ardamax | cfa4251031c5c3f91c0a62f9da254492

Sharing

Copy URL

Twitter E-mail

General

Target

cfa4251031c5c3f91c0a62f9da254492
Size

456KB
MD5

cfa4251031c5c3f91c0a62f9da254492
SHA1

13615e098aecf754564879979c906cc838c17bd1
SHA256

9900c4f4c89cc55146a1e250dcfb640680833d0e3d3de71a0119cab4ab204def
SHA512

ad7cb30f03219b6b4b31c6dfeead1cdc6817337433f64f44ee78dfec4ec5433e73d7c77aa2d82e0777588428c4791a8bac9b697b5abac3882714580fdef1a1bf
SSDEEP

6144:UqH9ZWnEPlRmH9b9pnurOJTyLAFM/2iAk6WQa/bVTNnh3RAc:jZjGH9P3yAFMWW3mc

Score

10^/10

ardamax

Malware Config

Signatures

Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
sample	family_ardamax

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cfa4251031c5c3f91c0a62f9da254492

Files

cfa4251031c5c3f91c0a62f9da254492
.exe windows:4 windows x86 arch:x86

c93124bed15d2778997ddf295fee61a7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

UrlUnescapeW
StrDupW
PathRemoveExtensionW
PathStripPathW
PathRemoveFileSpecW
PathFindExtensionW
PathFindFileNameW
PathFileExistsW
StrCmpIW
StrFormatByteSizeW

ws2_32

recv
send
WSAStartup
htons
WSACleanup
getservbyname
inet_addr
gethostbyname
socket
closesocket
shutdown
select
connect

comctl32

InitCommonControlsEx
ImageList_Draw
ImageList_Create
ImageList_ReplaceIcon
CreatePropertySheetPageW
PropertySheetW
DestroyPropertySheetPage
ImageList_LoadImageW
ImageList_Destroy
ImageList_GetImageCount
_TrackMouseEvent

shell32

SHChangeNotify
ShellExecuteExW
SHFileOperationW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
Shell_NotifyIconW
ExtractIconW
DoEnvironmentSubstW
ShellExecuteW

wininet

InternetGetLastResponseInfoW
InternetCloseHandle
FtpPutFileW
FtpCreateDirectoryW
FtpRemoveDirectoryW
FtpDeleteFileW
FtpSetCurrentDirectoryW
InternetConnectW
InternetOpenW

mpr

WNetCancelConnection2W
WNetAddConnection2W

kernel32

GetStringTypeW
GetThreadLocale
IsProcessorFeaturePresent
InterlockedCompareExchange
SetEnvironmentVariableA
CompareStringA
lstrcpyW
lstrlenW
CreateFileW
lstrcmpW
DeleteFileW
SetLastError
GetModuleHandleW
GetProcAddress
lstrlenA
lstrcpyA
lstrcmpA
LoadLibraryW
GetVersion
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
CloseHandle
WriteFile
lstrcmpiW
GetDateFormatW
FindResourceExW
Sleep
VirtualAlloc
VirtualFree
GetSystemTimeAsFileTime
OpenProcess
SetProcessWorkingSetSize
GetCurrentProcess
GlobalLock
GlobalUnlock
lstrcpynW
lstrcatW
RemoveDirectoryW
CreateDirectoryW
SetFileAttributesW
CreateThread
SetThreadPriority
ResumeThread
GetLocalTime
SystemTimeToFileTime
CompareFileTime
GetModuleFileNameW
GetShortPathNameW
GetEnvironmentVariableW
SetPriorityClass
GetCurrentThread
SetProcessPriorityBoost
MoveFileExW
ExitProcess
GetCurrentProcessId
CreateMutexW
GetLastError
InitializeCriticalSection
RaiseException
FlushInstructionCache
LockResource
InterlockedIncrement
InterlockedDecrement
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
DeleteCriticalSection
CompareStringW
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
GetVersionExW
EnumResourceNamesW
LocalAlloc
LocalReAlloc
ReadFile
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
SetFilePointer
LocalFree
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
Process32FirstW
Process32NextW
GetWindowsDirectoryW
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
FormatMessageW
GetTimeZoneInformation
GetTimeFormatW
GetTickCount
OutputDebugStringW
GetComputerNameW
lstrcmpiA
CopyFileW
GetTempFileNameW
GetTempPathW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileAttributesW
MoveFileW
HeapFree
HeapAlloc
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetVersionExA
GetProcessHeap
GetStartupInfoW
HeapDestroy
HeapCreate
GetModuleHandleA
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
GetCPInfo
GetACP
GetOEMCP
GetTimeFormatA
GetDateFormatA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
RtlUnwind
InterlockedExchange
LoadLibraryA
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
VirtualQuery
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers

user32

ScrollWindow
MoveWindow
GetWindowRect
BeginPaint
EndPaint
GetDlgItem
DestroyIcon
EndDialog
RegisterWindowMessageW
GetAncestor
SendMessageTimeoutW
GetWindowTextLengthW
GetWindowTextW
SendMessageW
DdeInitializeW
DdeCreateStringHandleW
DdeConnect
DdeClientTransaction
DdeAccessData
DdeDisconnect
DdeFreeStringHandle
DdeUninitialize
GetWindowThreadProcessId
GetWindowModuleFileNameW
GetDlgCtrlID
IsWindowVisible
GetClassNameW
GetWindow
EnumWindows
SetClipboardViewer
ChangeClipboardChain
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
IsWindow
PostQuitMessage
GetCursorPos
SetForegroundWindow
FindWindowW
RegisterHotKey
UnregisterHotKey
GetDesktopWindow
GetForegroundWindow
GetWindowDC
DispatchMessageW
TranslateMessage
GetMessageW
DefWindowProcW
DrawFocusRect
SetRectEmpty
DeleteMenu
CheckMenuItem
GetSubMenu
LoadMenuW
LoadIconW
CallWindowProcW
DialogBoxParamW
InvalidateRect
SetWindowPos
GetMenu
AdjustWindowRectEx
RegisterClassExW
GetClassInfoExW
DestroyWindow
IsMenu
DestroyMenu
GetMenuItemCount
GetMenuItemInfoW
SetMenuItemInfoW
UpdateWindow
GetParent
GetClientRect
LoadStringW
CharNextW
DrawTextW
GetClassLongW
SetWindowLongW
ReleaseDC
SetCursor
LoadCursorW
GetSysColorBrush
SystemParametersInfoW
GetWindowLongW
InflateRect
DrawFrameControl
CreateWindowExW
SetDlgItemInt
ReleaseCapture
GetCapture
SetCapture
ScreenToClient
WindowFromPoint
GetMessagePos
GetKeyState
FrameRect
OffsetRect
DrawEdge
IsWindowEnabled
CharLowerW
PeekMessageW
PtInRect
GetFocus
ModifyMenuW
TrackPopupMenuEx
GetMonitorInfoW
MonitorFromPoint
MapWindowPoints
FillRect
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExW
wsprintfW
MapVirtualKeyW
GetKeyNameTextW
UnregisterClassA
CopyRect
GetSystemMetrics
GetSysColor
TrackPopupMenu
MessageBoxW
LoadImageW
PostMessageW
KillTimer
SetTimer
GetDC
GetActiveWindow
EnableWindow
SetWindowTextW
SetDlgItemTextW
GetDlgItemInt
ShowWindow
GetDlgItemTextW
SetFocus
MessageBeep

gdi32

GetObjectW
CreateFontIndirectW
DeleteObject
PatBlt
CreateDIBSection
CreateCompatibleDC
SetBkColor
BitBlt
DeleteDC
CreateCompatibleBitmap
CreatePatternBrush
SetBrushOrgEx
GetDIBits
CreatePen
RealizePalette
CreateBitmap
GetTextMetricsW
CreateRectRgnIndirect
CombineRgn
ExcludeClipRect
SetTextColor
GetStockObject
CreateSolidBrush
CreateFontW
TextOutW
Polygon
SetPolyFillMode
SetBkMode
SelectObject
GetTextExtentPoint32W

comdlg32

GetSaveFileNameW
GetOpenFileNameW

ole32

CoTaskMemFree
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoInitialize

oleaut32

VarUI4FromStr
SysFreeString

Sections

.text
Size: 353KB - Virtual size: 353KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c93124bed15d2778997ddf295fee61a7

Headers

File Characteristics

Imports

shlwapi

ws2_32

comctl32

shell32

wininet

mpr

kernel32

user32

gdi32

comdlg32

ole32

oleaut32

Sections

.text Size: 353KB - Virtual size: 353KB

.rdata Size: 62KB - Virtual size: 61KB

.data Size: 8KB - Virtual size: 19KB

.rsrc Size: 47KB - Virtual size: 47KB

.text
Size: 353KB - Virtual size: 353KB

.rdata
Size: 62KB - Virtual size: 61KB

.data
Size: 8KB - Virtual size: 19KB

.rsrc
Size: 47KB - Virtual size: 47KB