fd2142e31d8c9f22351b40157b8a45723156f671f9b8fbda9d50cdf1c37401ad

Sharing

Copy URL

Twitter E-mail

General

Target

fd2142e31d8c9f22351b40157b8a45723156f671f9b8fbda9d50cdf1c37401ad
Size

766KB
MD5

fe12b1b0484d54cdd5939ed83e513afc
SHA1

13d3c2ab57b160b9b641496842e963a9e1e5b203
SHA256

fd2142e31d8c9f22351b40157b8a45723156f671f9b8fbda9d50cdf1c37401ad
SHA512

41fb683caac072b7ba6a48344dfd4deb6409f42e57fd31023b1da5a924dd4de83c6538308da67d1d051dd3b8c57f1a74f827c90c3fd0def854cd6a7fd51b86e9
SSDEEP

12288:UZIbjEIxKPzbAEMGmefOeXydyjmqlDKr/gDiZV8vTz4thGaPAr6TG6uqpRaC2S69:ArIxKPzbjR9ftXydCbuMO38vTz8PPArR

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/8P8S8Rn.exe
unpack001/ClHook.dll

Files

fd2142e31d8c9f22351b40157b8a45723156f671f9b8fbda9d50cdf1c37401ad
.zip
8P8S8Rn.exe
.exe windows:5 windows x86 arch:x86

c08fed9838bb96c03f806b2b7e4b8bc4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileW
ExpandEnvironmentStringsW
GetDateFormatW
InterlockedIncrement
InterlockedDecrement
GlobalLock
GlobalAlloc
TerminateThread
GetTimeFormatW
FileTimeToSystemTime
CompareStringW
GlobalUnlock
GlobalFree
FileTimeToLocalFileTime
LocalFree
GetTempFileNameW
SetEndOfFile
CopyFileW
MultiByteToWideChar
GetTempPathW
CreateProcessW
SetThreadExecutionState
GetPrivateProfileStringW
SetSystemPowerState
TerminateProcess
GlobalReAlloc
SetEnvironmentVariableA
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
LCMapStringW
HeapSize
GetFileTime
GetSystemTimeAsFileTime
QueryPerformanceCounter
DeleteCriticalSection
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
GetStringTypeW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsProcessorFeaturePresent
RaiseException
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DecodePointer
ExitProcess
GetModuleHandleW
LeaveCriticalSection
EnterCriticalSection
GetStartupInfoW
HeapSetInformation
GetCommandLineW
RtlUnwind
CreateThread
GetLastError
ExitThread
RemoveDirectoryW
MoveFileW
CreateFileW
SizeofResource
ReadFile
GetSystemDirectoryW
WriteFile
CreateDirectoryW
CompareFileTime
SetFilePointer
GetFileSize
EnumResourceNamesW
WideCharToMultiByte
GetModuleHandleA
FindNextFileW
FindClose
MulDiv
HeapCreate
HeapDestroy
HeapFree
FindFirstFileW
lstrcpyW
GetSystemTime
GetCurrentProcessId
GetWindowsDirectoryW
CloseHandle
GetCurrentThreadId
lstrcatW
lstrcmpiW
SetProcessWorkingSetSize
SetCurrentDirectoryW
LockResource
GetProcAddress
lstrlenW
lstrcmpW
GetModuleFileNameW
lstrcpynW
GetVersionExW
Sleep
LoadLibraryW
OpenProcess
GetProcessHeap
GetTickCount
WaitForSingleObject
GetUserDefaultLCID
GetCurrentProcess
SystemTimeToFileTime
LoadLibraryExW
HeapAlloc
LoadResource
FreeLibrary
FindResourceW
SetPriorityClass
HeapReAlloc
WriteConsoleW

user32

BeginPaint
GetDC
SetDlgItemInt
InvalidateRect
GetWindowTextW
ReleaseDC
GetDlgItem
EndDialog
SendDlgItemMessageW
GetSysColor
CheckDlgButton
IsDlgButtonChecked
GetKeyNameTextW
CheckRadioButton
SetWindowsHookExW
UnhookWindowsHookEx
MessageBoxW
GetDlgItemTextW
SetDlgItemTextW
EnableWindow
GetDlgCtrlID
SetWindowTextW
GetClientRect
IsWindowEnabled
CallNextHookEx
GetParent
GetFocus
DrawIconEx
LoadImageW
FillRect
MapVirtualKeyW
GetDlgItemInt
EndPaint
IsRectEmpty
UpdateWindow
IntersectRect
OffsetRect
GetIconInfo
DispatchMessageW
MoveWindow
GetShellWindow
GetWindowThreadProcessId
CheckMenuItem
DefWindowProcW
CallWindowProcW
GetMonitorInfoW
DestroyIcon
DestroyMenu
SendMessageW
ClientToScreen
DestroyWindow
SendNotifyMessageW
SetCursor
EnumDisplayMonitors
CloseClipboard
SetTimer
ScreenToClient
GetWindowRect
GetMessageW
MonitorFromPoint
PostQuitMessage
RegisterWindowMessageW
SetRectEmpty
DrawTextW
InvertRect
RegisterClipboardFormatW
CopyRect
IsIconic
ExitWindowsEx
EnumWindows
GetClassNameW
CreateIconFromResource
IsWindow
SetMenuDefaultItem
SetParent
SystemParametersInfoW
EmptyClipboard
SetClipboardData
CharNextW
CreateIconFromResourceEx
CharPrevW
LookupIconIdFromDirectoryEx
CharUpperW
SetFocus
IsWindowVisible
GetSystemMetrics
ReleaseCapture
OpenClipboard
PostThreadMessageW
CreateWindowExW
ShowWindow
LoadStringW
GetCursorPos
SetWindowPos
GetDesktopWindow
SetWindowLongW
EnableMenuItem
SetClassLongW
GetClipboardData
GetWindowLongW
BringWindowToTop
LoadMenuW
CheckMenuRadioItem
SetRect
GetAsyncKeyState
TrackPopupMenuEx
LoadIconW
RegisterClassExW
GetForegroundWindow
TranslateMessage
InsertMenuItemW
GetDoubleClickTime
wsprintfW
PtInRect
FindWindowW
WindowFromPoint
LoadCursorW
AttachThreadInput
TrackMouseEvent
DialogBoxParamW
SetForegroundWindow
GetSubMenu
KillTimer
PostMessageW
SetCapture
CreatePopupMenu

gdi32

StretchBlt
CreateFontIndirectW
DeleteDC
BitBlt
GetClipRgn
Polygon
GetDIBits
MoveToEx
CreatePolygonRgn
CreateDIBitmap
SetDIBits
CreateDIBSection
SelectClipRgn
CreateCompatibleDC
CombineRgn
SetStretchBltMode
CreateCompatibleBitmap
CreateRectRgn
GetPixel
GetObjectA
GetTextExtentPoint32W
SetTextColor
GetDeviceCaps
SetBkMode
DeleteObject
SelectObject
Rectangle
CreatePen
LineTo
CreateSolidBrush
GetStockObject

comdlg32

GetSaveFileNameW
GetOpenFileNameW
ChooseFontW
ChooseColorW

advapi32

GetUserNameW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW

shell32

ShellExecuteExW
SHEmptyRecycleBinW
SHQueryRecycleBinW
ShellExecuteW
ExtractIconExW
SHBrowseForFolderW
DuplicateIcon
SHGetPathFromIDListW
SHFileOperationW
SHGetFileInfoW
DragQueryFileW
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetMalloc
Shell_NotifyIconW

ole32

RegisterDragDrop
RevokeDragDrop
DoDragDrop
OleDuplicateData
ReleaseStgMedium
CoCreateInstance
CoInitializeEx
CoUninitialize
OleUninitialize
OleInitialize

comctl32

ord17
ImageList_ReplaceIcon
ImageList_Create
CreatePropertySheetPageW
PropertySheetW
ImageList_Destroy
ImageList_GetIcon

imm32

ImmGetContext
ImmSetOpenStatus
ImmGetOpenStatus
ImmReleaseContext

shlwapi

PathFindFileNameW
PathFileExistsW
PathIsDirectoryW
PathIsURLW
PathIsUNCW
StrStrIW
PathCombineW
PathUnquoteSpacesW
PathRemoveBackslashW
PathAddBackslashW
StrFormatByteSizeW
PathIsRootW
PathAppendW
StrDupW
AssocQueryStringW
PathIsSameRootW
PathRemoveFileSpecW
PathRemoveBlanksW
StrRetToBufW
PathRenameExtensionW
PathQuoteSpacesW
PathRemoveExtensionW

gdiplus

GdipDrawPolygonI
GdipDrawRectangleI
GdipFillPolygonI
GdiplusStartup
GdipCreateFontFromDC
GdipSetPenLineJoin
GdipDeleteStringFormat
GdipCreatePen1
GdipCreatePath
GdipCreateStringFormat
GdipCloneImage
GdipFillRectangleI
GdipSetInterpolationMode
GdipFillPath
GdipCreateFromHDC
GdipSetCompositingMode
GdipDrawString
GdipDeletePath
GdipGetFontSize
GdipAddPathString
GdipDisposeImage
GdipAlloc
GdipCreateSolidFill
GdipDeleteFontFamily
GdipGetFamily
GdipSetSmoothingMode
GdipSetStringFormatAlign
GdipDrawImageRectI
GdipGetFontStyle
GdipDeleteGraphics
GdipDeleteFont
GdipDrawPath
GdipSetTextRenderingHint
GdipSetStringFormatLineAlign
GdipMeasureString
GdipCreateBitmapFromHICON
GdipCreateFontFromLogfontA
GdipCloneBrush
GdipDeletePen
GdipFree
GdipDeleteBrush
GdipSetStringFormatFlags
GdiplusShutdown
GdipCreatePen2

Sections

.text
Size: 575KB - Virtual size: 574KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ClHook.dll
.dll windows:4 windows x86 arch:x86

c6ee2d77f5654551843ea97d0effbf4f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCPInfo
GetOEMCP
RtlUnwind
RaiseException
HeapFree
GetCommandLineA
TerminateProcess
HeapAlloc
HeapSize
HeapReAlloc
GetACP
GetTimeZoneInformation
SetUnhandledExceptionFilter
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
Sleep
IsBadReadPtr
IsBadCodePtr
SetStdHandle
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetLocaleInfoW
InterlockedExchange
SetEndOfFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileA
GetCurrentProcess
GetProcessVersion
FreeLibrary
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GetLastError
GetModuleHandleA
SetLastError
MultiByteToWideChar
WideCharToMultiByte
InterlockedIncrement
WritePrivateProfileStringA
GlobalFlags
GetVersion
lstrlenA
lstrcpynA
lstrcpyA
lstrcatA
SetErrorMode
InterlockedDecrement
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
GlobalUnlock
GlobalFree
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalFree
LocalAlloc
CloseHandle
GlobalLock
GlobalAlloc
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
GetCurrentThreadId
ExitProcess
GetModuleFileNameA
CopyFileA
VirtualAlloc
LoadLibraryA
GetProcAddress

advapi32

RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
GetUserNameA

comctl32

ord17

user32

SystemParametersInfoA
RegisterWindowMessageA
SetForegroundWindow
GetForegroundWindow
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
DestroyWindow
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
DestroyMenu
IsIconic
GetWindowPlacement
GetSystemMetrics
SetFocus
ShowWindow
SetWindowPos
SetWindowLongA
GetDlgItem
GrayStringA
DrawTextA
TabbedTextOutA
ReleaseDC
GetDC
GetMenuItemCount
wsprintfA
GetWindowTextA
SetWindowTextA
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameA
UnregisterClassA
UnhookWindowsHookEx
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
PeekMessageA
GetCursorPos
SetWindowsHookExA
GetParent
PostQuitMessage
PostMessageA
SendMessageA
SetCursor
EnableWindow
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
MessageBoxA
PtInRect

gdi32

SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
GetDeviceCaps
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetObjectA
SetBkColor
GetStockObject
SelectObject
RestoreDC
CreateBitmap
DeleteDC
DeleteObject
SaveDC

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

Exports

Exports

_ClCheckFullScreen
_ClCheckMouseCircle
_ClCheckPtOnEdge
_ClGetDllVersion
_ClGetReqForeground
_ClIsExplorerWindow
_ClOperateKeyboardHook
_ClOperateMouseHook
_ClSendSettings
_ClSetReqForeground

Sections

.text
Size: 188KB - Virtual size: 187KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
longlq.cl
p.mgc

Sharing

General

Malware Config

Signatures

Files

c08fed9838bb96c03f806b2b7e4b8bc4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

comctl32

imm32

shlwapi

gdiplus

Sections

.text Size: 575KB - Virtual size: 574KB

.rdata Size: 96KB - Virtual size: 95KB

.data Size: 6KB - Virtual size: 42KB

.rsrc Size: 75KB - Virtual size: 74KB

.reloc Size: 39KB - Virtual size: 38KB

c6ee2d77f5654551843ea97d0effbf4f

Headers

File Characteristics

Imports

kernel32

advapi32

comctl32

user32

gdi32

winspool.drv

Exports

Exports

Sections

.text Size: 188KB - Virtual size: 187KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 20KB - Virtual size: 33KB

.reloc Size: 20KB - Virtual size: 18KB

.text
Size: 575KB - Virtual size: 574KB

.rdata
Size: 96KB - Virtual size: 95KB

.data
Size: 6KB - Virtual size: 42KB

.rsrc
Size: 75KB - Virtual size: 74KB

.reloc
Size: 39KB - Virtual size: 38KB

.text
Size: 188KB - Virtual size: 187KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 20KB - Virtual size: 33KB

.reloc
Size: 20KB - Virtual size: 18KB