846f6ae0bdeb32f73006c7dbfef953e29fde547f5a845745f266285f90648d7c

Sharing

Copy URL Twitter E-mail

General

Target

846f6ae0bdeb32f73006c7dbfef953e29fde547f5a845745f266285f90648d7c
Size

1.2MB
MD5

dec69422282c401985769b62b2efc482
SHA1

25fe9670446d5f43ee9fd628d499cbb0abf60f41
SHA256

846f6ae0bdeb32f73006c7dbfef953e29fde547f5a845745f266285f90648d7c
SHA512

3f8c90884851ef97021f2520a87babdfdd1a5d9d2e82a0429d56d45720fea736e9084d126e3f9cc998ff776facfa803bcfec18405bed0a7c6c37389cd6229cff
SSDEEP

24576:5dP/ADQb1tpgVucwS082IolmWs130XnwC:5/1t1/mWsB0XH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
846f6ae0bdeb32f73006c7dbfef953e29fde547f5a845745f266285f90648d7c

Files

846f6ae0bdeb32f73006c7dbfef953e29fde547f5a845745f266285f90648d7c
.dll windows:4 windows x86 arch:x86

c91e09728d43f46390baaa8be98ddb3e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcatW
GetVersion
GetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SetFileTime
MulDiv
GlobalFlags
GetPrivateProfileIntW
WritePrivateProfileStringW
GlobalFindAtomW
GlobalAddAtomW
LockResource
LoadResource
FindResourceW
GetProcessVersion
GlobalSize
RtlUnwind
RaiseException
GetCommandLineA
HeapAlloc
HeapFree
ExitProcess
TerminateProcess
ExitThread
GetTimeZoneInformation
GetSystemTime
GetLocalTime
HeapSize
HeapReAlloc
FatalAppExitA
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
UnhandledExceptionFilter
IsBadCodePtr
GetCPInfo
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetACP
GetOEMCP
SetErrorMode
GetStringTypeW
SetConsoleCtrlHandler
SetStdHandle
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
TerminateThread
ResetEvent
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
EnumResourceLanguagesW
EnumResourceTypesW
EnumResourceNamesW
SizeofResource
VirtualQuery
LoadLibraryExW
AllocConsole
WriteConsoleW
FreeConsole
MoveFileExW
MoveFileExA
CreateDirectoryW
RemoveDirectoryA
CopyFileA
CreateDirectoryA
MoveFileA
DeleteFileA
SetFileAttributesA
GetTempPathA
GetCurrentDirectoryA
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
GetVersionExW
FindResourceExW
OutputDebugStringW
FormatMessageA
SetNamedPipeHandleState
WaitNamedPipeW
ConnectNamedPipe
CreateNamedPipeW
GetOverlappedResult
CancelIo
OpenEventW
OpenSemaphoreW
QueryPerformanceCounter
SleepEx
InterlockedExchange
PulseEvent
GetDriveTypeA
GetDriveTypeW
GetLogicalDrives
QueryDosDeviceA
SetVolumeLabelW
GetDiskFreeSpaceExW
DefineDosDeviceW
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
GlobalFree
TlsAlloc
LocalAlloc
WaitForMultipleObjects
ReleaseSemaphore
CreateSemaphoreW
FileTimeToLocalFileTime
FileTimeToSystemTime
GlobalUnlock
CreateEventW
SuspendThread
SetThreadPriority
ResumeThread
SetEvent
GlobalLock
GlobalAlloc
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
GetShortPathNameW
lstrcmpiW
GetThreadLocale
GetStringTypeExW
GetFullPathNameW
lstrcpynW
GetVolumeInformationW
lstrcpyW
UnlockFile
LockFile
GetExitCodeThread
FlushFileBuffers
DuplicateHandle
lstrlenA
lstrlenW
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedIncrement
GetPrivateProfileStringW
GetProfileStringW
VirtualProtect
WriteProcessMemory
WaitForSingleObject
ReleaseMutex
SetLastError
CreateMutexW
OpenMutexW
IsBadStringPtrW
IsBadReadPtr
CreateFileW
ReadFile
SetFilePointer
SetEndOfFile
WriteFile
GetEnvironmentVariableW
GetTempPathW
CreateFileMappingW
GetLogicalDriveStringsW
QueryDosDeviceW
GetTickCount
Sleep
MoveFileW
CopyFileW
GetFileAttributesW
SetFileAttributesW
lstrcmpW
RemoveDirectoryW
DeleteFileW
GetSystemInfo
FindFirstFileW
FindNextFileW
FindFirstFileA
FindNextFileA
FindClose
GetLastError
LoadLibraryW
LocalFree
OpenProcess
CreateThread
GetFileInformationByHandle
GetModuleHandleW
GetCurrentThreadId
MultiByteToWideChar
WideCharToMultiByte
VirtualProtectEx
GetModuleHandleA
IsBadWritePtr
GetFileAttributesA
GetSystemDirectoryA
GetWindowsDirectoryA
CreateFileA
GetFileSize
CreateFileMappingA
LoadLibraryA
GetProcAddress
GetCurrentProcess
FreeLibrary
FormatMessageW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
CloseHandle
GetCommandLineW
GetCurrentProcessId
GetModuleFileNameA
GetCurrentDirectoryW
GetModuleFileNameW
GetStringTypeA
GetSystemDirectoryW

user32

GetSubMenu
GetMenuItemID
TrackPopupMenu
SetWindowPlacement
DestroyWindow
CreateWindowExW
SetPropW
GetPropW
CallWindowProcW
RemovePropW
DefWindowProcW
GetMessageTime
GetMessagePos
SetForegroundWindow
OffsetRect
IntersectRect
SystemParametersInfoW
IsIconic
GetWindowPlacement
SetFocus
GetMenu
SetWindowPos
MoveWindow
SetWindowLongW
IsDialogMessageW
ScrollWindowEx
IsDlgButtonChecked
SetDlgItemTextW
SetDlgItemInt
WinHelpW
GetDlgItemInt
CheckRadioButton
CheckDlgButton
GrayStringW
DrawTextW
TabbedTextOutW
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
RegisterClassW
ShowWindow
GetClassInfoW
ScreenToClient
GetMenuStringW
DeleteMenu
InsertMenuW
GetMenuItemCount
SetWindowTextW
ClientToScreen
PtInRect
LoadStringW
UnregisterClassW
MsgWaitForMultipleObjects
GetWindowTextLengthW
GetMenuCheckMarkDimensions
LoadBitmapW
GetMenuState
ModifyMenuW
SetMenuItemBitmaps
CheckMenuItem
GetCapture
IsChild
GetTopWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
SetScrollInfo
GetScrollInfo
ScrollWindow
EndDeferWindowPos
CopyRect
BeginDeferWindowPos
GetClientRect
DeferWindowPos
EqualRect
AdjustWindowRectEx
SetActiveWindow
GetSysColor
MapWindowPoints
SendDlgItemMessageA
UpdateWindow
LoadIconW
LoadCursorW
GetSysColorBrush
AppendMenuW
RemoveMenu
wvsprintfW
DestroyMenu
SendDlgItemMessageW
EnableMenuItem
GetNextDlgTabItem
GetMessageW
TranslateMessage
GetActiveWindow
GetKeyState
ValidateRect
MessageBoxA
GetProcessWindowStation
GetCursorPos
GetLastActivePopup
IsWindowEnabled
EnableWindow
SetCursor
ShowOwnedPopups
PostQuitMessage
GetSystemMetrics
CharUpperW
wsprintfW
GetDlgCtrlID
EnumChildWindows
PeekMessageW
DispatchMessageW
UnhookWindowsHookEx
GetFocus
GetDlgItem
PostMessageW
GetAsyncKeyState
SendMessageW
CallNextHookEx
GetCursorInfo
GetWindowTextW
GetWindowTextA
IsWindowVisible
EnumDesktopWindows
MessageBoxW
OpenWindowStationW
SetProcessWindowStation
CloseWindowStation
GetUserObjectInformationW
OpenInputDesktop
OpenDesktopW
GetThreadDesktop
SetThreadDesktop
CloseDesktop
SetWindowsHookExA
SetWindowsHookExW
RegisterWindowMessageW
IsWindow
GetForegroundWindow
GetDesktopWindow
EnumWindows
GetWindowThreadProcessId
GetWindowLongW
GetWindow
GetWindowRect
GetParent
GetClassNameW
FindWindowExW
GetDlgItemTextW

gdi32

CreateRectRgn
SelectClipPath
ExtSelectClipRgn
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
GetDeviceCaps
GetViewportExtEx
GetWindowExtEx
CreatePen
ExtCreatePen
SetColorAdjustment
CreateHatchBrush
CreatePatternBrush
CreateDIBPatternBrushPt
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
GetDCOrgEx
GetObjectW
CopyMetaFileW
GetClipRgn
PolylineTo
PolyDraw
SetArcDirection
ArcTo
GetCurrentPositionEx
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
LineTo
MoveToEx
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
SelectClipRgn
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
CreateDCW
PolyBezierTo
SetViewportOrgEx
CreateBitmap
DeleteObject
DeleteDC
StartDocW
SaveDC
RestoreDC
SelectObject
GetStockObject
SelectPalette
SetBkColor
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
CreateSolidBrush
SetMapMode
CreateDCA
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectA
BitBlt
GetBitmapBits
SetTextColor

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegConnectRegistryW
RegSetValueExA
RegEnumKeyW
RegQueryInfoKeyW
RegEnumValueW
RegCreateKeyA
RegCreateKeyExA
LookupAccountNameW
SetSecurityDescriptorDacl
GetAce
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
DeregisterEventSource
ReportEventA
RegSetValueW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegOpenKeyW
GetUserNameW
GetTokenInformation
LookupAccountSidW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCreateKeyW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegisterEventSourceA
RegOpenKeyA
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegQueryValueExA

shell32

SHGetFileInfoW
DragAcceptFiles

comctl32

ord17

ole32

ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
ReadClassStg
CoTaskMemAlloc
OleDuplicateData
CoCreateInstance
CoTreatAsClass
ReleaseStgMedium
CoDisconnectObject
CreateBindCtx
StringFromCLSID
CoInitialize
CoInitializeEx

oleaut32

SysAllocStringLen
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayCopy
VarBstrFromDate
VarDateFromStr
VarBstrFromCy
VarCyFromStr
SysAllocStringByteLen
SysStringByteLen
VariantChangeType
SysAllocString
VariantCopy
SafeArrayRedim
VariantClear
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SysReAllocStringLen

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

ws2_32

getpeername
ntohl
ntohs
listen
shutdown
closesocket
connect
socket
getsockname
htons
htonl
bind
accept
setsockopt
WSACleanup
WSAStartup
getsockopt
send
recv
sendto
WSAGetLastError
recvfrom
WSAIoctl

Exports

Exports

?QueryInterface@@YGPAXK@Z
CLearInvalidIMControlData
CheckIMType
DbgInfo
GetIMControlData
GetIMType
INJSetThreadHookFlag
InitShareSeg
SetCtrlIMFlagType
SetHook
SetIMAgentInfo
SetIMTypeHooked
SetNotRecordContentType
SetPhotoFlagType
SetPhotoWarningFlag
SetPhotoWarningFlagEX
SetPolicyBySocket
StopIMCModule
UnSetHook

Sections

.text
Size: 896KB - Virtual size: 892KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 104KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.IMContr
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Desktop
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.IMHookC
Size: 4KB - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c91e09728d43f46390baaa8be98ddb3e

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

ole32

oleaut32

version

ws2_32

Exports

Exports

Sections

.text Size: 896KB - Virtual size: 892KB

.rdata Size: 112KB - Virtual size: 109KB

.data Size: 104KB - Virtual size: 161KB

.IMContr Size: 8KB - Virtual size: 6KB

.Desktop Size: 8KB - Virtual size: 5KB

.IMHookC Size: 4KB - Virtual size: 804B

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 64KB - Virtual size: 62KB

.text
Size: 896KB - Virtual size: 892KB

.rdata
Size: 112KB - Virtual size: 109KB

.data
Size: 104KB - Virtual size: 161KB

.IMContr
Size: 8KB - Virtual size: 6KB

.Desktop
Size: 8KB - Virtual size: 5KB

.IMHookC
Size: 4KB - Virtual size: 804B

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 64KB - Virtual size: 62KB