baec4eaed1867d602bd709076d7b849713ae413cc26705e05a881f5df45d0f2a

Sharing

Copy URL Twitter E-mail

General

Target

baec4eaed1867d602bd709076d7b849713ae413cc26705e05a881f5df45d0f2a
Size

3.1MB
MD5

6774d25dee266539b2625a18203ad8e6
SHA1

ca0720334230422991f9676b8cf2543a571f5653
SHA256

baec4eaed1867d602bd709076d7b849713ae413cc26705e05a881f5df45d0f2a
SHA512

8e58e41407a5aa7484940b02db3df8ddebf3c21fe1d0b6eff1a7ae3fe7b57381b3ba5340b9d896569d9c303b53a67840341f1d62487e060978a557fdc0aeb4ca
SSDEEP

49152:JoExjLs4rmsvb7qArwDMeiYLAbsJnV0UWQacEJOSbSPmDHjQMiV6X:JoELmGPrwliYLAbsZCU2cEDbtDDN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
baec4eaed1867d602bd709076d7b849713ae413cc26705e05a881f5df45d0f2a

Files

baec4eaed1867d602bd709076d7b849713ae413cc26705e05a881f5df45d0f2a
.dll windows:6 windows x86 arch:x86

3a1d94a45c1b17f360f087498753622c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TlsAlloc
SetLastError
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
SetEnvironmentVariableW
GetEnvironmentVariableW
GetTimeZoneInformation
Sleep
RemoveDirectoryW
GetFileAttributesExW
QueryFullProcessImageNameW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
ResetEvent
SetEvent
CreateEventW
FindNextFileW
LoadLibraryA
SetEndOfFile
K32GetModuleFileNameExW
GetNativeSystemInfo
ResumeThread
GetDriveTypeW
GetLongPathNameW
SearchPathW
RaiseException
TlsSetValue
IsDebuggerPresent
SleepConditionVariableSRW
WakeAllConditionVariable
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeSListHead
GetCPInfo
GetStringTypeW
GetFileInformationByHandleEx
TlsFree
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
HeapFree
HeapAlloc
GetStdHandle
GetFileType
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetConsoleMode
ReadConsoleW
SetFilePointerEx
SetConsoleCtrlHandler
GetFileSizeEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapSize
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
WriteConsoleW
lstrcmpiW
GetLocalTime
VerifyVersionInfoW
MulDiv
VerSetConditionMask
FormatMessageW
LocalFree
SystemTimeToFileTime
WriteFile
SetFileTime
SetFilePointer
LocalFileTimeToFileTime
CreateDirectoryW
FindResourceW
SizeofResource
LockResource
LoadResource
FreeResource
ExitProcess
GetACP
GlobalLock
GlobalUnlock
GetTickCount
ReadFile
GetFileSize
GetCurrentDirectoryW
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
SetFileInformationByHandle
QueryPerformanceCounter
LCMapStringEx
GetLocaleInfoEx
EncodePointer
LeaveCriticalSection
EnterCriticalSection
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
FormatMessageA
GetCurrentProcess
OpenProcess
LoadLibraryW
FreeLibrary
GetCurrentThreadId
GetPrivateProfileStringW
GetModuleFileNameW
ExpandEnvironmentStringsW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
OutputDebugStringW
DeleteFileW
lstrcatW
GetFileAttributesW
FindClose
lstrlenW
GetSystemDefaultLCID
FindFirstFileW
GetCurrentProcessId
CreateFileW
SetErrorMode
InitializeCriticalSectionAndSpinCount
lstrcpyW
WideCharToMultiByte
GlobalFree
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
ConvertFiberToThread
ReadConsoleA
SetConsoleMode
DeleteFiber
AreFileApisANSI
GetFullPathNameW
GetFileInformationByHandle
GlobalAlloc
MultiByteToWideChar
lstrcpynW
CloseHandle
WaitForSingleObject
DeleteCriticalSection
DecodePointer
GetLastError
TlsGetValue
GetStartupInfoW

user32

SendMessageW
SetWindowPos
KillTimer
SetTimer
GetWindowLongW
wsprintfW
InvalidateRect
CharPrevW
GetActiveWindow
ShowWindow
PostMessageW
GetParent
SetWindowTextW
GetProcessWindowStation
CharNextW
RegisterClassExW
IsWindow
IsIconic
EnableWindow
MapVirtualKeyExW
GetKeyNameTextW
GetKeyboardLayout
GetGUIThreadInfo
InvalidateRgn
CreateAcceleratorTableW
DrawTextA
wsprintfA
IsWindowEnabled
EqualRect
UpdateWindow
ClientToScreen
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
GetCaretBlinkTime
CreateCaret
TrackPopupMenu
AppendMenuW
EnableMenuItem
DestroyMenu
CreatePopupMenu
SetRect
FillRect
DrawTextW
GetWindowRgn
MoveWindow
UpdateLayeredWindow
GetUserObjectInformationW
SetWindowRgn
InflateRect
SetCursor
LoadCursorW
GetPropW
SetPropW
GetSystemMetrics
GetClassInfoExW
MessageBoxW
RegisterClassW
CallWindowProcW
PostQuitMessage
DefWindowProcW
LoadImageW
SetWindowLongW
PtInRect
IsRectEmpty
OffsetRect
UnionRect
IntersectRect
GetSysColor
ScreenToClient
GetCursorPos
GetUpdateRect
EndPaint
BeginPaint
ReleaseCapture
SetCapture
GetKeyState
GetFocus
SetFocus
IsZoomed
IsWindowVisible
DestroyWindow
CreateWindowExW
DispatchMessageW
TranslateMessage
GetMessageW
GetMonitorInfoW
MonitorFromWindow
GetWindow
MapWindowPoints
GetWindowRect
GetClientRect
GetWindowTextLengthW
GetWindowTextW
ReleaseDC
GetDC
SetForegroundWindow

gdi32

GetBitmapBits
SetBitmapBits
CreateCompatibleDC
GetDeviceCaps
GdiFlush
TextOutW
MoveToEx
GetObjectA
SetTextColor
SetStretchBltMode
StretchBlt
SetBkMode
SetBkColor
GetStockObject
BitBlt
CreatePatternBrush
CreateCompatibleBitmap
GetTextExtentPointA
ExtSelectClipRgn
SelectClipRgn
LineTo
GetTextExtentPoint32W
GetClipBox
GetCharABCWidthsW
CreateSolidBrush
CreateRectRgnIndirect
CreatePenIndirect
CombineRgn
CreateDIBSection
PtInRegion
CreateRectRgn
CreateRoundRectRgn
SetWindowOrgEx
GetObjectW
GetTextMetricsW
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateEnhMetaFileW
CloseEnhMetaFile
SelectObject
SaveDC
RestoreDC
Rectangle
RemoveFontMemResourceEx
AddFontMemResourceEx
DeleteObject
DeleteDC
CreatePen
CreateDIBitmap
CreateFontIndirectW

advapi32

RegCloseKey
RegOpenCurrentUser
RegCreateKeyExW
RegQueryInfoKeyA
RegDeleteKeyW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
GetUserNameW
CryptReleaseContext
RegEnumValueW

shell32

SHBrowseForFolderW
SHGetSpecialFolderPathW
DragQueryFileW
ShellExecuteExW
SHGetSpecialFolderLocation
SHGetPathFromIDListW

ole32

OleLockRunning
CLSIDFromString
CreateStreamOnHGlobal
ReleaseStgMedium
CLSIDFromProgID
CoInitialize
DoDragDrop
CoCreateInstance
CoTaskMemFree
OleInitialize
CoUninitialize
OleDuplicateData

oleaut32

VariantInit
VariantClear
SysFreeString
SysAllocString

comctl32

ord17
_TrackMouseEvent
InitCommonControlsEx

gdiplus

GdipAlloc
GdipCreatePath
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipDrawImageRectI
GdipGetPropertyItem
GdiplusShutdown
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipGetImageWidth
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdiplusStartup
GdipGetPropertyItemSize
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipFillPath
GdipFillRectangleI
GdipDrawPath
GdipDrawRectangleI
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipSetPenMode
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipAddPathArc
GdipAddPathLine
GdipDeletePath
GdipFree

imm32

ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow

shlwapi

PathFileExistsW

ws2_32

gethostbyname
gethostname
WSAStartup
closesocket
WSASetLastError
send
recv
WSAGetLastError
WSACleanup

crypt32

CertFindCertificateInStore
CertCloseStore
CertEnumCertificatesInStore
CertOpenStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext

bcrypt

BCryptGenRandom

Exports

Exports

AceCheckInstDir
AceCheckInstall
AceDelInstallConfig
AceExtractDll
AceGetCheckValue
AceGetInstDir
AceGetInstLanguageResID
AceGetLanguage
AceGetSilentLanguageResID
AceInit
AceOnSetup
AceOnSetupPost
AceOnUninstall
AcePopInt
AcePopString
AcePushInt
AcePushString
AceSaveInstallConfig
AceShowInstall
AceShowUnInstall

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 658KB - Virtual size: 658KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 238KB - Virtual size: 237KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3a1d94a45c1b17f360f087498753622c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

gdiplus

imm32

shlwapi

ws2_32

crypt32

bcrypt

Exports

Exports

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 658KB - Virtual size: 658KB

.data Size: 21KB - Virtual size: 45KB

.rsrc Size: 238KB - Virtual size: 237KB

.reloc Size: 97KB - Virtual size: 96KB

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 658KB - Virtual size: 658KB

.data
Size: 21KB - Virtual size: 45KB

.rsrc
Size: 238KB - Virtual size: 237KB

.reloc
Size: 97KB - Virtual size: 96KB