ed9c23f51bcfed9912c984729d373288a7d64c833732af45b3bf61159859108c

Sharing

Copy URL Twitter E-mail

General

Target

ed9c23f51bcfed9912c984729d373288a7d64c833732af45b3bf61159859108c
Size

1.6MB
MD5

f37c1d3f2fbdf8d4d8fb4f07db379404
SHA1

0236caa2fa3eb3e63021cc35f9b6699a23a01ae2
SHA256

ed9c23f51bcfed9912c984729d373288a7d64c833732af45b3bf61159859108c
SHA512

3377f6403a0a96159d77bb5bb21d328b3bb0e65110cb06f6c9e0905ed0843d713acca20aac6f92d106b1de8dccc61dcc17fcb5e500cd9f77b007ac9e022f532d
SSDEEP

24576:hPC5+0t5O0aGygSvaT2ioF7N8dif/kpRYJOtcmHEJvy6icmbCMACAzaI:V0t4euaLoy9aNIszeoa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ed9c23f51bcfed9912c984729d373288a7d64c833732af45b3bf61159859108c

Files

ed9c23f51bcfed9912c984729d373288a7d64c833732af45b3bf61159859108c
.exe windows:4 windows x86 arch:x86

2cf0ade2b1200f55340dc5232c72f18f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

libcurl

curl_global_cleanup
curl_easy_strerror
curl_easy_perform
curl_easy_escape
curl_slist_free_all
curl_easy_cleanup
curl_global_init
curl_easy_init
curl_easy_setopt
curl_slist_append

ddraw

DirectDrawCreateEx

imm32

ImmGetConversionStatus
ImmCreateContext
ImmReleaseContext
ImmIsIME
ImmSetOpenStatus
ImmGetDescriptionA
ImmGetCompositionStringA
ImmGetCandidateListA
ImmAssociateContext

wsock32

__WSAFDIsSet
recv
closesocket
send
select
WSAStartup
WSACleanup
WSAGetLastError
connect
shutdown
socket
inet_ntoa
setsockopt
htons
ioctlsocket
gethostbyname

kernel32

GetStartupInfoA
SetCurrentDirectoryA
SetEnvironmentVariableA
GetFileType
PeekNamedPipe
GetFileInformationByHandle
GetTickCount
CloseHandle
ReadFile
GetFileSize
CreateFileA
OutputDebugStringA
GetCurrentProcessId
GetVersionExA
LoadLibraryA
FreeLibrary
Module32Next
Module32First
CreateToolhelp32Snapshot
Process32Next
Process32First
OpenMutexA
GetProcAddress
GetModuleHandleA
IsBadReadPtr
GetCurrentThreadId
GlobalUnlock
GlobalLock
GlobalAlloc
WriteFile
GlobalFree
GlobalHandle
MultiByteToWideChar
HeapCreate
ReleaseMutex
SystemTimeToFileTime
GetSystemTime
CreateMutexA
GetLastError
GetCurrentDirectoryA
GetPrivateProfileStringA
GetModuleFileNameA
GetCommandLineA
ExitThread
WaitForMultipleObjects
CreateThread
CreateEventA
CopyFileA
DeleteFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetCurrentProcess
TerminateProcess
ExitProcess
CreateDirectoryA
HeapFree
HeapAlloc
GetLocalTime
GetTimeZoneInformation
RtlUnwind
MulDiv
GetCurrentThread
GetSystemDefaultLangID
VirtualAlloc
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
IsBadWritePtr
LCMapStringA
LCMapStringW
SetStdHandle
SetEndOfFile
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
GetVersion
SetFilePointer
IsBadCodePtr
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
RaiseException
SetHandleCount
GetStdHandle
CompareStringA
CompareStringW
HeapReAlloc
HeapSize
WideCharToMultiByte
FlushFileBuffers
HeapDestroy
VirtualFree
Sleep

user32

GetWindowLongA
DialogBoxParamA
DestroyWindow
PostQuitMessage
SetCursor
DefWindowProcA
PeekMessageA
TranslateMessage
DispatchMessageA
AdjustWindowRectEx
ShowWindow
CreateWindowExA
SetWindowLongA
SetWindowPos
UpdateWindow
SetSysColors
GetSysColor
LoadIconA
LoadCursorA
RegisterClassA
SetWindowTextA
GetKeyboardState
GetKeyboardLayout
GetWindowRect
PostMessageA
ShowCursor
GetAsyncKeyState
SetRect
GetClientRect
OffsetRect
GetDC
ReleaseDC
wsprintfA
MessageBoxA
GetWindowTextA
EnumWindows
RegisterClassExA
GetCursorPos
ScreenToClient
ClientToScreen
InvalidateRect
MoveWindow
GetParent
EndPaint
BeginPaint
EndDialog
SendMessageA
GetKeyState
SetFocus
GetClassInfoExA
SetParent
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExA
LoadBitmapA
SetCapture
ReleaseCapture
PtInRect

gdi32

DeleteDC
GetObjectA
CreateFontIndirectA
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetTextExtentPointA
GetDIBits
DeleteObject
GetDeviceCaps
GetStockObject
BitBlt
StretchBlt
CreateFontA
TextOutA
CreateSolidBrush
SetBkMode
SetTextColor

shell32

ShellExecuteA

ole32

CoInitialize
CoCreateInstance

dsound

ord1

winmm

mmioOpenA
mmioAscend
mmioRead
mmioDescend
mmioClose
mciSendCommandA
timeGetTime

comctl32

_TrackMouseEvent

iphlpapi

GetAdaptersAddresses

wininet

InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetReadFile

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 252KB - Virtual size: 10.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2cf0ade2b1200f55340dc5232c72f18f

Headers

File Characteristics

Imports

libcurl

ddraw

imm32

wsock32

kernel32

user32

gdi32

shell32

ole32

dsound

winmm

comctl32

iphlpapi

wininet

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 28KB - Virtual size: 24KB

.data Size: 252KB - Virtual size: 10.8MB

.rsrc Size: 8KB - Virtual size: 4KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 28KB - Virtual size: 24KB

.data
Size: 252KB - Virtual size: 10.8MB

.rsrc
Size: 8KB - Virtual size: 4KB