6a1c8afdd84aad1a644f2d0eae5ea908880f164dabc7683536132bd7f0706ee6

Sharing

Copy URL

Twitter E-mail

General

Target

6a1c8afdd84aad1a644f2d0eae5ea908880f164dabc7683536132bd7f0706ee6
Size

3.4MB
MD5

417ae1cdbf7c5d3ac8a69d1d8446ac13
SHA1

09f790beb7fef1a58863b7aa508ce49d5afd823e
SHA256

6a1c8afdd84aad1a644f2d0eae5ea908880f164dabc7683536132bd7f0706ee6
SHA512

389ce460fb1c1594b937dcc3b27c8a7830473f1a4491dd03addacffeb548765a778bfc5e81a1e6826e295104fe0c0566dab53c5aa14e2aaf33d69b0eb1a95e5c
SSDEEP

98304:0CR3XesxN9XQmZ5ksKSisxfVNHvcUXyhcRCDbreIp68w1MeMP1AK:P3XesxNVQMADV2C68w1MeMt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6a1c8afdd84aad1a644f2d0eae5ea908880f164dabc7683536132bd7f0706ee6

N/A. 1 IoCs

N/A.

dropper

resource	yara_rule
sample	dropper_html

Files

6a1c8afdd84aad1a644f2d0eae5ea908880f164dabc7683536132bd7f0706ee6
.exe windows:5 windows x86 arch:x86

7b327dfc8966701efde1acd9cc69d357

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\work\SSCap\trunk\Release\SSCap.pdb

Imports

advapi32

RegCreateKeyExW
RegQueryValueExW
RegDeleteValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryValueW
RegDeleteKeyW
RegEnumKeyW
RegEnumValueW
SystemFunction036

shlwapi

PathIsUNCW
PathStripToRootW
PathFindFileNameW
PathFindExtensionW
PathRemoveFileSpecW

kernel32

GetNumberFormatW
SearchPathW
GetUserDefaultLCID
SetErrorMode
VirtualProtect
FindResourceExW
GetCommandLineW
HeapSetInformation
GetStartupInfoW
DecodePointer
EncodePointer
HeapFree
GetSystemTimeAsFileTime
HeapAlloc
GetTimeFormatW
GetDateFormatW
GetFileType
ExitThread
HeapReAlloc
VirtualAlloc
VirtualQuery
CreateDirectoryA
RtlUnwind
HeapQueryInformation
HeapSize
ExitProcess
SetStdHandle
SetUnhandledExceptionFilter
GetWindowsDirectoryW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapCreate
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetACP
GetOEMCP
IsValidCodePage
GetFileSizeEx
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
GetStringTypeW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
IsDBCSLeadByteEx
GetTempPathW
GetTempFileNameW
GetStdHandle
GetFileTime
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThread
GetLastError
CreateEventW
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
WaitForSingleObject
SetEvent
Sleep
CloseHandle
CreateThread
WriteFile
ReadFile
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetCurrentProcessId
GetPrivateProfileStringW
WritePrivateProfileStringW
FindResourceW
LoadResource
SizeofResource
GetFileAttributesW
GetFileAttributesExW
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
LockResource
InterlockedIncrement
InterlockedDecrement
DeleteFileW
GetCurrentDirectoryW
GetSystemDirectoryW
LocalReAlloc
GlobalHandle
GlobalReAlloc
GlobalGetAtomNameW
GetThreadLocale
GetPrivateProfileIntW
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoW
LoadLibraryExW
InterlockedExchange
GlobalFlags
FileTimeToLocalFileTime
FileTimeToSystemTime
FindFirstFileW
FindClose
lstrcmpA
SuspendThread
SetThreadPriority
ReleaseActCtx
CreateActCtxW
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
InitializeCriticalSectionAndSpinCount
lstrcmpW
CopyFileW
GlobalSize
MulDiv
OpenMutexW
CreateMutexW
CreateFileW
SetThreadLocale
GetProfileIntW
lstrcpynW
DebugBreak
RaiseException
lstrcpyW
WinExec
lstrcatW
LocalAlloc
GetFileSize
CreateFileA
FreeResource
GetVersion
lstrcmpiW
DeactivateActCtx
lstrlenW
ActivateActCtx
GetCPInfo
Process32NextW
Process32FirstW
CreateProcessW
GetTickCount
LocalFree
CreateToolhelp32Snapshot
GetSystemInfo
GlobalFree
SetLastError
GlobalUnlock
MultiByteToWideChar
TerminateProcess
GetVersionExW
FormatMessageW
WideCharToMultiByte
GlobalAlloc
OpenProcess
GlobalLock
GetCurrentProcess
FreeLibrary
lstrlenA
ResumeThread
GetCurrentThreadId
TerminateThread
LCMapStringW

user32

ToUnicodeEx
DrawFrameControl
SetClassLongW
DestroyAcceleratorTable
SetParent
RegisterClipboardFormatW
GetNextDlgGroupItem
UnregisterClassW
UnpackDDElParam
ReuseDDElParam
LoadAcceleratorsW
InsertMenuItemW
BringWindowToTop
TranslateAcceleratorW
IsClipboardFormatAvailable
CopyImage
GetMenuDefaultItem
SetMenuDefaultItem
IsMenu
MonitorFromPoint
UpdateLayeredWindow
EnableScrollBar
UnionRect
CharUpperW
IsZoomed
GetAsyncKeyState
NotifyWinEvent
SetWindowRgn
SetLayeredWindowAttributes
EnumDisplayMonitors
CharNextW
CopyAcceleratorTableW
WaitMessage
SetWindowContextHelpId
MapDialogRect
ShowOwnedPopups
PostQuitMessage
RealChildWindowFromPoint
MapVirtualKeyW
GetKeyNameTextW
IntersectRect
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
ShowScrollBar
IsWindowVisible
ValidateRect
CreateWindowExW
GetClassInfoExW
GetClassInfoW
AdjustWindowRectEx
GetKeyboardState
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
SetWindowLongW
SetWindowPos
EndPaint
BeginPaint
GetWindowDC
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetDlgItem
EndDialog
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetWindowThreadProcessId
GetLastActivePopup
IsWindowEnabled
GetWindowTextLengthW
GetWindowTextW
GetScrollPos
SetScrollPos
GetClassNameW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
EnableMenuItem
CheckMenuItem
GetMenuStringW
TranslateMessage
PeekMessageW
RegisterWindowMessageW
GetSystemMenu
SetFocus
IsIconic
InvalidateRgn
DrawIcon
LoadIconW
IsRectEmpty
SetForegroundWindow
GetMessageW
SetRectEmpty
GetCapture
DispatchMessageW
HideCaret
EqualRect
ScreenToClient
GetMessagePos
GetFocus
GetWindow
RedrawWindow
UpdateWindow
SetCapture
MessageBeep
ReleaseCapture
GetKeyState
GetNextDlgTabItem
ClientToScreen
PostMessageW
GetParent
WindowFromPoint
GetClientRect
CreateIconIndirect
GetWindowRgn
SubtractRect
MapVirtualKeyExW
IsCharLowerW
GetDoubleClickTime
GetUpdateRect
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcW
DefFrameProcW
PostThreadMessageW
CharUpperBuffW
CopyIcon
InvertRect
LockWindowUpdate
SetCursorPos
GetIconInfo
DrawFocusRect
InflateRect
OffsetRect
TrackPopupMenuEx
LoadMenuW
DrawStateW
DestroyCursor
FrameRect
GetActiveWindow
DestroyMenu
SetCursor
RegisterClassW
CreateAcceleratorTableW
MessageBoxW
SetClipboardData
OpenClipboard
DeferWindowPos
GetKeyboardLayout
EmptyClipboard
CloseClipboard
EnableWindow
SendMessageW
IsWindow
GetDC
SendMessageA
CopyRect
DestroyIcon
GetSystemMetrics
InsertMenuW
RemoveMenu
GetMenuItemCount
LoadBitmapW
GetSysColorBrush
CreatePopupMenu
GetSysColor
GetDesktopWindow
GrayStringW
GetMenuState
ReleaseDC
SystemParametersInfoW
AppendMenuW
SetRect
ModifyMenuW
GetMenuItemInfoW
DrawEdge
DrawTextExW
CreateMenu
DeleteMenu
DrawIconEx
GetSubMenu
TabbedTextOutW
DrawTextW
GetMenuItemID
FillRect
GetCursorPos
GetWindowLongW
InvalidateRect
PtInRect
LoadCursorW
KillTimer
LoadImageW
GetWindowRect
SetTimer

gdi32

DeleteObject
SetPixel
GetDeviceCaps
CreateFontIndirectW
CreateDIBSection
DeleteDC
GetBkMode
CreateHatchBrush
PatBlt
GetTextExtentPoint32W
BitBlt
GetStockObject
StretchBlt
CreateBitmap
SetBkColor
SetTextColor
CreateDIBitmap
RealizePalette
CreatePalette
CreatePatternBrush
UnrealizeObject
CreateRectRgn
SelectPalette
CombineRgn
CreateRectRgnIndirect
CreateDCW
GetTextMetricsW
CopyMetaFileW
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetMapMode
GetClipBox
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
CreateCompatibleBitmap
GetLayout
SetLayout
SelectClipRgn
GetViewportExtEx
GetWindowExtEx
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
GetObjectType
SetRectRgn
GetMapMode
DPtoLP
GetRgnBox
GetBkColor
GetTextColor
EnumFontFamiliesW
GetTextCharsetInfo
CreateRoundRectRgn
CreatePolygonRgn
CreateEllipticRgn
Polyline
Polygon
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
OffsetRgn
SetDIBColorTable
EnumFontFamiliesExW
ExtFloodFill
SetPaletteEntries
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
GetTextFaceW
SetPixelV
CreateCompatibleDC
Rectangle
ExtTextOutW
Ellipse
PtVisible
GetObjectW
Escape
CreatePen
RectVisible
GetPixel
TextOutW
CreateSolidBrush
SetTextAlign

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

shell32

SHBrowseForFolderW
SHAppBarMessage
SHGetFileInfoW
DragQueryFileW
DragFinish
ShellExecuteExW
SHGetPathFromIDListW
SHGetMalloc
SHGetSpecialFolderLocation
SHGetDesktopFolder
Shell_NotifyIconW
ShellExecuteW

comctl32

InitCommonControlsEx
_TrackMouseEvent
ImageList_GetIconSize

ole32

CoRevokeClassObject
CoRegisterMessageFilter
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleLockRunning
CreateStreamOnHGlobal
OleGetClipboard
CoUninitialize
CoCreateInstance
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
ReleaseStgMedium
OleDuplicateData
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleIsCurrentClipboard
OleFlushClipboard
DoDragDrop
CoInitializeEx
OleInitialize
CoFreeUnusedLibraries
CoInitialize
OleUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid

oleaut32

VariantClear
VariantInit
SysAllocStringLen
VariantChangeType
VariantCopy
DispCallFunc
LoadRegTypeLi
SysStringLen
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayCreate
SysAllocString
VarBstrFromDate
OleCreateFontIndirect
SystemTimeToVariantTime
SysFreeString
VariantTimeToSystemTime

ws2_32

ntohl
inet_ntoa
recvfrom
sendto
__WSAFDIsSet
setsockopt
getpeername
ioctlsocket
connect
WSAStartup
inet_addr
htonl
select
WSAGetLastError
htons
getsockname
WSACleanup
recv
bind
socket
WSASetLastError
closesocket
gethostbyname
send
listen
accept
ntohs

oledlg

OleUIBusyW

gdiplus

GdipDrawImageI
GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipDeleteGraphics
GdiplusStartup
GdipCloneImage
GdipSaveImageToFile
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipGetImageEncodersSize
GdipAlloc
GdipCreateBitmapFromScan0
GdipFree
GdiplusShutdown

libintl3

ord27
ord51
ord26
ord35

wininet

HttpOpenRequestA
HttpQueryInfoA
InternetConnectA
InternetCloseHandle
InternetOpenA
HttpAddRequestHeadersA
HttpSendRequestW
HttpQueryInfoW
InternetSetOptionW
InternetReadFile

oleacc

LresultFromObject
CreateStdAccessibleObject
AccessibleObjectFromWindow

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundW

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 553KB - Virtual size: 553KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 51KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 485KB - Virtual size: 484KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 370KB - Virtual size: 370KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7b327dfc8966701efde1acd9cc69d357

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

shlwapi

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

shell32

comctl32

ole32

oleaut32

ws2_32

oledlg

gdiplus

libintl3

wininet

oleacc

imm32

winmm

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 553KB - Virtual size: 553KB

.data Size: 51KB - Virtual size: 146KB

.rsrc Size: 485KB - Virtual size: 484KB

.reloc Size: 370KB - Virtual size: 370KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 553KB - Virtual size: 553KB

.data
Size: 51KB - Virtual size: 146KB

.rsrc
Size: 485KB - Virtual size: 484KB

.reloc
Size: 370KB - Virtual size: 370KB