3bf45be6b42ea678f26c0d0bb71b72d367551a7a672c749e3d7d5011714319b1

Sharing

Copy URL Twitter E-mail

General

Target

3bf45be6b42ea678f26c0d0bb71b72d367551a7a672c749e3d7d5011714319b1
Size

12.4MB
MD5

ff85a3865cb085df3bb6d20506b09db9
SHA1

c3f72b9420103ca3d259344a2c124647b79310bc
SHA256

3bf45be6b42ea678f26c0d0bb71b72d367551a7a672c749e3d7d5011714319b1
SHA512

bbd676915de2ebbc06fd63e1708b5f3e79c87b340a9d7e6d0056076680afcd0e8267b4c3bb3cba0c7e26a58cf040ca28d005d4b5be6a8589705a27dfd1445f98
SSDEEP

196608:hB03xwWuXuUvhVEkALskbYaD0NguaUydaJCW73XPrJqHq5WjLFr+le/oxO:hB03xwW4rEN9sC1ACW73XIq5GLFreeaO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3bf45be6b42ea678f26c0d0bb71b72d367551a7a672c749e3d7d5011714319b1

Files

3bf45be6b42ea678f26c0d0bb71b72d367551a7a672c749e3d7d5011714319b1
.exe windows:5 windows x86 arch:x86

2caf5bb506e72a719786dcd604a6557b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

I:\build\trunk_en_3.0\package\install.pdb

Imports

kernel32

TerminateThread
FreeResource
CreateMutexW
GlobalFree
GlobalAlloc
GetCurrentProcessId
GetTickCount
Sleep
CreateEventW
DeviceIoControl
GetDriveTypeW
GetLogicalDriveStringsW
GetStartupInfoW
GetVersionExW
GetSystemInfo
GetPriorityClass
TerminateProcess
Module32NextW
Module32FirstW
DuplicateHandle
GetCurrentProcess
CopyFileW
CreateDirectoryW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetWindowsDirectoryW
OpenProcess
GetExitCodeProcess
CreateProcessW
GetVolumeInformationW
GetDiskFreeSpaceExW
MoveFileExW
RemoveDirectoryW
FindClose
FindNextFileW
SetLastError
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
ReadFile
FreeLibrary
lstrcmpiW
GetModuleFileNameW
DecodePointer
FindFirstFileW
DeleteFileW
CreateFileW
GetModuleHandleW
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
FindResourceExW
FindResourceW
SizeofResource
LockResource
GetCommandLineW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
RaiseException
SetEndOfFile
ReadConsoleW
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetFilePointerEx
FlushFileBuffers
GetFileType
GetConsoleMode
GetConsoleCP
WriteFile
GetStdHandle
UnregisterWaitEx
InitializeSListHead
ReleaseSemaphore
VirtualProtect
VirtualFree
VirtualAlloc
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
OutputDebugStringW
GetOEMCP
IsValidCodePage
GetModuleHandleExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CreateSemaphoreW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
RtlUnwind
IsDebuggerPresent
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
LoadResource
SetProcessWorkingSetSize
WideCharToMultiByte
MultiByteToWideChar
LocalFree
SetThreadPriority
WaitForSingleObject
ResumeThread
CloseHandle
GetLastError
GetCurrentThreadId
GetStringTypeW
FindFirstFileExW
GetFileAttributesExW
GetSystemTimeAsFileTime
GetCurrentThread
GetExitCodeThread
EnterCriticalSection
LeaveCriticalSection
EncodePointer
GetACP
GetFileSize
ExitProcess
MulDiv
GetLocalTime
GlobalLock
GlobalUnlock
GetUserDefaultUILanguage
CreateThread
ExitThread
LoadLibraryExW
CreateTimerQueue
IsProcessorFeaturePresent
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
SetEvent
WaitForSingleObjectEx
SignalObjectAndWait
SwitchToThread
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLogicalProcessorInformation

user32

SetTimer
ExitWindowsEx
PostQuitMessage
ShowWindow
BringWindowToTop
PostMessageW
SendMessageW
GetWindowRect
MoveWindow
MonitorFromWindow
GetMonitorInfoW
EnableWindow
wsprintfW
SetWindowTextW
KillTimer
GetKeyState
FindWindowExW
GetGUIThreadInfo
InvalidateRgn
CreateAcceleratorTableW
GetSysColor
ClientToScreen
SetCaretPos
ShowCaret
HideCaret
CreateCaret
SetRect
FillRect
DrawTextW
CharPrevW
wvsprintfW
SetCursor
UnionRect
OffsetRect
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
IsWindow
SetWindowPos
IsIconic
SetFocus
GetSystemMetrics
SetPropW
GetPropW
GetClientRect
GetWindowLongW
SetWindowLongW
GetParent
GetWindow
LoadImageW
DestroyWindow
GetCaretPos
CharNextW
GetActiveWindow
GetFocus
IsWindowVisible
SetCapture
ReleaseCapture
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetCursorPos
ScreenToClient
MapWindowPoints
IntersectRect
IsRectEmpty
PtInRect
IsZoomed
SetWindowRgn
MessageBoxW
GetWindowTextW
GetWindowTextLengthW
GetCaretBlinkTime

advapi32

RegSetValueExW
OpenProcessToken
DuplicateTokenEx
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetEntriesInAclW
SetSecurityInfo
LookupPrivilegeValueW
AdjustTokenPrivileges
GetTokenInformation
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
RegCreateKeyW
RegOpenKeyW

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHChangeNotify
SHGetFolderPathW
ShellExecuteW
ShellExecuteExW
ord165
SHGetSpecialFolderPathW
SHGetMalloc

ole32

CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
OleLockRunning
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CoCreateInstance

wininet

InternetReadFile
HttpOpenRequestW
HttpSendRequestW
InternetCrackUrlW
HttpQueryInfoW
InternetConnectW
InternetCloseHandle
InternetOpenW

gdiplus

GdipDisposeImage
GdipCloneImage
GdipCreateLineBrushI
GdipDeleteBrush
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipGetPropertyItem
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetCompositingQuality
GdipSetSmoothingMode
GdipSetPixelOffsetMode
GdipSetTextRenderingHint
GdipCloneBrush
GdipGraphicsClear
GdipDrawImage
GdipDrawImageRectI
GdipDeleteFontFamily
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipGetFamily
GdipDrawString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipLoadImageFromStream
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipSetInterpolationMode

shlwapi

PathAppendW
PathFileExistsW

version

VerQueryValueA
GetFileVersionInfoW
GetFileVersionInfoSizeW

psapi

EnumProcessModules
GetModuleFileNameExW

iphlpapi

GetAdaptersInfo

comctl32

ord17
_TrackMouseEvent

imm32

ImmSetCompositionFontW
ImmReleaseContext
ImmGetContext
ImmGetVirtualKey
ImmSetCompositionWindow

gdi32

SetBkMode
SetTextColor
CreateRoundRectRgn
SetWindowOrgEx
GetObjectW
GetTextMetricsW
SelectObject
SaveDC
RestoreDC
CreateSolidBrush
GetStockObject
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
GetDeviceCaps
BitBlt
CreatePatternBrush
Rectangle
GetObjectA
GdiFlush
ExtTextOutW
TextOutW
MoveToEx
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
RoundRect
SelectClipRgn
ExtSelectClipRgn
SetBkColor
StretchBlt
SetStretchBltMode
CreateDIBSection

oleaut32

SysAllocString
SysFreeString
VariantClear
VariantInit

Sections

.text
Size: 880KB - Virtual size: 879KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 234KB - Virtual size: 233KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 333.2MB - Virtual size: 333.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2caf5bb506e72a719786dcd604a6557b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

wininet

gdiplus

shlwapi

version

psapi

iphlpapi

comctl32

imm32

gdi32

oleaut32

Sections

.text Size: 880KB - Virtual size: 879KB

.rdata Size: 234KB - Virtual size: 233KB

.data Size: 21KB - Virtual size: 55KB

.rsrc Size: 333.2MB - Virtual size: 333.2MB

.reloc Size: 50KB - Virtual size: 50KB

.text
Size: 880KB - Virtual size: 879KB

.rdata
Size: 234KB - Virtual size: 233KB

.data
Size: 21KB - Virtual size: 55KB

.rsrc
Size: 333.2MB - Virtual size: 333.2MB

.reloc
Size: 50KB - Virtual size: 50KB