cd89a9bc0394625fabe3daabdd06ea99

Sharing

Copy URL Twitter E-mail

General

Target

cd89a9bc0394625fabe3daabdd06ea99
Size

1.3MB
MD5

cd89a9bc0394625fabe3daabdd06ea99
SHA1

6b4622a86dfdcc7d1601906090f9691d1223892f
SHA256

0a3de84e2725951ff214953a73f707990bbc17ed0a5cb5295e7d0637cf0e6ec6
SHA512

a287a7918446f3c6d76b44645228b3941eda4b8d956b9084de6fb9fa36644bf015a6166f502706470146434b295db229d30e813fde3528ee55c3a054a2abd1ef
SSDEEP

24576:5EGjZsA0avjfDrzHhuKpGZuuUs2gH9UEyC78f76+CyMAK0eQiUMB80eQiUMBOK:5DjZsDavjffAK8ZhxeEjmm+xMPyiUMB+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cd89a9bc0394625fabe3daabdd06ea99

Files

cd89a9bc0394625fabe3daabdd06ea99
.exe windows:4 windows x86 arch:x86

9834b0b15ed9e4adbdfcfff59bb7486c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\cocds\kisengine_git2\product\win32\dbginfo\kinstuiofficial.pdb

Imports

kernel32

FileTimeToLocalFileTime
GetUserDefaultLangID
GetComputerNameA
GetDiskFreeSpaceExW
GlobalMemoryStatusEx
DeviceIoControl
CreateFileA
LoadLibraryA
GetCurrentProcessId
ExpandEnvironmentStringsW
GetTempPathW
CreateProcessW
SetUnhandledExceptionFilter
CreateEventW
CreateThread
SetEvent
MoveFileW
GetLogicalDriveStringsW
QueryDosDeviceW
lstrcpyW
lstrcatW
GetDriveTypeW
SetCurrentDirectoryW
OutputDebugStringW
FlushFileBuffers
GetCurrentDirectoryA
GetFullPathNameA
FindFirstFileA
GetDriveTypeA
MoveFileExW
GetVolumeInformationW
ExpandEnvironmentStringsA
FormatMessageA
GetSystemDirectoryA
SleepEx
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
CreateFileMappingW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
FileTimeToSystemTime
QueryPerformanceCounter
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
ExitProcess
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
HeapCreate
GetCPInfo
LCMapStringW
LCMapStringA
RtlUnwind
GetStartupInfoW
VirtualQuery
GetModuleHandleA
VirtualProtect
GetSystemTimeAsFileTime
ExitThread
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
GetCurrentDirectoryW
GetSystemInfo
InterlockedCompareExchange
LockResource
FreeLibrary
GetLastError
GetPrivateProfileIntW
GetProcAddress
lstrcmpiW
LoadLibraryW
lstrlenA
GetLocalTime
LocalFree
LocalAlloc
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetSystemDirectoryW
RemoveDirectoryW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
GetTickCount
GetFileAttributesW
SetEndOfFile
WriteFile
CreateDirectoryW
SetFilePointer
Sleep
GetCurrentThread
SetThreadPriority
TerminateThread
WaitForSingleObject
WideCharToMultiByte
FreeResource
lstrlenW
ReadFile
InterlockedDecrement
RaiseException
MultiByteToWideChar
FlushInstructionCache
CreateFileW
InterlockedIncrement
GetCurrentProcess
UnmapViewOfFile
CloseHandle
MapViewOfFileEx
GetUserDefaultLCID
FindResourceExW
GetFileSize
GetWindowsDirectoryW
GlobalAlloc
GetVersionExW
GlobalLock
LeaveCriticalSection
LoadLibraryExW
SetLastError
EnterCriticalSection
GetModuleFileNameW
FindResourceW
DeleteCriticalSection
LoadResource
InterlockedExchange
GetCurrentThreadId
GlobalFree
InitializeCriticalSection
SizeofResource
GetModuleHandleW
GlobalUnlock
GetPrivateProfileStringW
GetStringTypeW

user32

EnableWindow
GetWindowThreadProcessId
SetWindowTextW
IntersectRect
KillTimer
GetCursorPos
IsRectEmpty
EnumDisplaySettingsW
EnumDisplayDevicesW
GetSystemMetrics
UnregisterClassA
DrawIconEx
SetCapture
SetWindowLongW
SystemParametersInfoW
GetParent
SetWindowPos
GetWindow
ReleaseCapture
RegisterWindowMessageW
AttachThreadInput
PostThreadMessageW
GetWindowRect
GetClassInfoExW
ScreenToClient
GetDlgCtrlID
GetWindowLongW
InvalidateRect
CharNextW
GetClientRect
ShowWindow
PostMessageW
MapWindowPoints
SetActiveWindow
MoveWindow
GetKeyState
SetRectEmpty
UpdateLayeredWindow
IsChild
WindowFromPoint
LoadIconW
GetScrollPos
DefWindowProcW
PtInRect
DrawTextW
IsDialogMessageW
CreateWindowExW
DestroyIcon
SendMessageW
RegisterClassExW
InflateRect
PeekMessageW
SetFocus
IsWindow
BeginPaint
SetRect
GetMessageW
TranslateMessage
FindWindowW
OffsetRect
DispatchMessageW
EndPaint
EqualRect
LoadImageW
SetCursor
GetNextDlgTabItem
LoadBitmapW
DestroyWindow
LoadCursorW
CallWindowProcW
MonitorFromWindow
GetActiveWindow
GetDlgItem
GetDC
GetMonitorInfoW
GetDesktopWindow
CopyRect
ReleaseDC
IsWindowVisible
IsWindowEnabled
FindWindowExW
UpdateWindow
BringWindowToTop
EnumDisplayDevicesA
ClientToScreen
GetWindowTextW
SetTimer
GetWindowTextLengthW
GetFocus
GetForegroundWindow
SetWindowRgn
SetForegroundWindow

gdi32

GetViewportOrgEx
SetViewportOrgEx
ExtTextOutW
DeleteObject
SetBkColor
CreateFontIndirectW
SaveDC
SelectObject
SelectClipRgn
CreateRectRgnIndirect
SetBkMode
GetObjectW
BitBlt
TextOutW
CreateCompatibleBitmap
CreateBitmap
GetStockObject
StretchBlt
ExtSelectClipRgn
CreateDIBSection
CreateCompatibleDC
GetTextExtentPoint32W
RestoreDC
DeleteDC
GetTextColor
RoundRect
MoveToEx
GetClipRgn
LineTo
Rectangle
CreatePen
CombineRgn
CreateRectRgn
GetDeviceCaps
GetCurrentObject
RectInRegion
SetStretchBltMode
OffsetRgn
GetTextMetricsW
CreateRoundRectRgn
SetTextColor
CreateFontW

advapi32

DuplicateTokenEx
RegOpenKeyExA
OpenProcessToken
RegOpenKeyW
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegQueryValueExA
RegEnumKeyExA

shell32

SHGetMalloc
ShellExecuteW
SHGetSpecialFolderPathW
Shell_NotifyIconW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetFolderPathW

ole32

CoSetProxyBlanket
CoInitializeEx
CoUninitialize
CoTaskMemAlloc
CoInitializeSecurity
CoTaskMemFree
CoTaskMemRealloc
CreateStreamOnHGlobal
CoCreateInstance
CoCreateGuid

oleaut32

VarUI4FromStr
SafeArrayUnlock
SafeArrayLock
SysStringLen
VariantClear
VariantInit
SysAllocString
SysFreeString

shlwapi

StrToIntA
PathFileExistsW
PathAddBackslashW
StrToIntW
PathRemoveFileSpecW
PathFindFileNameW
PathAppendW

comctl32

_TrackMouseEvent
InitCommonControlsEx

msimg32

AlphaBlend

gdiplus

GdipSetPenDashStyle
GdipDrawRectangleI
GdipDrawLine
GdipCreateBitmapFromStream
GdipCreateFont
GdipSetPenMode
GdipSetPenStartCap
GdipSetPenEndCap
GdipSetCompositingQuality
GdipSetPixelOffsetMode
GdipGetFamily
GdipAddPathStringI
GdipGetFontSize
GdipFillPath
GdipDrawImageI
GdipDrawPath
GdipAddPathArcI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromHBITMAP
GdipMeasureString
GdipAddPathRectangleI
GdipDrawImageRectRect
GdipCreateFontFromLogfontW
GdipCreateHBITMAPFromBitmap
GdipFillRectangleI
GdipSetStringFormatLineAlign
GdipAddPathPieI
GdipGetImageWidth
GdipSetStringFormatFlags
GdipDrawImagePointsRectI
GdipCloneBrush
GdipGetImageHeight
GdipSetStringFormatTrimming
GdipSetClipPath
GdipDeleteBrush
GdipClosePathFigure
GdipSetInterpolationMode
GdipFree
GdipCreateBitmapFromScan0
GdipDeleteFontFamily
GdipDeletePath
GdipGetImagePixelFormat
GdipCreatePath
GdipCreateSolidFill
GdipDeleteFont
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawLinesI
GdipNewPrivateFontCollection
GdipLoadImageFromFile
GdipCreateFromHDC
GdipDeletePrivateFontCollection
GdipGraphicsClear
GdipCloneImage
GdipDrawImageRectI
GdipPrivateAddFontFile
GdipDrawString
GdipTranslateWorldTransform
GdipCreateLineBrushI
GdiplusStartup
GdipSetSmoothingMode
GdipGetFontCollectionFamilyCount
GdipRotateWorldTransform
GdipCloneBitmapArea
GdipSetTextRenderingHint
GdipDisposeImage
GdipCreateImageAttributes
GdipAlloc
GdipResetWorldTransform
GdipDisposeImageAttributes
GdiplusShutdown
GdipDrawImageRectRectI
GdipCreateStringFormat
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipSetImageAttributesColorMatrix
GdipDeleteStringFormat
GdipLoadImageFromStream
GdipDeletePen
GdipImageRotateFlip
GdipSetStringFormatAlign
GdipCreatePen1
GdipFillRectangle

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

iphlpapi

GetAdaptersInfo

psapi

GetProcessImageFileNameW
GetModuleFileNameExW

Sections

.text
Size: 664KB - Virtual size: 662KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 536KB - Virtual size: 532KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9834b0b15ed9e4adbdfcfff59bb7486c

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

version

iphlpapi

psapi

Sections

.text Size: 664KB - Virtual size: 662KB

.rdata Size: 136KB - Virtual size: 134KB

.data Size: 20KB - Virtual size: 34KB

.rsrc Size: 536KB - Virtual size: 532KB

.text
Size: 664KB - Virtual size: 662KB

.rdata
Size: 136KB - Virtual size: 134KB

.data
Size: 20KB - Virtual size: 34KB

.rsrc
Size: 536KB - Virtual size: 532KB