d6813a09e06308ebc6a68abc53ea4ebd

Sharing

Copy URL Twitter E-mail

General

Target

d6813a09e06308ebc6a68abc53ea4ebd
Size

166KB
MD5

d6813a09e06308ebc6a68abc53ea4ebd
SHA1

f7a33300257f99c7f3d992ab43c6473bfc318898
SHA256

eb076e8a1c0d28fd0db59f3d3ad98e8c18dcbd98bdc4777a3802ed16cabb6757
SHA512

e87ed629b88ef4d2b2c8a57a8504de15f38bc8297f0187c63a8ed3fe5a02b4c6a3bc4188abb3aaff93281c291adfd64448cac8c779976cdab5c7c79394c92d29
SSDEEP

3072:ekHJBoxwOA4N0+50oqquk0jg/vUvxcuQBhOwtdXQuBys1rush4OEVK6uOggk8bd:ekHbomyN0mBu3E3MQ12vs1r1jECjgkYd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d6813a09e06308ebc6a68abc53ea4ebd

Files

d6813a09e06308ebc6a68abc53ea4ebd
.exe windows:5 windows x86 arch:x86

b89a5df37e1ed0d348603f954d1a6fb9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

CreatePropertySheetPageW
InitCommonControls
ImageList_Create
PropertySheetW
PropertySheetA
ImageList_Destroy
ImageList_Draw

kernel32

GetCommandLineW
InterlockedDecrement
GetUserDefaultLCID
GetCPInfo
HeapDestroy
lstrlenA
IsDBCSLeadByte
FormatMessageA
OutputDebugStringW
CreateMutexW
SetStdHandle
SetEvent
CreateDirectoryW
lstrcatA
GetLastError
GetSystemTimeAsFileTime
GetVersion
GetSystemInfo
GetProcessHeap
lstrcmpiW
GetStringTypeA
GetSystemDirectoryA
VirtualQuery
LCMapStringA
QueryPerformanceCounter
OpenEventA
GetVersionExW
ExitProcess
LoadLibraryExA
GlobalLock
CreateThread
CreateProcessW
GetExitCodeThread
FormatMessageW
CompareStringA
GetComputerNameW
VirtualAlloc
GetCurrentThreadId
SetFileAttributesW
GetDriveTypeA
lstrcpynA
ReleaseSemaphore
FileTimeToLocalFileTime
WaitForMultipleObjects
GetTempPathA
ResumeThread
SetUnhandledExceptionFilter
FindResourceA
GetModuleFileNameW
MulDiv
GetLocaleInfoA
SetFilePointer
CreateProcessA
CancelIo
GetModuleHandleW
lstrcmpiA
GetLocalTime
TlsAlloc
GetCurrentProcessId
SetLastError
GetModuleFileNameA
FileTimeToSystemTime
GetCommandLineA
IsBadReadPtr
WriteConsoleW
FindFirstFileA
GetCurrentThread
HeapAlloc
FreeEnvironmentStringsA
MultiByteToWideChar
GetLocaleInfoW
GetFullPathNameW
HeapFree
GetConsoleMode
WaitForSingleObject
CreateFileA
FindNextFileA
WriteFile
GetThreadLocale
GetVersionExA
TlsGetValue
GetCurrentProcess
ReleaseMutex
ExpandEnvironmentStringsW
GlobalUnlock
GetTickCount
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
HeapCreate
GetFileAttributesA
InterlockedIncrement
CreateEventW
GetACP
GetSystemTime
TlsFree
SetHandleCount
TlsSetValue
CreateEventA
InterlockedExchange
EnterCriticalSection
CreateDirectoryA
MapViewOfFile
LocalAlloc
VirtualFree
SetFileAttributesA
SetEndOfFile
FindResourceW
FreeEnvironmentStringsW
GetEnvironmentStrings
ResetEvent
UnhandledExceptionFilter
IsDebuggerPresent
Sleep
UnmapViewOfFile
SizeofResource
SetThreadPriority
WideCharToMultiByte
InterlockedCompareExchange
DeleteFileA
CloseHandle
GetDriveTypeW
CreateFileMappingA
GetModuleHandleA

user32

MsgWaitForMultipleObjects
IsRectEmpty
MapWindowPoints
CallNextHookEx
BeginPaint
GetWindowDC
RegisterWindowMessageW
DispatchMessageA
RedrawWindow
FindWindowA
CreatePopupMenu
SetWindowLongW
GetSysColorBrush
IsWindow
OffsetRect
EnableMenuItem
CharNextA
GetDC
RegisterClassW
SendDlgItemMessageA
CallWindowProcA
CallWindowProcW
DestroyMenu
DrawTextA
ReleaseCapture
GetSubMenu
GetCapture
LoadCursorW
CheckDlgButton
PostMessageW
GetForegroundWindow
DrawFocusRect
RegisterClipboardFormatW
PeekMessageW
LoadBitmapW

ntdll

RtlCreateTimer
NtDeleteKey
_wcslwr
RtlOpenCurrentUser
RtlLengthSecurityDescriptor
NtCancelIoFile
NtUnmapViewOfSection
NtQueryKey
RtlInitAnsiString
RtlReleaseResource
RtlGetSaclSecurityDescriptor
VerSetConditionMask
_snwprintf
RtlAddAccessAllowedAce
NtDelayExecution
NtQueryDirectoryFile
NtWriteFile
RtlQueryEnvironmentVariable_U
RtlDestroyEnvironment
RtlUpcaseUnicodeStringToOemString
RtlLengthRequiredSid
RtlxUnicodeStringToAnsiSize
RtlInitializeCriticalSectionAndSpinCount
RtlQueueWorkItem
RtlUnwind
atoi
NtQueryPerformanceCounter
NtFsControlFile
RtlUnicodeToMultiByteN
NtDeleteValueKey
RtlIntegerToUnicodeString
NtSetInformationProcess
RtlGetNtProductType
RtlConvertSidToUnicodeString
RtlxOemStringToUnicodeSize
_strnicmp
RtlOemStringToUnicodeString
RtlNewSecurityObject
strrchr
_wcsnicmp
_allmul
NtQueryAttributesFile
RtlCopyUnicodeString
RtlAllocateAndInitializeSid
sprintf
wcsncmp
wcscat
RtlCreateSecurityDescriptor
RtlAddAce
RtlInitializeResource
RtlRunEncodeUnicodeString
RtlLeaveCriticalSection
NtCreateKey
_chkstk
RtlDetermineDosPathNameType_U
NtWaitForSingleObject
RtlMultiByteToUnicodeN
swprintf
NtQueryVirtualMemory
RtlEqualSid
RtlValidRelativeSecurityDescriptor
RtlAppendUnicodeToString
RtlCompareUnicodeString
NtOpenDirectoryObject
NtDuplicateObject
RtlExpandEnvironmentStrings_U
NtOpenSymbolicLinkObject
RtlInitString
RtlAcquireResourceExclusive
RtlxUnicodeStringToOemSize
_stricmp
wcscmp
NtSetSecurityObject
RtlAcquireResourceShared
RtlDeleteResource
RtlWriteRegistryValue
NtQuerySecurityObject
wcscpy
RtlCopySid
NtAllocateLocallyUniqueId
_vsnprintf
NtEnumerateKey
NtSetEvent
DbgPrint
NtWaitForMultipleObjects
NtSetValueKey
RtlInitUnicodeString
DbgBreakPoint
NtFreeVirtualMemory
NtOpenKey
wcslen
RtlSetEnvironmentVariable
RtlGetAce
RtlGetFullPathName_U
RtlCreateUserThread
RtlSetSaclSecurityDescriptor
RtlStringFromGUID
RtlDosPathNameToNtPathName_U
RtlInitializeGenericTable
RtlFreeUnicodeString
wcstol
RtlCopyLuid
NtAdjustPrivilegesToken
RtlImageNtHeader
RtlGetDaclSecurityDescriptor
NtQueryDirectoryObject
NtAllocateVirtualMemory
RtlFreeSid
memmove
strncpy
RtlGetOwnerSecurityDescriptor
RtlDeleteSecurityObject
RtlCreateTimerQueue
RtlAllocateHeap
NtImpersonateAnonymousToken
NtQueryInformationFile
RtlFreeHeap
RtlAppendUnicodeStringToString
NtEnumerateValueKey
NtMapViewOfSection
wcschr
RtlUpcaseUnicodeString
RtlRegisterWait
RtlSizeHeap
RtlAnsiStringToUnicodeString
NtQueryInformationProcess
RtlAdjustPrivilege

ole32

CLSIDFromProgID
CreateItemMoniker
CoCreateFreeThreadedMarshaler
CreateOleAdviseHolder
OleUninitialize
GetRunningObjectTable
ProgIDFromCLSID
PropVariantClear
CoRevertToSelf
PropVariantCopy
CoMarshalInterThreadInterfaceInStream
OleLoadFromStream
WriteClassStm
CoGetInterfaceAndReleaseStream
ReleaseStgMedium
CoUnmarshalInterface
GetHGlobalFromStream
StringFromGUID2
StgIsStorageFile
CoTaskMemRealloc
CoCreateInstance
CreateILockBytesOnHGlobal
CoImpersonateClient
OleRegGetUserType
CoInitializeSecurity
CreateStreamOnHGlobal
CoInitializeEx
CoInitialize
CoGetObjectContext
CoTaskMemFree
StgCreateDocfileOnILockBytes
OleInitialize
StringFromIID
CoRevokeClassObject
CreateDataAdviseHolder
CoRegisterClassObject
CoMarshalInterface
OleSaveToStream
CLSIDFromString
CoUninitialize
CoGetMalloc
CoDisconnectObject
OleRegGetMiscStatus
CoFreeUnusedLibraries
CoSetProxyBlanket
CoGetClassObject
IIDFromString
StgOpenStorage
OleRegEnumVerbs
CoReleaseMarshalData
OleRun
StgCreateDocfile
StringFromCLSID
CreateBindCtx

msvcrt

fwrite
toupper
wcscpy
__set_app_type
memmove
swprintf
_access
isxdigit
wcsspn
_errno
strncmp
_adjust_fdiv
srand
_ltoa
atoi
__p__iob
_initterm
sprintf
iswctype
wcsncmp
mbstowcs
fflush
_write
exit
__dllonexit
_chsize
_vsnwprintf
_rotl
malloc
_itow
ceil
_purecall
__p__osver
_fileno
_strlwr
wcslen
_ultow
fopen
_wtol
_wcsupr
_vsnprintf
_ltow
isleadbyte
calloc
__pioinfo
fprintf
wcsstr
_isatty
iswdigit
_CIsqrt
isspace
_iob
rand
wcscspn
??0exception@@QAE@ABV0@@Z
__initenv
strtok
wcsncpy
wcstoul
_strdup
bsearch
floor
_ftol
_strnicmp
_lseeki64
strncpy
_stat
_tell
wcspbrk

shell32

SHGetFolderPathW
SHBrowseForFolderA
DragQueryFileA
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
ShellExecuteExW
SHBindToParent
SHGetPathFromIDListW
SHGetPathFromIDListA
SHGetMalloc
SHChangeNotify
SHGetFileInfoW
CommandLineToArgvW
SHGetDesktopFolder
ShellExecuteA
DragQueryFileW
ShellExecuteW
SHBrowseForFolderW
SHFileOperationW

shlwapi

StrCpyNW
PathFindFileNameA
UrlUnescapeW
PathIsRootW
SHStrDupW
StrToIntW
wnsprintfA
UrlCanonicalizeW
SHDeleteValueW
StrCatW
StrCmpW
StrCmpNW
SHDeleteKeyW
PathCreateFromUrlW
PathSkipRootW
PathAppendA
SHGetValueW
SHSetValueW
StrCmpNIA
AssocQueryStringW
PathIsUNCW
PathRemoveBackslashW
PathIsDirectoryW
wnsprintfW
SHDeleteKeyA
UrlIsW
SHRegGetBoolUSValueW
PathRemoveExtensionW
PathRemoveFileSpecW
PathFileExistsW
PathStripToRootA
StrStrIA
PathRemoveFileSpecA
PathAddBackslashW
PathIsURLW
SHDeleteValueA

comdlg32

ChooseColorA
GetOpenFileNameW
GetOpenFileNameA
PrintDlgW
PageSetupDlgW
GetSaveFileNameW
ChooseFontA
FindTextW
CommDlgExtendedError
PrintDlgA
FindTextA
GetSaveFileNameA
GetFileTitleA
PrintDlgExW
ChooseColorW
GetFileTitleW
ChooseFontW
PageSetupDlgA

advapi32

RegisterTraceGuidsW
SetThreadToken
OpenServiceA
OpenSCManagerA
GetUserNameA
LockServiceDatabase
RegFlushKey
RegQueryInfoKeyW
RegEnumKeyExW
LookupAccountNameW
CryptDestroyKey
LsaOpenPolicy
CopySid
RegEnumKeyExA
GetSecurityDescriptorOwner
RegDeleteValueA
OpenServiceW
GetTokenInformation
RegOpenKeyExA
MakeSelfRelativeSD
DeregisterEventSource
IsValidSid
ReportEventW
RegConnectRegistryW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSidLengthRequired
SetEntriesInAclW
GetUserNameW
OpenSCManagerW
RegSetValueExW
GetLengthSid
ConvertStringSidToSidW
GetAce
OpenProcessToken
UnregisterTraceGuids
ControlService
RegQueryInfoKeyA
RegEnumValueA
RegOpenKeyExW
LsaClose
GetAclInformation
LookupPrivilegeValueW
LookupAccountSidW
AllocateAndInitializeSid
AddAce
RegDeleteValueW
EqualSid
LookupPrivilegeValueA
SetSecurityDescriptorDacl
CryptGenRandom
ChangeServiceConfigW
RegEnumKeyW
GetSidIdentifierAuthority
RegSetValueA
RegOpenKeyA
SetSecurityDescriptorGroup
CloseServiceHandle
SetNamedSecurityInfoW
RegCreateKeyExW
AddAccessAllowedAce
DeleteService

oleaut32

SysAllocStringLen
SafeArrayGetUBound
SafeArrayPutElement
CreateErrorInfo
VariantCopy
VariantChangeType
SafeArrayGetElement
VariantCopyInd

Sections

.tls
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 159KB - Virtual size: 158KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 490B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b89a5df37e1ed0d348603f954d1a6fb9

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

kernel32

user32

ntdll

ole32

msvcrt

shell32

shlwapi

comdlg32

advapi32

oleaut32

Sections

.tls Size: 2KB - Virtual size: 2KB

.text Size: 159KB - Virtual size: 158KB

DATA Size: 1KB - Virtual size: 1KB

.tls Size: 512B - Virtual size: 102KB

.tls Size: 512B - Virtual size: 490B

.rsrc Size: 512B - Virtual size: 492B

.tls
Size: 2KB - Virtual size: 2KB

.text
Size: 159KB - Virtual size: 158KB

DATA
Size: 1KB - Virtual size: 1KB

.tls
Size: 512B - Virtual size: 102KB

.tls
Size: 512B - Virtual size: 490B

.rsrc
Size: 512B - Virtual size: 492B