12520eef278a20f1f67483f83a4d421090715cb8783b772e65d696ace9923819

Sharing

Copy URL Twitter E-mail

General

Target

12520eef278a20f1f67483f83a4d421090715cb8783b772e65d696ace9923819
Size

689KB
MD5

587a07b361071bc866a8894c687200f2
SHA1

0eaf3459d2bba72fbe4034abde3d10b1560be6a5
SHA256

12520eef278a20f1f67483f83a4d421090715cb8783b772e65d696ace9923819
SHA512

5f6548e08a7a0f1f460bedec2c8d86bebe2c967ed5730613785bbb622f22fa93cb685e3937decb0c7c26b9557dde323e1f733f17547da76bdb7ea6e1a0dafd62
SSDEEP

12288:Iqn6Lm4kx8tbf50Xc/jYfN3UQ9QUfISIR:I+6SDx8tSXX1EQ91i

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
12520eef278a20f1f67483f83a4d421090715cb8783b772e65d696ace9923819

Files

12520eef278a20f1f67483f83a4d421090715cb8783b772e65d696ace9923819
.exe windows:6 windows x86 arch:x86

1fbaefe8e5e9d740add4946be14a6ae9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

mstsc.pdb

Imports

advapi32

TraceMessage
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
RegEnumValueW
RegEnumKeyExW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegSetValueExA
CredWriteW
CredReadW
GetUserNameA
CredDeleteW
CredFree
CredReadDomainCredentialsW
CredWriteDomainCredentialsW
RegQueryValueExA
RegOpenKeyExA
CredUnmarshalCredentialW
RegSetValueExW
RegCreateKeyExW
RegCreateKeyExA

kernel32

ReadFile
GetFileSize
FormatMessageW
CreateDirectoryW
FindResourceExW
MapViewOfFile
CreateFileMappingW
InterlockedCompareExchange
GetLocaleInfoW
UnmapViewOfFile
HeapSetInformation
ExpandEnvironmentStringsW
CreateProcessW
GetCommandLineW
WideCharToMultiByte
GetFileAttributesExW
FindFirstFileW
FindNextFileW
FindClose
GetTempPathW
SetFilePointer
GetVersion
GetACP
CreateEventW
CreateThread
SetEvent
InterlockedDecrement
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
TlsFree
TlsAlloc
SearchPathW
InitializeCriticalSection
FindResourceW
LoadResource
LockResource
SystemTimeToFileTime
WriteFile
lstrlenW
GetSystemTime
WaitForSingleObject
LoadLibraryA
ExpandEnvironmentStringsA
HeapAlloc
DeleteCriticalSection
GetProcessHeap
HeapFree
LeaveCriticalSection
EnterCriticalSection
DeviceIoControl
VerifyVersionInfoW
LoadLibraryExW
GetModuleFileNameW
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
OutputDebugStringA
InterlockedExchange
FreeLibrary
LoadLibraryW
InterlockedIncrement
lstrcmpiW
MulDiv
DebugBreak
GetCurrentProcess
TerminateProcess
GetStartupInfoA
MultiByteToWideChar
GetProcAddress
GetVersionExA
SetLastError
Sleep
CreateMutexW
DeleteFileW
GetModuleHandleW
CreateFileW
CloseHandle
GetLastError
GetFullPathNameW
GetFileAttributesW
CompareStringW
LocalAlloc
LocalFree
GetCurrentDirectoryW
GetVersionExW

gdi32

BitBlt
SelectObject
CreateCompatibleDC
CreateFontIndirectW
TranslateCharsetInfo
SetMapMode
SetBkMode
SetTextColor
StretchBlt
CreateCompatibleBitmap
GetObjectW
DeleteDC
UpdateColors
GetDeviceCaps
RealizePalette
EqualRgn
SelectPalette
CreatePalette
GetDIBColorTable
CreateRectRgn
CreateRectRgnIndirect
DeleteObject
SetRectRgn
GetDCOrgEx
GetClipBox
CombineRgn
GetStockObject

user32

ShowWindow
IsIconic
GetWindowPlacement
FindWindowW
SendMessageTimeoutW
SystemParametersInfoA
IsDialogMessageW
SetForegroundWindow
PostMessageW
IsWindow
SendMessageW
SetWindowTextW
EnableMenuItem
AdjustWindowRect
IntersectRect
EnableWindow
CopyRect
EqualRect
CreateMenu
ModifyMenuW
GetSystemMenu
MoveWindow
GetClientRect
SetWindowPos
IsZoomed
LoadCursorW
SetCursor
AppendMenuW
SetWindowPlacement
UnregisterClassW
GetClassInfoExW
OffsetRect
GetWindowRect
LoadIconW
GetSystemMetrics
TranslateAcceleratorW
IsChild
PostQuitMessage
DestroyWindow
DefWindowProcW
GetWindowLongW
CreateWindowExW
RegisterClassExW
BeginPaint
LoadAcceleratorsW
DialogBoxParamW
CreateDialogParamW
KillTimer
SetTimer
SystemParametersInfoW
GetClassInfoW
DefDlgProcW
RegisterClassW
MonitorFromWindow
GetMonitorInfoW
LoadStringW
SetFocus
UpdateWindow
InvalidateRect
LockWindowUpdate
IsWindowVisible
GetDlgItem
AdjustWindowRectEx
GetDesktopWindow
ShowWindowAsync
GetMenu
RedrawWindow
IsWindowEnabled
SetRect
DestroyIcon
LoadImageW
GetMessageW
TranslateMessage
DispatchMessageW
GetCursorPos
ScreenToClient
GetWindowDC
DrawIconEx
DrawTextW
MapDialogRect
GetWindow
FillRect
CheckDlgButton
IsDlgButtonChecked
SendDlgItemMessageW
CreateDialogIndirectParamW
GetDlgItemTextW
MapWindowPoints
ReleaseDC
DrawIcon
EndPaint
EndDialog
SetDlgItemTextW
GetDC
SetWindowLongW

msvcrt

_errno
_wcslwr
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
wcsrchr
srand
time
wcschr
iswspace
toupper
_wtoi
wcspbrk
towlower
_acmdln
_initterm
_amsg_exit
__setusermatherr
_adjust_fdiv
iswdigit
_wtol
??_U@YAPAXI@Z
_wcsicmp
wcstok
_wcsnicmp
towupper
_vsnprintf
free
__p__commode
__p__fmode
__set_app_type
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
_controlfp
calloc
bsearch
ungetc
_fileno
_read
__pioinfo
__badioinfo
realloc
wcstombs
isdigit
wcsncmp
wcsstr
memmove
_vsnwprintf
memset
memcpy
_purecall
malloc
wctomb
??_V@YAXPAX@Z
localeconv
isxdigit
isleadbyte
__mb_cur_max
mbtowc
iswctype

ole32

CoCreateInstance
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoInitialize

oleaut32

SysAllocStringLen
SysAllocStringByteLen
VariantInit
VariantClear
SysStringLen
SysAllocString
SysFreeString

shell32

SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
ExtractIconW

comctl32

ImageList_ReplaceIcon
ImageList_GetImageCount
InitCommonControlsEx
ImageList_Create
ord17

comdlg32

GetSaveFileNameW
GetOpenFileNameW
GetFileTitleW

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathFindExtensionW
PathAppendW
ord388

crypt32

CertFreeCertificateContext
CertFreeCertificateChain
CryptBinaryToStringW
CryptStringToBinaryW
CertDuplicateCertificateContext
CertDuplicateCertificateChain
CertGetCertificateContextProperty
CertVerifyCertificateChainPolicy
CryptMsgClose
CertOpenStore
CryptMsgUpdate
CryptMsgOpenToDecode
CryptSignMessage
CertCloseStore
CryptVerifyDetachedMessageSignature
CryptDecodeObject
CertFindExtension
CertGetCertificateChain
CertGetEnhancedKeyUsage

credui

CredUIPromptForCredentialsW
CredUIParseUserNameW

cryptui

CryptUIDlgViewCertificateW

ntdll

RtlInitializeCriticalSection
NtOpenFile
RtlInitUnicodeString
VerSetConditionMask
RtlUnwind

winhttp

WinHttpCloseHandle
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpSendRequest
WinHttpQueryOption

secur32

QuerySecurityPackageInfoW
FreeContextBuffer
GetUserNameExW

netapi32

NetGetJoinInformation
NetApiBufferFree

Sections

.text
Size: 325KB - Virtual size: 325KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 308KB - Virtual size: 307KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1fbaefe8e5e9d740add4946be14a6ae9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ole32

oleaut32

shell32

comctl32

comdlg32

shlwapi

crypt32

credui

cryptui

ntdll

winhttp

secur32

netapi32

Sections

.text Size: 325KB - Virtual size: 325KB

.data Size: 5KB - Virtual size: 9KB

.rsrc Size: 308KB - Virtual size: 307KB

.reloc Size: 49KB - Virtual size: 50KB

.text
Size: 325KB - Virtual size: 325KB

.data
Size: 5KB - Virtual size: 9KB

.rsrc
Size: 308KB - Virtual size: 307KB

.reloc
Size: 49KB - Virtual size: 50KB