1a9c670c5ad137dee7340818f820aab9d40659fb50d470600055fddab7b322da

Sharing

Copy URL Twitter E-mail

General

Target

1a9c670c5ad137dee7340818f820aab9d40659fb50d470600055fddab7b322da
Size

5.0MB
MD5

7295ea3063fe2b83fa8d2a9b7b4e4d07
SHA1

12c0fc6f6a4f6637e9ac1a997994f4d1dab9b0fe
SHA256

1a9c670c5ad137dee7340818f820aab9d40659fb50d470600055fddab7b322da
SHA512

2cf5c68472db7cafefb8caaa5b4d5f87bb8badb4b353200d257ea5eecdcba6aafe07d7f946174c999ab529234b2a475c7867ed436d1ce1aa9dd6a0464de0e1ae
SSDEEP

49152:z++0MyzKgayE9w19OqdslWW3nX4DFC60bIQGJbYU:z8lGwDYWW3I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a9c670c5ad137dee7340818f820aab9d40659fb50d470600055fddab7b322da

Files

1a9c670c5ad137dee7340818f820aab9d40659fb50d470600055fddab7b322da
.dll windows:4 windows x86 arch:x86

cc3af5a9eb1a7a0341cb083e4e61b8f6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemInfo
GetVersionExA
FreeConsole
AllocConsole
WriteConsoleA
GetStdHandle
OutputDebugStringA
GetCommandLineA
ExpandEnvironmentStringsW
CreateDirectoryA
SetFileAttributesA
GetLocaleInfoW
CreateMutexW
OpenMutexW
LocalFree
TlsSetValue
GetCurrentThread
GetCurrentProcess
DuplicateHandle
TlsFree
InterlockedIncrement
InterlockedDecrement
SetLastError
ResumeThread
GetFileTime
GetFileSize
GetLocalTime
DeviceIoControl
GetVersion
GetExitCodeThread
DeleteFileA
GetFileAttributesA
GetEnvironmentVariableW
CreateFileA
InitializeCriticalSection
Process32First
DefineDosDeviceA
GetDiskFreeSpaceExA
SetVolumeLabelA
GetVolumeInformationA
GetLogicalDrives
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
Process32Next
GetPrivateProfileIntA
QueryPerformanceCounter
lstrcmpA
VirtualProtectEx
WriteProcessMemory
InterlockedExchangeAdd
InterlockedCompareExchange
CreateProcessA
GetThreadPriority
SetThreadPriority
GetPriorityClass
SetPriorityClass
SuspendThread
BeginUpdateResourceA
UpdateResourceA
EndUpdateResourceA
EnumResourceLanguagesA
EnumResourceTypesA
EnumResourceNamesA
SizeofResource
LockResource
LoadLibraryExA
FreeResource
GetWindowsDirectoryA
BackupRead
BackupSeek
BackupWrite
SetFileTime
OpenSemaphoreA
CancelIo
GetOverlappedResult
CreateNamedPipeA
ConnectNamedPipe
WaitNamedPipeA
SetNamedPipeHandleState
MoveFileExA
RemoveDirectoryW
CreateDirectoryW
RemoveDirectoryA
MoveFileA
GetTempPathA
ExpandEnvironmentStringsA
SetEnvironmentVariableA
SetConsoleCtrlHandler
GetStringTypeW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetPrivateProfileStringA
GetProfileStringA
OpenEventA
GetFullPathNameA
GetFullPathNameW
GetDriveTypeA
GetLongPathNameA
GetLongPathNameW
CreateMutexA
CreateFileMappingA
MapViewOfFile
OpenFileMappingA
UnmapViewOfFile
ReleaseMutex
CreateEventW
OpenEventW
OpenMutexA
TerminateThread
ResetEvent
WaitForMultipleObjects
CreateProcessW
CopyFileA
lstrlenW
GetDiskFreeSpaceExW
VirtualQueryEx
ReadProcessMemory
SetEvent
WaitForSingleObject
CreateEventA
OutputDebugStringW
VirtualProtect
CompareFileTime
GetComputerNameA
VirtualQuery
GetExitCodeProcess
GetProcessTimes
GetTickCount
FileTimeToSystemTime
QueryDosDeviceA
GetVolumeInformationW
OpenProcess
FindFirstFileW
FindNextFileW
FindFirstFileA
FindNextFileA
FindClose
CreateThread
GetFileAttributesExA
GetFileInformationByHandle
WideCharToMultiByte
IsBadWritePtr
GetTimeZoneInformation
SystemTimeToFileTime
FileTimeToLocalFileTime
GetFileType
MultiByteToWideChar
GetTempPathW
GetTempFileNameW
FlushFileBuffers
MoveFileExW
SetFileAttributesW
GetFileAttributesExW
GetFileAttributesW
QueryDosDeviceW
Sleep
EnterCriticalSection
LeaveCriticalSection
GetComputerNameW
MulDiv
GetDriveTypeW
TlsGetValue
WritePrivateProfileStringA
DeleteCriticalSection
GlobalLock
GlobalUnlock
GlobalAlloc
GlobalFree
GetLastError
CreateFileW
ReadFile
CloseHandle
CopyFileW
SetFilePointer
SetEndOfFile
WriteFile
DeleteFileW
MoveFileW
LoadLibraryA
FreeLibrary
LoadLibraryW
GetModuleHandleW
GetCurrentThreadId
GetCurrentProcessId
IsBadReadPtr
GetModuleHandleA
GetProcAddress
GetCurrentDirectoryW
GetModuleFileNameW
GetSystemDirectoryW
GetCurrentDirectoryA
GetModuleFileNameA
GetSystemDirectoryA
GetCommandLineW
TlsAlloc
GetStringTypeA
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
UnhandledExceptionFilter
IsBadCodePtr
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
CompareStringW
CompareStringA
SetUnhandledExceptionFilter
GetStartupInfoA
SetHandleCount
SetStdHandle
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetOEMCP
GetCPInfo
LCMapStringW
LCMapStringA
FatalAppExitA
HeapSize
TerminateProcess
ExitProcess
RaiseException
GetSystemTime
HeapReAlloc
HeapFree
HeapAlloc
RtlUnwind
PulseEvent
ReleaseSemaphore
CreateSemaphoreA
InterlockedExchange
lstrlenA
FormatMessageA
LoadResource
FindResourceExA
GetACP
FormatMessageW
SleepEx

user32

FindWindowExA
GetWindowLongA
PostMessageA
RegisterClipboardFormatW
IsClipboardFormatAvailable
EnumClipboardFormats
GetWindowTextA
GetClassNameA
SystemParametersInfoW
DrawTextW
FillRect
GetDC
GetClipboardFormatNameW
SendMessageW
CallWindowProcW
GetCursorPos
WindowFromPoint
GetDesktopWindow
GetWindowRect
DdeQueryConvInfo
GetWindow
IsWindow
OffsetRect
IsZoomed
MoveWindow
WaitForInputIdle
FindWindowA
GetClipboardOwner
EnumDesktopsA
SwitchDesktop
CreateDesktopA
SetClipboardData
PostThreadMessageW
OpenDesktopW
EnumDesktopWindows
IsWindowVisible
MessageBoxW
MessageBoxA
OpenWindowStationA
SetProcessWindowStation
CloseWindowStation
GetProcessWindowStation
GetUserObjectInformationA
OpenInputDesktop
OpenDesktopA
GetThreadDesktop
SetThreadDesktop
CloseDesktop
SendMessageA
DdeDisconnect
DdeConnectList
DdeQueryNextServer
DdeDisconnectList
SendMessageTimeoutW
EnumWindows
GetPropW
GetWindowThreadProcessId
GetWindowTextW
GetForegroundWindow
GetClientRect
ClientToScreen
IsRectEmpty
LoadCursorA
SetCursor
ReleaseDC
GetParent
GetWindowLongW
SetWindowLongW
PostMessageW
GetDlgItem
GetClassNameW
FindWindowExW
MsgWaitForMultipleObjects
wsprintfA
GetSystemMetrics
GetUserObjectInformationW
WindowFromDC

gdi32

GetBkColor
GetClipRgn
PtInRegion
GetRegionData
CreateRectRgnIndirect
CombineRgn
GetTextMetricsA
GetTextExtentPoint32W
CreateRectRgn
SelectClipRgn
CreatePen
MoveToEx
LineTo
GetTextFaceW
GetFontUnicodeRanges
GetGlyphIndicesW
CreateDCA
CreatePalette
RealizePalette
CreateDIBitmap
ExtTextOutA
SetDIBits
GetObjectA
GetDIBits
SetDIBColorTable
GdiFlush
GetPaletteEntries
SetPixel
CloseEnhMetaFile
CreateEnhMetaFileW
GetWindowOrgEx
GetWindowExtEx
SetWindowExtEx
CreateCompatibleBitmap
SelectPalette
GetViewportOrgEx
GetViewportExtEx
GetWorldTransform
SetBkColor
SetViewportExtEx
SetWorldTransform
SetWindowOrgEx
SetViewportOrgEx
CreateCompatibleDC
CreateDIBSection
BitBlt
SetStretchBltMode
StretchBlt
DeleteDC
SaveDC
GetStockObject
GetMapMode
LPtoDP
SetMapMode
DPtoLP
GetTextAlign
SetTextAlign
GetBkMode
TextOutW
RestoreDC
EndDoc
CreateSolidBrush
GetClipBox
SelectObject
SetBkMode
GetTextColor
SetTextColor
GetCurrentObject
GetObjectW
GetDeviceCaps
CreateFontIndirectW
DeleteObject
CopyEnhMetaFileW
DeleteEnhMetaFile
GetBitmapBits

advapi32

RegCreateKeyExA
GetUserNameW
RegEnumValueA
RegDeleteKeyA
RegSetValueExA
RegDeleteValueA
GetUserNameA
GetTokenInformation
LookupAccountSidA
RegOpenKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyA
RegQueryInfoKeyA
RegEnumKeyA
RegOpenKeyExA
RegCreateKeyW
RegQueryValueExA
RegQueryValueExW
RegOpenKeyW
RegSetValueExW
RegCloseKey
ControlService
StartServiceA
OpenServiceA
DeleteService
OpenSCManagerA
LockServiceDatabase
CreateServiceA
CloseServiceHandle
UnlockServiceDatabase
RegConnectRegistryA
RegCreateKeyExW
QueryServiceStatus
QueryServiceConfigA
ChangeServiceConfigA
EnumServicesStatusA
SetFileSecurityA
RegSetKeySecurity
LookupAccountNameW
SetSecurityDescriptorDacl
GetAce
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
LookupAccountSidW
DeregisterEventSource
ReportEventA
RegisterEventSourceA

shell32

SHGetSpecialFolderPathW
CommandLineToArgvW
SHChangeNotify
SHGetPathFromIDListA
SHGetPathFromIDListW
DragQueryFileA
DragQueryFileW

ole32

CoCreateGuid
CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemFree
CoInitializeEx

oleaut32

DosDateTimeToVariantTime
SysAllocStringLen
SysFreeString
SysAllocString
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayDestroy
SysStringLen
SystemTimeToVariantTime

mpr

WNetGetConnectionW
WNetGetConnectionA

ws2_32

send
listen
shutdown
getsockname
ntohl
recv
getpeername
WSAGetLastError
htonl
getsockopt
sendto
ntohs
WSAStartup
recvfrom
gethostbyname
WSACleanup
setsockopt
accept
bind
htons
WSAIoctl
socket
connect
closesocket

winmm

timeKillEvent
timeSetEvent

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueA

Exports

Exports

AddApplyDocLog
AddApplyDocLog1
AddBurnLog
AddDocBurnLog
AddPassthru
AddUpDlLogEx
DelPassthru
DelSCDTProcesIdentifyTypeInCache
DelSCDTProcesTypeInCache
DelTobeTargetProcessByName
DelTobeTargetProcessByProcID
DelTobeTargetProcessIdentifyByName
DelTobeTargetProcessIdentifyByProcID
ExpandSpecialPath
FreeBuffer
GetCaptureFlags
GetDocInfos
GetDocLogs2
GetDocLogs3
GetDocPolicyLogs
GetIMFTInfos
GetMstscLogs
GetNewProcCmd
GetPortPolicyLogs
GetPortPolicyLogs2
GetPortPolicyLogs3
GetPrintInfos
GetPrintLogs
GetPrintLogs2
GetPrintPolicyLogs
GetProcInfosEx
GetProcInfosEx2
GetSCDTDesktopMode
GetSCDTLogonState
GetSCDTProcesIdentifyTypeInCache
GetSCDTProcesTypeInCache
GetSpecialBurnSetting
GetSpecialToolBurnMode
GetTWMMsgInfo
GetTWMStatus
GetUDiskRigthts
GetUpDownPolicyLogs
GetUrlInfos
GetUrlLogs
GetUrlPolicyLogs
INJInstallDetours
INJUninstallDetours
InitRecordMgr
InitSCDTShareInfo
InitShareInfoMgr
InitUPDLShareMemory
InstallDetours
InstallDetoursModule
InstallDetoursOne
IsDisRemarkBurn
IsDisableBurnFile
IsInSecuDesktop
IsInSecuDesktop2
IsInSecuDesktopPath
IsInTobeTargetProcessByName
IsInTobeTargetProcessByProcID
IsInTobeTargetProcessIdentifyByName
IsInTobeTargetProcessIdentifyByProcID
IsSecuDesktopSDDisk
SetAppCtrlFlag
SetAppInfoKeyTick
SetCDBurnCtrlFlag
SetCDOtherBurnCtrlFlag
SetCDSpecialBurnCtrlFlag
SetCaptureFlags
SetComputer
SetDocBackupFlag
SetDocCtrl
SetDocCtrlFlag
SetDocTick
SetDocWaterMarkFlag
SetFlags
SetIMFTCtrl
SetIMFTCtrlFlag
SetIP
SetIsNeedHookSwitchDesk
SetNetShareWhitePath
SetNetworkStatus
SetOffline
SetPortCtrlFlag
SetPortTick
SetPortableFlags
SetPrintCtrl
SetPrintCtrlFlag
SetPrintPageCtrlFlag
SetPrintPageTick
SetPrintTick
SetProcCtrl
SetProcCtrl2
SetProduct
SetProtectdIPAndPort
SetSCDTCtrlFlag
SetSCDTDesktopMode
SetSCDTLogonState
SetSCDTProcesIdentifyTypeInCache
SetSCDTProcesTypeInCache
SetSCIOutSendCtrlFlag
SetSpecialBurnToolFlag
SetStatus
SetTIjtNecessity
SetTIjtNecessityTick
SetTWMMsgInfo
SetTWMStatus
SetTobeTargetProcessByName
SetTobeTargetProcessByProcID
SetTobeTargetProcessIdentifyByName
SetTobeTargetProcessIdentifyByProcID
SetUDiskCtrlFlag
SetUDiskTick
SetUDiskVols
SetUDiskVols2
SetUpDownCtrlFlag
SetUpDownTick
SetUrlClsidsTick
SetUrlCtrl
SetUrlCtrlFlag
SetUrlTick
SetUser
SetUserID
SetWPDCtrlFlag
TSetLogConfig
UninstallDetours
UninstallDetoursOne
UpdateSandboxProcessFileRegPolicy
UpdateSandboxProcessIdentifyFileRegPolicy

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 232KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 668KB - Virtual size: 893KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

whadntds
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

TLCONFIG
Size: 4KB - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 236KB - Virtual size: 234KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cc3af5a9eb1a7a0341cb083e4e61b8f6

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

mpr

ws2_32

winmm

version

Exports

Exports

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

.rdata Size: 232KB - Virtual size: 228KB

.data Size: 668KB - Virtual size: 893KB

whadntds Size: 1.2MB - Virtual size: 1.2MB

TLCONFIG Size: 4KB - Virtual size: 276B

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 236KB - Virtual size: 234KB

.text
Size: 2.7MB - Virtual size: 2.7MB

.rdata
Size: 232KB - Virtual size: 228KB

.data
Size: 668KB - Virtual size: 893KB

whadntds
Size: 1.2MB - Virtual size: 1.2MB

TLCONFIG
Size: 4KB - Virtual size: 276B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 236KB - Virtual size: 234KB