678f4f743afe6a0506d0fb19f2c5253f45a16f8d5cc9fed3bf790d036b881666

Sharing

Copy URL Twitter E-mail

General

Target

678f4f743afe6a0506d0fb19f2c5253f45a16f8d5cc9fed3bf790d036b881666
Size

14.4MB
MD5

4fd73419e15d2621bffb553d82bc0413
SHA1

26febf0897f7274fe37a11cfa7e977f0bc8e2660
SHA256

678f4f743afe6a0506d0fb19f2c5253f45a16f8d5cc9fed3bf790d036b881666
SHA512

d719a50f42aa126e5d0d1d3f5c687c299bc43cd633ec0c771a89642c9584245017c131081ff8b2e1a99b38813717d8522213c3e4e13abd4e0fc494c81c5ccb66
SSDEEP

393216:ZHBzKKceW/nWMxxrqg7fDLRHgtZ5Pl2oqpk+B3:ZHBzKrtWA9lg1PlyG+B3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
678f4f743afe6a0506d0fb19f2c5253f45a16f8d5cc9fed3bf790d036b881666

Files

678f4f743afe6a0506d0fb19f2c5253f45a16f8d5cc9fed3bf790d036b881666
.exe windows:6 windows x86 arch:x86

f2bef91fb73cbf721d9c78f563b78f44

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForMultipleObjects
SetThreadPriority
GetLocaleInfoW
GetFileAttributesW
ReleaseMutex
GetSystemDirectoryW
GetModuleHandleA
DisconnectNamedPipe
GetLogicalDriveStringsW
CreateEventW
FormatMessageW
GetFileAttributesExW
OutputDebugStringW
SetEvent
GetCurrentThread
TerminateThread
QueryPerformanceFrequency
LoadLibraryW
ResetEvent
GetCurrentDirectoryW
GetOverlappedResult
ExitProcess
VerSetConditionMask
FreeLibrary
VerifyVersionInfoW
QueryPerformanceCounter
GetDriveTypeW
IsDebuggerPresent
ConnectNamedPipe
SetUnhandledExceptionFilter
FlushFileBuffers
GlobalSize
GlobalAlloc
GlobalLock
GetCurrentProcessId
GlobalUnlock
MultiByteToWideChar
WideCharToMultiByte
SetFilePointerEx
UnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LockResource
InterlockedPopEntrySList
SetThreadAffinityMask
VirtualProtect
VirtualFree
VirtualAlloc
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
ReadConsoleW
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetFileType
SetEnvironmentVariableA
GetACP
GetStdHandle
GetModuleFileNameA
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
GetTimeZoneInformation
LoadLibraryExW
RtlUnwind
InterlockedFlushSList
InterlockedPushEntrySList
GetCPInfo
LCMapStringW
CompareStringW
EncodePointer
InitializeCriticalSectionAndSpinCount
SetLastError
DuplicateHandle
GetStringTypeW
FindFirstFileExW
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
IsProcessorFeaturePresent
WaitForSingleObjectEx
RemoveDirectoryW
CancelIo
GetVolumeInformationW
UnregisterWaitEx
TryEnterCriticalSection
HeapSize
FreeResource
FindClose
InitializeCriticalSectionEx
GetTempPathW
GetCommandLineW
GetCurrentThreadId
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateProcessW
MoveFileExW
GetProcAddress
GetDiskFreeSpaceExW
WaitForSingleObject
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
MoveFileW
GetTickCount
CopyFileW
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
FindResourceW
RaiseException
LoadResource
HeapReAlloc
ReleaseSemaphore
DeleteFileW
GetEnvironmentVariableW
FindNextFileW
HeapFree
FindFirstFileW
SizeofResource
CreateDirectoryW
GetVersionExW
CreateFileW
SetFilePointer
WriteFile
ReadFile
CloseHandle
GetLastError
Sleep
QueryDepthSList
CreateMutexW

user32

FindWindowW
UnregisterClassW
MessageBoxW
PostMessageW
SetForegroundWindow
GetForegroundWindow
AttachThreadInput
ShowWindow
SetWindowPos
GetWindowThreadProcessId
GetWindowTextW
MsgWaitForMultipleObjectsEx
GetSystemMenu
SetWindowLongW
TranslateMessage
SetFocus
EnumWindows
PeekMessageW
DispatchMessageW
RegisterClassExW
CreateWindowExW
DestroyWindow
GetFocus
SendMessageTimeoutW
DefWindowProcW
GetMessageW
GetWindowLongW
EndPaint
BeginPaint
GetCursorPos
ReleaseDC
SetCursorPos
GetAncestor
InvalidateRect
ReleaseCapture
GetParent
SystemParametersInfoW
EnableMenuItem
GetDesktopWindow
ShowCaret
GetClientRect
SetCursor
ToUnicode
SetClipboardData
SetCapture
DestroyCaret
LoadCursorW
GetClipboardData
SetLayeredWindowAttributes
GetMessageTime
TrackMouseEvent
CreateCaret
IsChild
EmptyClipboard
CloseClipboard
CreateIconIndirect
GetMonitorInfoW
GetWindowInfo
DestroyIcon
RedrawWindow
GetCapture
OpenClipboard
GetAsyncKeyState
GetActiveWindow
SetCaretPos
GetKeyboardState
PostQuitMessage
GetMessageExtraInfo
GetUpdateRgn
GetMessagePos
MapVirtualKeyW
GetWindowRect
GetDC
IsWindowVisible
EnumChildWindows
EnumDisplayMonitors
GetIconInfo
ScreenToClient
SendMessageW
GetSystemMetrics
SetWindowTextW
MessageBeep
WindowFromPoint
GetWindowPlacement
DestroyCursor

gdi32

CreateDIBSection
StretchDIBits
CreateRectRgnIndirect
GetPixel
CreateRectRgn
GetRegionData
GetObjectW
ExcludeClipRect
RestoreDC
CreateBitmap
CombineRgn
SelectObject
GetKerningPairsW
CreateCompatibleDC
EnumFontFamiliesExW
GetDeviceCaps
GetTextMetricsW
DeleteDC
SetMapperFlags
GetGlyphIndicesW
GetGlyphOutlineW
DeleteObject
RemoveFontMemResourceEx
SetMapMode
CreateFontIndirectW
GetOutlineTextMetricsW
SaveDC

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW

shell32

ExtractAssociatedIconW
SHGetMalloc
ShellExecuteW
SHGetPathFromIDListW
SHFileOperationW
ord165
SHGetKnownFolderPath
SHGetSpecialFolderPathW
CommandLineToArgvW
SHBrowseForFolderW

ole32

RevokeDragDrop
RegisterDragDrop
DoDragDrop
CoTaskMemAlloc
OleInitialize
OleUninitialize
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize
CoCreateGuid

shlwapi

PathFileExistsW
PathRemoveFileSpecW
PathStripToRootW

ws2_32

select
inet_ntoa
recv
getsockopt
send
setsockopt
accept
__WSAFDIsSet
WSAStartup
closesocket

winmm

timeGetTime
timeKillEvent
timeBeginPeriod

imm32

ImmNotifyIME
ImmGetCompositionStringW
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 344KB - Virtual size: 343KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 119.3MB - Virtual size: 119.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f2bef91fb73cbf721d9c78f563b78f44

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

shlwapi

ws2_32

winmm

imm32

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 344KB - Virtual size: 343KB

.data Size: 30KB - Virtual size: 43KB

.tls Size: 512B - Virtual size: 13B

.gfids Size: 3KB - Virtual size: 2KB

.rsrc Size: 119.3MB - Virtual size: 119.3MB

.reloc Size: 94KB - Virtual size: 94KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 344KB - Virtual size: 343KB

.data
Size: 30KB - Virtual size: 43KB

.tls
Size: 512B - Virtual size: 13B

.gfids
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 119.3MB - Virtual size: 119.3MB

.reloc
Size: 94KB - Virtual size: 94KB