1188a7daa5fdcd64ebdb55b792b0029df6911ce7810eae026840f4f2225c0486

Sharing

Copy URL Twitter E-mail

General

Target

1188a7daa5fdcd64ebdb55b792b0029df6911ce7810eae026840f4f2225c0486
Size

776KB
MD5

8db18cb085391706375c6a45aeed94a6
SHA1

f646b81baefd9c471ac7405e2172e937ba6b51fe
SHA256

1188a7daa5fdcd64ebdb55b792b0029df6911ce7810eae026840f4f2225c0486
SHA512

4c538604a7cde0d4a252fed9aa30a320608a6db7465fe7bf7a7c349d94a95b79f0ff8e2f9cefcf02ca403d044c828dce24eb92f6d8e9ea9c22a1414aac8d4c6f
SSDEEP

12288:FWFXWeW2OApxynCTlkLB/ZxJzdfEjmEwhoiG+ONb6DyauXIULa:gvWixyKkLLzdLvU+ONDauXIU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1188a7daa5fdcd64ebdb55b792b0029df6911ce7810eae026840f4f2225c0486

Files

1188a7daa5fdcd64ebdb55b792b0029df6911ce7810eae026840f4f2225c0486
.dll windows:4 windows x86 arch:x86

df5188acc0e61b3d0240f7a8a80c6379

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetCursorPos
GetParent
GetWindowThreadProcessId
GetSysColor
IsChild
GetFocus
GetClassNameW
SetRect
SetRectEmpty
CopyRect
DispatchMessageW
TranslateMessage
PeekMessageW
SetCursor
LoadCursorW
LoadStringW
wsprintfW
GetWindowRect
ScreenToClient
GetDC
ReleaseDC
IsRectEmpty
ClientToScreen

gdi32

DeleteDC
GetTextMetricsW
SelectObject
CreateFontIndirectW
GetDeviceCaps
CreateCompatibleDC
GetTextExtentPoint32W
EnumFontFamiliesExW
DeleteObject

advapi32

RegQueryValueExW
RegOpenKeyExW

oleacc

AccessibleObjectFromWindow

ole32

StringFromGUID2
CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

GetErrorInfo
CreateErrorInfo
SysAllocStringByteLen
SysStringByteLen
SysStringLen
SysFreeString
VariantInit
VariantClear
VariantChangeType
SysAllocString
VarI4FromStr
OleTranslateColor

wininet

InternetReadFile
InternetOpenW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
InternetCrackUrlW
InternetCloseHandle
InternetQueryDataAvailable
HttpQueryInfoW

shlwapi

PathFileExistsA
PathCreateFromUrlW
PathMakePrettyW
PathSkipRootW
PathFileExistsW
PathRemoveFileSpecW
SHGetValueW
UrlUnescapeW
PathFindExtensionW
PathFindFileNameW
UrlIsW
UrlHashW
UrlCombineW

psapi

GetModuleInformation

baselib

_InsertInScriptSetPreviousAction@12
_MakeObjectException@16
_InstallMsgFilter@4
_GetUpdateThesOption@24
_UpdateCRC32@12
_GetEngineThesOption@12
_GetVKeyTextEx@16
_InsertInScriptSelectUserInput@4
_wcschar@8
_EngineSimulationGetProperty@16
_GetModuleFromFunction@4
_InsertInScriptSetOrigValue@20
_AddEnumProperty@12
_LookupInDictionaryW@8
_TerminateDictionaryW@4
_InsertInDictionaryW@12
InvokeAPC
_RefreshObjectProperties@8
_InsertInScriptDestroy@8
_UnregisterObject@4
_NotifyClassObjectDestruction@8
_RegisterObject@20
_GetObjectOwnerWindow@4
_GetHandleFromObject@4
_SetObjectOwnerWindow@8
_InsertInScriptPreviousAction@4
_GetFirstChildObject@4
_RefreshObjectPropertiesPreviousAction@4
_TranslateAndCapture@28
_InitializeDictionaryW@4
_GetNextSiblingObject@4
_NotifyRecursiveObjectDestruction@8
_GetTypeOfObject@4
_GetObjectClass@8
_MapLibrary@4
_LinkFunctionEx@8
_UnmapLibrary@4
_StartEnumClassObjectProperty@12
_GetCurrentCodePage@0
_ConvertString@20
_wcslower@4
_IsEngineTranslationInitialized@0
_GetObjectScriptName@4
_InsertInScriptSelect@8
_wcsifind@8
_wcstoint@12
_GetObjectData@8
_GetClassFromName@4
_AddClassToList@16
_RegisterStandardControl@32
_GetObjectException@4
_InsertInScript@8
_GetObjectFromHWnd@4
_GetClassObjectProperty@20
_GetParentObject@4
_GetObjectClassName@12
_SetParentObject@8
_GetPropertyIndexFromName@4
_SetLastDisplayCall@8
snxprintfW
_wcsfind@8
_wcsncopy@12
_GetThesaurusInfo@8
_GetRuntimePath@0
_UnpackDatabase@16
_DisplaySystemErrorEx@12

sdkcontrollib

?AddToContent@CDropDownListBox@SimulatorControls@@QAEXAAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?Register@CSimulatorControlBase@SimulatorControls@@QAEPAUtObj@@PAUtClass@@PAU3@@Z
??1CDropDownListBox@SimulatorControls@@UAE@XZ
?SetControlPosition@CSimulatorControlBase@SimulatorControls@@QAEXABVCPosition@2@@Z
??0CPosition@SimulatorControls@@QAE@ABUtagRECT@@@Z
??0CDropDownListBox@SimulatorControls@@QAE@XZ
?TriggerSelectionEvent@CDropDownListBox@SimulatorControls@@QAEXV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?SetValue@CDropDownListBox@SimulatorControls@@QAEXABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?SetNumOfVisibleItems@CDropDownListBox@SimulatorControls@@QAEXI@Z
?GetProperty@CSimulatorControlBase@SimulatorControls@@QBEIQBGPAGI@Z
?Unregister@CSimulatorControlBase@SimulatorControls@@QAEXXZ
??0CBasicException@SimulatorControls@@QAE@ABV01@@Z
??0CInvalidArgumentException@SimulatorControls@@QAE@ABV01@@Z
??1CInvalidArgumentException@SimulatorControls@@UAE@XZ
??0CInvalidArgumentException@SimulatorControls@@QAE@QBDH0@Z
?EnumProperty@CSimulatorControlBase@SimulatorControls@@QAEHPAUtPropEnum@@@Z

baseguilib

?Free@CMemory@@SIXPAX@Z
?Malloc@CMemory@@SIPAXI@Z
?CreateAndThrow@COutOfMemory@@SIXPBDH@Z
?Malloc@CMemory@@SIPAXIPBDH@Z

coolctrls

?SetStyleOff@CPropertyManager@@QAEXI@Z
?SetStyle@CPropertyManager@@QAEXI_N@Z
?SetEventsHandler@CPropertyManager@@QAEXPAVIEventsHandler@1@@Z
?Create@CPropertyListCtrl@@QAEXABVCWnd@@I@Z
??4CPropertyListCtrl@@QAEAAV0@PBVCPropertyManager@@@Z
?AddCategoryItem@CPropertyManager@@QAEPAXABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
??0CPropertyItem@@QAE@ABQAX@Z
?SetValue@CPropertyItem@@QAEXABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?SetItemDisplayName@CPropertyManager@@QAEXPAXV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?SetComments@CPropertyItem@@QAEXABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
??1CPropertyItem@@QAE@XZ
??0CPropertyListCtrl@@QAE@XZ
??0CPropertyManager@@QAE@XZ
??1CPropertyListCtrl@@QAE@XZ
??1CPropertyManager@@QAE@XZ
?AddYesNoItem@CPropertyManager@@QAEPAXPAXABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@I_N@Z

kernel32

ExitProcess
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
CompareStringA
CompareStringW
LCMapStringW
TlsAlloc
SetLastError
IsValidLocale
IsValidCodePage
UnhandledExceptionFilter
FlushFileBuffers
SetHandleCount
TlsFree
EnumSystemLocalesA
GetUserDefaultLCID
HeapSize
TerminateProcess
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
SetUnhandledExceptionFilter
HeapDestroy
GetStdHandle
GetFileType
GetModuleHandleA
GetModuleFileNameA
GetProcAddress
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
VirtualProtect
GetSystemInfo
QueryPerformanceCounter
GetSystemTimeAsFileTime
IsBadCodePtr
GetTimeZoneInformation
GetACP
GetOEMCP
SetStdHandle
GetLocaleInfoW
LoadLibraryA
CreateFileA
FindClose
RtlUnwind
RaiseException
GetLocaleInfoA
LeaveCriticalSection
EnterCriticalSection
InterlockedExchange
WideCharToMultiByte
IsBadReadPtr
GetCurrentProcess
OutputDebugStringW
VirtualQuery
GetModuleFileNameW
GetSystemTime
MultiByteToWideChar
DeleteFileA
SetEndOfFile
SetEnvironmentVariableA
TlsSetValue
TlsGetValue
LCMapStringA
GetVersionExA
GetCommandLineA
GetCPInfo
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileW
FindNextFileW
HeapFree
HeapReAlloc
GetStartupInfoA
HeapAlloc
InterlockedDecrement
GetModuleHandleW
CloseHandle
WriteFile
GetFileSize
CreateFileW
GetCurrentThreadId
InterlockedIncrement
GetSystemDefaultLCID
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcessId
GetTickCount
Sleep
MulDiv
LocalFree
LocalUnlock
LocalLock
LocalReAlloc
LocalAlloc
lstrlenW
FormatMessageW
LocalSize
DeleteFileW
CopyFileW
ReadFile
SetFilePointer
GetLastError

Exports

Exports

_GetGrabbingPropertyListCtrl@8
_MainClassLink@4

Sections

.text
Size: 524KB - Virtual size: 521KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 176KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

df5188acc0e61b3d0240f7a8a80c6379

Headers

File Characteristics

Imports

user32

gdi32

advapi32

oleacc

ole32

oleaut32

wininet

shlwapi

psapi

baselib

sdkcontrollib

baseguilib

coolctrls

kernel32

Exports

Exports

Sections

.text Size: 524KB - Virtual size: 521KB

.rdata Size: 176KB - Virtual size: 172KB

.data Size: 16KB - Virtual size: 23KB

.rsrc Size: 4KB - Virtual size: 304B

.reloc Size: 52KB - Virtual size: 51KB

.text
Size: 524KB - Virtual size: 521KB

.rdata
Size: 176KB - Virtual size: 172KB

.data
Size: 16KB - Virtual size: 23KB

.rsrc
Size: 4KB - Virtual size: 304B

.reloc
Size: 52KB - Virtual size: 51KB