e526e55c439ea64f7a044ce99d4e77bb016266011792b9a2a8679286df872a02

Sharing

Copy URL Twitter E-mail

General

Target

e526e55c439ea64f7a044ce99d4e77bb016266011792b9a2a8679286df872a02
Size

10.9MB
MD5

fdcb4c9986e5b585e4413df533788552
SHA1

241da332f02456a587198ae231a08d5f6eafe89f
SHA256

e526e55c439ea64f7a044ce99d4e77bb016266011792b9a2a8679286df872a02
SHA512

99b9a252d8e91fc418dd0aceab4f92249c644fff2c6de312416d377175ca30be20e42d0a62bb95cd0b8f9251042f0033a9fe388e98d9633e74b036b83b83157b
SSDEEP

196608:fgMhdReguW3oCVIPj/27JOZtTcgZimQqvM9eWzh7sGSd36tO/m3lRhe72R/Iosc3:4snCa2d33MI98kNHqcV67stEQsCKyiDf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e526e55c439ea64f7a044ce99d4e77bb016266011792b9a2a8679286df872a02

Files

e526e55c439ea64f7a044ce99d4e77bb016266011792b9a2a8679286df872a02
.exe windows:4 windows x86 arch:x86

e5a626923b13883dfcd1a319d4cacc73

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

autonester-t

ord2
ord1

mpr

WNetOpenEnumA
WNetEnumResourceA
WNetCloseEnum

richpeaceam

GetSSOptEnvironment
CheckShapeShifter
ShapeShifterOpt
DeleteSSOptEnvironment
ShapeShifterAM

ws2_32

WSAStartup
gethostname
WSACleanup
inet_ntoa
gethostbyname

gdiplus

GdipCreatePen1
GdipDrawRectangleI
GdipFillPolygonI
GdipDrawCurveI
GdipDrawPolygonI
GdipDrawEllipseI
GdipDrawLinesI
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesRemapTable
GdipCreateFromHDC
GdipDeleteGraphics
GdipReleaseDC
GdipSetPageUnit
GdipDrawImagePointsRectI
GdipGetImageWidth
GdipGetImageHeight
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipFree
GdipDisposeImage
GdipCloneImage
GdipAlloc
GdipCreateHBITMAPFromBitmap
GdiplusStartup
GdiplusShutdown
GdipLoadImageFromFile
GdipLoadImageFromFileICM
GdipGetImagePixelFormat
GdipCreateBitmapFromScan0
GdipCloneBitmapAreaI
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipDeletePen
GdipSetPenWidth
GdipSetPenDashArray
GdipSetCompositingQuality
GdipSetSmoothingMode
GdipSetPixelOffsetMode

setupapi

SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA

hid

HidD_GetAttributes
HidD_FlushQueue
HidD_GetHidGuid

kernel32

SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
MoveFileA
lstrcpynA
GetFullPathNameA
GetStringTypeExA
GetThreadLocale
GetShortPathNameA
VirtualProtect
WaitForMultipleObjects
lstrlenW
FileTimeToLocalFileTime
ResumeThread
SuspendThread
GetTempFileNameA
SetFileTime
GetDiskFreeSpaceA
GlobalFlags
GetCurrentThread
LocalFileTimeToFileTime
GlobalHandle
LocalReAlloc
GetProcessVersion
GetCPInfo
GetOEMCP
FindResourceExA
lstrcpyW
RtlUnwind
RaiseException
GetTimeZoneInformation
GetACP
GetSystemTimeAsFileTime
ExitProcess
TerminateProcess
GetStartupInfoA
GetCommandLineA
DuplicateHandle
SetStdHandle
GetFileType
HeapSize
FatalAppExitA
GlobalFindAtomA
HeapCreate
VirtualFree
VirtualAlloc
SetUnhandledExceptionFilter
LCMapStringW
CompareStringA
CompareStringW
GetStringTypeA
GetStringTypeW
SetHandleCount
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
IsBadCodePtr
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
CreateFileW
SetConsoleCtrlHandler
GetLocaleInfoW
SetEnvironmentVariableA
SetCurrentDirectoryA
InterlockedExchange
GetSystemDirectoryA
MoveFileExA
LocalLock
LocalUnlock
GetModuleHandleW
GlobalGetAtomNameA
lstrcmpiA
ExitThread
GlobalAddAtomA
CopyFileA
GetLocalTime
lstrlenA
SetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
Sleep
GetModuleFileNameA
DeleteFileA
SetFileAttributesA
GlobalDeleteAtom
FindResourceA
GetOverlappedResult
lstrcatA
OpenMutexA
IsBadReadPtr
IsBadWritePtr
ReleaseSemaphore
OpenSemaphoreA
CreateSemaphoreA
SearchPathA
HeapReAlloc
InterlockedIncrement
FindNextFileA
FindFirstFileA
SetErrorMode
GetVersion
FindClose
GetFileSize
ReadFile
HeapFree
GetProcessHeap
HeapAlloc
TlsFree
GetCurrentProcessId
GetSystemTime
SystemTimeToFileTime
TlsAlloc
TlsGetValue
TlsSetValue
GetEnvironmentVariableA
GetVolumeInformationA
InterlockedCompareExchange
QueryDosDeviceA
GetVersionExA
CreateThread
DeviceIoControl
SizeofResource
LoadResource
LockResource
GetComputerNameA
DeleteCriticalSection
LocalAlloc
InterlockedDecrement
lstrcmpA
GetDriveTypeA
GetFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SetEvent
ResetEvent
GetPrivateProfileIntA
GlobalReAlloc
TerminateThread
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
SetProcessWorkingSetSize
CreateMutexA
InitializeCriticalSection
ReleaseMutex
EnterCriticalSection
LeaveCriticalSection
lstrcpyA
GetModuleHandleA
WritePrivateProfileStringA
GlobalAlloc
CreateFileA
WriteFile
GetLastError
FormatMessageA
LocalFree
WinExec
GetPrivateProfileStringA
GetProfileIntA
GetSystemDefaultLangID
GetThreadPriority
SetThreadPriority
CreateEventA
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
GetWindowsDirectoryA
GetTickCount
GetCurrentThreadId
MulDiv
GlobalSize
GlobalLock
GlobalUnlock
GetCurrentDirectoryA
CreateDirectoryA
GlobalFree
WaitForSingleObject
GetFileAttributesA
HeapDestroy

user32

LoadStringA
OemToCharA
CharToOemA
wvsprintfA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
IsDialogMessageA
ScrollWindowEx
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
SendDlgItemMessageA
AdjustWindowRectEx
DeferWindowPos
BeginDeferWindowPos
EndDeferWindowPos
ScrollWindow
GetScrollInfo
SetScrollInfo
GetScrollRange
GetTopWindow
IsChild
WinHelpA
RegisterClassA
GetMenuItemCount
GetMenuItemID
TrackPopupMenu
SetWindowPlacement
GetWindowTextLengthA
GetWindowTextA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
GetLastActivePopup
SetWindowPos
IsIconic
GetWindowPlacement
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamA
PostThreadMessageA
CreateWindowExA
RegisterClassExA
DestroyWindow
UnregisterClassA
GetUpdateRect
BeginPaint
SetScrollRange
LoadImageA
IsWindowEnabled
LockWindowUpdate
SetParent
GetDlgItem
SetWindowTextA
EnumDisplaySettingsA
MessageBoxA
IsRectEmpty
MapDialogRect
GetDlgCtrlID
ShowWindow
WindowFromDC
SetMenu
GetIconInfo
CreateIconIndirect
DestroyIcon
GetPropA
GetActiveWindow
wsprintfA
IsZoomed
CloseWindow
SetPropA
DeleteMenu
RemovePropA
SetScrollPos
GetSystemMenu
ReuseDDElParam
SetForegroundWindow
SetActiveWindow
SetFocus
BringWindowToTop
GetMessageA
TranslateMessage
DispatchMessageA
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
PeekMessageA
PostQuitMessage
GetAsyncKeyState
DrawEdge
ClipCursor
InvertRect
IsWindow
GrayStringA
DrawTextA
TabbedTextOutA
UnpackDDElParam
AppendMenuA
GetClassNameA
ShowOwnedPopups
SetWindowContextHelpId
InSendMessage
EndPaint
CopyIcon
CharUpperA
GetDialogBaseUnits
GetSysColorBrush
GetDCEx
CopyAcceleratorTableA
GetClassInfoA
DefWindowProcA
SystemParametersInfoA
GetWindowDC
CallWindowProcA
GetDesktopWindow
IsWindowVisible
MapWindowPoints
GetCursorPos
RedrawWindow
MessageBeep
MoveWindow
EnableMenuItem
CheckMenuItem
UnionRect
SetRectEmpty
SetCursorPos
DrawFocusRect
MsgWaitForMultipleObjects
DestroyMenu
WindowFromPoint
ValidateRect
CharNextA
RegisterClipboardFormatA
IsClipboardFormatAvailable
DestroyCursor
WaitMessage
LoadAcceleratorsA
GetScrollPos
TranslateAcceleratorA
SetWindowLongA
GetWindow
ShowScrollBar
GetSystemMetrics
DrawMenuBar
GetMenu
LoadMenuA
RemoveMenu
InsertMenuA
GetSubMenu
GetMenuStringA
SetCapture
GetCapture
LoadBitmapA
CopyRect
PtInRect
GetWindowLongA
ReleaseCapture
SetCursor
LoadCursorA
UpdateWindow
ReleaseDC
GetDC
EqualRect
IntersectRect
SetRect
OffsetRect
GetSysColor
KillTimer
GetFocus
GetWindowRect
SetTimer
PostMessageA
GetParent
FillRect
LoadIconA
ScreenToClient
ClientToScreen
GetClientRect
GetKeyState
InflateRect
SendMessageA
InvalidateRect
EnableWindow
RegisterWindowMessageA
GetNextDlgGroupItem
GetTabbedTextExtentA
CreateMenu
FindWindowA
GetMenuCheckMarkDimensions

gdi32

GetDIBits
RealizePalette
SelectPalette
DeleteDC
CreateDCA
SetBkMode
SetBkColor
SetTextColor
DeleteObject
CreatePatternBrush
CreateBitmap
GetClipBox
GetSystemPaletteEntries
CreatePalette
CreateBrushIndirect
GetRgnBox
CreatePenIndirect
GetPixel
CombineRgn
CreateHatchBrush
Ellipse
CreateRectRgnIndirect
PatBlt
CreateDIBitmap
SetDIBitsToDevice
SetStretchBltMode
ExtSelectClipRgn
StretchDIBits
PlayEnhMetaFile
GetEnhMetaFilePaletteEntries
DeleteEnhMetaFile
SetWinMetaFileBits
GetEnhMetaFileHeader
SetEnhMetaFileBits
GetDCOrgEx
SaveDC
RestoreDC
SetPolyFillMode
SetROP2
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
GetStockObject
ScaleWindowExtEx
SelectClipRgn
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
MoveToEx
LineTo
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
GetCurrentPositionEx
ArcTo
SetArcDirection
PolyDraw
PolylineTo
SetColorAdjustment
PolyBezierTo
GetClipRgn
SelectClipPath
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
GetViewportExtEx
GetWindowExtEx
ExtCreatePen
CreateDIBPatternBrushPt
GetMapMode
SetRectRgn
DPtoLP
LPtoDP
GetCharWidthA
SetAbortProc
GetWindowOrgEx
GetViewportOrgEx
CopyMetaFileA
GetNearestColor
GetStretchBltMode
GetPolyFillMode
GetTextAlign
GetBkMode
GetROP2
GetTextFaceA
DeleteMetaFile
CloseMetaFile
CreateMetaFileA
GetCurrentObject
EndDoc
AbortDoc
EndPage
StartPage
StartDocA
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetTextCharacterExtra
GetGlyphOutlineA
GetBkColor
EnumFontFamiliesExA
Polygon
SelectObject
CreateFontA
Arc
PtInRegion
CreateFontIndirectA
OffsetRgn
Rectangle
GetTextMetricsA
SetPixel
GetTextColor
GetTextExtentPoint32A
GetDeviceCaps
RectInRegion
CreatePen
BitBlt
CreateCompatibleBitmap
UnrealizeObject
StretchBlt
CreateSolidBrush
CreateCompatibleDC
GetObjectA
CreateDIBSection
CreateRectRgn
CreatePolygonRgn
SetWindowExtEx
FillRgn

comdlg32

ChooseFontA
PrintDlgA
PageSetupDlgA
GetSaveFileNameA
ChooseColorA
GetFileTitleA
GetOpenFileNameA
CommDlgExtendedError

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

advapi32

RegCloseKey
RegCreateKeyA
RegSetValueA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
GetUserNameA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegOpenKeyA
SetFileSecurityA
GetFileSecurityA
RegDeleteValueA
RegDeleteKeyA
RegQueryValueA
RegEnumKeyA

shell32

DragFinish
SHGetFileInfoA
DragAcceptFiles
DragQueryFileA
SHChangeNotify
SHGetSpecialFolderPathA
ShellExecuteA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
ExtractIconA

comctl32

ImageList_DragLeave
ImageList_GetImageInfo
ImageList_AddMasked
ImageList_Draw
ImageList_GetImageCount
ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_Add
ImageList_Create
ImageList_SetBkColor
ord17
PropertySheetA
DestroyPropertySheetPage
CreatePropertySheetPageA
ord13
ord14
ImageList_Destroy
ImageList_LoadImageA
ImageList_Merge
ImageList_Read
ImageList_Write
ImageList_EndDrag

odbc32

ord10
ord5
ord16
ord61
ord13
ord18
ord11
ord43
ord3
ord68
ord12
ord14
ord9
ord46
ord19
ord44
ord8
ord59
ord17
ord20
ord49
ord48
ord4
ord72
ord31
ord24
ord75
ord15
ord41
ord2
ord1
ord23
ord50
ord45
ord51
ord55

oledlg

ord8

ole32

CreateOleAdviseHolder
OleRegGetMiscStatus
OleSetContainedObject
OleTranslateAccelerator
IsAccelerator
GetRunningObjectTable
StringFromCLSID
OleCreateFromData
OleCreateMenuDescriptor
CoGetMalloc
OleIsRunning
OleQueryLinkFromData
OleQueryCreateFromData
OleCreateLinkFromData
OleSetMenuDescriptor
CoRevokeClassObject
CoRegisterClassObject
CoRegisterMessageFilter
CoGetClassObject
CoTreatAsClass
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CreateBindCtx
OleDuplicateData
CoTaskMemAlloc
CoDisconnectObject
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
CreateGenericComposite
CreateItemMoniker
CreateStreamOnHGlobal
OleSaveToStream
WriteClassStm
OleGetIconOfClass
GetHGlobalFromILockBytes
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
OleLockRunning
StgIsStorageFile
StgOpenStorage
StgCreateDocfile
CreateFileMoniker
DoDragDrop
OleGetClipboard
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
CoTaskMemFree
ReleaseStgMedium
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
OleSave
OleLoad
OleCreate
OleCreateLinkToFile
OleCreateFromFile
OleCreateStaticFromData
OleRegEnumVerbs
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
OleRun
CoUninitialize
CreateDataAdviseHolder
CoInitialize
OleDestroyMenuDescriptor

olepro32

ord253

oleaut32

SysAllocStringByteLen
SysStringByteLen
SafeArrayGetUBound
CreateErrorInfo
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayRedim
VarCyFromStr
VarBstrFromCy
VarDateFromStr
VarBstrFromDate
SafeArrayCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayGetElement
SafeArrayPtrOfIndex
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SysAllocStringLen
SysReAllocStringLen
SysStringLen
LoadTypeLi
SysAllocString
VariantCopy
SysFreeString
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreate
SafeArrayPutElement
GetErrorInfo
SetErrorInfo
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantClear
VariantInit
VariantChangeType

shlwapi

PathFileExistsA
PathIsDirectoryA

winscard

SCardEstablishContext
SCardListReadersA
SCardConnectA
SCardDisconnect
SCardReleaseContext
SCardReconnect
g_rgSCardT1Pci
SCardTransmit

wininet

HttpQueryInfoA
InternetGetConnectedState
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetReadFile

Sections

.text
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 620KB - Virtual size: 618KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 508KB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e5a626923b13883dfcd1a319d4cacc73

Headers

File Characteristics

Imports

autonester-t

mpr

richpeaceam

ws2_32

gdiplus

setupapi

hid

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

odbc32

oledlg

ole32

olepro32

oleaut32

shlwapi

winscard

wininet

Sections

.text Size: 5.9MB - Virtual size: 5.9MB

.rdata Size: 620KB - Virtual size: 618KB

.data Size: 508KB - Virtual size: 1.8MB

.rsrc Size: 3.9MB - Virtual size: 3.9MB

.text
Size: 5.9MB - Virtual size: 5.9MB

.rdata
Size: 620KB - Virtual size: 618KB

.data
Size: 508KB - Virtual size: 1.8MB

.rsrc
Size: 3.9MB - Virtual size: 3.9MB