Ezel2[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Ezel2.exe
Size

2.6MB
MD5

82e46b27032b65e7eb36aa86a9f9be3d
SHA1

77edcd30d866b090922c16dd25dc7099e9fe38a9
SHA256

163354c7fad9853511db23571b4f665e9ba49c2f8c293551115ceddc0930e7ff
SHA512

8fb3c12ec274c1ddd8eecc3925b2e4b7ae60bf8821ef5e4b51a0a7f40960189f3d297669c1ae2741ea20e12c2e54c65fdfeba83c33b3b02ecadb610db4dc2d32
SSDEEP

49152:SuiHuhn/0NQLo36ZTRTE23yw6GZenQFX6ihk6JAy:P5hn/3o36sw6GOiG6+y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Ezel2.exe

Files

Ezel2.exe
.exe windows:5 windows x86 arch:x86

ae25595236a5a776976fc8be65d0d576

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

s:\PROJECT\metin2\mainline\Srcs\Tools\TorrentPatch\bin\TorrentPatch_x86_MT_VC90.pdb

Imports

kernel32

GetCurrentProcessId
GetEnvironmentVariableW
GetCPInfo
IsValidCodePage
SetEnvironmentVariableW
GetFileType
GetFileAttributesW
GetWindowsDirectoryW
FindNextFileW
RaiseException
CreateThread
GetThreadLocale
GetCommandLineW
SetErrorMode
SetLastError
LocalAlloc
HeapSize
GetProcessHeap
InterlockedExchange
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
CreateDirectoryW
HeapAlloc
HeapFree
GetFileAttributesA
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
RtlUnwind
HeapReAlloc
ExitThread
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetDriveTypeA
GetFullPathNameA
GetFullPathNameW
MoveFileW
MoveFileA
RemoveDirectoryW
WriteConsoleW
LCMapStringA
LCMapStringW
GetModuleFileNameA
GetCurrentThread
SetHandleCount
VirtualFree
VirtualAlloc
HeapCreate
GetOEMCP
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
GetTimeFormatA
GetDateFormatA
GetLocaleInfoA
EnumSystemLocalesA
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
GetCurrentDirectoryA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
CompareStringA
CreateFileMappingW
FormatMessageA
lstrcpyA
GetSystemTime
SetThreadAffinityMask
GetTimeZoneInformation
OutputDebugStringW
GetStdHandle
GetTempFileNameW
FindFirstFileW
FindClose
GetTempPathW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
GetACP
ExitProcess
GetExitCodeThread
GetCurrentProcess
GetProcessAffinityMask
TlsAlloc
TlsSetValue
TlsFree
TlsGetValue
ResumeThread
TerminateThread
SetThreadPriority
InterlockedDecrement
InterlockedIncrement
ReleaseSemaphore
CreateSemaphoreW
LoadLibraryW
GetCurrentThreadId
CreateFileA
ReadFile
SetFilePointer
UnmapViewOfFile
GetSystemInfo
CreateFileMappingA
OutputDebugStringA
MapViewOfFile
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateEventW
WaitForSingleObject
SetEvent
GetModuleHandleW
CopyFileW
DeleteFileW
WriteFile
DeleteFileA
GetTickCount
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
LocalFree
FormatMessageW
CreateProcessW
SetFileTime
TerminateProcess
OpenProcess
FreeLibrary
GetProcAddress
LoadLibraryA
GetVersionExW
GetFileSize
GetCurrentDirectoryW
GlobalFree
GlobalAlloc
GlobalUnlock
GlobalLock
GetFileTime
GetFileSizeEx
CreateFileW
SetCurrentDirectoryW
GetModuleFileNameW
Sleep
OpenMutexW
ReleaseMutex
CloseHandle
GetLastError
ExpandEnvironmentStringsW
CreateMutexW

user32

DrawFrameControl
DrawIconEx
GetClassNameW
GetWindowTextW
GetWindowTextLengthW
SetMenu
DrawIcon
GetUpdateRect
BringWindowToTop
IsZoomed
IsIconic
GetDesktopWindow
GetSystemMenu
FlashWindow
CreateDialogIndirectParamW
GetForegroundWindow
DrawTextW
CopyRect
DrawFocusRect
OffsetRect
MapWindowPoints
GetMessageW
ValidateRect
DestroyCursor
keybd_event
IsClipboardFormatAvailable
HideCaret
DestroyAcceleratorTable
CreateAcceleratorTableW
TranslateAcceleratorW
DrawEdge
UnionRect
ChildWindowFromPoint
DefFrameProcW
TranslateMDISysAccel
DefMDIChildProcW
GetMenuStringW
GetMessagePos
DrawStateW
DrawStateA
RegisterClipboardFormatW
ChangeDisplaySettingsW
EnumDisplaySettingsW
ShowCursor
KillTimer
SetTimer
DispatchMessageA
PeekMessageA
IsWindow
PtInRect
GetCapture
UnhookWindowsHookEx
UnregisterHotKey
RegisterHotKey
CallNextHookEx
GetActiveWindow
GetMenuItemInfoW
SystemParametersInfoW
GetMessageTime
GetWindow
BeginDeferWindowPos
EndDeferWindowPos
InvalidateRect
SetWindowTextW
GetFocus
IsWindowEnabled
GetDlgItem
CallWindowProcW
LoadImageW
ClientToScreen
ScreenToClient
UpdateWindow
RedrawWindow
SetParent
GetCursorPos
WindowFromPoint
GetParent
ScrollWindow
SetScrollInfo
GetScrollInfo
SetCursorPos
ReleaseCapture
SetCapture
ShowWindow
EnableWindow
SetFocus
SetWindowPos
SetWindowLongW
FillRect
GetWindowRect
GetAsyncKeyState
VkKeyScanW
DispatchMessageW
TranslateMessage
ReleaseDC
GetDC
CheckMenuRadioItem
CheckMenuItem
InsertMenuItemW
EnableMenuItem
GetMenuItemCount
GetSubMenu
CreateMenu
AppendMenuW
DrawMenuBar
GetMenuState
InsertMenuW
RemoveMenu
ModifyMenuW
DestroyMenu
CreatePopupMenu
SetMenuItemInfoW
UnregisterClassW
GetKeyState
RegisterWindowMessageW
DdePostAdvise
DdeConnect
DdeNameService
DdeCreateStringHandleW
DdeDisconnect
DdeInitializeW
DdeGetLastError
DdeCreateDataHandle
DdeGetData
DdeFreeDataHandle
DdeUninitialize
DdeQueryStringW
DdeFreeStringHandle
DestroyWindow
SendMessageW
SetCursor
RegisterClassW
MessageBeep
PeekMessageW
MessageBoxW
PostThreadMessageW
DestroyIcon
LoadBitmapW
IsWindowVisible
CreateDialogParamW
BeginPaint
GetWindowDC
EndPaint
CreateIconIndirect
GetIconInfo
InflateRect
GetUpdateRgn
GetSysColor
SetWindowsHookExW
SetForegroundWindow
RegisterClipboardFormatA
OpenClipboard
SetClipboardData
CloseClipboard
IsDialogMessageW
DeferWindowPos
TrackPopupMenu
MessageBoxA
PostMessageW
GetSystemMetrics
MoveWindow
CreateWindowExW
LoadCursorW
LoadIconW
DefWindowProcW
PostQuitMessage
AdjustWindowRectEx
GetClientRect
GetWindowLongW
SetWindowRgn
DdeClientTransaction

gdi32

CreatePalette
GetNearestPaletteIndex
StretchDIBits
StretchBlt
MaskBlt
SetBrushOrgEx
GetStockObject
Ellipse
RoundRect
Rectangle
PolyPolygon
SetPolyFillMode
Polygon
Pie
Arc
CreateSolidBrush
SelectClipRgn
GetRegionData
ExtCreateRegion
OffsetRgn
GetTextColor
GetBkColor
SetMapMode
SetViewportExtEx
SetWindowExtEx
SetViewportOrgEx
SetWindowOrgEx
GetTextExtentExPointW
DeleteObject
GetDeviceCaps
GetTextMetricsW
GetCharABCWidthsW
SetROP2
TextOutW
PolyBezier
Polyline
SetPixel
GetPixel
ExtFloodFill
ExtSelectClipRgn
GetClipBox
SetTextColor
SetStretchBltMode
SaveDC
RestoreDC
SetBkMode
SetBkColor
CreateBitmap
CreateCompatibleBitmap
BitBlt
DeleteDC
CreateCompatibleDC
GetPaletteEntries
GetObjectW
ExcludeClipRect
CreateRectRgn
GetTextExtentPoint32W
SelectPalette
RealizePalette
CreateFontIndirectW
CreateHatchBrush
CreatePatternBrush
ExtCreatePen
CreatePen
LineTo
MoveToEx
GetRgnBox
EqualRgn
PtInRegion
RectInRegion
CombineRgn
SelectObject
GetSystemPaletteEntries
CreateRectRgnIndirect
SetTextAlign
CreateDIBSection
GetDIBits
CreateDIBitmap
GetDIBColorTable
PatBlt
CreateICW
EnumFontFamiliesExW
SetAbortProc
EndDoc
StartPage
EndPage
StartDocW
CreateDCW
GetEnhMetaFileW
CopyEnhMetaFileW
DeleteEnhMetaFile
GdiFlush

shell32

ShellExecuteW
ShellExecuteExW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
Shell_NotifyIconW
DragAcceptFiles
DragFinish
DragQueryPoint
DragQueryFileW
ExtractIconW
ExtractIconExW
SHFileOperationW

ole32

OleUninitialize
OleCreate
OleSetContainedObject
CoCreateInstance
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleSetClipboard
OleIsCurrentClipboard
OleFlushClipboard
ReleaseStgMedium
OleGetClipboard
OleInitialize

oleaut32

VariantClear
SysAllocString

comctl32

ord17
ord16
CreateStatusWindowW
ImageList_GetIconSize
ImageList_Draw
ImageList_GetImageCount
ImageList_Create
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_Add
ImageList_EndDrag
ImageList_DragMove
ImageList_DragEnter
ImageList_DragLeave
ImageList_SetDragCursorImage
ImageList_BeginDrag

wininet

InternetCloseHandle
InternetReadFile
InternetQueryDataAvailable
InternetOpenW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
HttpQueryInfoW

shlwapi

StrCatW

winmm

timeGetTime

comdlg32

PageSetupDlgW
ChooseColorW
PrintDlgW
GetSaveFileNameW
GetOpenFileNameW
ChooseFontW
CommDlgExtendedError

advapi32

FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
OpenThreadToken
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenProcessToken

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 456KB - Virtual size: 456KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 257KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 205KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ae25595236a5a776976fc8be65d0d576

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

comctl32

wininet

shlwapi

winmm

comdlg32

advapi32

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 456KB - Virtual size: 456KB

.data Size: 72KB - Virtual size: 257KB

.SHARED Size: 512B - Virtual size: 4B

.rsrc Size: 67KB - Virtual size: 66KB

.reloc Size: 205KB - Virtual size: 205KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 456KB - Virtual size: 456KB

.data
Size: 72KB - Virtual size: 257KB

.SHARED
Size: 512B - Virtual size: 4B

.rsrc
Size: 67KB - Virtual size: 66KB

.reloc
Size: 205KB - Virtual size: 205KB