d4902fc962ebe0545edd9bc7e5bacd2fde5bf5de5c5e3e0150402b85ab6e3fb8

Sharing

Copy URL Twitter E-mail

General

Target

d4902fc962ebe0545edd9bc7e5bacd2fde5bf5de5c5e3e0150402b85ab6e3fb8
Size

1020KB
MD5

25905ab750877919a96db752102108f1
SHA1

da64d6d3f6ea7acfcf58a1c455e6a82982ea248c
SHA256

d4902fc962ebe0545edd9bc7e5bacd2fde5bf5de5c5e3e0150402b85ab6e3fb8
SHA512

58c20ab88fefe1860f853db8f38d7fb4fa5e873990b392af32858831c1c5705025fdd94b35d687da8d922cad8dc01f1c5923bb7d88835180cf14fd50cf1c8789
SSDEEP

24576:dyevqXwPrXqJ2tMRedGZKPuUX8xOGUGAVBC4iaPD3o+huDa6E7W30kn:dVqoVw076E7WV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d4902fc962ebe0545edd9bc7e5bacd2fde5bf5de5c5e3e0150402b85ab6e3fb8

Files

d4902fc962ebe0545edd9bc7e5bacd2fde5bf5de5c5e3e0150402b85ab6e3fb8
.exe windows:4 windows x86 arch:x86

c87dd742b4c30f8ed63ea20e5491d96a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rtlics

ICS_DHCP_Need_ReSet
ord4
Get_Hi_Speed_Adapter
ord8
ICS_DHCP_Enable_PublicLAN
CheckICS
ord3
ord5
ord2
ord7
ord1

version

GetFileVersionInfoSizeA
GetFileVersionInfoA

gdiplus

GdipCreatePen1
GdipFree
GdipDrawLineI
GdipAlloc
GdipCreateFromHDC
GdipDrawImageRectI
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateSolidFill
GdipDrawString
GdipDeleteBrush
GdipCloneBrush
GdipSetPenStartCap
GdipSetPenEndCap
GdipDeletePen
GdipDeleteGraphics
GdipGetGenericFontFamilySansSerif
GdipDisposeImage
GdipCloneBitmapAreaI
GdipGetImageHeight
GdipCreateBitmapFromFile
GdipCloneImage
GdiplusStartup
GdiplusShutdown
GdipCreateFont
GdipGetImageWidth
GdipDeleteFont

enumdevlib

GetDeviceInfo
ShowDevice8180
EnumDevicesChange

rtllib

RT_SetIsXlink
RT_SetChannel
RT_SetNetworkType
RT_Set802_1xStatus
RT_CustomRequest
RT_AutoCfgScan
RT_Passphrase128
RT_Passphrase64
RT_GetAdapterList
RT_GEN_PIN
RT_GetMacAddress
RT_WPSAPSurvey
RT_WS2_stop
RT_PasswordHash
RT_Set_HW_PBCStatus
RT_Get_HW_PBCStatus
RT_Check_Session_Overlap
RT_WSC_Connect
RT_WPS
RT_GetStatusDriverInfo
RT_GetStatusPerformanceInfo
RT_GetStatusPowerMode
RT_GetUsbHubType
RT_GetUsbMode
RT_GetStatistics
RT_SiteSurvey_WS2
RT_WPSAPSurveyEx
RT_WPS_Registrar_APConfig
RT_WPS_External_Registrar
RT_WPS_External_Registrar_Add_New_Device
RT_WPS_2_Support_Weak_Security
RT_VERIFY_PIN
RT_CCX_SetTxPowerPercentage
RT_CCX_GetTxPowerPercentage
RT_GetPort_Auth_State
RT_GetStatusDynamicRate
RT_GetExtendedStatistics
RT_GetStatusSignalInfoMIMO
RT_GetStatus_11N_Txrate
RT_GetStatus_11N_Rxrate
RT_GetInitial_11N_Txrate
RT_Get_11N_Retry_Count
RT_DebugCmdSend
RT_DebugCmdCheck
RT_DebuggCmdReturn
RT_CCX_GetTxPowerRange
RT_CCX_GetTpower
RT_SetEapFastVersion
RT_CCX_SetTpower
RT_GetEapFastVersion
RT_SiteSurveyEx
RT_SetWDS_AP_LIST
RT_GetMeshID
RT_AP_GetStationList
RT_SetBeaconInterval
RT_WS2_init
RT_GetPIN_WS2
RT_Debug_Methodflag
RT_GetMeshMode
RT_NicChangeState
RT_SetNicTcpipAddr
RT_Stop
RT_AP_SwitchToStationMode
RT_ReNewIPAddress
RT_SetMeshMode
RT_AP_SwitchToAPMode
RT_EnableZeroConfig
RT_SetRadioOff
RT_SetPrivacy
RT_SetAuthenticaionMode
RT_SetDefaultKeyID
RT_SetWEPKey
RT_SetSSID
RT_SetDTIMPeriod
RT_GetSSID
RT_GetStatusLinkInfo
RT_Disassociate
RT_UIDlgView_Cert
RT_Get_Cert_CA_List
RT_Get_Cert_CA_URL
RT_Need_check_USB
RT_IsXPConfig
RT_AP_GetIsAPMode
RT_ZeroConfigService
RT_GetIsRadioOff
RT_GetStatusHardwareRadioOff
RT_SetIsWDS_MODE
RT_GetIsWDS_MODE
RT_AP_IsSupported
RT_RegisterMessageHandler
RT_GetStatusMediaStatus
RT_GetPacFileInfo
RT_GetPacFileNameList
RT_RefreshPacFileNameList
RT_GetUserCertList
RT_GetAUTOChannel
RT_GetStatusChannelInfo
RT_GetChannelList
RT_CertUrlWin32String
RT_GetLoginInfo
RT_GetStatusSecurityInfo
RT_GetStatusSignalInfo
RT_GetNicGuid
RT_SetOID
RT_SetEncryptionStatus
RT_GetMacAddressString
RT_SetPreambleMode
RT_GetPreambleMode
RT_SetRates
RT_GetRates
RT_SetPowerSaveMode
RT_GetPowerSaveMode
RT_SetLoginInfo
RT_SetMeshID
RT_AP_SetPassphrase
RT_ADD_PMK_CONX
RT_ADD_PSK_CONX
RT_credServerVerify
RT_SetPacFileIndex
RT_Set_8021x_tunnle
RT_Set_8021x_conf
RT_GetDefaultEncryptionAlgorithm
RT_SetMHSecurityInfo
RT_ConfigCCX
RT_SetAUTOChannel
RT_REMOVE_PSK_CONX
RT_CCX_ENABLE_RM
RT_SetDATA_RATE_STA
RT_SetIsHidden_SSID
RT_SetLOCKED_STA_ADDRESS
RT_SetFILTER_STA_ADDRESS
RT_Set_Filter_Type
RT_IsUnplug
RT_Check_Switch_USB
RT_Rescan
RT_VWLan_SoftAP_Set_Passphrase
RT_VWLan_SoftAP_Set_WEP
RT_VWLan_SoftAP_Set_Encrypt_Mode
RT_VWLan_SoftAP_Set_Auth_Mode
RT_SetUserLogOff
RT_GetUserLogOff
RT_CCX_InitCallback
RT_GetDriverPath
RT_Initialize
RT_SetDefaultAdapterIndex
RT_GetStatusWEPKeyMisMatch
RT_VWLan_SoftAP_Enable
RT_VWLan_SoftAP_IsEnable
RT_VWLan_SoftAP_GetGUID
RT_VWLan_SoftAP_GetSSID
RT_GetLiveTime
RT_VWLan_SoftAP_GetStationList
RT_GetChannelPlanString
RT_GetRTSThreshold
RT_GetFragmentationThreshold
RT_SetChannelPlan
RT_GetWirelessMode
RT_GetSupportedWirelessMode
RT_GetTurboMode
RT_Set_WMM_QoS_APSD
RT_Get_WMM_QoS_APSD
RT_GetIsXlink
RT_SetTurboMode
RT_SetRTSThreshold
RT_SetFragmentationThreshold
RT_SetAdhocDefaultWirelessMode
RT_SetWirelessMode
RT_EnableWirelessMode
RT_SaveLog
RT_SendMagicPacket
RT_GetDTIMPeriod
RT_GetBeaconInterval
RT_SetBSSID

iplib

GetIpInformation

rtlqrcode

??0ExTern_CImage@@QAE@XZ
?Load@ExTern_CImage@@QAEJPBD@Z
?GetWidth@ExTern_CImage@@QAEHXZ
?GetHeight@ExTern_CImage@@QAEHXZ
?Draw@ExTern_CImage@@QAEHPAUHDC__@@HH@Z
Rtl_Generate_QRCode
??1ExTern_CImage@@UAE@XZ

vlanapi

RT_SetEnableWZC
RT_CreateVWLAN
RT_HideVWLAN
RT_IS_Disable_ByVID
RT_GetVlanGUID_ByVID
RT_DeldteVWLAN
RT_SetEnableNIC
RT_IsEnableWZC
RT_Char2WChar
RT_WChar2Char

kernel32

GetThreadLocale
GetStringTypeExA
GetVolumeInformationA
DeleteFileA
MoveFileA
SetEndOfFile
UnlockFile
LockFile
SetFilePointer
GetCurrentProcess
DuplicateHandle
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
GlobalFlags
GetProcessVersion
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetDiskFreeSpaceA
GetFileTime
SetFileTime
GetFullPathNameA
GetTempFileNameA
GetFileAttributesA
WritePrivateProfileStringA
FindNextFileA
FindFirstFileA
FindClose
ReleaseMutex
InterlockedExchange
GetProfileStringA
MulDiv
GlobalAlloc
GetShortPathNameA
GetCurrentThread
GlobalFree
LoadLibraryA
GetVersion
lstrcatA
GlobalGetAtomNameA
SetEnvironmentVariableA
CompareStringW
CompareStringA
IsBadCodePtr
IsBadReadPtr
GetDriveTypeA
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
LCMapStringW
LCMapStringA
GetTimeZoneInformation
GetACP
HeapSize
HeapReAlloc
lstrcmpA
GetCommandLineA
GetFileType
SetStdHandle
RaiseException
ExitThread
ExitProcess
GetStartupInfoA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
RtlUnwind
SetErrorMode
FileTimeToLocalFileTime
FileTimeToSystemTime
GetCurrentDirectoryA
GetOEMCP
GetCPInfo
SystemTimeToFileTime
GetLastError
Sleep
LocalFileTimeToFileTime
OutputDebugStringA
CloseHandle
GetFileSize
CreateFileA
GetLocalTime
CreateThread
TerminateThread
WaitForSingleObject
ResumeThread
lstrlenW
GetVersionExA
GetPrivateProfileIntA
GetPrivateProfileStringA
GlobalUnlock
GlobalLock
SetEvent
WinExec
GetTickCount
ResetEvent
WaitForMultipleObjects
GetModuleFileNameA
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
FlushFileBuffers
GetComputerNameA
WriteFile
ReadFile
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
CopyFileA
CreateMutexA
FreeLibrary
lstrcpynA
ProcessIdToSessionId
GetCurrentProcessId
LockResource
LoadResource
SizeofResource
FindResourceA
SuspendThread
SetThreadPriority
GetCurrentThreadId
CreateEventA
InterlockedIncrement
InterlockedDecrement
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
LocalFree
FormatMessageA
SetLastError
GetProcAddress
GetModuleHandleA
lstrcpyA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
lstrcmpiA

user32

GetMenuItemID
SetDlgItemTextA
IsDialogMessageA
SetWindowTextA
MoveWindow
ShowWindow
CreateDialogIndirectParamA
EndDialog
PostQuitMessage
MapDialogRect
GetWindowDC
BeginPaint
EndPaint
TabbedTextOutA
GrayStringA
SetRectEmpty
LoadAcceleratorsA
TranslateAcceleratorA
ReuseDDElParam
UnpackDDElParam
IsZoomed
ShowOwnedPopups
SetWindowContextHelpId
RegisterClipboardFormatA
SetRect
GetSysColorBrush
GetClassNameA
CharUpperA
InsertMenuA
WindowFromPoint
DestroyIcon
CharNextA
CopyAcceleratorTableA
GetNextDlgGroupItem
MessageBeep
GetDCEx
LockWindowUpdate
SetParent
TrackPopupMenu
GetDlgItem
GetWindowTextLengthA
GetWindowTextA
DefWindowProcA
DestroyWindow
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
DrawMenuBar
CallWindowProcA
RemovePropA
GetMessageTime
GetMessagePos
GetForegroundWindow
GetWindow
SetWindowLongA
SetWindowPos
RegisterWindowMessageA
IntersectRect
GetWindowPlacement
GetScrollPos
SetScrollPos
GetCapture
LoadCursorA
DestroyCursor
BeginDeferWindowPos
EndDeferWindowPos
EqualRect
IsIconic
SetCursorPos
PtInRect
ClientToScreen
ScreenToClient
SetCapture
GetDlgCtrlID
IsChild
CreateWindowExA
WaitMessage
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
GetMessageA
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
SetWindowsHookExA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
GetNextDlgTabItem
GetFocus
DrawTextA
SystemParametersInfoA
CreateIconFromResource
GetSubMenu
DeleteMenu
GetCursorPos
GetDC
ReleaseDC
SetForegroundWindow
UpdateWindow
OffsetRect
BringWindowToTop
GetSysColor
GetAsyncKeyState
LoadImageA
GetClientRect
InflateRect
FrameRect
IsRectEmpty
InvalidateRect
SetCursor
RegisterDeviceNotificationA
GetMenu
PeekMessageA
TranslateMessage
DispatchMessageA
IsWindowVisible
GetDesktopWindow
GetWindowRect
GetSystemMetrics
LoadStringA
IsWindow
LoadMenuA
GetMenuItemCount
ModifyMenuA
RemoveMenu
GetMenuStringA
GetMenuState
CheckMenuItem
SetMenu
DestroyMenu
OpenClipboard
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
FillRect
LoadBitmapA
LoadIconA
wsprintfA
FindWindowA
MessageBoxA
GetParent
PostMessageA
ShowScrollBar
SendMessageA
EnableWindow
RedrawWindow
PostThreadMessageA
KillTimer
SetTimer
SendDlgItemMessageA
MapWindowPoints
SetActiveWindow
SetFocus
AdjustWindowRectEx
DeferWindowPos
CopyRect
ScrollWindow
GetScrollInfo
SetScrollInfo
GetScrollRange
SetScrollRange
GetTopWindow
WinHelpA
GetClassInfoA
ReleaseCapture
RegisterClassA
IsWindowUnicode
DefDlgProcA
DrawFocusRect
ExcludeUpdateRgn
ShowCaret
HideCaret
UnregisterClassA
CheckRadioButton

gdi32

SelectClipRgn
ExcludeClipRect
IntersectClipRect
MoveToEx
ScaleWindowExtEx
SetWindowExtEx
LineTo
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetBkMode
SelectPalette
RestoreDC
SaveDC
DeleteDC
CreateRectRgnIndirect
SetBkColor
SetTextColor
GetClipBox
PatBlt
CreateBitmap
GetTextExtentPointA
GetStockObject
GetObjectA
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
DeleteObject
CreatePalette
GetDeviceCaps
RealizePalette
CreateFontA
CreateDIBitmap
GetBkColor
GetTextColor
CreateDCA
LPtoDP
GetTextMetricsA
StretchDIBits
DPtoLP
CreateFontIndirectA
CombineRgn
SetRectRgn
GetMapMode
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
CreatePatternBrush
CreateSolidBrush
CreatePen
GetWindowExtEx
GetViewportExtEx
CreateRectRgn

comdlg32

GetFileTitleA
GetOpenFileNameA
CommDlgExtendedError
PrintDlgA
GetSaveFileNameA

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegSetValueExA
RegCreateKeyA
RegFlushKey
RegDeleteValueA
RegEnumValueA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegCreateKeyExA
SetFileSecurityA
GetFileSecurityA
RegSetValueA

shell32

DragQueryFileA
DragFinish
Shell_NotifyIconA
ExtractIconA
SHGetFileInfoA

comctl32

ImageList_SetOverlayImage
ImageList_ReplaceIcon
ImageList_AddMasked
ImageList_Create
ImageList_GetIcon
ord17
ImageList_Destroy
PropertySheetA
DestroyPropertySheetPage
CreatePropertySheetPageA

oledlg

ord8

ole32

StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoRegisterMessageFilter
CoGetClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemFree
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CLSIDFromString
CLSIDFromProgID

olepro32

ord253

oleaut32

SysFreeString
VariantCopy
VariantClear
VariantChangeType
SysAllocStringLen
SysAllocString
SysStringLen
SysAllocStringByteLen
VariantTimeToSystemTime

wsock32

WSAGetLastError
WSASetLastError
WSAStartup
WSACleanup
gethostname
setsockopt
ntohl
connect
sendto
recvfrom
socket
inet_ntoa
WSAAsyncSelect
send
recv
gethostbyname
closesocket
bind
ioctlsocket
htonl
htons
ntohs
inet_addr
accept

shlwapi

StrStrIA

wtsapi32

WTSUnRegisterSessionNotification
WTSEnumerateSessionsA
WTSRegisterSessionNotification

Sections

.text
Size: 684KB - Virtual size: 682KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 291KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 152KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c87dd742b4c30f8ed63ea20e5491d96a

Headers

File Characteristics

Imports

rtlics

version

gdiplus

enumdevlib

rtllib

iplib

rtlqrcode

vlanapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

wsock32

shlwapi

wtsapi32

Sections

.text Size: 684KB - Virtual size: 682KB

.rdata Size: 128KB - Virtual size: 126KB

.data Size: 52KB - Virtual size: 291KB

.rsrc Size: 152KB - Virtual size: 149KB

.text
Size: 684KB - Virtual size: 682KB

.rdata
Size: 128KB - Virtual size: 126KB

.data
Size: 52KB - Virtual size: 291KB

.rsrc
Size: 152KB - Virtual size: 149KB