ee03f8cf4d02184fe39a4b4f01a0ae892b6085d25c3f7a539b1f0b6266f23dd6

Sharing

Copy URL

Twitter E-mail

General

Target

ee03f8cf4d02184fe39a4b4f01a0ae892b6085d25c3f7a539b1f0b6266f23dd6
Size

1.4MB
MD5

878ac88798b4b5a92ba0205e20828429
SHA1

242a54b92d6a0a60bd7abc22a8f85217d5e8e5d0
SHA256

ee03f8cf4d02184fe39a4b4f01a0ae892b6085d25c3f7a539b1f0b6266f23dd6
SHA512

6d60dcb6a1a4a07dd7c22f7047945f64c0c56d835b6f6ef21ff6741cba54a68ff7bcc9c417f50f38db20a2e65cb22dd3b48ed1aa1d14ecc9a9a1e58f81782047
SSDEEP

24576:QJSM/zWZ++FyClUYQ/pZEtZyfq3YHks9X2NB0jRmJHVJZh/u:QJ3E+4JlCBCtIy3YHks9Xg04JHVU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ee03f8cf4d02184fe39a4b4f01a0ae892b6085d25c3f7a539b1f0b6266f23dd6

Files

ee03f8cf4d02184fe39a4b4f01a0ae892b6085d25c3f7a539b1f0b6266f23dd6
.exe windows:10 windows x64 arch:x64

42719ea4a45a44ca6085389b9651c9ab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

WMPDMC.pdb

Imports

advapi32

EventWriteTransfer
TraceMessage
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
EventRegister
EventUnregister
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
TraceEvent

kernel32

GetCurrentThreadId
HeapSetInformation
RegisterApplicationRestart
ReleaseActCtx
EnterCriticalSection
LeaveCriticalSection
GetProcessHeap
HeapAlloc
HeapFree
RaiseException
CloseHandle
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
GetLastError
GlobalLock
GetTickCount
SizeofResource
LockResource
LoadResource
FindResourceExW
PowerClearRequest
CreateEventW
OpenEventW
CompareStringOrdinal
SetEvent
Sleep
DuplicateHandle
GetCurrentProcess
CreateThread
PowerCreateRequest
PowerSetRequest
GlobalUnlock
MulDiv
TryEnterCriticalSection
InitializeSRWLock
ResetEvent
lstrcmpiW
HeapSize
HeapReAlloc
HeapDestroy
CompareStringW
MultiByteToWideChar
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
lstrlenW
lstrlenA
FindResourceW
GetDurationFormatEx
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDateFormatW
RegGetValueW
TlsGetValue
AddAtomW
DeleteAtom
GetAtomNameW
OutputDebugStringW
FreeLibraryAndExitThread
GetThreadLocale
GetThreadUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
SetProcessWorkingSetSizeEx
FindAtomW
GetSystemDirectoryW
GetVersion
TlsAlloc
TlsFree
TlsSetValue
GetModuleFileNameA
DebugBreak
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
AcquireSRWLockShared
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
ReleaseSRWLockShared
CreateEventExW
InitializeCriticalSectionAndSpinCount
LocalAlloc
QueryPerformanceFrequency
GetTickCount64
LCIDToLocaleName
InitializeCriticalSectionEx
GetThreadPreferredUILanguages
InitOnceExecuteOnce
SetThreadPreferredUILanguages
VirtualQueryEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
MapViewOfFile
UnmapViewOfFile
CreateSemaphoreW
DeactivateActCtx
VirtualQuery
GetModuleHandleW
ResolveDelayLoadedAPI
DelayLoadFailureHook
LoadLibraryExW
CreateMutexW
LocalFree
FormatMessageW
FreeLibrary
SetErrorMode
GlobalFree
GlobalAlloc
WaitForMultipleObjects
OutputDebugStringA
QueryActCtxW
GetModuleHandleExW
GetModuleFileNameW
CreateActCtxW
FindActCtxSectionStringW
ActivateActCtx
GetProcAddress
SetLastError
LoadLibraryW

gdi32

CreateRectRgn
GetClipRgn
IntersectClipRect
SelectClipRgn
GetLayout
SetTextAlign
GetTextAlign
GetCurrentObject
SetTextColor
SetBkColor
SetBkMode
PatBlt
StretchDIBits
GetStockObject
SetDCBrushColor
DeleteEnhMetaFile
SetStretchBltMode
PlayEnhMetaFile
GdiGradientFill
ExtTextOutW
GetTextColor
GdiTransparentBlt
SetPixel
CreatePatternBrush
GetTextExtentPoint32W
CreateHalftonePalette
SelectPalette
RealizePalette
GetBrushOrgEx
SetBrushOrgEx
GetDIBits
GetBkMode
OffsetWindowOrgEx
SetWindowOrgEx
RectVisible
GetRegionData
ExtCreateRegion
CombineRgn
OffsetRgn
GetRgnBox
CreateFontIndirectW
CreateDIBPatternBrushPt
SetLayout
LPtoDP
GetBkColor
GetTextMetricsW
GetDCBrushColor
GetTextExtentPointW
GetPixel
CreateSolidBrush
StretchBlt
CreateBitmap
CreateCompatibleBitmap
GetDeviceCaps
Polyline
CreatePen
DeleteDC
GdiAlphaBlend
DeleteObject
GetObjectW
CreateCompatibleDC
CreateDIBSection
SelectObject
BitBlt

user32

CharUpperW
GetWindowTextW
GetWindowTextLengthW
SetRect
GetIconInfo
DestroyIcon
GetGUIThreadInfo
NotifyWinEvent
IntersectRect
DrawTextW
InflateRect
DrawFrameControl
MapVirtualKeyW
GetKeyNameTextW
DrawIconEx
DrawFocusRect
SetWindowLongW
MonitorFromWindow
EnumChildWindows
IsCharAlphaNumericW
GetDpiForSystem
RegisterWindowMessageW
SetFocus
GetFocus
SetPropW
UnregisterPowerSettingNotification
IsChild
GetAncestor
GetPropW
RemovePropW
CallWindowProcW
SetParent
GetClassLongW
UpdateWindow
GetWindowRgnBox
SetWindowRgn
RedrawWindow
EnableWindow
GetScrollInfo
SetScrollInfo
LoadStringW
GetDpiForWindow
MoveWindow
SubtractRect
LoadImageW
RegisterClassExW
DefWindowProcW
GetClassInfoExW
TranslateAcceleratorW
PeekMessageW
LoadAcceleratorsW
ChangeWindowMessageFilterEx
SetProcessDPIAware
SendMessageTimeoutW
FindWindowW
CharNextW
IsIconic
GetClassNameW
GetDesktopWindow
GetWindowThreadProcessId
IsWindowVisible
GetWindow
SystemParametersInfoW
SetWindowLongPtrW
GetWindowLongPtrW
MapWindowPoints
PostQuitMessage
DestroyWindow
GetParent
SetWindowPos
GetWindowLongW
AdjustWindowRectEx
GetClientRect
GetMonitorInfoW
MonitorFromRect
BringWindowToTop
mouse_event
GetForegroundWindow
SetForegroundWindow
SetWindowTextW
DispatchMessageW
TranslateMessage
IsDialogMessageW
SendMessageW
UnhookWindowsHookEx
CallNextHookEx
ShowWindow
CreateDialogParamW
GetActiveWindow
GetKeyState
UnionRect
DestroyMenu
TrackPopupMenu
GetSubMenu
EnableMenuItem
CharUpperA
CreateWindowExW
LoadMenuW
ScreenToClient
CopyRect
EqualRect
InvalidateRect
OffsetRect
IsRectEmpty
GetSystemMetrics
PostThreadMessageW
IsWindow
PtInRect
GetWindowRect
KillTimer
SetTimer
ClientToScreen
LoadCursorW
UnregisterClassA
SetCursor
PostMessageW
SetRectEmpty
GetSysColor
FrameRect
GetSysColorBrush
FillRect
GetCursorPos
GetDoubleClickTime
RegisterClipboardFormatW
ReleaseDC
GetDC
CreateIconIndirect
SetWindowsHookExW

api-ms-win-crt-string-l1-1-0

wcscmp
memset
wcsspn
strnlen
wcspbrk
wcsncmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
_initterm

api-ms-win-crt-private-l1-1-0

_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__wcsdup
_o__wcsicmp
_o__wcsnicmp
_o__wcstoui64
_o__wtof
_o__wtol
_o_calloc
_o_ceilf
_o_cosf
_o_exit
_o_expf
_o_floor
_o_floorf
_o_free
_o_iswalnum
_o_iswalpha
_o_iswdigit
_o_iswspace
_o_malloc
_o_memcpy_s
_o_powf
_o_qsort
_o_sin
_o_sqrt
_o_strncpy_s
_o_terminate
_o_wcsncpy_s
_o_wcstok_s
_o_wcstol
__current_exception
__current_exception_context
__CxxFrameHandler3
_o__invalid_parameter_noinfo
_o__initialize_wide_environment
_o__initialize_onexit_table
_o__get_wide_winmain_command_line
wcsstr
wcschr
_o__exit
_o__errno
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___p__commode
__C_specific_handler
__std_terminate
__CxxFrameHandler4
_CxxThrowException
__C_specific_handler_noexcept
memcmp
memcpy
memmove

ntdll

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

oleaut32

SafeArrayGetDim
SafeArrayGetVartype
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayCreateVector
SafeArrayGetElement
VariantCopy
VarBstrCmp
SafeArrayUnaccessData
VarUI4FromStr
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreate
SysAllocStringLen
SysAllocStringByteLen
SysStringByteLen
SysStringLen
VariantInit
SysAllocString
VariantClear
SysFreeString

ole32

CoCreateInstance
CoTaskMemAlloc
PropVariantClear
CoInitializeEx
CLSIDFromString
ReleaseStgMedium
OleUninitialize
OleInitialize
CoTaskMemRealloc
CreateStreamOnHGlobal
RevokeDragDrop
RegisterDragDrop
CoTaskMemFree
CoUninitialize
StringFromGUID2
CoCreateGuid
CoDisconnectObject
CoWaitForMultipleHandles

gdiplus

GdipCloneImage
GdipAlloc
GdipFree
GdipCreateBitmapFromStream
GdipSetInterpolationMode
GdipCreateImageAttributes
GdipGetImageWidth
GdiplusStartup
GdipDrawImageRectRectI
GdipCreateBitmapFromHBITMAP
GdipDeleteGraphics
GdipDisposeImageAttributes
GdipCreateBitmapFromHICON
GdiplusShutdown
GdipCreateHBITMAPFromBitmap
GdipDisposeImage
GdipGetImageHeight
GdipSetImageAttributesWrapMode
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext

uxtheme

GetThemeAnimationProperty
GetThemeAnimationTransform
BufferedPaintUnInit
IsAppThemed
BeginBufferedPaint
GetBufferedPaintBits
BufferedPaintClear
EndBufferedPaint
ord47
DrawThemeTextEx
GetThemePartSize
GetThemeAppProperties
GetThemeMetric
GetThemeColor
GetThemeFont
GetThemeMargins
OpenThemeData
CloseThemeData
BufferedPaintInit
GetThemeBackgroundExtent

wmpdui

SetGadgetFocusEx
GetGadgetStyle
CustomGadgetHitTestQuery
FindGadgetFromPoint
GetGadgetTicket
MapGadgetPoints
GetGadgetFlags
UtilDrawBlendRect
GetGadgetSize
DisableContainerHwnd
InvalidateLayeredDescendants
LookupGadgetTicket
GetStdColorBrushI
GetStdColorI
GetDUserModule
FindStdColor
InitGadgets
DUserFlushMessages
DUserFlushDeferredMessages
SetWindowResizeFlag
GadgetTransCompositionChanged
SetGadgetBufferInfo
GetGadget
AttachWndProcW
BuildAnimation
DetachWndProc
GetGadgetRgn
CreateAction
EnsureGadgetTransInitialized
GetGadgetLayerInfo
DetachGadgetVisuals
SetGadgetLayerInfo
ReleaseDetachedObjects
ReleaseLayeredRef
AddLayeredRef
SetGadgetFlags
GetGadgetVisual
SetGadgetOrder
SetTransitionVisualProperties
DestroyPendingDCVisuals
ChangeCurrentAnimationScenario
GetGadgetRootInfo
GetCachedDWriteRenderTarget
CacheDWriteRenderTarget
ReleaseMouseCapture
AdjustClipInsideRef
DUserStopPVLAnimation
BuildInterpolation
SetGadgetFocus
GetGadgetRect
DUserPostEvent
DUserSendEvent
CreateGadget
DeleteHandle
InvalidateGadget
SetGadgetRect
SetGadgetMessageFilter
GetGadgetAnimation
GetMessageExW
SetGadgetParent
SetGadgetStyle
ForwardGadgetMessage
SetGadgetRootInfo
GetGadgetFocus

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCompareStringOrdinal
WindowsIsStringEmpty
WindowsDeleteString
WindowsCreateString
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsGetStringLen

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-crt-math-l1-1-0

_isnan

api-ms-win-core-path-l1-1-0

PathCchAppend

oleacc

GetRoleTextW
ObjectFromLresult
CreateStdAccessibleObject
LresultFromObject
AccessibleObjectFromWindow

dwmapi

DwmIsCompositionEnabled
DwmRenderGesture
DwmTetherContact

windowscodecs

WICCreateImagingFactory_Proxy

api-ms-win-shcore-scaling-l1-1-0

RegisterScaleChangeNotifications
GetScaleFactorForDevice
RevokeScaleChangeNotifications

api-ms-win-shcore-scaling-l1-1-1

GetScaleFactorForMonitor

Sections

.text
Size: 852KB - Virtual size: 851KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

fothk
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 208KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 324KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

42719ea4a45a44ca6085389b9651c9ab

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

ntdll

oleaut32

ole32

gdiplus

uxtheme

wmpdui

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-core-path-l1-1-0

oleacc

dwmapi

windowscodecs

api-ms-win-shcore-scaling-l1-1-0

api-ms-win-shcore-scaling-l1-1-1

Sections

.text Size: 852KB - Virtual size: 851KB

fothk Size: 4KB - Virtual size: 4KB

.rdata Size: 208KB - Virtual size: 205KB

.data Size: 4KB - Virtual size: 16KB

.pdata Size: 44KB - Virtual size: 43KB

.didat Size: 4KB - Virtual size: 152B

.rsrc Size: 324KB - Virtual size: 320KB

.reloc Size: 24KB - Virtual size: 21KB

.text
Size: 852KB - Virtual size: 851KB

fothk
Size: 4KB - Virtual size: 4KB

.rdata
Size: 208KB - Virtual size: 205KB

.data
Size: 4KB - Virtual size: 16KB

.pdata
Size: 44KB - Virtual size: 43KB

.didat
Size: 4KB - Virtual size: 152B

.rsrc
Size: 324KB - Virtual size: 320KB

.reloc
Size: 24KB - Virtual size: 21KB