311c2f446d0ddc7e7d8ed2e6bb013dd4a9b80bc78ea28e2822f34875a72d05fe

Sharing

Copy URL

Twitter E-mail

General

Target

311c2f446d0ddc7e7d8ed2e6bb013dd4a9b80bc78ea28e2822f34875a72d05fe
Size

5.8MB
MD5

21b99a94b458967e596550994e4d8011
SHA1

7ad14b212f738967f8d7084d5946ca3180b4bb6c
SHA256

311c2f446d0ddc7e7d8ed2e6bb013dd4a9b80bc78ea28e2822f34875a72d05fe
SHA512

85a3c25701caba608f228ec8bc1ad271079c855d6d04f15bc723c8f27adf3936125e6b43cb977436e1610df07efbb0a594a2ef5991e7eb3fa1076060c1e20571
SSDEEP

98304:a+MFSZ4aZkaPqywyWVGtau9lCjurm4soKLsXEf6NzqIiNwkfC7Yyd:aRSzHUVu9lCjZ4sWI6NzqI+wkqUyd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
311c2f446d0ddc7e7d8ed2e6bb013dd4a9b80bc78ea28e2822f34875a72d05fe

Files

311c2f446d0ddc7e7d8ed2e6bb013dd4a9b80bc78ea28e2822f34875a72d05fe
.exe windows:6 windows x86 arch:x86

4c9f0a3af28167b5eff46c9a1b79c6d6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\IntegoAV_WS1\IavProduct\bin\Win32\Release\IavWebFilter.pdb

Imports

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

wtsapi32

WTSQuerySessionInformationW
WTSEnumerateSessionsW
WTSFreeMemory
WTSQueryUserToken

iphlpapi

GetAdaptersInfo
GetTcpTable2

crypt32

CryptDecodeObject
CertFreeCertificateContext
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringW
CryptMsgClose

wintrust

CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext
CryptCATAdminAcquireContext
CryptCATAdminEnumCatalogFromHash
WinVerifyTrust
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminReleaseContext

iavwfapi

?nf_unRegisterDriver@nfapi@@YA?AW4_NF_STATUS@@PBD@Z
?nf_init@nfapi@@YA?AW4_NF_STATUS@@PBDPAVNF_EventHandler@1@@Z
?nf_free@nfapi@@YAXXZ
?nf_addRule@nfapi@@YA?AW4_NF_STATUS@@PAU_NF_RULE@1@H@Z
?nf_adjustProcessPriviledges@nfapi@@YAXXZ
?nf_getTCPConnInfo@nfapi@@YA?AW4_NF_STATUS@@_KPAU_NF_TCP_CONN_INFO@1@@Z
?nf_udpSetConnectionState@nfapi@@YA?AW4_NF_STATUS@@_KH@Z
?nf_tcpSetConnectionState@nfapi@@YA?AW4_NF_STATUS@@_KH@Z
?nf_tcpPostReceive@nfapi@@YA?AW4_NF_STATUS@@_KPBDH@Z
?nf_udpPostSend@nfapi@@YA?AW4_NF_STATUS@@_KPBEPBDHPAU_NF_UDP_OPTIONS@1@@Z
?nf_getProcessNameA@nfapi@@YAHKPADK@Z
?nf_udpPostReceive@nfapi@@YA?AW4_NF_STATUS@@_KPBEPBDHPAU_NF_UDP_OPTIONS@1@@Z
?nf_tcpPostSend@nfapi@@YA?AW4_NF_STATUS@@_KPBDH@Z
?nf_registerDriverEx@nfapi@@YA?AW4_NF_STATUS@@PBD0@Z

iavwfprotocols

?pf_stopLog@ProtocolFilters@@YAXXZ
?pf_setRootSSLCertSubject@ProtocolFilters@@YAXPBD@Z
?pf_init@ProtocolFilters@@YAHPAVPFEvents@1@PB_W@Z
?pf_getNFEventHandler@ProtocolFilters@@YAPAVNF_EventHandler@nfapi@@XZ
?pf_isFilterActive@ProtocolFilters@@YAH_KW4_PF_FilterType@1@@Z
?pf_postObject@ProtocolFilters@@YAH_KPAVPFObject@1@@Z
?pf_addFilter@ProtocolFilters@@YAH_KW4_PF_FilterType@1@KW4_PF_OpTarget@1@1@Z
?PFObject_create@ProtocolFilters@@YAPAVPFObject@1@HH@Z
?pf_free@ProtocolFilters@@YAXXZ

kernel32

CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SignalObjectAndWait
GetWindowsDirectoryW
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsValidCodePage
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
EnumSystemLocalesW
IsValidLocale
GetTimeZoneInformation
GetStdHandle
ExitProcess
VirtualQuery
VirtualAlloc
GetCommandLineA
HeapQueryInformation
GetFileType
SetStdHandle
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
CreateSemaphoreA
GetVersionExA
GetOEMCP
GetACP
GetComputerNameW
FormatMessageA
GetCurrentDirectoryA
GetLocalTime
GetSystemTime
CompareFileTime
OutputDebugStringW
GetCPInfo
LCMapStringW
GetStringTypeW
AreFileApisANSI
SetFilePointerEx
GetFileInformationByHandle
FindFirstFileExW
TryEnterCriticalSection
SwitchToThread
QueryPerformanceFrequency
GetTempFileNameW
SearchPathW
GetProfileIntW
lstrcpyW
GetCurrentDirectoryW
VirtualProtect
GetUserDefaultUILanguage
GetLocaleInfoW
GetCurrentThread
GlobalFindAtomW
GlobalDeleteAtom
GetSystemDirectoryW
EncodePointer
GlobalAddAtomW
SetThreadPriority
lstrcmpW
GlobalFlags
lstrcmpiW
LoadLibraryA
DuplicateHandle
UnlockFile
SetFilePointer
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
FlushFileBuffers
SetFileTime
LocalFileTimeToFileTime
GetFileTime
GetFileSizeEx
GetFileAttributesExW
CompareStringW
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
GetTempPathW
TlsAlloc
DeleteTimerQueueTimer
GlobalGetAtomNameW
LoadLibraryW
LoadLibraryExW
GetModuleHandleA
FreeLibrary
VerifyVersionInfoW
InitializeCriticalSectionAndSpinCount
OutputDebugStringA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetProcAddress
FileTimeToLocalFileTime
FormatMessageW
MulDiv
GlobalUnlock
GlobalLock
GlobalSize
SetLastError
GetThreadId
WaitForMultipleObjects
GlobalFree
GlobalAlloc
lstrcmpA
LocalAlloc
lstrcpynW
TerminateProcess
IsWow64Process
GetSystemInfo
GetNativeSystemInfo
GetVersionExW
GetProductInfo
GetModuleHandleW
FindResourceExW
SetEvent
CreateEventW
CopyFileW
MoveFileExW
LocalFree
SetFileAttributesW
GetFileAttributesW
ExpandEnvironmentStringsA
RemoveDirectoryW
GetShortPathNameW
ExpandEnvironmentStringsW
GetLongPathNameW
CreateDirectoryW
GetDriveTypeW
CreateProcessW
WTSGetActiveConsoleSessionId
Process32FirstW
QueryFullProcessImageNameA
Process32NextW
Wow64RevertWow64FsRedirection
Sleep
OpenProcess
PeekNamedPipe
CreatePipe
Wow64DisableWow64FsRedirection
OpenThread
CreateToolhelp32Snapshot
ResumeThread
SuspendThread
Thread32First
Thread32Next
GetCurrentProcess
GetExitCodeProcess
WriteFile
ReadFile
GetFileSize
CreateFileW
GetModuleFileNameW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
FindClose
FindNextFileW
FindFirstFileW
MoveFileW
DeleteFileW
CreateMutexW
ReleaseMutex
GetTickCount
GetCurrentThreadId
CreateThread
CreateSemaphoreW
GetCurrentProcessId
CloseHandle
ReleaseSemaphore
TerminateThread
GetTickCount64
QueueUserWorkItem
WaitForSingleObject
SetUnhandledExceptionFilter
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
FindResourceW
LoadResource
RaiseException
HeapReAlloc
LockResource
GetLastError
HeapSize
InitializeCriticalSectionEx
HeapFree
SizeofResource
ChangeTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
VirtualFree
QueryDepthSList
InterlockedPopEntrySList
UnregisterWaitEx
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
GetUserDefaultLCID
SystemTimeToFileTime
TlsGetValue
VerSetConditionMask
CreateTimerQueue

user32

SetTimer
DeleteMenu
SetCursor
ShowOwnedPopups
MapDialogRect
GetAsyncKeyState
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
OffsetRect
SetRectEmpty
SendDlgItemMessageA
CopyImage
SystemParametersInfoW
GetMenuItemInfoW
GetIconInfo
MessageBeep
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
CreatePopupMenu
GetMenuDefaultItem
DestroyMenu
IntersectRect
InflateRect
PostQuitMessage
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
LoadIconW
GetTopWindow
GetClassLongW
EqualRect
CopyRect
KillTimer
AdjustWindowRectEx
GetClientRect
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
ScrollWindow
RedrawWindow
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
UpdateWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
IsIconic
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
DestroyWindow
IsChild
IsMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
MapVirtualKeyW
GetKeyNameTextW
LoadMenuW
SetLayeredWindowAttributes
EnumDisplayMonitors
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateW
SetClassLongW
SetWindowRgn
SetParent
InvalidateRect
TrackMouseEvent
LoadImageW
GetNextDlgGroupItem
SetCapture
ReleaseCapture
WindowFromPoint
DrawFocusRect
IsRectEmpty
MapWindowPoints
DrawIconEx
DestroyCursor
RegisterClassW
CallWindowProcW
DefWindowProcW
PostMessageW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
FillRect
ScreenToClient
EndPaint
DrawEdge
DrawFrameControl
BeginPaint
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
IsZoomed
GetSystemMenu
BringWindowToTop
SetCursorPos
CopyIcon
FrameRect
wsprintfW
GetMenuStringW
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuW
AppendMenuW
RemoveMenu
GetDesktopWindow
GetWindowTextW
GetWindowTextLengthW
UnhookWindowsHookEx
SendMessageW
EnableWindow
IsWindowEnabled
MessageBoxW
GetWindowLongW
GetParent
GetWindowThreadProcessId
GetLastActivePopup
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
LoadCursorW
CharUpperW
SetFocus
SetScrollPos
GetScrollPos
GetWindow
IsWindow
ShowWindow
MoveWindow
SetWindowPos
GetDlgItem
CheckDlgButton
GetDlgCtrlID
GetFocus
SetWindowTextW
SetWindowLongW
IsDialogMessageW
GetWindowRect
ClientToScreen
PtInRect
GetClassNameW
RealChildWindowFromPoint
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
IsWindowVisible
GetActiveWindow
DrawTextW
GetKeyState
ValidateRect
DrawIcon
UnionRect
UpdateLayeredWindow
MonitorFromPoint
LoadAcceleratorsW
TranslateAcceleratorW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
GetComboBoxInfo
PostThreadMessageW
WaitMessage
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
SetRect
LockWindowUpdate
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuW
RegisterClipboardFormatW
CharUpperBuffW
IsClipboardFormatAvailable
GetUpdateRect
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
SubtractRect
CreateMenu
GetWindowRgn
GetCursorPos
SetWindowsHookExW
CallNextHookEx
DestroyIcon

gdi32

GetObjectW
MoveToEx
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CombineRgn
CreateFontIndirectW
CreateRectRgnIndirect
PatBlt
GetLayout
DPtoLP
GetTextExtentPoint32W
GetTextMetricsW
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
GetBkColor
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
Rectangle
GetRgnBox
OffsetRgn
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetTextFaceW
SetLayout
SetMapMode
CopyMetaFileW
CreateDCW
GetDeviceCaps
DeleteDC
DeleteObject
BitBlt
CreateBitmap
CreateCompatibleDC
CreateHatchBrush
CreatePen
CreatePatternBrush
CreateRectRgn
CreateSolidBrush
Escape
ExcludeClipRect
GetClipBox
GetObjectType
GetPixel
GetStockObject
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectObject
SetTextAlign
SetTextColor
SetROP2
RoundRect
SetPolyFillMode
SelectPalette
SetBkColor
SetBkMode
SetRectRgn

msimg32

TransparentBlt
AlphaBlend

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

RegEnumKeyExW
RegQueryValueExA
CryptHashData
CryptImportKey
CryptExportKey
CryptDeriveKey
CryptEnumProvidersA
CryptGetProvParam
CryptGetUserKey
RegQueryValueExW
RegDeleteKeyW
ConvertSidToStringSidW
LookupAccountNameW
RegDeleteKeyExW
CryptDestroyKey
CryptGenRandom
CryptReleaseContext
CryptSignHashA
CryptDestroyHash
CryptCreateHash
CryptSetHashParam
CryptAcquireContextW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
SetFileSecurityW
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
FreeSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
ChangeServiceConfig2W
DeleteService
ControlService
StartServiceW
OpenServiceW
QueryServiceStatusEx
GetSidSubAuthorityCount
GetSidSubAuthority
CryptAcquireContextA
RegOpenKeyExA
GetUserNameA
IsValidSid
OpenProcessToken
CreateProcessAsUserW
GetTokenInformation
RegCloseKey
RegOpenKeyExW
RegGetValueW
SetServiceStatus
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW

shell32

SHGetPathFromIDListW
SHGetDesktopFolder
SHGetFileInfoW
DragQueryFileW
DragFinish
SHBrowseForFolderW
SHAppBarMessage
SHGetSpecialFolderLocation
ShellExecuteW

shlwapi

PathRemoveFileSpecW
PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathIsUNCW
UrlUnescapeW
wnsprintfW
StrFormatKBSizeW

uxtheme

DrawThemeText
DrawThemeParentBackground
OpenThemeData
GetThemePartSize
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
IsAppThemed
GetWindowTheme
GetCurrentThemeName
GetThemeColor
DrawThemeBackground
CloseThemeData

ole32

IsAccelerator
OleTranslateAccelerator
OleCreateMenuDescriptor
OleLockRunning
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
CreateStreamOnHGlobal
CoDisconnectObject
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize
CoCreateInstance
CoInitialize
CoInitializeEx
CoCreateGuid
OleDestroyMenuDescriptor
CoSetProxyBlanket

oleaut32

VarBstrFromDate
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
VariantInit
SysFreeString
SysAllocString
VariantCopy
VariantChangeType
VariantClear
SysAllocStringLen
LoadTypeLi

dbghelp

MiniDumpWriteDump

ws2_32

inet_ntop
inet_ntoa
getpeername
WSAStartup
socket
WSACleanup
listen
htons
inet_addr
bind
WSAGetLastError
closesocket
ntohs
gethostbyname
shutdown
getsockopt
getsockname
ioctlsocket
connect
__WSAFDIsSet
recv
select
send
setsockopt
accept

gdiplus

GdipDisposeImage
GdipGetImageGraphicsContext
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageRectI
GdipSetInterpolationMode
GdipAlloc
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateFromHDC
GdiplusStartup
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdiplusShutdown
GdipFree

wininet

InternetCrackUrlW
InternetCanonicalizeUrlW

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmGetOpenStatus
ImmGetContext
ImmReleaseContext

winmm

PlaySoundW

sqlite3

sqlite3_close
sqlite3_open
sqlite3_column_int
sqlite3_column_text
sqlite3_step
sqlite3_prepare_v2
sqlite3_bind_text
sqlite3_finalize
sqlite3_bind_int

rpcrt4

RpcStringFreeW
UuidCreate
UuidToStringW

Sections

.text
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 266KB - Virtual size: 300KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 207KB - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 246KB - Virtual size: 245KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4c9f0a3af28167b5eff46c9a1b79c6d6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

userenv

wtsapi32

iphlpapi

crypt32

wintrust

iavwfapi

iavwfprotocols

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

dbghelp

ws2_32

gdiplus

wininet

oleacc

imm32

winmm

sqlite3

rpcrt4

Sections

.text Size: 3.9MB - Virtual size: 3.9MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 266KB - Virtual size: 300KB

.rsrc Size: 207KB - Virtual size: 207KB

.reloc Size: 246KB - Virtual size: 245KB

.text
Size: 3.9MB - Virtual size: 3.9MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 266KB - Virtual size: 300KB

.rsrc
Size: 207KB - Virtual size: 207KB

.reloc
Size: 246KB - Virtual size: 245KB