6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2

Sharing

Copy URL Twitter E-mail

General

Target

6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2
Size

2.1MB
MD5

c6c25d0e580e0cb0038b40f310a489e1
SHA1

607b33dccc785dac27627831b63628f97175d6b5
SHA256

6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2
SHA512

aee036a03d62f799421aa0bb7046612b2cecc3b7352864d9163cb32c997057f4f9e2b11af406fe9790c94475b72b5caee40a66400ea9807262f85389d69a8cea
SSDEEP

49152:mJXfy0ooUGxgjYKS/WSkY7c8B7x+ROhiyCSR7vJOYXb:30BUI+3LqLXb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2

Files

6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2
.exe windows:5 windows x86 arch:x86

6b7f17f8dde7d875885ad7c11038c8a6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Y:\Projects\graphstudionext\bin\graphstudionext.pdb

Imports

quartz

AMGetErrorTextW

winmm

timeBeginPeriod
timeKillEvent
timeGetTime
timeSetEvent
timeEndPeriod

msdmo

MoFreeMediaType
DMOEnum
DMOUnregister

kernel32

LocalReAlloc
TlsFree
SetErrorMode
GetFileAttributesExW
LocalFileTimeToFileTime
GetCurrentDirectoryW
GetCommandLineW
HeapSetInformation
GetStartupInfoW
EncodePointer
DecodePointer
VirtualProtect
VirtualQuery
GetSystemTimeAsFileTime
GetTimeFormatW
GetDateFormatW
HeapReAlloc
RtlUnwind
HeapQueryInformation
HeapSize
ExitProcess
TlsSetValue
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeW
LCMapStringW
GetConsoleCP
GetConsoleMode
IsProcessorFeaturePresent
GetTimeZoneInformation
WriteConsoleW
SetStdHandle
GetDriveTypeW
SetEnvironmentVariableA
TlsAlloc
GlobalHandle
TlsGetValue
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetDiskFreeSpaceW
GetTempFileNameW
GetFileTime
SetFileTime
ReplaceFileW
SystemTimeToFileTime
GetFileAttributesW
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
CompareStringA
GetLocaleInfoW
LoadLibraryExW
lstrcmpA
GlobalFlags
GlobalGetAtomNameW
ReleaseActCtx
CreateActCtxW
GetShortPathNameW
GetFullPathNameW
GetVolumeInformationW
FindFirstFileW
FindClose
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
MoveFileW
DeleteFileW
lstrcmpiW
GetThreadLocale
GetStringTypeExW
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
FreeResource
CreateThread
GetThreadPriority
InterlockedExchange
SetThreadPriority
GetCurrentThread
DuplicateHandle
WaitForMultipleObjects
GetSystemInfo
CreateEventW
VirtualAlloc
ReleaseSemaphore
VirtualFree
SetEvent
ResetEvent
WaitForSingleObject
GlobalReAlloc
GetVersion
FormatMessageW
LocalAlloc
LocalFree
SearchPathW
lstrcatW
lstrlenA
SetDllDirectoryW
GetModuleHandleW
GetCurrentThreadId
RaiseException
FlushInstructionCache
lstrcmpW
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
InterlockedDecrement
InterlockedIncrement
Sleep
HeapFree
HeapAlloc
GetProcessHeap
OutputDebugStringW
CloseHandle
CreateFileW
GetFileSizeEx
SetFilePointerEx
ReadFile
WriteFile
DeleteCriticalSection
InitializeCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
EnterCriticalSection
LeaveCriticalSection
GetTickCount
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
GetCurrentProcessId
MulDiv
FreeLibrary
lstrcpyW
GetProcAddress
GetVersionExW
LoadLibraryW
GetSystemDirectoryW
MultiByteToWideChar
ActivateActCtx
DeactivateActCtx
SetLastError
GetLastError
WideCharToMultiByte
lstrlenW
lstrcpynW
FindResourceW
LoadResource
LockResource
SizeofResource
InterlockedCompareExchange
InterlockedPushEntrySList
InterlockedPopEntrySList
SetUnhandledExceptionFilter

user32

SetWindowRgn
DrawIcon
GetMessageW
RealChildWindowFromPoint
InflateRect
UnpackDDElParam
ReuseDDElParam
DestroyMenu
DestroyIcon
LoadAcceleratorsW
IsIconic
InsertMenuItemW
CharUpperW
GetWindowThreadProcessId
GetWindowDC
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
CheckMenuItem
ShowWindow
IsDialogMessageW
IsDlgButtonChecked
SetDlgItemTextW
SetDlgItemInt
GetDlgItemInt
CheckRadioButton
CheckDlgButton
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
GetLastActivePopup
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MonitorFromWindow
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
IsWindowVisible
RegisterClassW
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
GetWindowPlacement
GetDlgCtrlID
IsWindowEnabled
GetNextDlgTabItem
EndDialog
GetMenuState
GetMenuStringW
AppendMenuW
MsgWaitForMultipleObjects
GetQueueStatus
PeekMessageW
PostThreadMessageW
OffsetRect
TrackMouseEvent
DispatchMessageW
TranslateMessage
DrawFocusRect
ValidateRect
SetCursor
MessageBoxW
CreateDialogParamW
SetForegroundWindow
LoadIconW
LoadMenuW
EnableMenuItem
SetMenuItemInfoW
DeleteMenu
SetRect
GetMenuItemInfoW
PostMessageW
KillTimer
SetActiveWindow
RemoveMenu
SetTimer
GetWindowRect
EndPaint
ClientToScreen
DestroyWindow
GetWindowTextLengthW
DestroyAcceleratorTable
ScreenToClient
CharNextW
RegisterWindowMessageW
FillRect
IsChild
GetFocus
InvalidateRgn
CreateAcceleratorTableW
SetFocus
BeginPaint
GetClassInfoExW
RegisterClassExW
GetWindowTextW
GetDlgItem
GetDesktopWindow
UpdateWindow
SetWindowTextW
CallWindowProcW
MoveWindow
ModifyMenuW
SetClipboardData
CloseClipboard
EmptyClipboard
OpenClipboard
ReleaseDC
GetDC
IsRectEmpty
IntersectRect
ReleaseCapture
SetCapture
GetCursorPos
InsertMenuW
CreatePopupMenu
LoadBitmapW
PtInRect
MessageBeep
InvalidateRect
GetTabbedTextExtentW
CreateMenu
GetNextDlgGroupItem
CopyAcceleratorTableW
UnregisterClassW
GetActiveWindow
GetMenuItemID
NotifyWinEvent
WindowFromPoint
UnionRect
IsZoomed
DestroyCursor
RegisterClipboardFormatW
SetWindowContextHelpId
MapDialogRect
ShowOwnedPopups
PostQuitMessage
AdjustWindowRectEx
SetWindowPos
RedrawWindow
IsWindow
GetWindowLongW
SetWindowLongW
DefMDIChildProcW
GetMenu
DrawMenuBar
TranslateMDISysAccel
TranslateAcceleratorW
DefFrameProcW
BringWindowToTop
CreateWindowExW
GetSubMenu
GetMenuItemCount
LoadCursorW
MapWindowPoints
GetParent
GetSysColorBrush
GetSysColor
SystemParametersInfoW
EnumDisplayMonitors
SetRectEmpty
CopyRect
GetMonitorInfoW
GetSystemMetrics
GetClientRect
GetClassNameW
GetWindow
DefWindowProcW
GetClassInfoW
SendMessageW
EnableWindow
CreateDialogIndirectParamW
UnregisterClassA

gdi32

SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ExtSelectClipRgn
GetCharWidthW
StretchDIBits
CreateEllipticRgn
DPtoLP
Escape
Ellipse
TextOutW
EndPage
SetAbortProc
AbortDoc
EndDoc
GetViewportOrgEx
GetBkColor
GetTextColor
GetMapMode
GetRgnBox
GetNearestColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextAlign
GetTextFaceW
GetWindowOrgEx
LPtoDP
ExtTextOutW
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
RectVisible
PtVisible
StartDocW
GetWindowExtEx
GetViewportExtEx
GetStockObject
CreateFontIndirectW
EnumFontFamiliesW
GetTextCharsetInfo
DeleteObject
GetDeviceCaps
BitBlt
SetLayout
CreateCompatibleBitmap
StartPage
CreateCompatibleDC
ExcludeClipRect
GetClipBox
SetMapMode
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
CreateDCW
CreateDIBSection
SelectObject
CreateBitmap
PatBlt
SetPixel
GetPixel
Rectangle
Polygon
GetTextExtentPoint32W
CreateFontW
DeleteDC
EnumFontFamiliesExW
CreateRectRgnIndirect
CreateDIBitmap
GetTextMetricsW
CreatePatternBrush
CreatePen
CreateSolidBrush
GetObjectW
GetLayout

msimg32

TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW
GetJobW

advapi32

RegEnumKeyExW
RegQueryValueW
GetFileSecurityW
SetFileSecurityW
RegSetValueW
RegCreateKeyW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegEnumValueW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyW
RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegDeleteValueW
RegQueryValueExW

shell32

DragAcceptFiles
ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHAddToRecentDocs
SHGetFileInfoW
DragFinish
ExtractIconW
DragQueryFileW

comctl32

InitCommonControlsEx

shlwapi

PathFindExtensionW
PathFindFileNameW
PathFileExistsW
PathStripPathW
PathRemoveFileSpecW
SHRegGetPathW
SHCreateStreamOnFileW
PathStripToRootW
PathIsUNCW
PathAddExtensionW
SHStrDupW

ole32

CoInitializeEx
CoFreeUnusedLibraries
CoRegisterClassObject
CoGetClassObject
OleUninitialize
CoRegisterMessageFilter
StringFromGUID2
CLSIDFromProgID
CoTaskMemAlloc
CoLoadLibrary
CoGetMalloc
StgCreateDocfile
StgOpenStorage
StgIsStorageFile
MkParseDisplayName
CreateBindCtx
CreateStreamOnHGlobal
CreateItemMoniker
GetRunningObjectTable
StringFromCLSID
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitialize
CoTaskMemFree
OleFlushClipboard
OleIsCurrentClipboard
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoRevokeClassObject
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
IsAccelerator
OleTranslateAccelerator
OleLockRunning
StgOpenStorageOnILockBytes
PropVariantClear
OleInitialize
CoCreateGuid

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime
VariantCopy
SysAllocString
VariantChangeType
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
LoadRegTypeLi
OleCreateFontIndirect
SysAllocStringLen
VariantInit
LoadTypeLi
VariantClear
SysStringLen
SysFreeString

oledlg

OleUIBusyW

gdiplus

GdipCloneImage
GdipGetImageEncodersSize
GdipCreateBitmapFromScan0
GdipDisposeImage
GdipSaveImageToFile
GdiplusShutdown
GdipFree
GdipCreateBitmapFromHBITMAP
GdipGetImageEncoders
GdiplusStartup
GdipAlloc

xmllite

CreateXmlReader

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

ws2_32

gethostname
gethostbyname
inet_ntoa

oleacc

CreateStdAccessibleObject
LresultFromObject

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 519KB - Virtual size: 519KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 39KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 177KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 164KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

lhmzekm
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6b7f17f8dde7d875885ad7c11038c8a6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

quartz

winmm

msdmo

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

gdiplus

xmllite

version

ws2_32

oleacc

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 519KB - Virtual size: 519KB

.data Size: 39KB - Virtual size: 68KB

.rsrc Size: 177KB - Virtual size: 176KB

.reloc Size: 164KB - Virtual size: 165KB

lhmzekm Size: 72KB - Virtual size: 72KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 519KB - Virtual size: 519KB

.data
Size: 39KB - Virtual size: 68KB

.rsrc
Size: 177KB - Virtual size: 176KB

.reloc
Size: 164KB - Virtual size: 165KB

lhmzekm
Size: 72KB - Virtual size: 72KB