GuiClass[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

GuiClass.exe
Size

2.5MB
MD5

66510f08f06540e1307034def1fb43ce
SHA1

a1e9d84079982b9df355070c9888ddc58c874db1
SHA256

4dc7e1d37a422640a0d919a86fd056b71c30edda3cb04027a2ce8a242f9a043b
SHA512

53bc88bfc75aa468dad7ced68fbd4b28e07c0b1a5485c477735fc665ead14766d5f77de0a7794e06e0ca48caf997933ec39b3e9a87e82d63fa24f1faedf6d6c3
SSDEEP

24576:Ky0nkMEU3OnjBZTxOVf3OOOPI8w8q5EDkc8bTxZlYgUlrrP58CY9Q3YtfKVdLNup:7BnGvdY74Q3gnaXwIXPb3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GuiClass.exe

Files

GuiClass.exe
.exe windows:6 windows x64 arch:x64

c7c0ca3034e236553c9805ef58db38e2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

opengl32

glClear

kernel32

TlsFree
VerSetConditionMask
GetLastError
GetModuleHandleExW
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryA
Sleep
GetStartupInfoW
GetModuleHandleW
GlobalAlloc
TlsGetValue
GlobalLock
GlobalFree
SetThreadExecutionState
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
TlsSetValue
TlsAlloc
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
Process32Next
Process32First
InitializeSListHead
CreateToolhelp32Snapshot
GetConsoleWindow
SetConsoleTextAttribute
GetLocalTime
CloseHandle
GetStdHandle
GetSystemTimeAsFileTime
GlobalUnlock

user32

GetActiveWindow
GetKeyState
SetCapture
ReleaseCapture
MsgWaitForMultipleObjects
GetSystemMetrics
SetForegroundWindow
SetPropW
GetPropW
RemovePropW
SetWindowTextW
GetClientRect
GetWindowRect
AdjustWindowRectEx
SetCursorPos
SetCursor
GetCursorPos
ClientToScreen
ScreenToClient
WindowFromPoint
ClipCursor
SetRect
OffsetRect
PtInRect
GetWindowLongW
SetWindowLongW
SetFocus
LoadCursorW
LoadImageW
IsZoomed
SystemParametersInfoW
MonitorFromWindow
GetRawInputData
RegisterRawInputDevices
GetRawInputDeviceInfoA
GetRawInputDeviceList
GetMessageExtraInfo
CallWindowProcW
GetWindowLongPtrW
SetWindowLongPtrW
EmptyClipboard
GetLayeredWindowAttributes
WaitMessage
PostMessageW
SendMessageW
GetMessageTime
TrackMouseEvent
EnumDisplayMonitors
GetMonitorInfoW
EnumDisplayDevicesW
EnumDisplaySettingsExW
EnumDisplaySettingsW
ChangeDisplaySettingsExW
ReleaseDC
GetDC
GetClipboardData
SetClipboardData
CloseClipboard
GetClassLongPtrW
OpenClipboard
BringWindowToTop
IsIconic
IsWindowVisible
SetWindowPlacement
GetWindowPlacement
SetWindowPos
MoveWindow
FlashWindow
DestroyIcon
MapVirtualKeyW
ToUnicode
DestroyWindow
CreateWindowExW
CreateIconIndirect
ShowWindow
MessageBoxA
TranslateMessage
DispatchMessageW
PeekMessageW
RegisterDeviceNotificationW
UnregisterDeviceNotification
DefWindowProcW
SetLayeredWindowAttributes
UnregisterClassW
RegisterClassExW

gdi32

CreateDIBSection
DeleteDC
GetDeviceCaps
GetDeviceGammaRamp
SetDeviceGammaRamp
CreateBitmap
CreateRectRgn
DeleteObject
ChoosePixelFormat
DescribePixelFormat
SetPixelFormat
SwapBuffers
CreateDCW

shell32

DragQueryPoint
DragQueryFileW
DragFinish
DragAcceptFiles

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext

vcruntime140

__current_exception_context
__current_exception
__C_specific_handler
strstr
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcmp
memcpy
memmove
memset
memchr
strchr
__std_terminate

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_c_exit
_cexit
_seh_filter_exe
_set_app_type
terminate
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
__p___argv
__p___argc

api-ms-win-crt-string-l1-1-0

strspn
strncpy
strcmp
strcspn
strcat_s
tolower
strncmp

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
fwrite
__p__commode
ftell
__stdio_common_vsprintf
__stdio_common_vsscanf
__stdio_common_vfprintf
__stdio_common_vsprintf_s
fseek
fread
fflush
_wfopen
fclose
_set_fmode

api-ms-win-crt-heap-l1-1-0

malloc
_set_new_mode
_callnewh
free
realloc

api-ms-win-crt-math-l1-1-0

fmaxf
ceilf
fminf
cosf
fmodf
sqrtf
acosf
sinf
powf
__setusermatherr

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 317KB - Virtual size: 316KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 173KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c7c0ca3034e236553c9805ef58db38e2

Headers

DLL Characteristics

File Characteristics

Imports

opengl32

kernel32

user32

gdi32

shell32

msvcp140

imm32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 317KB - Virtual size: 316KB

.rdata Size: 173KB - Virtual size: 173KB

.data Size: 2.0MB - Virtual size: 2.0MB

.pdata Size: 16KB - Virtual size: 16KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 317KB - Virtual size: 316KB

.rdata
Size: 173KB - Virtual size: 173KB

.data
Size: 2.0MB - Virtual size: 2.0MB

.pdata
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1KB - Virtual size: 1KB