77fe8b7d1429b8207c98dbf2d2132a9f216504c417e70ca0ae4a8ebaf113cc02

Sharing

Copy URL

Twitter E-mail

General

Target

77fe8b7d1429b8207c98dbf2d2132a9f216504c417e70ca0ae4a8ebaf113cc02
Size

6.7MB
MD5

4df67fdffb17735693e05dbc0ff1af49
SHA1

e83a5ca99aab07af047a28e8814cdab6ec2fcab9
SHA256

77fe8b7d1429b8207c98dbf2d2132a9f216504c417e70ca0ae4a8ebaf113cc02
SHA512

1de5e18f908e8c82652f21f57f9816ce2792208196efb59ea3fec9f7b1c9f6e1b1aeb32ef23ac32bbf06e9c90506fc99573e7aa49581e950fd0179a97ae1e4bf
SSDEEP

98304:yYZUEjoJsG5kHHOBD3kjwLTLtLixoilX3oor+vm5KsxXAePEkj2crBgfh6gwH+:y0bmLdTLtLs3oor+vmIAjyh6gwe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
77fe8b7d1429b8207c98dbf2d2132a9f216504c417e70ca0ae4a8ebaf113cc02

Files

77fe8b7d1429b8207c98dbf2d2132a9f216504c417e70ca0ae4a8ebaf113cc02
.exe windows:6 windows x86 arch:x86

89951a846f1be6e057102d26f5623552

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\work\LinXSplit-BJ03 - ESHOW\Release\MR.pdb

Imports

hid

HidD_GetHidGuid
HidD_GetAttributes
HidP_GetCaps
HidD_FreePreparsedData
HidD_GetPreparsedData

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW

d3d11

D3D11CreateDevice

gdiplus

GdiplusShutdown
GdipSetStringFormatLineAlign
GdipGetPropertyItemSize
GdipDisposeImage
GdipFree
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipCreateBitmapFromScan0
GdipDrawImageI
GdipGetPropertyItem
GdipTranslateWorldTransform
GdipCloneImage
GdipSetStringFormatTrimming
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipAlloc
GdipRotateWorldTransform
GdiplusStartup
GdipGetImageWidth
GdipGetImageHeight
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipFillPath
GdipFillRectangleI
GdipDrawPath
GdipDrawRectangleI
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipSetPenMode
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipAddPathArc
GdipAddPathLine
GdipDeletePath
GdipCreatePath
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipImageSelectActiveFrame
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat

kernel32

MoveFileW
DeleteFileW
CreateDirectoryW
TerminateProcess
Module32FirstW
GetFileSize
GetFileAttributesW
GetTickCount
GetOverlappedResult
CreateThread
SetThreadLocale
GetThreadLocale
SetThreadUILanguage
GetThreadUILanguage
GetSystemDefaultLangID
GetSystemTimeAsFileTime
GetVersionExW
GetSystemInfo
lstrcpyW
SetThreadExecutionState
ReleaseSemaphore
ReadFile
GetStartupInfoW
HeapFree
GetCurrentProcess
GetModuleHandleW
GetProcAddress
WritePrivateProfileStringW
GetPrivateProfileStringW
WaitForSingleObject
CreateProcessW
GetLongPathNameW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
CreateMutexW
VerifyVersionInfoW
VerSetConditionMask
HeapSize
Sleep
MultiByteToWideChar
LocalFree
WideCharToMultiByte
FormatMessageW
LeaveCriticalSection
EnterCriticalSection
CancelWaitableTimer
SetWaitableTimer
CreateWaitableTimerW
QueryPerformanceCounter
QueryPerformanceFrequency
DeleteCriticalSection
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionEx
FreeResource
LockResource
SizeofResource
LoadResource
FindResourceW
GetCurrentThreadId
CreateFileW
GetLocalTime
GetModuleFileNameW
OpenProcess
GetCurrentProcessId
SetUnhandledExceptionFilter
SetThreadPriority
CloseHandle
WaitForMultipleObjects
CreateEventW
SetEvent
lstrcpynW
lstrlenW
GetCommandLineW
SetPriorityClass
CreateSemaphoreW
InitializeCriticalSection
OutputDebugStringW
ResumeThread
HeapReAlloc
HeapAlloc
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
WriteFile
GetProcessHeap
IsValidCodePage
FindNextFileW
FindFirstFileExW
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
LCMapStringW
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
MoveFileExW
PeekNamedPipe
GetFileInformationByHandle
GetFileType
SetStdHandle
VirtualQuery
GetCommandLineA
HeapQueryInformation
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
RtlUnwind
GetThreadPriority
GetProcessAffinityMask
WriteConsoleW
GetConsoleMode
VirtualAlloc
VirtualFree
InterlockedExchange
GetConsoleScreenBufferInfo
GetStdHandle
SetConsoleTextAttribute
ExitProcess
GetACP
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
GetTempFileNameW
SearchPathW
GetProfileIntW
GetTempPathW
GetWindowsDirectoryW
SystemTimeToTzSpecificLocalTime
SetFileTime
LocalFileTimeToFileTime
GetFileTime
GetFileSizeEx
GetFileAttributesExW
FileTimeToLocalFileTime
FindResourceExW
GetCurrentDirectoryW
GlobalAlloc
GlobalSize
GlobalUnlock
GlobalLock
GlobalFree
MulDiv
CopyFileW
SetLastError
OutputDebugStringA
EncodePointer
GetSystemDirectoryW
FreeLibrary
GetModuleHandleA
LoadLibraryExW
LoadLibraryA
LoadLibraryW
GlobalDeleteAtom
lstrcmpW
GlobalAddAtomW
GlobalFindAtomW
CompareStringW
SetErrorMode
SuspendThread
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalAlloc
LocalReAlloc
lstrcmpA
GlobalGetAtomNameW
FileTimeToSystemTime
SystemTimeToFileTime
GlobalFlags
GetCurrentThread
GetUserDefaultUILanguage
VirtualProtect
FindClose
FindFirstFileW
FlushFileBuffers
GetFullPathNameW
GetVolumeInformationW
LockFile
SetEndOfFile
SetFilePointer
UnlockFile
DuplicateHandle
lstrcmpiW

user32

GetSysColor
InflateRect
PeekMessageW
GetMessagePos
GetMessageTime
CallWindowProcW
RegisterClassW
GetClassInfoW
GetClassInfoExW
IsMenu
IsChild
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
IsIconic
GetDlgCtrlID
GetFocus
GetKeyState
GetCapture
GetMenu
SetMenu
TrackPopupMenu
SetActiveWindow
ValidateRect
RedrawWindow
ScrollWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
SetPropW
GetPropW
RemovePropW
GetWindowTextW
GetWindowTextLengthW
AdjustWindowRectEx
MapWindowPoints
EqualRect
PtInRect
GetClassLongW
GetClassNameW
GetLastActivePopup
SetWindowsHookExW
CallNextHookEx
SetScrollInfo
GetScrollInfo
WinHelpW
MonitorFromWindow
GetActiveWindow
GetSysColorBrush
IsWindowEnabled
DrawTextW
DrawTextExW
GrayStringW
TabbedTextOutW
GetWindowDC
ClientToScreen
RealChildWindowFromPoint
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
CopyImage
UnregisterClassW
CheckDlgButton
SendDlgItemMessageA
SetRectEmpty
CreateDialogIndirectParamW
EndDialog
GetNextDlgTabItem
MapDialogRect
DestroyIcon
CharUpperW
TrackMouseEvent
InvalidateRect
LoadImageW
ShowOwnedPopups
SetCursor
GetNextDlgGroupItem
SetCapture
ReleaseCapture
WindowFromPoint
DrawFocusRect
IsRectEmpty
MessageBeep
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
GetMenuDefaultItem
DestroyMenu
GetKeyNameTextW
LoadMenuW
SetLayeredWindowAttributes
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateW
SetClassLongW
SetWindowRgn
SetParent
DrawEdge
DrawFrameControl
IsZoomed
BringWindowToTop
SetCursorPos
CopyIcon
FrameRect
DrawIcon
UnionRect
UpdateLayeredWindow
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
GetComboBoxInfo
PostThreadMessageW
WaitMessage
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
LockWindowUpdate
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuW
RegisterClipboardFormatW
CharUpperBuffW
IsClipboardFormatAvailable
GetUpdateRect
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
SubtractRect
CreateMenu
GetWindowRgn
wsprintfW
CharNextW
CharPrevW
CreateCaret
GetCaretBlinkTime
ShowCaret
SetCaretPos
GetCaretPos
wsprintfA
DrawTextA
InvalidateRgn
GetGUIThreadInfo
RegisterClassExW
DefWindowProcW
CreateWindowExW
IsWindow
DestroyWindow
GetDesktopWindow
GetShellWindow
GetMonitorInfoW
LoadIconW
CreateDialogParamW
SetTimer
GetSystemMetrics
GetCursorPos
SetForegroundWindow
CreatePopupMenu
AppendMenuW
GetMenuItemInfoW
RemoveMenu
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringW
SendMessageW
SetWindowLongW
GetWindowLongW
SetRect
IntersectRect
CopyRect
OffsetRect
UnregisterDeviceNotification
RegisterDeviceNotificationW
GetTopWindow
GetWindowThreadProcessId
GetParent
GetWindow
GetForegroundWindow
MapVirtualKeyW
PostMessageW
PostQuitMessage
LoadCursorW
CheckMenuItem
UnhookWindowsHookEx
IsDialogMessageW
TranslateAcceleratorW
RegisterWindowMessageW
LoadAcceleratorsW
EnumWindows
LoadBitmapW
ScreenToClient
DeleteMenu
GetSystemMenu
GetAsyncKeyState
DispatchMessageW
TranslateMessage
GetMessageW
SetWindowPos
keybd_event
DestroyCursor
DrawIconEx
GetIconInfo
GetCursorInfo
MonitorFromPoint
ReleaseDC
EnumDisplayMonitors
GetDC
LoadStringW
UpdateWindow
ShowWindow
ChangeDisplaySettingsExW
EnumDisplaySettingsW
EnumDisplayDevicesW
SetFocus
EnableWindow
SetWindowTextW
MoveWindow
FillRect
GetClientRect
GetDlgItem
SystemParametersInfoW
EndPaint
BeginPaint
KillTimer
MessageBoxW
FindWindowW
IsWindowVisible
EnableMenuItem
GetWindowRect

gdi32

GetObjectType
GetPixel
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
GetClipBox
PtVisible
RectVisible
RestoreDC
SaveDC
ExcludeClipRect
Escape
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextAlign
CreateRectRgn
CreatePen
CreateHatchBrush
SetBitmapBits
CreateBitmap
SetBkColor
ExtTextOutW
CopyMetaFileW
CreatePatternBrush
GetBitmapBits
GetDeviceCaps
CreateCompatibleBitmap
CreateDCW
CreateFontIndirectW
GetStockObject
TextOutW
GetTextExtentPoint32W
CreateSolidBrush
SetTextColor
SetBkMode
GetObjectW
SetPixel
SelectObject
DeleteObject
CreateDIBSection
BitBlt
CreateCompatibleDC
DeleteDC
MoveToEx
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetTextExtentPointA
GdiFlush
GetObjectA
GetCharABCWidthsW
CreatePenIndirect
RemoveFontMemResourceEx
AddFontMemResourceEx
GetTextFaceW
GetViewportOrgEx
GetWindowOrgEx
SetPixelV
SetPaletteEntries
ExtFloodFill
PtInRegion
GetBoundsRect
FrameRgn
FillRgn
RoundRect
OffsetRgn
GetRgnBox
Rectangle
LPtoDP
CreateRoundRectRgn
Polyline
Polygon
CreatePolygonRgn
GetTextColor
Ellipse
CreateEllipticRgn
SetDIBColorTable
StretchBlt
GetTextCharsetInfo
EnumFontFamiliesW
CreateDIBitmap
GetBkColor
RealizePalette
GetSystemPaletteEntries
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
EnumFontFamiliesExW
GetTextMetricsW
DPtoLP
SetRectRgn
PatBlt
CreateRectRgnIndirect
CombineRgn

comdlg32

GetOpenFileNameW

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
RegSetValueExW
GetUserNameA
RegCreateKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW

shell32

SHGetFileInfoW
DragQueryFileW
DragFinish
ShellExecuteW
SHGetDesktopFolder
SHGetPathFromIDListW
SHBrowseForFolderW
Shell_NotifyIconW
CommandLineToArgvW
SHAppBarMessage
SHGetSpecialFolderLocation

ole32

CLSIDFromProgID
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
CoInitializeEx
CreateStreamOnHGlobal
CLSIDFromString
CoDisconnectObject
ReleaseStgMedium
OleDuplicateData
CoTaskMemAlloc
OleUninitialize
OleInitialize
CoUninitialize
CoInitialize
CoTaskMemFree
CoCreateInstance

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

msimg32

AlphaBlend
TransparentBlt

comctl32

InitCommonControlsEx
ord17
_TrackMouseEvent

shlwapi

PathFindExtensionW
PathFindFileNameW
PathIsUNCW
PathStripToRootW
StrFormatKBSizeW
PathRemoveFileSpecW

uxtheme

DrawThemeParentBackground
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
DrawThemeText
GetWindowTheme
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor
GetThemePartSize
GetCurrentThemeName

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
ImmGetOpenStatus

dbghelp

MiniDumpWriteDump

dwmapi

DwmIsCompositionEnabled

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification

d3d9

Direct3DCreate9

avrt

AvRevertMmThreadCharacteristics
AvSetMmThreadCharacteristicsW

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

winmm

timeBeginPeriod
timeEndPeriod
PlaySoundW
timeGetDevCaps

ws2_32

gethostname
gethostbyname
WSAStartup

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

oleaut32

SysAllocString
VarBstrFromDate
VariantCopy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
LoadTypeLi
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen
SysFreeString

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 606KB - Virtual size: 606KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 592KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.eh_fram
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 191KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

89951a846f1be6e057102d26f5623552

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

hid

setupapi

d3d11

gdiplus

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

version

msimg32

comctl32

shlwapi

uxtheme

imm32

dbghelp

dwmapi

wtsapi32

d3d9

avrt

oleacc

winmm

ws2_32

winspool.drv

oleaut32

Sections

.text Size: 3.3MB - Virtual size: 3.3MB

.text.un Size: 53KB - Virtual size: 53KB

.rodata Size: 11KB - Virtual size: 10KB

.rdata Size: 606KB - Virtual size: 606KB

.data Size: 26KB - Virtual size: 592KB

.eh_fram Size: 65KB - Virtual size: 65KB

.rodata Size: 1024B - Virtual size: 528B

.rsrc Size: 2.5MB - Virtual size: 2.5MB

.reloc Size: 191KB - Virtual size: 190KB

.text
Size: 3.3MB - Virtual size: 3.3MB

.text.un
Size: 53KB - Virtual size: 53KB

.rodata
Size: 11KB - Virtual size: 10KB

.rdata
Size: 606KB - Virtual size: 606KB

.data
Size: 26KB - Virtual size: 592KB

.eh_fram
Size: 65KB - Virtual size: 65KB

.rodata
Size: 1024B - Virtual size: 528B

.rsrc
Size: 2.5MB - Virtual size: 2.5MB

.reloc
Size: 191KB - Virtual size: 190KB