b6d4ce9e1ebe8b542fdd9901167e41cfc961474793c9a7b7035081abad0b45ce

Sharing

Copy URL Twitter E-mail

General

Target

b6d4ce9e1ebe8b542fdd9901167e41cfc961474793c9a7b7035081abad0b45ce
Size

4.3MB
MD5

748f7a21decda4027767380e80b81df5
SHA1

5e07a762ea3d91c65a467f82243c5975e98ba803
SHA256

b6d4ce9e1ebe8b542fdd9901167e41cfc961474793c9a7b7035081abad0b45ce
SHA512

77a63629bad978494f868d57421d9a51e00f68648d8464ca780a2f365d440eb7d5c1a25ce5b7f87473eb8a68f635503b47eb0e01913635697a72c5df992f10ad
SSDEEP

49152:uvq1Y0HS1JQskQUNRLeRMCFbaCYsmajDXQqpSBkj+DMB5V0WyzrUUZ/e9B8umOq2:C0rskhNFCFmFebvV0zzDkjP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b6d4ce9e1ebe8b542fdd9901167e41cfc961474793c9a7b7035081abad0b45ce

Files

b6d4ce9e1ebe8b542fdd9901167e41cfc961474793c9a7b7035081abad0b45ce
.dll windows:6 windows x64 arch:x64

c4eea33616cb9b3e7958afadc99b0c19

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

shlwapi

SHAutoComplete
PathFileExistsA

kernel32

RtlPcToFileHeader
QueryPerformanceFrequency
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleFileNameA
HeapAlloc
HeapCreate
GetTempPathA
GetDriveTypeW
LoadLibraryW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
GlobalFree
GlobalHandle
GlobalSize
GlobalLock
GlobalUnlock
GlobalAlloc
ReadConsoleOutputCharacterA
SetConsoleCursorPosition
GetConsoleScreenBufferInfo
FillConsoleOutputCharacterW
WriteConsoleW
WriteConsoleA
AttachConsole
FreeConsole
GetStdHandle
SetLastError
MulDiv
ExpandEnvironmentStringsW
IsBadStringPtrA
IsBadReadPtr
GetFileType
WaitForMultipleObjects
CreateEventW
SetEvent
GetLogicalDriveStringsW
FreeLibrary
GetACP
GetTempFileNameW
GetLongPathNameW
FindFirstFileW
IsValidCodePage
FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleFileNameW
GetNativeSystemInfo
GetVersionExW
TerminateProcess
GetEnvironmentVariableW
FormatMessageW
GetProcAddress
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentThread
ExitProcess
GetCurrentProcess
WaitForSingleObject
InitializeCriticalSection
RaiseException
OutputDebugStringW
SetErrorMode
GetCPInfo
LCMapStringEx
DecodePointer
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
CopyFileW
GetLastError
CloseHandle
AreFileApisANSI
GetTempPathW
GetFileAttributesW
FindClose
CreateFileW
SetCurrentDirectoryW
WideCharToMultiByte
FormatMessageA
LocalFree

advapi32

RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
GetUserNameA
GetUserNameW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyW
RegEnumValueW

ole32

OleGetClipboard
OleFlushClipboard
OleIsCurrentClipboard
CoTaskMemFree
ReleaseStgMedium
OleUninitialize
OleInitialize
CoTaskMemAlloc
OleSetClipboard
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
RevokeDragDrop
CoLockObjectExternal
CoUninitialize
RegisterDragDrop

oleaut32

SysAllocString
SysFreeString
VariantClear

comctl32

ImageList_Replace
ImageList_Draw
ord17
ImageList_GetIconSize
ImageList_SetBkColor
ord16
ImageList_Create
ImageList_Destroy
ImageList_GetImageCount
ImageList_GetImageInfo
ImageList_Add

rpcrt4

UuidToStringW
RpcStringFreeW

oleacc

LresultFromObject

uxtheme

SetWindowTheme
IsThemePartDefined
GetThemeBackgroundExtent
GetCurrentThemeName
IsAppThemed
IsThemeActive
GetThemeSysFont
GetThemeSysColor
GetThemeInt
GetThemePartSize
GetThemeMargins
DrawThemeParentBackground
GetThemeColor
GetThemeBackgroundContentRect
DrawThemeBackground
CloseThemeData
OpenThemeData
IsThemeBackgroundPartiallyTransparent
GetThemeFont

vcruntime140

__std_type_info_compare
__C_specific_handler
memset
strstr
wcschr
strrchr
strchr
wcsstr
memcmp
_purecall
__intrinsic_setjmp
memchr
__std_terminate
__uncaught_exception
__std_type_info_destroy_list
longjmp
__AdjustPointer
_CxxThrowException
__current_exception_context
__current_exception
__RTtypeid
memcpy
__std_exception_destroy
memmove
__std_exception_copy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_crt_atexit
_register_onexit_function
_cexit
_initterm
_initterm_e
system
exit
terminate
_errno
abort
_invalid_parameter_noinfo_noreturn
_execute_onexit_table

api-ms-win-crt-stdio-l1-1-0

ungetc
setvbuf
fwrite
_fseeki64
fsetpos
fread
fputc
fgetpos
fgetc
fflush
fclose
_get_stream_buffer_pointers
__stdio_common_vsprintf_s
__stdio_common_vswprintf_p
_kbhit
_fsopen
fseek
__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vfwprintf
_wsopen_dispatch
_open_osfhandle
__stdio_common_vswscanf
__stdio_common_vfprintf
__stdio_common_vsscanf
_fileno
_get_osfhandle
_ftelli64
ferror
feof
clearerr
_wfopen
_telli64
_lseeki64
_write
_read
_close
__stdio_common_vswprintf

api-ms-win-crt-filesystem-l1-1-0

_wrename
_unlock_file
_wremove
_lock_file

api-ms-win-crt-string-l1-1-0

wcsncpy
towlower
strncpy
strncmp
iswalpha
iswdigit
_strdup
_wcsicmp
iswalnum
wcspbrk
__strncnt
islower
iswprint
_wcsdup
isupper
iswspace
iswxdigit
towupper
strlen
isspace
tolower
strcmp
strcspn
toupper

api-ms-win-crt-utility-l1-1-0

rand
abs
qsort
bsearch

api-ms-win-crt-math-l1-1-0

fabs
floorf
powf
cosf
fmodf
sinf
sqrtf
tanf
ceilf
atan2f
frexp
acosf
fmod
atan2
sqrt
cos
lroundf
ceil
floor
pow
_fdopen
lround
ldexp
sin

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
calloc
realloc
free

api-ms-win-crt-locale-l1-1-0

_unlock_locales
setlocale
localeconv
___lc_locale_name_func
___lc_codepage_func
_lock_locales
___mb_cur_max_func
_create_locale
_free_locale
__pctype_func

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-convert-l1-1-0

_wtoi
wcstol
strtol
_wcstod_l
wcstod
atof
strtoll
strtod
strtof
wcstoul
_wcstoui64
_wcstoi64
_wtol

api-ms-win-crt-time-l1-1-0

_gmtime64
_localtime64
_mktime64
_time64
_tzset
_get_timezone
wcsftime

api-ms-win-crt-environment-l1-1-0

_wgetenv
getenv
_wgetcwd

msimg32

AlphaBlend
GradientFill

user32

GetMenuState
IsClipboardFormatAvailable
wsprintfW
GetClipboardFormatNameW
RegisterClipboardFormatW
EnumDisplayMonitors
MonitorFromPoint
EnumDisplaySettingsW
ChangeDisplaySettingsExW
FindWindowExW
ChildWindowFromPoint
HideCaret
keybd_event
IsMenu
GetComboBoxInfo
GetDesktopWindow
UnionRect
EndPaint
BeginPaint
GetWindowDC
ValidateRect
GetMessageW
GetClassNameW
MessageBeep
GetWindowTextLengthW
GetWindowTextW
IsRectEmpty
ValidateRgn
DrawIconEx
DestroyCursor
DestroyIcon
GetCaretBlinkTime
GetDoubleClickTime
TranslateAcceleratorW
DestroyAcceleratorTable
CreateAcceleratorTableW
InsertMenuItemW
SetMenuInfo
RemoveMenu
ModifyMenuW
AppendMenuW
InsertMenuW
DestroyMenu
CreatePopupMenu
CreateMenu
CheckMenuRadioItem
GetSysColorBrush
SetMenuItemInfoW
GetMenuItemID
GetSubMenu
CheckMenuItem
MonitorFromWindow
DrawFrameControl
DrawEdge
SetRectEmpty
SetRect
DrawStateW
CreateIconIndirect
DrawFocusRect
DrawTextW
SetForegroundWindow
EnableMenuItem
GetSystemMenu
DrawMenuBar
GetDialogBaseUnits
CreateDialogIndirectParamW
IsZoomed
IsIconic
FlashWindowEx
SetLayeredWindowAttributes
GetMonitorInfoW
OffsetRect
CopyRect
GetWindowPlacement
SetWindowRgn
GetProcessDefaultLayout
GetDlgItem
CreateDialogParamW
SystemParametersInfoW
GetScrollInfo
SetScrollInfo
IsDialogMessageW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetWindow
SetParent
GetParent
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
GetWindowLongW
PtInRect
InflateRect
FillRect
MessageBoxW
PostThreadMessageW
PostMessageW
RegisterClassW
CreateWindowExW
BringWindowToTop
PeekMessageW
SendMessageW
DefWindowProcW
UnregisterClassW
DestroyWindow
DispatchMessageW
MsgWaitForMultipleObjects
SetTimer
KillTimer
SetCursor
LoadCursorW
DdeInitializeW
DdeUninitialize
DdeConnect
DdeDisconnect
DdePostAdvise
DdeNameService
DdeClientTransaction
DdeCreateDataHandle
DdeGetData
DdeFreeDataHandle
DdeGetLastError
DdeCreateStringHandleW
DdeQueryStringW
DdeFreeStringHandle
RegisterWindowMessageW
SetMenu
GetWindowRect
LoadBitmapW
LoadIconW
LoadImageW
GetIconInfo
TranslateMessage
RegisterHotKey
UnregisterHotKey
GetMessagePos
GetMessageTime
PostQuitMessage
CallWindowProcW
IsWindow
ShowWindow
AnimateWindow
MoveWindow
SetWindowPos
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
IsWindowVisible
SetFocus
GetActiveWindow
GetFocus
GetKeyState
GetAsyncKeyState
VkKeyScanW
MapVirtualKeyW
GetCapture
SetCapture
ReleaseCapture
EnableWindow
IsWindowEnabled
GetSystemMetrics
GetMenuItemCount
TrackPopupMenu
GetMenuItemInfoW
UpdateWindow
GetDC
ReleaseDC
GetUpdateRgn
InvalidateRect
RedrawWindow
ScrollWindow
EnableScrollBar
SetWindowTextW
GetClientRect
SetCursorPos
GetCursorPos
ClientToScreen
ScreenToClient
MapWindowPoints
WindowFromPoint
ChildWindowFromPointEx
GetSysColor

gdi32

CreateCompatibleBitmap
CreateBitmapIndirect
CreateBitmap
BitBlt
SetTextColor
SetBkMode
SetBkColor
OffsetRgn
GetRegionData
ExtCreateRegion
GdiFlush
SetBrushOrgEx
GetTextMetricsW
SelectPalette
SelectObject
CreateCompatibleDC
RealizePalette
GetDeviceCaps
ExcludeClipRect
CreateRectRgn
GetObjectW
LineTo
DeleteDC
EndPage
StartPage
EndDoc
StartDocW
SetAbortProc
EnumFontFamiliesExW
PlayEnhMetaFile
GetEnhMetaFileHeader
GetEnhMetaFileW
DeleteEnhMetaFile
CreateEnhMetaFileW
CloseEnhMetaFile
SetViewportOrgEx
GetSystemPaletteEntries
CreateDCW
CreateICW
GetTextExtentExPointW
GetCharABCWidthsW
CreateRectRgnIndirect
MoveToEx
DeleteObject
GetBkColor
SetWindowOrgEx
SetWindowExtEx
SetViewportExtEx
PolyBezier
Polyline
Polygon
LPtoDP
DPtoLP
ExtTextOutW
ModifyWorldTransform
SetWorldTransform
GetWorldTransform
SetROP2
StretchDIBits
SetPolyFillMode
SetPixel
GetLayout
SetLayout
SetMapMode
SetGraphicsMode
ExtSelectClipRgn
SelectClipRgn
RoundRect
Rectangle
PolyPolygon
Pie
MaskBlt
GetPixel
GetObjectType
GetClipBox
ExtFloodFill
Ellipse
Arc
CreatePolygonRgn
RectInRegion
PtInRegion
GetRgnBox
EqualRgn
CombineRgn
SetDIBColorTable
GetDIBColorTable
CreateDIBSection
GetDIBits
CreateDIBitmap
CreatePatternBrush
CreateHatchBrush
SetStretchBltMode
StretchBlt
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
ExtCreatePen
CreatePen
GetStockObject
GetOutlineTextMetricsW
CreateFontIndirectW
GetTextExtentPoint32W
GetWindowExtEx
GetViewportExtEx
GetGraphicsMode
CreateSolidBrush

winspool.drv

ClosePrinter
GetPrinterW
DocumentPropertiesW
OpenPrinterW

comdlg32

GetOpenFileNameW
PageSetupDlgW
PrintDlgW
CommDlgExtendedError
GetSaveFileNameW
ChooseFontW

shell32

ord6
DragFinish
DragQueryFileW
ExtractIconExW
ExtractIconW
SHGetFolderPathW
SHGetFileInfoW
DragAcceptFiles
DragQueryPoint

Exports

Exports

Py_Main

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 67KB - Virtual size: 251KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c4eea33616cb9b3e7958afadc99b0c19

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

advapi32

ole32

oleaut32

comctl32

rpcrt4

oleacc

uxtheme

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

msimg32

user32

gdi32

winspool.drv

comdlg32

shell32

Exports

Exports

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

.rdata Size: 1.4MB - Virtual size: 1.4MB

.data Size: 67KB - Virtual size: 251KB

.pdata Size: 114KB - Virtual size: 114KB

.rsrc Size: 1024B - Virtual size: 584B

.reloc Size: 80KB - Virtual size: 80KB

.text
Size: 2.7MB - Virtual size: 2.7MB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 67KB - Virtual size: 251KB

.pdata
Size: 114KB - Virtual size: 114KB

.rsrc
Size: 1024B - Virtual size: 584B

.reloc
Size: 80KB - Virtual size: 80KB