrinterDataExW
EnumPrintersW
ResetPrinterW
SetJobW
GetJobW
EnumJobsW
SetPrinterW
GetPrinterW
FlushPrinter
GetPrinterDataW
EnumPrinterKeyW
ConnectToPrinterDlg
SetPortW
ConfigurePortW
EnumFormsW
SetFormW
GetFormW
SetPrinterDataExW
SetPrinterDataW
EnumPrinterDataExW

comdlg32

GetSaveFileNameA
GetOpenFileNameA

advapi32

RegCloseKey
RegSetValueA
RegDeleteKeyA
RegQueryValueExA
LookupPrivilegeValueA
GetUserNameA
OpenProcessToken
RegOpenKeyExA
RegCreateKeyA
AdjustTokenPrivileges

shell32

ord6
SHBindToParent
ord176
ord75
ord47
ord88
SHGetDataFromIDListW
SHGetInstanceExplorer
ord645
ord4
ord2
SHGetDesktopFolder
SHGetPathFromIDListW
ord154
ord190
ord23
ord17
ord16
ord24
ord152
ord153
ord155
ord19
ord18
SHSetLocalizedName
SHIsFileAvailableOffline
CommandLineToArgvW
DragQueryPoint
DragAcceptFiles
FindExecutableW
ShellAboutW
ExtractAssociatedIconW
ExtractIconW
ShellExecuteExW
SHEmptyRecycleBinW
Shell_NotifyIconW
SHGetFileInfoW
SHGetDiskFreeSpaceExA
ord180

comctl32

ImageList_SetBkColor
ImageList_Destroy
ImageList_Create
CreateToolbarEx
ImageList_ReplaceIcon
InitCommonControlsEx
ImageList_Remove

userenv

GetProfilesDirectoryW
GetUserProfileDirectoryW

dxgi

CreateDXGIFactory

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 57KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 582KB - Virtual size: 581KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

96f9c6dd6d7f5522adbe99713d391a99

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

comctl32

userenv

dxgi

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 47KB - Virtual size: 47KB

.data Size: 57KB - Virtual size: 67KB

.pdata Size: 4KB - Virtual size: 4KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 582KB - Virtual size: 581KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 47KB - Virtual size: 47KB

.data
Size: 57KB - Virtual size: 67KB

.pdata
Size: 4KB - Virtual size: 4KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 582KB - Virtual size: 581KB

.reloc
Size: 2KB - Virtual size: 1KB