72b42e937330ddedbc9d10d8916130ee97565f18a088fe4ef226d13b6002d2dc

Sharing

Copy URL Twitter E-mail

General

Target

72b42e937330ddedbc9d10d8916130ee97565f18a088fe4ef226d13b6002d2dc
Size

3.3MB
MD5

cc4e1c8fd0af41b581c9893a446c762c
SHA1

06d958323674e9954dd634d52f673b71b591280c
SHA256

72b42e937330ddedbc9d10d8916130ee97565f18a088fe4ef226d13b6002d2dc
SHA512

f391f25e7e4d1250137b11f0f6e9925be04901632266d873d3763b20ad8e891bff887f74469844eb1d20216995eb5062fd988a2af4c090bc5c29d3db6b17510c
SSDEEP

49152:bl5HQiwBGfHAFjDFlL+v+9mb2JKsMXIrvJKtORizuQJSwE9z9IG:MtJN+J2JKatKtaQMwE9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
72b42e937330ddedbc9d10d8916130ee97565f18a088fe4ef226d13b6002d2dc

Files

72b42e937330ddedbc9d10d8916130ee97565f18a088fe4ef226d13b6002d2dc
.exe windows:6 windows x86 arch:x86

c4ab8763277fe07e8a7a1f5ab6c99a11

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

XpsRchVw.pdb

Imports

advapi32

TraceMessage
CryptReleaseContext
CryptDestroyKey
CryptGenKey
CryptAcquireContextW
CryptContextAddRef
CryptDuplicateKey
CryptDecrypt
CryptEncrypt
EventWrite
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegDeleteKeyW
RegEnumValueW
RegQueryInfoKeyW
RegFlushKey
RegDeleteValueW
RegGetValueW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
EventRegister
EventUnregister
CryptSignHashW
CryptDestroyHash
RegOpenKeyExW
CryptCreateHash
RegQueryValueExA
RegOpenKeyExA

kernel32

RaiseFailFastException
GetLongPathNameW
GetProcessHeap
GetModuleFileNameW
GetModuleHandleW
LocalFree
GetCurrentDirectoryW
SetCurrentDirectoryW
GetTickCount
InitOnceBeginInitialize
CreateEventW
GetSystemInfo
CreateThread
ResumeThread
GetExitCodeThread
WaitForMultipleObjects
SetEvent
InitOnceComplete
GetProcAddress
FindResourceW
SizeofResource
LoadResource
LockResource
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
EnterCriticalSection
GetStringTypeExW
lstrlenA
CompareStringW
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
GetFileAttributesW
ReplaceFileW
CopyFileW
FindFirstFileExW
FindNextFileW
WaitForSingleObject
GetFullPathNameW
SetFileAttributesW
FindClose
LoadLibraryW
GetSystemTimeAsFileTime
InterlockedCompareExchange
GetStartupInfoW
FileTimeToLocalFileTime
FileTimeToSystemTime
OutputDebugStringA
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetCurrentProcessId
SystemTimeToFileTime
GetFileSizeEx
GetUserDefaultUILanguage
ResetEvent
GetVersionExW
GetFileInformationByHandle
CompareStringEx
GetUserDefaultLocaleName
IsValidLocaleName
FindNLSStringEx
GetSystemDirectoryW
GetLocalTime
GetDateFormatEx
SystemTimeToTzSpecificLocalTime
GetDateFormatW
GetTimeFormatW
Sleep
GetSystemTime
TzSpecificLocalTimeToSystemTime
MulDiv
CompareStringOrdinal
CompareFileTime
DeleteCriticalSection
InitializeCriticalSection
RaiseException
CreateFileA
CreateFileW
DeleteFileA
DeleteFileW
CreateFileMappingA
InitializeCriticalSectionAndSpinCount
GetTempPathW
SetFilePointerEx
OutputDebugStringW
FormatMessageW
FindResourceExW
LoadLibraryExW
GetLocaleInfoW
GetSystemDefaultUILanguage
SearchPathW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetTempFileNameA
GetTempFileNameW
ReadFile
VirtualProtect
WriteProcessMemory
GetLastError
GetFileSize
LoadLibraryA
FreeLibrary
LeaveCriticalSection
SetEndOfFile
DuplicateHandle
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetUserDefaultLCID
GetVersionExA
IsProcessorFeaturePresent
FindResourceA
WriteFile
SetFilePointer
CloseHandle
InterlockedDecrement
InterlockedIncrement
InterlockedExchange
SetLastError
GetCurrentThreadId
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
FoldStringW
LocalAlloc

gdi32

CreatePen
SelectClipRgn
StretchBlt
GetRandomRgn
MoveToEx
GetWorldTransform
GetCurrentObject
CreateDIBSection
SetStretchBltMode
SetGraphicsMode
LineTo
CreateRectRgn
SetWorldTransform
ExtTextOutW
TextOutW
ExtEscape
SaveDC
RestoreDC
GetTextExtentPoint32W
CreateSolidBrush
SetBkMode
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
SelectObject
GetTextExtentPointW
GetClipBox
SetTextColor
SetBkColor
CreateFontIndirectW
CreateICW
GetDeviceCaps
DeleteDC
DeleteObject
GetObjectW

user32

IsDialogMessageW
CopyRect
DrawTextExW
FlashWindowEx
OpenIcon
OpenClipboard
EmptyClipboard
RegisterClipboardFormatW
SetClipboardData
DestroyCursor
CloseClipboard
GetShellWindow
GetDlgItemInt
GetForegroundWindow
SetWindowPlacement
InsertMenuItemW
GetWindowPlacement
IntersectRect
UnionRect
EqualRect
SetMenu
IsIconic
IsZoomed
AdjustWindowRect
LoadIconW
SetCursor
SetForegroundWindow
TranslateAcceleratorW
DestroyMenu
MonitorFromRect
PostMessageW
GetAncestor
MapWindowPoints
RedrawWindow
ValidateRect
IsRectEmpty
GetCapture
GetUpdateRgn
GetUpdateRect
GetGestureInfo
CloseGestureInfoHandle
SetGestureConfig
ClientToScreen
GetScrollInfo
SetScrollInfo
ScrollWindowEx
KillTimer
SetTimer
DrawIconEx
GetIconInfo
MsgWaitForMultipleObjects
MsgWaitForMultipleObjectsEx
GetDesktopWindow
OffsetRect
DrawTextW
DrawFrameControl
GetMenuItemCount
CheckMenuRadioItem
RemovePropW
SetWindowTextW
SetParent
IsProcessDPIAware
LoadImageW
SystemParametersInfoW
IsWindowEnabled
TrackMouseEvent
GetCursorPos
ScreenToClient
PtInRect
IsWindow
CheckDlgButton
GetSysColor
GetSysColorBrush
MessageBoxW
SetPropW
RemoveMenu
CreatePopupMenu
GetDC
ReleaseDC
GetPropW
CallWindowProcW
GetScrollBarInfo
GetSystemMetrics
GetParent
GetWindow
MonitorFromWindow
GetMonitorInfoW
DestroyIcon
SendMessageW
SetRectEmpty
GetFocus
IsChild
PostQuitMessage
GetKeyState
LoadAcceleratorsW
LoadMenuW
ShowWindow
LoadCursorW
GetClientRect
GetWindowRect
DeferWindowPos
CheckMenuItem
EnableMenuItem
EndPaint
FillRect
BeginPaint
DefWindowProcW
SetFocus
SetDlgItemTextW
MessageBeep
GetDlgItemTextW
EndDialog
GetSubMenu
DestroyWindow
TrackPopupMenuEx
UpdateWindow
EndDeferWindowPos
SetRect
IsWindowVisible
BeginDeferWindowPos
InflateRect
GetDlgCtrlID
ReleaseCapture
SetCapture
PeekMessageW
GetMessageW
TranslateMessage
SetMenuItemInfoW
DispatchMessageW
GetMenu
SetWindowPos
UnhookWindowsHookEx
CallNextHookEx
SetWindowLongW
GetMenuState
CreateWindowExW
SetWindowsHookExW
LoadStringW
GetWindowTextW
GetWindowTextLengthW
IsDlgButtonChecked
EnableWindow
GetDlgItem
SendDlgItemMessageW
DialogBoxParamW
GetMessageTime
GetMessagePos
GetWindowLongW
RegisterClassExW
InvalidateRect

msvcrt

_CIpow
_strdup
_controlfp
realloc
_onexit
_lock
__dllonexit
_unlock
__uncaught_exception
_except_handler4_common
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
abort
__mb_cur_max
__crtLCMapStringW
__crtGetStringTypeW
setlocale
___mb_cur_max_func
_errno
___lc_handle_func
___lc_codepage_func
isupper
__pctype_func
__crtLCMapStringA
calloc
malloc
_callnewh
towupper
wcsstr
towlower
wcstombs
_strtoi64
_strtoui64
_isnan
_finite
wcstod
iswxdigit
ceil
floor
_CIfmod
atol
swprintf_s
wcsncmp
_wcsnicmp
bsearch
tolower
islower
isdigit
isalnum
isspace
_beginthreadex
?set_terminate@@YAP6AXXZP6AXXZ@Z
_wtoi
wcsncpy_s
_wcsicmp
iswspace
_ftol2_sse
_stricmp
mbstowcs
ldiv
sprintf_s
strcspn
memchr
localeconv
memset
free
memcpy
_wtol
__CxxFrameHandler3
_purecall
_vsnwprintf
_ftol2
??1bad_cast@@UAE@XZ
_CxxThrowException
??0bad_cast@@QAE@ABV0@@Z
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
memcpy_s
memmove_s
_CItanh
_CIacos
_CIatan2
_CIsin
_CIsqrt

ntdll

WinSqmAddToStream

netutils

NetApiBufferFree

wkscli

NetGetJoinInformation

comctl32

ord381
HIMAGELIST_QueryInterface
ImageList_LoadImageW
ImageList_Draw
ImageList_ReplaceIcon
InitCommonControlsEx
ord345
ImageList_DrawEx
ord380
ImageList_GetIconSize
ImageList_Destroy
ImageList_Create
ImageList_AddMasked
ImageList_Add

dwrite

DWriteCreateFactory

gdiplus

GdipCloneBrush
GdipMultiplyMatrix
GdipIsMatrixInvertible
GdipIsMatrixIdentity
GdipCloneMatrix
GdipGetRegionBounds
GdipIsVisibleRegionPoint
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipGetSolidFillColor
GdipTranslateTextureTransform
GdipScaleTextureTransform
GdipTranslateLineTransform
GdipScaleLineTransform
GdipCreatePath
GdipDeletePath
GdipCreateBitmapFromScan0
GdipBitmapSetResolution
GdipSetImageAttributesColorMatrix
GdipGetBrushType
GdipCreateTexture2
GdipSetPenWidth
GdipGetPenWidth
GdipSetPenLineCap197819
GdipSetPenLineJoin
GdipSetPenMiterLimit
GdipSetPenTransform
GdipSetPenBrushFill
GdipSetPenDashOffset
GdipSetPenDashArray
GdipStartPathFigure
GdipAddPathLine
GdipAddPathBezier
GdipTransformPath
GdipGetPointCount
GdipGetImageGraphicsContext
GdipGetInterpolationMode
GdipSetInterpolationMode
GdipTranslateWorldTransform
GdipGetDpiX
GdipGetDpiY
GdipDrawPath
GdipFillRectangleI
GdipFillPath
GdipDrawImageRectRect
GdipSetClipPath
GdipGetVisibleClipBounds
GdipIsVisibleClipEmpty
GdipIsVisibleRectI
GdipGetPathData
GdipSetTextureTransform
GdipGetTextureTransform
GdipResetTextureTransform
GdipMultiplyTextureTransform
GdipSetLinePresetBlend
GdipMultiplyLineTransform
GdipSetLineWrapMode
GdipGetImagePixelFormat
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipSetImageAttributesWrapMode
GdipCreateMatrix2
GdipRotateMatrix
GdipInvertMatrix
GdipVectorTransformMatrixPoints
GdipCreateTextureIA
GdipCreateRegionPath
GdipAddPathRectangle
GdipSetPixelOffsetMode
GdipDrawImageRectI
GdipDrawImageRectRectI
GdipSetPathFillMode
GdipClosePathFigure
GdipSetPathMarker
GdipFlush
GdipTransformRegion
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipSaveAdd
GdipSaveAddImage
GdipResetWorldTransform
GdipRotateWorldTransform
GdipSetPageScale
GdipDrawRectangleI
GdipFillRegion
GdipDrawString
GdipMeasureDriverString
GdipDrawImage
GdipDrawImageI
GdipSetClipRegion
GdipGetClip
GdipCreateRegionRectI
GdipCreateRegionHrgn
GdipGetImageFlags
GdipGetImageRawFormat
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipAddPathBeziers
GdipFillRectangle
GdipDrawRectangle
GdipGetPageScale
GdipGetPageUnit
GdipSetPageUnit
GdipGetWorldTransform
GdipScaleWorldTransform
GdipSetWorldTransform
GdipSetSmoothingMode
GdipGetSmoothingMode
GdipCreateSolidFill
GdipScaleMatrix
GdipTranslateMatrix
GdipSetMatrixElements
GdipCreateMatrix
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipCombineRegionPath
GdipCombineRegionRegion
GdipSetEmpty
GdipDeleteRegion
GdipGetPathWorldBounds
GdipDeleteBrush
GdipDeleteMatrix
GdipGetMatrixElements
GdipRestoreGraphics
GdipSaveGraphics
GdipTransformPoints
GdipSetClipRect
GdipCreateLineBrush
GdipIsVisibleRect
GdipMultiplyWorldTransform
GdipTransformMatrixPoints
GdipDeletePen
GdipCreatePen1
GdiplusStartup
GdiplusShutdown
GdipDrawImageRect
GdipGraphicsClear
GdipReleaseDC
GdipGetDC
GdipCreateFromHDC
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetImageHeight
GdipGetImageWidth
GdipDeleteGraphics
GdipCloneImage
GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipDisposeImage
GdipAlloc
GdipFree
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatLineAlign
GdipMeasureString
GdipCreateRegion
GdipSetStringFormatAlign

ole32

CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
StgIsStorageFile
CreateStreamOnHGlobal
ReleaseStgMedium
CoInitialize
CoUninitialize
CoRegisterClassObject
StgCreateStorageEx
StgOpenStorageOnILockBytes
StringFromGUID2
CoCreateGuid
IIDFromString
StgOpenStorageEx
CoInitializeEx
CoRevokeClassObject

shell32

DragQueryFileW
SHAppBarMessage
SHParseDisplayName
ShellExecuteW
SHCreateItemFromParsingName
DragAcceptFiles
ShellExecuteExW
ShellAboutW

winmm

timeGetTime

cryptxml

CryptXmlEnumAlgorithmInfo

ncrypt

NCryptSignHash

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 10B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 168KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c4ab8763277fe07e8a7a1f5ab6c99a11

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

netutils

wkscli

comctl32

dwrite

gdiplus

ole32

shell32

winmm

cryptxml

ncrypt

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.data Size: 41KB - Virtual size: 57KB

.tls Size: 512B - Virtual size: 10B

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.reloc Size: 168KB - Virtual size: 169KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.data
Size: 41KB - Virtual size: 57KB

.tls
Size: 512B - Virtual size: 10B

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

.reloc
Size: 168KB - Virtual size: 169KB