GuiClass[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

GuiClass.exe
Size

2.5MB
MD5

ba30bbbe7c544ed19ffebb7af0fd6330
SHA1

fae57caf8f3386628fd75bda563f699ad86fa2fc
SHA256

c9e2084e00fb2990994bf5659f4100e1ccf8774e6b5e6a3cbf8ec5a0efbe95fa
SHA512

8b7ca1912aea033c8976b3fee8a3696a865a7d23c006e8799da3c325357b13e368d251fa1e59009f73b3aa1a9a9d227f65029484a54ce784f20b6b74f99b2584
SSDEEP

24576:8YoBPL0j6pnnxqQxOVf3OOOPI8w8q5EDkc8bTxZlYgUlrrP58CY9Q3YtfKVdLNu3:FJYnsvdY74Q3gnaXwIXPb3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GuiClass.exe

Files

GuiClass.exe
.exe windows:6 windows x64 arch:x64

d9fa92ed878455c05a85af4cfa99ac5f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

opengl32

glClear

kernel32

VerSetConditionMask
GetLastError
GetModuleHandleExW
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryA
Sleep
GetStartupInfoW
GetModuleHandleW
GlobalAlloc
TlsSetValue
EnterCriticalSection
GlobalFree
SetThreadExecutionState
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
TlsFree
TlsGetValue
TlsAlloc
DeleteCriticalSection
GlobalUnlock
LeaveCriticalSection
InitializeCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
Process32Next
InitializeSListHead
Process32First
CreateToolhelp32Snapshot
SetConsoleTextAttribute
GetLocalTime
CloseHandle
GetStdHandle
GetSystemTimeAsFileTime
GlobalLock

user32

GetKeyState
SetCapture
ReleaseCapture
MsgWaitForMultipleObjects
GetSystemMetrics
SetForegroundWindow
SetPropW
GetPropW
RemovePropW
SetWindowTextW
GetClientRect
GetWindowRect
AdjustWindowRectEx
SetCursorPos
SetCursor
GetCursorPos
ClientToScreen
ScreenToClient
WindowFromPoint
ClipCursor
SetRect
OffsetRect
PtInRect
GetWindowLongW
SetWindowLongW
GetClassLongPtrW
GetActiveWindow
LoadImageW
OpenClipboard
SystemParametersInfoW
MonitorFromWindow
GetRawInputData
RegisterRawInputDevices
GetRawInputDeviceInfoA
GetRawInputDeviceList
GetMessageExtraInfo
CallWindowProcW
GetWindowLongPtrW
SetWindowLongPtrW
SetFocus
SetLayeredWindowAttributes
GetLayeredWindowAttributes
WaitMessage
PostMessageW
SendMessageW
GetMessageTime
TrackMouseEvent
EnumDisplayMonitors
GetMonitorInfoW
EnumDisplayDevicesW
EnumDisplaySettingsExW
EnumDisplaySettingsW
ChangeDisplaySettingsExW
ReleaseDC
EmptyClipboard
GetClipboardData
SetClipboardData
LoadCursorW
CloseClipboard
IsZoomed
BringWindowToTop
IsIconic
IsWindowVisible
SetWindowPlacement
GetWindowPlacement
SetWindowPos
MoveWindow
GetDC
DestroyIcon
MapVirtualKeyW
ToUnicode
ShowWindow
CreateIconIndirect
TranslateMessage
DispatchMessageW
PeekMessageW
RegisterDeviceNotificationW
UnregisterDeviceNotification
DefWindowProcW
UnregisterClassW
RegisterClassExW
FlashWindow
CreateWindowExW
DestroyWindow

gdi32

CreateDIBSection
DeleteDC
GetDeviceCaps
GetDeviceGammaRamp
SetDeviceGammaRamp
CreateBitmap
CreateRectRgn
DeleteObject
ChoosePixelFormat
DescribePixelFormat
SetPixelFormat
SwapBuffers
CreateDCW

shell32

DragQueryPoint
DragQueryFileW
DragFinish
DragAcceptFiles

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext

vcruntime140

__current_exception_context
__current_exception
__C_specific_handler
strstr
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcmp
memcpy
memmove
memset
memchr
strchr
__std_terminate

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
terminate
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_register_thread_local_exe_atexit_callback
__p___argc
__p___argv
_c_exit

api-ms-win-crt-string-l1-1-0

strncpy
strcspn
strspn
strncmp
tolower
strcmp

api-ms-win-crt-stdio-l1-1-0

__p__commode
fseek
ftell
fwrite
__stdio_common_vsprintf
__acrt_iob_func
fread
fflush
fclose
__stdio_common_vfprintf
_wfopen
_set_fmode
__stdio_common_vsscanf

api-ms-win-crt-heap-l1-1-0

_callnewh
_set_new_mode
malloc
realloc
free

api-ms-win-crt-math-l1-1-0

fminf
fmaxf
ceilf
cosf
fmodf
sqrtf
acosf
sinf
powf
__setusermatherr

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 317KB - Virtual size: 316KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 173KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d9fa92ed878455c05a85af4cfa99ac5f

Headers

DLL Characteristics

File Characteristics

Imports

opengl32

kernel32

user32

gdi32

shell32

msvcp140

imm32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 317KB - Virtual size: 316KB

.rdata Size: 173KB - Virtual size: 173KB

.data Size: 2.0MB - Virtual size: 2.0MB

.pdata Size: 16KB - Virtual size: 16KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 317KB - Virtual size: 316KB

.rdata
Size: 173KB - Virtual size: 173KB

.data
Size: 2.0MB - Virtual size: 2.0MB

.pdata
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1KB - Virtual size: 1KB