0413f2f2365bfd385770efafbf00ce675bf2e5b64ca4d8bad7072b0d80381cfd

Sharing

Copy URL Twitter E-mail

General

Target

0413f2f2365bfd385770efafbf00ce675bf2e5b64ca4d8bad7072b0d80381cfd
Size

3.6MB
MD5

fedd9f9f9b97cac8e7fd5cead5fb0dc0
SHA1

c2184c782064aae87aa69c74a72ca59245fe7017
SHA256

0413f2f2365bfd385770efafbf00ce675bf2e5b64ca4d8bad7072b0d80381cfd
SHA512

df4e7bf1f6bb3d8fb981bc03df6fc6e66a0a66ef8ce060989dcdb2be5d7cac6fa7d27e7ad45d271f9cc34c1f35f74a9222e625975408f910494b7f062dae4ec5
SSDEEP

49152:GCs7YDbu5IHjb33zxEcArGc6fwTuQ3QdCe4FI8SPG7DC0yJYXL0jj45:GCs7YW5+L3yGDfwA0/p7DjSC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0413f2f2365bfd385770efafbf00ce675bf2e5b64ca4d8bad7072b0d80381cfd

Files

0413f2f2365bfd385770efafbf00ce675bf2e5b64ca4d8bad7072b0d80381cfd
.exe windows:5 windows x86 arch:x86

9ae186797bac5811ba59eb3f67210cab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertFindCertificateInStore
CertOpenStore
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertEnumCertificatesInStore
CertCloseStore

ws2_32

sendto
WSACloseEvent
WSACreateEvent
WSAEventSelect
WSAGetLastError
WSAEnumNetworkEvents
WSACleanup
WSAStartup
getnameinfo
htonl
__WSAFDIsSet
select
ioctlsocket
accept
listen
gethostname
getaddrinfo
freeaddrinfo
recvfrom
shutdown
WSAIoctl
WSASetLastError
getpeername
getsockname
socket
ntohs
send
closesocket
setsockopt
htons
getsockopt
recv
connect
bind

wldap32

ord145
ord216
ord142
ord41
ord14
ord147
ord79
ord27
ord26
ord127
ord46
ord117
ord301
ord219
ord133
ord208
ord167

kernel32

GlobalUnlock
GlobalFree
CloseHandle
GetCurrentProcessId
SleepEx
WideCharToMultiByte
WaitForSingleObjectEx
GetEnvironmentVariableA
MoveFileExW
FormatMessageW
GetSystemDirectoryW
QueryPerformanceFrequency
ReadFile
GetStdHandle
WaitForMultipleObjects
PeekNamedPipe
GetFileType
QueryPerformanceCounter
VerSetConditionMask
VerifyVersionInfoW
CompareFileTime
GetSystemTimeAsFileTime
HeapFree
HeapSize
HeapReAlloc
HeapAlloc
GetProcessHeap
FindFirstFileW
FindNextFileW
GetCurrentProcess
SetFilePointer
CreateFileW
UnmapViewOfFile
DuplicateHandle
GetFileInformationByHandle
FileTimeToSystemTime
GetLocalTime
GetFileSize
SystemTimeToFileTime
GetSystemTime
CreateFileMappingW
MapViewOfFile
FileTimeToDosDateTime
OutputDebugStringW
SetCurrentDirectoryW
GetCurrentDirectoryW
IsBadStringPtrW
IsBadStringPtrA
GetACP
FreeResource
LockResource
ExitProcess
MulDiv
SetFileTime
DosDateTimeToFileTime
CreateDirectoryW
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryA
DeleteFileW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
FormatMessageA
InitOnceComplete
InitOnceBeginInitialize
LocalFree
FindFirstFileExW
GetFileAttributesExW
GetFullPathNameW
SetEndOfFile
SetFileInformationByHandle
SetFilePointerEx
AreFileApisANSI
GetCommandLineA
GetOEMCP
IsValidCodePage
CreateFileA
GetFileInformationByHandleEx
GetStringTypeW
EncodePointer
LCMapStringEx
GetCPInfo
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
SetStdHandle
FlushFileBuffers
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
HeapQueryInformation
GetTimeZoneInformation
GetConsoleOutputCP
SetConsoleCtrlHandler
WriteConsoleW
FreeLibraryAndExitThread
ExitThread
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
GetSystemInfo
HeapValidate
RtlUnwind
VirtualQuery
GetStartupInfoW
CreateEventW
ResetEvent
SetEvent
TerminateProcess
WriteFile
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
CreateProcessA
GetTempPathA
SetLastError
GetLastError
GetModuleFileNameA
CreateThread
LoadLibraryW
Sleep
GetTickCount
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
RaiseException
DeleteCriticalSection
FlushInstructionCache
GlobalLock
GlobalAlloc
CopyFileA
FindClose
FindNextFileA
FindFirstFileA
DecodePointer
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
lstrcmpiW
GetModuleHandleW
GetProcAddress
FreeLibrary
InitializeCriticalSectionEx

user32

CreateCaret
SetRect
FillRect
DrawTextW
CharPrevW
SetWindowRgn
IsZoomed
OffsetRect
InflateRect
SetCursor
wvsprintfW
IsRectEmpty
UnionRect
IntersectRect
GetCursorPos
InvalidateRect
GetUpdateRect
EndPaint
BeginPaint
KillTimer
ReleaseCapture
SetCapture
GetKeyState
GetFocus
IsWindowVisible
DestroyWindow
LoadImageW
GetCaretBlinkTime
AdjustWindowRectEx
GetPropW
SetPropW
GetMenu
EnableWindow
SetFocus
IsIconic
CreateWindowExW
GetClassInfoExW
GetSysColor
RegisterClassW
CallWindowProcW
DefWindowProcW
PostMessageW
DispatchMessageW
TranslateMessage
GetMessageW
wsprintfW
PostQuitMessage
SetTimer
LoadBitmapW
SendMessageW
PtInRect
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
MoveWindow
CreateAcceleratorTableW
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
LoadCursorW
ClientToScreen
ScreenToClient
GetWindowDC
ShowWindow
SetDlgItemTextW
GetDlgItem
GetWindow
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
GetParent
IsWindow
GetClientRect
MapWindowPoints
SetWindowPos
GetDesktopWindow
GetSystemMetrics
ReleaseDC
GetDC
CharNextW
SetWindowLongW
DialogBoxParamW
UnregisterClassW
GetActiveWindow
InvalidateRgn
GetGUIThreadInfo
GetProcessWindowStation
RegisterClassExW
GetUserObjectInformationW
MessageBoxW
EndDialog

gdi32

DeleteDC
GetStockObject
SelectPalette
GetObjectW
GetDeviceCaps
RealizePalette
CreatePatternBrush
GetObjectA
GdiFlush
ExtTextOutW
TextOutW
MoveToEx
CreateDIBSection
SetTextColor
SetStretchBltMode
StretchBlt
SetBkMode
ExtSelectClipRgn
SelectClipRgn
RoundRect
LineTo
GetTextExtentPoint32W
GetClipBox
GetCharABCWidthsW
CreateSolidBrush
CreateRectRgnIndirect
CreatePenIndirect
CombineRgn
CreateRoundRectRgn
SetWindowOrgEx
GetTextMetricsW
SaveDC
RestoreDC
Rectangle
CreatePen
CreateFontIndirectW
GetObjectType
SetViewportOrgEx
SetBkColor
DeleteObject
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetDIBits
CreateDCA

advapi32

CryptSignHashW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptEnumProvidersW
RegDeleteKeyW
CryptDestroyHash

ole32

CoTaskMemRealloc
CoTaskMemAlloc
CoInitialize
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CLSIDFromString
CLSIDFromProgID
OleLockRunning
CreateStreamOnHGlobal
CoTaskMemFree
CoCreateInstance

oleaut32

VariantInit
VariantClear
SysFreeString
SysAllocString
VarUI4FromStr

shlwapi

PathFindFileNameA
PathAppendA
PathFileExistsA
wvnsprintfW

comctl32

_TrackMouseEvent
ord17

gdiplus

GdiplusStartup
GdipCloneBrush
GdipDeleteBrush
GdipCreateLineBrushI
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetCompositingQuality
GdipSetSmoothingMode
GdipSetPixelOffsetMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipGraphicsClear
GdipDrawImage
GdipDrawImageRectI
GdipDeleteStringFormat
GdipFree
GdipDeleteFontFamily
GdipCreateFontFromDC
GdipAlloc
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipGetFamily
GdipDrawString
GdipCreateStringFormat
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipGetImageWidth
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdiplusShutdown

iphlpapi

GetAdaptersInfo

imm32

ImmSetCompositionFontW
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow

bcrypt

BCryptGenRandom

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 715KB - Virtual size: 715KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 277KB - Virtual size: 277KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9ae186797bac5811ba59eb3f67210cab

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

ws2_32

wldap32

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shlwapi

comctl32

gdiplus

iphlpapi

imm32

bcrypt

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 715KB - Virtual size: 715KB

.data Size: 33KB - Virtual size: 62KB

.rsrc Size: 277KB - Virtual size: 277KB

.reloc Size: 116KB - Virtual size: 116KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 715KB - Virtual size: 715KB

.data
Size: 33KB - Virtual size: 62KB

.rsrc
Size: 277KB - Virtual size: 277KB

.reloc
Size: 116KB - Virtual size: 116KB