197e6f61a66fa23397f2c0fb27b419200c9acfcd2c2bbca6f0d209b03722dbde

Sharing

Copy URL Twitter E-mail

General

Target

197e6f61a66fa23397f2c0fb27b419200c9acfcd2c2bbca6f0d209b03722dbde
Size

8.7MB
MD5

fd78daa00b27e3e5534677d7c01a9887
SHA1

6b85aac7ba9df91baf30b4e581d0f5fa7700a0c7
SHA256

197e6f61a66fa23397f2c0fb27b419200c9acfcd2c2bbca6f0d209b03722dbde
SHA512

b420d401c6d8fa53d84d269436bfc2616446cc768679b35006250e2ba8f6171b976a72114c5fca0f59d3e531ac863777480d027ad012cd54dd74ee8bbb19c1a6
SSDEEP

196608://pCw9iEvwJjOQWKVzjlEAWsOr62rgWaI6HMaJTtGb:HpCw9iEAXW6j6J/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
197e6f61a66fa23397f2c0fb27b419200c9acfcd2c2bbca6f0d209b03722dbde

Files

197e6f61a66fa23397f2c0fb27b419200c9acfcd2c2bbca6f0d209b03722dbde
.exe windows:5 windows x64 arch:x64

7697d93015235d042265b72929924192

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memset
setlocale
__set_app_type
_fmode
_commode
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_cexit
_exit
_c_exit
_XcptFilter
__C_specific_handler
_onexit
__dllonexit
wcslen
wcscpy
wcsncpy
wcscat
wcschr
_wcsicmp
memcpy
memcmp
memmove
strncmp
isdigit
malloc
free
wcscmp
_stricmp
sprintf
strcpy
sscanf
strlen
strcat
_wstat
_wcsdup
strcmp
strncpy
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
log
pow
rand
fwrite
powf
floor
cos
sin
log10
_wfopen
fseek
fclose
fread
longjmp
setjmp
wcsncmp
_snwprintf
tolower
_localtime64
_mktime64
_wcsnicmp
_itow
_gmtime64
sqrtf
sinf
cosf
fmodf
abs
ftell
wcsstr
swscanf
getenv
__iob_func
fprintf
realloc
_close
calloc
_errno
_lseeki64
_snprintf
abort
_wopen
_setmode
_open_osfhandle
_strdup
strrchr
wctomb
_get_osfhandle
_open
toupper
mbstowcs
strchr
frexp
modf
fopen
strerror
atof
fflush
_vsnwprintf
ceil

kernel32

GetShortPathNameW
GetUserDefaultLangID
CloseHandle
GetCurrentThreadId
GetEnvironmentVariableW
SystemTimeToFileTime
LocalFileTimeToFileTime
FindResourceW
LoadResource
LockResource
SizeofResource
CreateToolhelp32Snapshot
GetLogicalDriveStringsW
QueryDosDeviceW
FileTimeToLocalFileTime
FileTimeToSystemTime
ExpandEnvironmentStringsW
GetCurrentProcess
GetSystemDefaultLangID
MultiByteToWideChar
GetModuleHandleW
GetProcAddress
CreateRemoteThread
WaitForSingleObject
GetExitCodeThread
GetCurrentProcessId
OpenProcess
GetLastError
FormatMessageW
GetVolumeInformationW
FindFirstFileW
FindNextFileW
FindClose
WideCharToMultiByte
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
CreateProcessW
HeapCreate
CreateSemaphoreW
HeapDestroy
ExitProcess
GetStartupInfoA
HeapFree
CreateFileW
GetFileSize
HeapAlloc
ReadFile
HeapReAlloc
CreateThread
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
Sleep
DuplicateHandle
CreatePipe
GetStdHandle
GetModuleFileNameW
PeekNamedPipe
GetExitCodeProcess
SetEnvironmentVariableW
GetCommandLineW
SetFilePointer
SetEndOfFile
WriteFile
DeleteFileW
FreeLibrary
LoadLibraryExW
GlobalAlloc
GlobalLock
GlobalHandle
GlobalUnlock
GlobalFree
lstrcpyA
lstrcpynA
LoadLibraryW
GetVersionExW
SetLastError
CreateDirectoryW
GetDriveTypeW
GetFileAttributesW
SetFileAttributesW
SetCurrentDirectoryW
CopyFileW
RemoveDirectoryW
GetCurrentDirectoryW
SetFileTime
MulDiv
GetLocalTime
TlsSetValue
TlsGetValue
TlsAlloc
HeapSize
TlsFree
DeleteCriticalSection
GetSystemTimeAsFileTime
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
GetTempPathW
IsValidCodePage
GetACP
GetOEMCP
GetFileType
GetFileInformationByHandle
GetFileAttributesA
CreateFileA
GetFullPathNameW
UnregisterWait
GetCurrentThread
RegisterWaitForSingleObject

user32

SendMessageW
OemToCharW
GetCursorPos
WindowFromPoint
GetClassLongPtrW
SetClassLongPtrW
SetWindowRgn
GetClassNameW
CallNextHookEx
GetWindowLongPtrW
SetWindowsHookExW
UnhookWindowsHookEx
ReleaseDC
EnumWindows
GetWindowThreadProcessId
FindWindowExW
FindWindowW
GetForegroundWindow
SetCursorPos
InvalidateRect
GetSysColor
GetWindow
IsWindow
DefWindowProcW
SetWindowLongPtrW
GetClientRect
FillRect
CallWindowProcW
GetParent
IsWindowEnabled
GetDC
SetWindowPos
BeginPaint
EndPaint
GetAsyncKeyState
KillTimer
ScreenToClient
SetTimer
DrawTextW
GetDlgCtrlID
GetWindowRect
OffsetRect
IsRectEmpty
MapWindowPoints
SubtractRect
FrameRect
InflateRect
RedrawWindow
ShowWindow
DrawFrameControl
PostMessageW
MessageBoxW
IsWindowVisible
EnableWindow
wsprintfA
LoadIconW
RegisterClassExW
CreateWindowExW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
SetFocus
GetIconInfo
UpdateWindow
ReleaseCapture
DrawStateW
SetCapture
GetSystemMetrics
GetKeyState
GetPropW
ClipCursor
SetCursor
GetCapture
GetFocus
DrawFocusRect
GetMessagePos
LoadCursorW
SetPropW
ChildWindowFromPointEx
DestroyWindow
MoveWindow
RemovePropW
GetSysColorBrush
SetRect
GetWindowLongW
ClientToScreen
SetScrollPos
GetWindowDC
SystemParametersInfoW
GetScrollPos
EnumPropsExW
SetActiveWindow
IsZoomed
IsIconic
PeekMessageW
MsgWaitForMultipleObjects
GetMessageW
GetActiveWindow
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
DestroyIcon
GetMenu
RegisterClassW
AdjustWindowRectEx
UnregisterClassW
CreateAcceleratorTableW
DestroyAcceleratorTable
DefFrameProcW
EnumChildWindows
IsChild
RegisterWindowMessageW
CopyImage
DrawIconEx
CreateIconFromResourceEx
CreateIconFromResource
CharLowerW
CharUpperW

gdi32

CreateRoundRectRgn
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteDC
DeleteObject
CreateRectRgn
CreateSolidBrush
CreatePatternBrush
SetBkMode
SetTextColor
SelectClipRgn
SetDCBrushColor
GetStockObject
SetBrushOrgEx
GetObjectType
GetObjectW
CreateDIBSection
GdiGetBatchLimit
GdiSetBatchLimit
GetTextExtentPoint32W
SetBkColor
ExcludeClipRect
CreateFontIndirectW
CreateRectRgnIndirect
GetClipRgn
ExtSelectClipRgn
CreatePen
MoveToEx
LineTo
GetDeviceCaps
GetDIBits
SetTextAlign
TextOutW
SetStretchBltMode
StretchBlt
GetTextMetricsW
GetPixel
CreateBitmap
SetPixel
CreateFontW

advapi32

RegOpenKeyExW
RegOpenKeyW
RegConnectRegistryW
RegQueryValueExW
RegCloseKey
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
LookupAccountNameW
IsValidSid
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyW
SystemFunction036
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext

comctl32

ImageList_Create
InitCommonControlsEx
_TrackMouseEvent
ImageList_Replace
ImageList_Add
ImageList_ReplaceIcon
ImageList_Remove
ImageList_AddMasked
ImageList_Destroy
ImageList_GetIconSize

oleaut32

SafeArrayGetDim
SafeArrayGetUBound
SafeArrayGetElement

ole32

CoInitialize
CoCreateInstance
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoTaskMemFree
RevokeDragDrop

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteExW
SHGetFolderLocation

ws2_32

WSAStartup
gethostbyname
WSACleanup
closesocket

winmm

timeBeginPeriod

msimg32

AlphaBlend

gdiplus

GdipDeleteFont
GdipDeleteGraphics
GdipDeletePath
GdipDeleteMatrix
GdipDeletePen
GdipDeleteStringFormat
GdipFree
GdipGetDpiX
GdipGetDpiY

imagehlp

MakeSureDirectoryPathExists
MapFileAndCheckSumW

uxtheme

SetWindowTheme
OpenThemeData
DrawThemeBackground
CloseThemeData

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 258KB - Virtual size: 258KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6.7MB - Virtual size: 7.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 284KB - Virtual size: 283KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.debug_l
Size: 512B - Virtual size: 123B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_i
Size: 512B - Virtual size: 46B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_a
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_a
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_s
Size: 512B - Virtual size: 155B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_f
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.modplug
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7697d93015235d042265b72929924192

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

gdi32

advapi32

comctl32

oleaut32

ole32

shell32

ws2_32

winmm

msimg32

gdiplus

imagehlp

uxtheme

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 258KB - Virtual size: 258KB

.pdata Size: 49KB - Virtual size: 49KB

.data Size: 6.7MB - Virtual size: 7.2MB

.rsrc Size: 284KB - Virtual size: 283KB

.debug_l Size: 512B - Virtual size: 123B

.debug_i Size: 512B - Virtual size: 46B

.debug_a Size: 512B - Virtual size: 20B

.debug_a Size: 512B - Virtual size: 48B

.debug_s Size: 512B - Virtual size: 155B

.debug_f Size: 512B - Virtual size: 72B

.modplug Size: - Virtual size: 20KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 258KB - Virtual size: 258KB

.pdata
Size: 49KB - Virtual size: 49KB

.data
Size: 6.7MB - Virtual size: 7.2MB

.rsrc
Size: 284KB - Virtual size: 283KB

.debug_l
Size: 512B - Virtual size: 123B

.debug_i
Size: 512B - Virtual size: 46B

.debug_a
Size: 512B - Virtual size: 20B

.debug_a
Size: 512B - Virtual size: 48B

.debug_s
Size: 512B - Virtual size: 155B

.debug_f
Size: 512B - Virtual size: 72B

.modplug
Size: - Virtual size: 20KB