ed6fb52ff24f8b7d567194ba112489860505b44b8a0db7ca9bc67e2c94896da5

Sharing

Copy URL Twitter E-mail

General

Target

ed6fb52ff24f8b7d567194ba112489860505b44b8a0db7ca9bc67e2c94896da5
Size

4.8MB
MD5

791c959b58ec797d43afb42ce0ba6a98
SHA1

60744ca4262dfecfb223dc47c99d0fdc010c16fe
SHA256

ed6fb52ff24f8b7d567194ba112489860505b44b8a0db7ca9bc67e2c94896da5
SHA512

772510797990457ee4de1e33fb8643fb163c3739299467b25d6a23eb88e441d0a13a7a9473421b1e3cccbd828078601297bf90ee7c07343f5c22b3b4ec28f4d3
SSDEEP

98304:GmhCP6iL6YbmkRcKkAUArR7FVqwzlOfVH5WIZBzO8PFIN:GbzbLfUYRRVAtZBO8PFIN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ed6fb52ff24f8b7d567194ba112489860505b44b8a0db7ca9bc67e2c94896da5

Files

ed6fb52ff24f8b7d567194ba112489860505b44b8a0db7ca9bc67e2c94896da5
.exe windows:5 windows x86 arch:x86

ed7fed570c4f1b0dd3cd1f6afb5b0498

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Magictray\MagicTray\Bin\Release\mytime.pdb

Imports

kernel32

CreateMutexW
CreateProcessW
GetStartupInfoW
GetCommandLineW
GetDriveTypeW
GetSystemDirectoryW
GetTempPathW
GetWindowsDirectoryW
GetDiskFreeSpaceExW
SetFileAttributesW
DeleteFileW
CopyFileW
MoveFileW
MoveFileExW
WaitNamedPipeW
IsBadReadPtr
IsBadCodePtr
GetTickCount
FileTimeToSystemTime
GetTimeZoneInformation
TzSpecificLocalTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetSystemInfo
SetLocalTime
GetLocalTime
GetSystemTime
DeviceIoControl
FlushFileBuffers
GetLogicalDrives
Sleep
EnterCriticalSection
SetLastError
GetCurrentThreadId
CreateThread
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
SetProcessWorkingSetSize
VirtualProtect
LocalFree
GlobalMemoryStatusEx
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
FreeResource
InterlockedDecrement
InterlockedIncrement
EndUpdateResourceW
UpdateResourceW
BeginUpdateResourceW
BeginUpdateResourceA
LoadLibraryExW
LoadLibraryExA
FreeLibrary
Module32NextW
Module32FirstW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetVersionExW
LoadLibraryW
lstrlenW
lstrlenA
WaitForSingleObject
WriteProcessMemory
CreateRemoteThread
OpenProcess
VirtualFreeEx
VirtualAllocEx
FindNextFileW
FindFirstFileW
GetFileAttributesW
CreateFileW
CreateDirectoryW
DosDateTimeToFileTime
FileTimeToDosDateTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
CloseHandle
SetFileTime
GetFileTime
FindClose
ReadFile
WriteFile
GetFileSizeEx
GetFileSize
WideCharToMultiByte
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
GetLastError
DecodePointer
GetFullPathNameW
lstrcpyW
FindResourceW
GetModuleHandleW
GetModuleFileNameW
SizeofResource
LoadResource
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSection
RaiseException
GetCurrentProcess
GetProcessHeap
HeapSize
HeapFree
SetEndOfFile
GetCurrentDirectoryW
SetCurrentDirectoryW
WriteConsoleW
SetStdHandle
OutputDebugStringA
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
SetConsoleCtrlHandler
HeapQueryInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleCP
SetFilePointerEx
ReadConsoleW
GetConsoleMode
LockResource
GetFileType
GetACP
GetStdHandle
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
GetFullPathNameA
InterlockedFlushSList
RtlUnwind
CreateFileA
SetFilePointer
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
GetUserDefaultUILanguage
lstrcmpW
IsBadStringPtrW
MulDiv
SetEvent
TerminateThread
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
HeapReAlloc
HeapAlloc
HeapDestroy
GetProcAddress
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
FormatMessageW
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
GetThreadTimes
GetCurrentThread
QueryPerformanceFrequency
QueryPerformanceCounter
VirtualQuery
FindResourceExW
lstrcmpiW

gdi32

ExtSelectClipRgn
SelectClipRgn
RoundRect
Rectangle
LineTo
GetTextExtentPoint32W
GetClipBox
GetCharABCWidthsW
CreateRectRgnIndirect
CreateRectRgn
CreatePen
CombineRgn
SetStretchBltMode
SetBkColor
GetBitmapBits
CreateCompatibleBitmap
CreatePatternBrush
CreateSolidBrush
PtInRegion
OffsetRgn
SetWindowOrgEx
SaveDC
RestoreDC
CreateRoundRectRgn
DeleteObject
GetTextMetricsW
SetDIBColorTable
SelectObject
CreateDIBSection
CreateCompatibleDC
CreateDCW
StretchBlt
GdiFlush
TextOutW
SetBitmapBits
MoveToEx
GetObjectW
GetObjectA
SetTextColor
SetBkMode
SelectPalette
RealizePalette
GetStockObject
GetDIBits
GetDeviceCaps
DeleteDC
CreateFontIndirectW
BitBlt

comdlg32

GetSaveFileNameW
ChooseFontW
ChooseColorW
GetOpenFileNameW

advapi32

FreeSid
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
SetTokenInformation
AllocateAndInitializeSid
GetLengthSid
GetUserNameW
CreateProcessAsUserW
DuplicateTokenEx
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyExW
RegFlushKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
ChangeServiceConfigW
ChangeServiceConfig2W
CloseServiceHandle
CreateServiceW
OpenSCManagerW
OpenServiceW
StartServiceW
SetEntriesInAclW
SetNamedSecurityInfoW
ConvertStringSidToSidW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA

shell32

ShellExecuteExW
CommandLineToArgvW
SHFileOperationW
SHCreateDirectoryExW
SHGetFolderPathW
ShellExecuteW

ole32

CreateILockBytesOnHGlobal
ReleaseStgMedium
OleDuplicateData
OleSetContainedObject
OleCreateStaticFromData
StgCreateDocfileOnILockBytes
StgCreateDocfile
OleUninitialize
OleInitialize
CoInitialize
CoUninitialize
CoSetProxyBlanket
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
OleRun
CreateStreamOnHGlobal
OleLockRunning

oleaut32

SysFreeString
VariantCopy
VariantChangeType
CreateErrorInfo
VarUdateFromDate
VariantInit
VariantTimeToSystemTime
SetErrorInfo
GetErrorInfo
SystemTimeToVariantTime
SysAllocStringByteLen
SysStringByteLen
SysAllocString
VariantClear

shlwapi

PathFindFileNameW
PathFindExtensionW
PathAppendW
PathFileExistsW

gdiplus

GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateHBITMAPFromBitmap
GdipGetFontSize
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipSaveImageToStream
GdipSaveImageToFile
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipSetPenWidth
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipGetPathWorldBounds
GdipAddPathString
GdipDeletePath
GdipTranslateWorldTransform
GdipFree
GdipAlloc
GdipDrawString
GdipMeasureString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipSetStringFormatHotkeyPrefix
GdipRotateWorldTransform
GdipDrawLineI
GdipDrawLinesI
GdipFillRectangleI
GdipFillEllipseI
GdipDrawImageRectI
GdipDrawImageRectRectI
GdipDrawPath
GdipDrawRectangleI
GdipSetImageAttributesColorKeys
GdipSetPenDashStyle
GdipAddPathArcI
GdipAddPathLineI
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipDeleteFontFamily
GdipCreateFontFromDC
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdiplusShutdown
GdiplusStartup
GdipSaveGraphics
GdipDrawImageI
GdipGraphicsClear
GdipSetImageAttributesWrapMode
GdipSetImageAttributesColorMatrix
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipGetFamily
GdipCreatePath
GdipGetFontStyle
GdipCreateBitmapFromHBITMAP
GdipGetImagePalette
GdipGetImagePaletteSize
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipReleaseDC

imm32

ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
ImmSetCandidateWindow

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

urlmon

URLDownloadToFileW

wininet

InternetCloseHandle
InternetOpenW
InternetSetOptionW
HttpOpenRequestA
InternetConnectW
InternetQueryOptionW
InternetOpenUrlW
InternetReadFile
HttpOpenRequestW
HttpSendRequestA
HttpSendRequestExW
HttpEndRequestW
HttpQueryInfoW
InternetWriteFile
InternetConnectA
HttpAddRequestHeadersA

iphlpapi

GetAdaptersInfo

winmm

sndPlaySoundW
mciSendStringW

powrprof

SetSuspendState

sensapi

IsNetworkAlive

dbghelp

MiniDumpWriteDump

ws2_32

sendto
htonl
htons
inet_addr
ntohl
recvfrom
setsockopt
socket
WSAStartup
WSACleanup

comctl32

_TrackMouseEvent
ord17

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 660KB - Virtual size: 660KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 61KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7.8MB - Virtual size: 7.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ed7fed570c4f1b0dd3cd1f6afb5b0498

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

imm32

version

urlmon

wininet

iphlpapi

winmm

powrprof

sensapi

dbghelp

ws2_32

comctl32

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 660KB - Virtual size: 660KB

.data Size: 61KB - Virtual size: 102KB

.tls Size: 512B - Virtual size: 13B

.gfids Size: 2KB - Virtual size: 2KB

.rsrc Size: 7.8MB - Virtual size: 7.8MB

.reloc Size: 160KB - Virtual size: 160KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 660KB - Virtual size: 660KB

.data
Size: 61KB - Virtual size: 102KB

.tls
Size: 512B - Virtual size: 13B

.gfids
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 7.8MB - Virtual size: 7.8MB

.reloc
Size: 160KB - Virtual size: 160KB