19aa4045c76b1f5e1378f5246470858f3bbfef71937a93411a713e21f604b52e

Sharing

Copy URL

Twitter E-mail

General

Target

19aa4045c76b1f5e1378f5246470858f3bbfef71937a93411a713e21f604b52e
Size

1016KB
MD5

bb196a6e551889942a03c97729fd24f2
SHA1

77b593cb5bbbae1c8ec8d9a191af939740de4c34
SHA256

19aa4045c76b1f5e1378f5246470858f3bbfef71937a93411a713e21f604b52e
SHA512

187912ee66c704ec5f33abfa5fdc5479789760f9f0e8ff2c33fefc653f2bbe5f4b4520f143702c4d933a8bb69355b12bbff45c1a3a4f37f28a5fd94d02c6f2a1
SSDEEP

12288:F/CufPplvMwQRocXdov5LUFnCkHwQevRPK31lNHoMJiZOwvbDnH09tWmg:FjplvMXRocXdu5TQevRPK31lN2VnH09a

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
19aa4045c76b1f5e1378f5246470858f3bbfef71937a93411a713e21f604b52e

Files

19aa4045c76b1f5e1378f5246470858f3bbfef71937a93411a713e21f604b52e
.dll windows:4 windows x86 arch:x86

3a049c86d3cb80928a5c129bc89b220b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winimhc3

SetPolicyBySocket
SetPhotoWarningFlag
SetPhotoFlagType
SetNotRecordContentType
SetCtrlIMFlagType
DbgInfo
SetPhotoWarningFlagEX
StopIMCModule
SetIMTypeHooked
SetIMAgentInfo

kernel32

MulDiv
GlobalFlags
GetPrivateProfileIntW
WritePrivateProfileStringW
GetCurrentDirectoryW
GlobalFindAtomW
GlobalAddAtomW
LockResource
LoadResource
FindResourceW
LoadLibraryA
GetProcessVersion
GlobalSize
RtlUnwind
RaiseException
GetCommandLineA
HeapAlloc
HeapFree
ExitProcess
TerminateProcess
ExitThread
GetTimeZoneInformation
GetSystemTime
GetLocalTime
HeapSize
HeapReAlloc
FatalAppExitA
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
UnhandledExceptionFilter
IsBadCodePtr
GetCPInfo
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
SetFileTime
GetOEMCP
GetStringTypeA
GetStringTypeW
SetConsoleCtrlHandler
SetStdHandle
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetDiskFreeSpaceExW
SetVolumeLabelW
QueryDosDeviceA
GetLogicalDrives
GetDriveTypeW
GetDriveTypeA
QueryPerformanceCounter
ReleaseMutex
MoveFileExW
MoveFileExA
CreateDirectoryW
RemoveDirectoryA
CopyFileA
CreateDirectoryA
MoveFileA
DeleteFileA
SetFileAttributesA
GetEnvironmentVariableW
GetTempPathW
GetTempPathA
GetCurrentDirectoryA
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
VirtualProtect
GetFileAttributesA
GetSystemDirectoryA
GetWindowsDirectoryA
CreateFileMappingA
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
EnumResourceLanguagesW
EnumResourceTypesW
EnumResourceNamesW
SizeofResource
VirtualQuery
LoadLibraryExW
AllocConsole
WriteConsoleW
FreeConsole
GetExitCodeThread
WaitForMultipleObjects
TerminateThread
ResetEvent
GetVersionExW
FindResourceExW
OutputDebugStringW
FormatMessageA
CreateSemaphoreW
ReleaseSemaphore
SystemTimeToFileTime
LocalFileTimeToFileTime
GetFileTime
SetLastError
GetVersion
lstrcatW
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
GlobalFree
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalAlloc
FileTimeToLocalFileTime
FileTimeToSystemTime
GlobalUnlock
CreateEventW
SuspendThread
SetThreadPriority
ResumeThread
SetEvent
GlobalLock
GlobalAlloc
GlobalDeleteAtom
lstrcmpiA
GetCurrentThread
DefineDosDeviceW
lstrcmpA
GetShortPathNameW
lstrcmpiW
GetThreadLocale
GetStringTypeExW
GetFullPathNameW
lstrcpynW
GetVolumeInformationW
lstrcpyW
UnlockFile
LockFile
FlushFileBuffers
DuplicateHandle
lstrlenA
lstrlenW
InterlockedDecrement
InterlockedIncrement
GetPrivateProfileStringW
GetProfileStringW
FreeLibrary
IsBadReadPtr
CreateMutexW
OpenMutexW
CreateFileW
ReadFile
SetFilePointer
SetEndOfFile
WriteFile
GetFileSize
CreateFileMappingW
GetLogicalDriveStringsW
QueryDosDeviceW
GetTickCount
Sleep
MoveFileW
CopyFileW
GetFileAttributesW
SetFileAttributesW
lstrcmpW
RemoveDirectoryW
DeleteFileW
GetSystemInfo
FindFirstFileW
FindNextFileW
FindFirstFileA
FindNextFileA
FindClose
GetLastError
LoadLibraryW
LocalFree
OpenProcess
GetCurrentProcess
CreateThread
GetModuleHandleA
CreateFileA
GetFileInformationByHandle
GetModuleHandleW
GetProcAddress
GetCurrentThreadId
MultiByteToWideChar
WideCharToMultiByte
WaitForSingleObject
FormatMessageW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
CloseHandle
GetCurrentProcessId
GetModuleFileNameW
GetModuleFileNameA
GetWindowsDirectoryW
GetSystemDirectoryW
SleepEx
InterlockedExchange
GetACP
PulseEvent

user32

GetMenu
GetSubMenu
GetMenuItemID
TrackPopupMenu
SetWindowPlacement
DestroyWindow
CreateWindowExW
SetPropW
GetPropW
CallWindowProcW
RemovePropW
DefWindowProcW
GetMessageTime
GetMessagePos
SetForegroundWindow
OffsetRect
IntersectRect
SystemParametersInfoW
IsIconic
GetWindowPlacement
SetFocus
ShowWindow
SetWindowPos
RegisterClassW
SetWindowLongW
IsDialogMessageW
ScrollWindowEx
IsDlgButtonChecked
SetDlgItemTextW
SetDlgItemInt
SendDlgItemMessageW
GetDlgItemInt
GetCapture
CheckRadioButton
CheckDlgButton
GrayStringW
DrawTextW
TabbedTextOutW
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ScreenToClient
GetMenuStringW
DeleteMenu
InsertMenuW
GetClassInfoW
WinHelpW
MoveWindow
GetMenuItemCount
SetWindowTextW
ClientToScreen
PtInRect
LoadStringW
UnregisterClassW
UnhookWindowsHookEx
GetWindowTextLengthW
GetMenuCheckMarkDimensions
LoadBitmapW
GetMenuState
ModifyMenuW
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
MsgWaitForMultipleObjects
IsChild
GetTopWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
SetScrollInfo
GetScrollInfo
ScrollWindow
EndDeferWindowPos
CopyRect
BeginDeferWindowPos
GetClientRect
DeferWindowPos
EqualRect
AdjustWindowRectEx
IsWindow
SetActiveWindow
GetSysColor
MapWindowPoints
SendDlgItemMessageA
UpdateWindow
LoadIconW
LoadCursorW
GetSysColorBrush
AppendMenuW
RemoveMenu
wvsprintfW
DestroyMenu
GetDlgItem
MessageBoxA
GetProcessWindowStation
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
GetKeyState
ValidateRect
PeekMessageW
GetCursorPos
GetLastActivePopup
IsWindowEnabled
EnableWindow
SetCursor
ShowOwnedPopups
SendMessageW
PostQuitMessage
GetSystemMetrics
CharUpperW
wsprintfW
GetDlgCtrlID
EnumChildWindows
PostMessageW
SetWindowsHookExW
CallNextHookEx
GetCursorInfo
GetWindowTextW
GetWindowTextA
IsWindowVisible
EnumDesktopWindows
MessageBoxW
SetProcessWindowStation
CloseWindowStation
GetUserObjectInformationW
OpenInputDesktop
OpenDesktopW
GetThreadDesktop
SetThreadDesktop
CloseDesktop
EnumDesktopsW
OpenWindowStationW
RegisterWindowMessageW
GetForegroundWindow
GetDesktopWindow
EnumWindows
GetWindowThreadProcessId
GetWindowLongW
GetWindow
GetWindowRect
GetParent
GetClassNameW
FindWindowExW
GetDlgItemTextW

gdi32

GetCurrentPositionEx
ArcTo
SetArcDirection
PolyDraw
PolylineTo
SetColorAdjustment
PolyBezierTo
GetClipRgn
CreateRectRgn
SelectClipPath
ExtSelectClipRgn
PlayMetaFileRecord
SetTextJustification
EnumMetaFile
PlayMetaFile
GetDeviceCaps
GetViewportExtEx
GetWindowExtEx
CreatePen
ExtCreatePen
CreateSolidBrush
CreateHatchBrush
CreatePatternBrush
CreateDIBPatternBrushPt
PtVisible
RectVisible
TextOutW
ExtTextOutW
SetMapperFlags
GetDCOrgEx
GetObjectW
CopyMetaFileW
CreateDCW
SetTextAlign
LineTo
MoveToEx
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
SelectClipRgn
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetTextColor
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
CreateBitmap
Escape
SetTextCharacterExtra
DeleteObject
DeleteDC
StartDocW
SaveDC
RestoreDC
SelectObject
GetStockObject
GetObjectType
SetBkColor
CreateDCA
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectA
BitBlt
GetBitmapBits
SelectPalette

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegQueryValueExA
RegCreateKeyExA
RegConnectRegistryW
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
GetAce
SetSecurityDescriptorDacl
LookupAccountNameW
OpenSCManagerW
RegSetValueExA
RegEnumKeyW
RegQueryInfoKeyW
RegEnumValueW
DeregisterEventSource
RegSetValueW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyW
GetUserNameW
GetTokenInformation
LookupAccountSidW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCreateKeyW
RegQueryValueExW
RegCloseKey
ReportEventA
RegisterEventSourceA
RegOpenKeyA
QueryServiceStatus
CloseServiceHandle
OpenServiceW
RegCreateKeyA

shell32

DragAcceptFiles
SHGetFileInfoW

comctl32

ord17

ole32

ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
ReadClassStg
SetConvertStg
CoTaskMemFree
CreateBindCtx
CoTaskMemAlloc
OleDuplicateData
CoCreateInstance
StringFromCLSID
CoTreatAsClass
ReleaseStgMedium
CoDisconnectObject
WriteFmtUserTypeStg
CoInitializeEx
CoInitialize

oleaut32

SysAllocStringLen
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayCopy
VarBstrFromDate
VarDateFromStr
VarBstrFromCy
VarCyFromStr
SysAllocStringByteLen
SysStringByteLen
VariantChangeType
SysAllocString
VariantCopy
SafeArrayRedim
VariantClear
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SysReAllocStringLen

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Exports

Exports

DebugInfo
GetIMFTLog
ScanIM
SetCtrlIMFlag
SetIMHookLogFlag
SetIMPolicyBySocket
SetIMType
SetNotRecordContent
SetPhotoFlag
SetPhotoWarning
SetPhotoWarningEX
SetRecordFlag
SetUserInfo
StartIMHook
StopIMHook
SyncTime

Sections

.text
Size: 768KB - Virtual size: 764KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 84KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3a049c86d3cb80928a5c129bc89b220b

Headers

File Characteristics

Imports

winimhc3

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

ole32

oleaut32

version

Exports

Exports

Sections

.text Size: 768KB - Virtual size: 764KB

.rdata Size: 96KB - Virtual size: 94KB

.data Size: 84KB - Virtual size: 115KB

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 56KB - Virtual size: 52KB

.text
Size: 768KB - Virtual size: 764KB

.rdata
Size: 96KB - Virtual size: 94KB

.data
Size: 84KB - Virtual size: 115KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 56KB - Virtual size: 52KB