df97958bf1fdae5df7db87703fda6cca

Sharing

Copy URL Twitter E-mail

General

Target

df97958bf1fdae5df7db87703fda6cca
Size

481KB
MD5

df97958bf1fdae5df7db87703fda6cca
SHA1

de848c6e08b0f745a5bdca4cebd4ed31ae391b99
SHA256

24ab197eaecfaabab125fa7d2b89516dbd07d5c2f734e1104bda6d9394ea1409
SHA512

ae38ef7c4f54259639be514ec846043b7ee7db9a60efceec5aae9631798581f4c82ac22a9e7f2a73503e7c5cf770cf7da9d4b566faec3d54e9c0ce7ee965cbdf
SSDEEP

12288:AhXJ0YRm/w+X/1O8KTMOQKNKrTvVesMA4La4rKJ8n:AhXJ09/d1O8ATQKNStesMbkJ8n

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df97958bf1fdae5df7db87703fda6cca

Files

df97958bf1fdae5df7db87703fda6cca
.exe windows:6 windows x64 arch:x64

4719b02304af42d5d7e52bfb2da0f4e8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memset
wcschr
memcpy
wcslen
wcscpy
wcscmp
memmove
wcscat
strncpy
memcmp
_wfopen
_setjmp
fclose
malloc
free
longjmp
wcsncmp
wcsncpy
_wcsicmp
tolower
floor
_localtime64
_mktime64
_wcsnicmp
_itow
_gmtime64
fabs
ceil
fseek
ftell
fread
pow
??3@YAXPEAX@Z
wcsstr
_wcsdup
_isnan
exit
sprintf
__iob_func
fprintf
fwrite
fflush
ferror
getenv
sscanf
_vsnwprintf
sinf
cosf
fmodf
abs

kernel32

GetModuleHandleW
HeapCreate
HeapDestroy
ExitProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CloseHandle
OpenProcess
TerminateProcess
CreateFileW
ReadDirectoryChangesW
GetDriveTypeW
GetVolumeInformationW
HeapFree
TlsGetValue
HeapAlloc
TlsSetValue
TlsAlloc
UnregisterWait
EnterCriticalSection
LeaveCriticalSection
TlsFree
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcess
GetCurrentThread
DuplicateHandle
RegisterWaitForSingleObject
WaitForSingleObject
LoadLibraryW
GetProcAddress
CreateThread
TerminateThread
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameW
CreatePipe
GetStdHandle
CreateProcessW
RtlLookupFunctionEntry
RtlVirtualUnwind
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
FreeLibrary
HeapReAlloc
GetCurrentThreadId
GetTickCount
WideCharToMultiByte
DeleteFileW
QueryPerformanceFrequency
QueryPerformanceCounter
Sleep
GetComputerNameW
SetLastError
GetCurrentProcessId
SetFileAttributesW
FindFirstFileW
FindClose
GetFileAttributesW
GetLastError
FindNextFileW
GetTempPathW
MoveFileW
CopyFileW
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateDirectoryW
WriteFile
SetFilePointer
ReadFile
MulDiv
GetLocalTime
GlobalLock
GlobalUnlock
HeapSize
MultiByteToWideChar

user32

GetForegroundWindow
SetWindowsHookExW
MapVirtualKeyW
GetKeyNameTextW
GetAsyncKeyState
CallNextHookEx
GetWindowTextLengthW
GetWindowTextW
GetWindowRect
ClientToScreen
GetDesktopWindow
GetDC
ReleaseDC
GetClassNameW
GetWindowLongPtrW
IsWindow
SetMenu
DestroyMenu
GetSystemMetrics
DestroyWindow
SystemParametersInfoW
GetWindow
SetActiveWindow
SendMessageW
DestroyIcon
LoadIconW
LoadCursorW
GetPropW
RegisterClassW
AdjustWindowRectEx
CreateWindowExW
SetPropW
ShowWindow
CreateAcceleratorTableW
UnregisterClassW
PeekMessageW
MsgWaitForMultipleObjects
GetMessageW
GetActiveWindow
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
DefFrameProcW
DefWindowProcW
GetParent
RemovePropW
DestroyAcceleratorTable
SetRect
EnumChildWindows
SetFocus
GetFocus
PostMessageW
SetWindowPos
IsWindowEnabled
IsWindowVisible
GetKeyState
GetWindowThreadProcessId
IsChild
RegisterWindowMessageW
EnumDisplaySettingsW
OpenClipboard
GetClipboardData
CloseClipboard
FillRect
CopyImage
CharLowerW
CharUpperW
CallWindowProcW
SetWindowLongPtrW
GetIconInfo
DrawIconEx

gdi32

BitBlt
DeleteObject
GetStockObject
CreateFontIndirectW
GetDeviceCaps
CreateDCW
DeleteDC
GetObjectType
GetObjectW
CreateCompatibleDC
SelectObject
CreateSolidBrush
GdiGetBatchLimit
GdiSetBatchLimit
CreateDIBSection
SetStretchBltMode
SetBrushOrgEx
StretchBlt
CreateBitmap
SetPixel
GetDIBits
GetTextExtentPoint32W
SetBkMode
SetTextAlign
SetBkColor
SetTextColor
TextOutW
GetTextMetricsW
CreateCompatibleBitmap
GetPixel

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
ShellExecuteExW
SHGetFolderLocation

wsock32

closesocket
WSACleanup
WSAStartup
select
__WSAFDIsSet
ioctlsocket
recvfrom
socket
inet_addr
gethostbyname
htons
bind
connect
recv
send
sendto
accept
listen
WSAGetLastError

ole32

CoInitialize
CoCreateInstance
CoUninitialize
RevokeDragDrop
CoTaskMemFree

winmm

timeBeginPeriod

gdiplus

GdipDeleteFont
GdipDeleteGraphics
GdipDeletePath
GdipDeleteMatrix
GdipDeletePen
GdipDeleteStringFormat
GdipFree
GdipGetDpiX
GdipGetDpiY

advapi32

GetUserNameW

comctl32

InitCommonControlsEx

Sections

.code
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 219KB - Virtual size: 218KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4719b02304af42d5d7e52bfb2da0f4e8

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

user32

gdi32

shell32

wsock32

ole32

winmm

gdiplus

advapi32

comctl32

Sections

.code Size: 64KB - Virtual size: 64KB

.text Size: 219KB - Virtual size: 218KB

.rdata Size: 37KB - Virtual size: 36KB

.pdata Size: 11KB - Virtual size: 10KB

.data Size: 72KB - Virtual size: 85KB

.rsrc Size: 75KB - Virtual size: 74KB

.reloc Size: 1KB - Virtual size: 1KB

.code
Size: 64KB - Virtual size: 64KB

.text
Size: 219KB - Virtual size: 218KB

.rdata
Size: 37KB - Virtual size: 36KB

.pdata
Size: 11KB - Virtual size: 10KB

.data
Size: 72KB - Virtual size: 85KB

.rsrc
Size: 75KB - Virtual size: 74KB

.reloc
Size: 1KB - Virtual size: 1KB