4ca0f71fbaa55f1b7eb031cc98418f5b[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

4ca0f71fbaa55f1b7eb031cc98418f5b.exe
Size

18.8MB
MD5

4ca0f71fbaa55f1b7eb031cc98418f5b
SHA1

266b9bcd793ca9511dfd89a6ed0ee8491fbd5e19
SHA256

d7043cc407c12f70081d454e349f5d2e86ae643728c788f1f736b78a529ac866
SHA512

a0140cac03c0c43d42201a63ba89527e342d3f1909ebf194f76e80240adc52c9e3668d06e9135f34032303cbbe704e1ad72f9e6c116dd92e56fe5943536724cd
SSDEEP

393216:QSTpcwdvmm4rvKZoBmqGQQfLSGoSm9XE5/LKFdu9CwJsv6tnpPx:QSKwdvm9rSOIqGQQfLSGoSm9XSXP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ca0f71fbaa55f1b7eb031cc98418f5b.exe

Files

4ca0f71fbaa55f1b7eb031cc98418f5b.exe
.exe windows:6 windows x86 arch:x86

4a67d9feedd543a10a742d9ea9dce09d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

dwmapi

DwmGetWindowAttribute
DwmSetWindowAttribute
DwmEnableBlurBehindWindow

imm32

ImmGetDefaultIMEWnd
ImmGetContext
ImmReleaseContext
ImmAssociateContext
ImmGetVirtualKey
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmNotifyIME
ImmGetOpenStatus
ImmGetCompositionStringW
ImmAssociateContextEx

oleaut32

SysAllocString
SafeArrayCreateVector
SafeArrayPutElement
VariantClear
VariantInit
SysFreeString

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW
SetupDiOpenDevRegKey
SetupDiOpenDeviceInterfaceW

shlwapi

AssocQueryStringW

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

api-ms-win-shcore-scaling-l1-1-1

SetProcessDpiAwareness
GetDpiForMonitor
GetProcessDpiAwareness

comdlg32

GetOpenFileNameW
GetSaveFileNameW

d3d9

Direct3DCreate9

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory2

dcomp

DCompositionCreateDevice

gdi32

RemoveFontResourceExW
AddFontMemResourceEx
RemoveFontMemResourceEx
SelectObject
EnumFontFamiliesExW
GetTextFaceW
GetCharABCWidthsW
GetCharABCWidthsFloatW
GetGlyphOutlineW
GetOutlineTextMetricsW
GetTextExtentPoint32W
GetCharWidthI
GetCharABCWidthsI
SetBkMode
SetGraphicsMode
SetTextColor
SetTextAlign
AddFontResourceExW
ExtTextOutW
GetDeviceCaps
CreateDIBSection
GdiFlush
BitBlt
ChoosePixelFormat
SetPixelFormat
OffsetRgn
SetLayout
CreateCompatibleBitmap
CreateDCW
CreateBitmap
DescribePixelFormat
GetPixelFormat
SwapBuffers
GetBitmapBits
GetObjectW
GetDIBits
SetWorldTransform
GetFontData
CreateFontIndirectW
CreateCompatibleDC
GetStockObject
DeleteDC
DeleteObject
CreateRectRgn
CombineRgn
GetTextMetricsW

dwrite

DWriteCreateFactory

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WakeByAddressSingle
WaitOnAddress

userenv

GetUserProfileDirectoryW

advapi32

RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
GetSidSubAuthorityCount
GetSidSubAuthority
GetNamedSecurityInfoW
LookupAccountSidW
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
GetTokenInformation
GetLengthSid
FreeSid
RegQueryInfoKeyW
RegOpenKeyExW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
SystemFunction036
OpenProcessToken
RegSetValueExW
LookupAccountNameW
GetUserNameW
RegNotifyChangeKeyValue
AddAccessAllowedAceEx
DuplicateToken
CopySid
AllocateAndInitializeSid
AddAccessDeniedAceEx
RegQueryValueExW

authz

AuthzFreeContext
AuthzInitializeContextFromSid
AuthzInitializeContextFromToken
AuthzInitializeResourceManager
AuthzAccessCheck
AuthzFreeResourceManager

kernel32

IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapSize
WriteConsoleW
GetSystemDirectoryW
GetUserDefaultLocaleName
GetStartupInfoW
CompareStringEx
GetCommandLineW
GetCurrentProcessId
LocalFree
AllocConsole
FreeConsole
AttachConsole
OutputDebugStringW
GetConsoleWindow
GetLastError
CloseHandle
DuplicateHandle
SetEvent
WaitForSingleObject
CreateEventW
Sleep
WaitForMultipleObjects
GetCurrentProcess
SwitchToThread
CreateThread
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
TerminateThread
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemInfo
MultiByteToWideChar
WideCharToMultiByte
GetACP
TerminateProcess
IsProcessorFeaturePresent
GetModuleFileNameW
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTime
GetLocalTime
LocalAlloc
FormatMessageW
CreateFileW
FlushFileBuffers
GetFileType
GetLogicalDrives
ReadFile
SetEndOfFile
SetFilePointerEx
WriteFile
SetErrorMode
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
GetLongPathNameW
RemoveDirectoryW
SetFileTime
GetTempPathW
GetVolumePathNamesForVolumeNameW
DeviceIoControl
CopyFileW
MoveFileW
MoveFileExW
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
GetFileInformationByHandleEx
FreeLibrary
GetModuleHandleExW
GetProcAddress
LoadLibraryW
GetModuleHandleW
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GetCurrencyFormatW
GetUserDefaultLCID
GetUserPreferredUILanguages
ResetEvent
WaitForSingleObjectEx
PeekNamedPipe
GetOverlappedResult
CancelIoEx
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
GetTimeZoneInformation
GetGeoInfoW
GetUserGeoID
FindFirstFileExW
FindNextFileW
GetCurrentPackageFullName
GetComputerNameExW
GetExitCodeProcess
OpenProcess
K32GetModuleFileNameExW
GetUserDefaultLangID
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
GetFileSizeEx
WTSGetActiveConsoleSessionId
GlobalAlloc
GlobalSize
GlobalUnlock
GlobalLock
CheckRemoteDebuggerPresent
ExpandEnvironmentStringsW
CreateProcessW
LoadLibraryA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisconnectNamedPipe
WaitNamedPipeW
WaitForMultipleObjectsEx
GlobalFree
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetEnvironmentVariableW
EnumSystemLocalesW
IsValidLocale
LCMapStringW
CompareStringW
HeapReAlloc
HeapAlloc
HeapFree
GetStdHandle
ExitProcess
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
SetFileAttributesW
SetStdHandle
FreeLibraryAndExitThread
ExitThread
GetCommandLineA
GetCPInfo
ReleaseMutex
CreateMutexW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
RaiseException
EncodePointer
InitializeSListHead
RtlUnwind
DecodePointer
LCMapStringEx
GetThreadPriority
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
LoadLibraryExW
GetSystemTimeAsFileTime
GetStringTypeW

netapi32

NetShareEnum
NetApiBufferFree

ole32

CoTaskMemFree
CoCreateInstance
CoInitializeEx
StringFromGUID2
OleInitialize
OleUninitialize
ReleaseStgMedium
CoLockObjectExternal
CoIncrementMTAUsage
CoCreateFreeThreadedMarshaler
RegisterDragDrop
CoCreateGuid
RevokeDragDrop
OleSetClipboard
OleGetClipboard
OleFlushClipboard
OleIsCurrentClipboard
DoDragDrop
CoGetMalloc
CoUninitialize

user32

SetWindowRgn
SetWindowTextW
GetWindowRect
AdjustWindowRectEx
AdjustWindowRectExForDpi
SetCursor
SetParent
GetWindowThreadProcessId
GetWindow
DestroyCursor
MonitorFromPoint
MonitorFromWindow
GetMonitorInfoW
GetDpiForWindow
GetAncestor
GetSysColor
LoadIconW
IsHungAppWindow
SetClipboardViewer
ChangeClipboardChain
AddClipboardFormatListener
RemoveClipboardFormatListener
SetMenu
DrawMenuBar
CreateMenu
CreatePopupMenu
DestroyMenu
InsertMenuW
AppendMenuW
ModifyMenuW
RemoveMenu
TrackPopupMenu
GetMenuItemInfoW
SetMenuItemInfoW
GetDisplayConfigBufferSizes
QueryDisplayConfig
DisplayConfigGetDeviceInfo
EnumDisplayMonitors
SetDisplayAutoRotationPreferences
GetMessageW
SendInput
GetPointerInfo
GetKeyboardLayout
IsWindowEnabled
CreateCaret
DestroyCaret
ShowCaret
SetCaretPos
FindWindowA
GetKeyState
GetKeyboardState
ToAscii
ToUnicode
MapVirtualKeyW
HiliteMenuItem
TrackPopupMenuEx
SetMenuDefaultItem
LoadImageW
GetCursor
EndPaint
CreateCursor
CreateIconIndirect
GetIconInfo
GetCursorInfo
TrackMouseEvent
GetMessageExtraInfo
GetAsyncKeyState
GetTouchInputInfo
CloseTouchInputHandle
GetPointerType
GetPointerFrameTouchInfo
GetPointerFrameTouchInfoHistory
GetPointerPenInfo
GetPointerPenInfoHistory
SkipPointerFrameMessages
GetPointerDeviceRects
ChangeWindowMessageFilterEx
IsZoomed
GetWindowPlacement
SetWindowPos
RegisterClassExW
GetClassInfoW
UnregisterPowerSettingNotification
RegisterPowerSettingNotification
RegisterWindowMessageW
UpdateLayeredWindowIndirect
DestroyIcon
GetDesktopWindow
GetCaretBlinkTime
MessageBeep
BeginPaint
SetForegroundWindow
GetForegroundWindow
EnableMenuItem
GetSystemMenu
GetMenu
GetSystemMetricsForDpi
ReleaseCapture
SetCapture
GetCapture
IsTouchWindow
UnregisterTouchWindow
RegisterTouchWindow
SetFocus
IsIconic
IsWindowVisible
SetWindowPlacement
IsWindow
GetDoubleClickTime
ReleaseDC
GetDC
SystemParametersInfoForDpi
SystemParametersInfoW
MessageBoxW
SetWindowLongW
GetWindowLongW
KillTimer
SetCoalescableTimer
SetTimer
MsgWaitForMultipleObjectsEx
GetQueueStatus
DestroyWindow
CreateWindowExW
UnregisterClassW
RegisterClassW
DefWindowProcW
PostMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
CharNextExA
GetParent
ChildWindowFromPointEx
WindowFromPoint
ScreenToClient
DrawIconEx
MoveWindow
FlashWindowEx
GetUpdateRect
SetLayeredWindowAttributes
UpdateLayeredWindow
ShowWindow
IsChild
AttachThreadInput
SendMessageW
EnumDisplayDevicesW
GetClipboardFormatNameW
RegisterClipboardFormatW
ChangeWindowMessageFilter
EnableNonClientDpiScaling
SetProcessDpiAwarenessContext
AreDpiAwarenessContextsEqual
GetAwarenessFromDpiAwarenessContext
GetWindowDpiAwarenessContext
LoadCursorW
GetThreadDpiAwarenessContext
ClientToScreen
GetCursorPos
GetClientRect
InvalidateRect
GetSystemMetrics
SetCursorPos
GetFocus
GetKeyboardLayoutList

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

winmm

timeKillEvent
PlaySoundW
timeSetEvent

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsDeleteStringBuffer
WindowsPromoteStringBuffer
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsPreallocateStringBuffer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

shell32

SHGetKnownFolderPath
SHCreateItemFromParsingName
ord155
SHGetPathFromIDListW
SHParseDisplayName
SHGetFileInfoW
SHGetStockIconInfo
ord727
ShellExecuteW
SHCreateItemFromIDList
SHGetMalloc
SHGetKnownFolderIDList
SHBrowseForFolderW
Shell_NotifyIconGetRect
Shell_NotifyIconW
CommandLineToArgvW

iphlpapi

ConvertInterfaceIndexToLuid
ConvertInterfaceLuidToGuid
ConvertInterfaceLuidToNameW
ConvertInterfaceNameToLuidW
GetAdaptersAddresses
ConvertInterfaceLuidToIndex

winhttp

WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpGetDefaultProxyConfiguration
WinHttpOpen
WinHttpCloseHandle

ws2_32

getpeername
closesocket
bind
__WSAFDIsSet
getsockopt
getnameinfo
htons
getaddrinfo
ntohl
htonl
WSACleanup
WSAStartup
WSAAsyncSelect
listen
select
setsockopt
WSAGetLastError
WSAAccept
WSAConnect
getsockname
WSAHtonl
WSAIoctl
WSANtohs
WSANtohl
WSARecv
WSASend
WSARecvFrom
WSASendTo
WSASocketW
freeaddrinfo

crypt32

CertCloseStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertAddStoreToCollection
CertVerifyTimeValidity
CertOpenSystemStoreW
CertGetCertificateChain
CertFreeCertificateChain
CertFindChainInStore
PFXImportCertStore
CertOpenStore

secur32

EncryptMessage
FreeContextBuffer
DecryptMessage
InitSecurityInterfaceW
ApplyControlToken
DeleteSecurityContext
AcceptSecurityContext
InitializeSecurityContextW
FreeCredentialsHandle
QueryContextAttributesW
AcquireCredentialsHandleW

bcrypt

BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptEncrypt
BCryptDecrypt
BCryptDestroyKey
BCryptOpenAlgorithmProvider

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
GetRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

Exports

Exports

qt_qmlDebugClearBuffer
qt_qmlDebugConnectionBlocker
qt_qmlDebugConnectorOpen
qt_qmlDebugDisableService
qt_qmlDebugEnableService
qt_qmlDebugMessageAvailable
qt_qmlDebugMessageBuffer
qt_qmlDebugMessageLength
qt_qmlDebugObjectAvailable
qt_qmlDebugSendDataToService
qt_qmlDebugSetStreamVersion
qt_startup_hook

Sections

.text
Size: 13.9MB - Virtual size: 13.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 528KB - Virtual size: 605KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmimed
Size: 332KB - Virtual size: 331KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 503KB - Virtual size: 503KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4a67d9feedd543a10a742d9ea9dce09d

Headers

DLL Characteristics

File Characteristics

Imports

dwmapi

imm32

oleaut32

setupapi

shlwapi

wtsapi32

api-ms-win-shcore-scaling-l1-1-1

comdlg32

d3d9

d3d11

dxgi

dcomp

gdi32

dwrite

api-ms-win-core-synch-l1-2-0

userenv

advapi32

authz

kernel32

netapi32

ole32

user32

version

winmm

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

shell32

iphlpapi

winhttp

ws2_32

crypt32

secur32

bcrypt

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

Exports

Exports

Sections

.text Size: 13.9MB - Virtual size: 13.9MB

.rdata Size: 3.6MB - Virtual size: 3.6MB

.data Size: 528KB - Virtual size: 605KB

.qtmimed Size: 332KB - Virtual size: 331KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 503KB - Virtual size: 503KB

.text
Size: 13.9MB - Virtual size: 13.9MB

.rdata
Size: 3.6MB - Virtual size: 3.6MB

.data
Size: 528KB - Virtual size: 605KB

.qtmimed
Size: 332KB - Virtual size: 331KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 503KB - Virtual size: 503KB