9ef17aec2e528e8ab79f10aa05416044a613089759660285e90470222b5c4173

Sharing

Copy URL Twitter E-mail

General

Target

9ef17aec2e528e8ab79f10aa05416044a613089759660285e90470222b5c4173
Size

8.9MB
MD5

9782bbd54d547d7c12db60647ad0ec51
SHA1

04cc85cf9d9a3e060aa2931390648c5a6d3d80a4
SHA256

9ef17aec2e528e8ab79f10aa05416044a613089759660285e90470222b5c4173
SHA512

6225901f9e68e7566df638a01c7200a5f5b306ad502cbafaeacf6918416cca49bd8dfba5b7b0addcf52265075c83eb4b8e1674516139ba4355c71df1d3fca0e4
SSDEEP

196608:r5JAO4t/IEwEfBL5uoJVUrhyKtNAraqBvhCrOIi/ye4kJK8iXcV5C:r5JqdXTd5LU0a+BB86b/yHkJ2M6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9ef17aec2e528e8ab79f10aa05416044a613089759660285e90470222b5c4173

Files

9ef17aec2e528e8ab79f10aa05416044a613089759660285e90470222b5c4173
.exe windows:5 windows x86 arch:x86

0326debfd3f236404adc459ed5e3a842

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalAlloc
DeleteFileW
GetTempPathW
FindResourceW
WriteFile
SizeofResource
LoadResource
LockResource
ExitThread
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
ExpandEnvironmentStringsW
PeekNamedPipe
WaitForMultipleObjects
GetSystemDirectoryA
SleepEx
ResetEvent
FreeLibraryAndExitThread
lstrlenA
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
GetFileSizeEx
GetFileInformationByHandle
InterlockedCompareExchange
CreateEventW
SetCurrentDirectoryW
MulDiv
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetModuleHandleW
GetLastError
GetCurrentProcessId
LocalFree
LocalAlloc
WideCharToMultiByte
GetCurrentDirectoryW
GlobalLock
GlobalUnlock
SetEvent
MultiByteToWideChar
GetSystemDirectoryW
GetSystemWindowsDirectoryW
CopyFileW
OutputDebugStringA
GetCurrentProcess
OutputDebugStringW
GetVersionExW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
TerminateProcess
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetPrivateProfileStringW
GlobalFree
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
DecodePointer
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetSystemInfo
FormatMessageW
FindClose
CreateDirectoryW
FindFirstFileW
FindNextFileW
FileTimeToSystemTime
ReleaseMutex
CreateMutexW
lstrcpyW
GetTickCount
AreFileApisANSI
GetLongPathNameW
FlushInstructionCache
HeapCreate
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FreeResource
GetFullPathNameW
GetLocalTime
GetVersionExA
GetSystemTime
GetModuleHandleA
EncodePointer
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetACP
GetFileType
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WaitForSingleObjectEx
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
FlushFileBuffers
WriteConsoleW
SetEndOfFile
Sleep
InterlockedDecrement
InterlockedIncrement
CreateFileW
WritePrivateProfileStringW
GetModuleFileNameW
ReadFile
GetFileSize
CreateThread
QueryDosDeviceW
GetWindowsDirectoryW
LoadLibraryW
GetLogicalDriveStringsW
lstrcmpiW
CloseHandle
OpenProcess
LoadLibraryA
lstrlenW
SetLastError
GetProcessHeap
HeapFree
HeapAlloc
VirtualFree
VirtualAlloc
GetProcAddress
MoveFileExW
FreeLibrary

user32

ClientToScreen
SetRect
EnableMenuItem
GetSysColor
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetSystemMetrics
IsWindowVisible
DrawTextW
SystemParametersInfoA
CharLowerBuffW
MapVirtualKeyA
UpdateLayeredWindow
IsMenu
IsWindowEnabled
CreatePopupMenu
DestroyMenu
GetMenuItemCount
AppendMenuW
TrackPopupMenu
GetMenuInfo
SetMenuInfo
GetMenuItemInfoW
SetMenuContextHelpId
GetMonitorInfoW
MonitorFromWindow
GetWindow
GetParent
SetWindowLongW
MapWindowPoints
GetWindowRect
GetClientRect
GetCursorPos
GetDlgItem
CreateWindowExW
RegisterClassExW
PeekMessageW
DefWindowProcW
GetWindowLongW
GetFocus
SetFocus
PtInRect
EqualRect
IsRectEmpty
UnionRect
CopyRect
SetCursor
KillTimer
SetTimer
DestroyWindow
DestroyCursor
LoadCursorW
IntersectRect
GetKeyState
UnregisterClassW
GetIconInfo
DrawIconEx
OffsetRect
InflateRect
ReleaseDC
GetDC
SendMessageW
ShowWindow
SetWindowPos
SetWindowTextW
IsWindow
SetForegroundWindow
FindWindowW
InvalidateRect
TrackMouseEvent
EndPaint
BeginPaint
UpdateWindow
ReleaseCapture
SetCapture
GetCapture
IsZoomed
IsIconic
DispatchMessageW
TranslateMessage
GetMessageW
CharNextW
LoadImageW
CreateIconFromResource
LoadBitmapW
DestroyIcon
GetClassNameW
CallWindowProcW
ScreenToClient
SetLayeredWindowAttributes
AnimateWindow
SystemParametersInfoW
PostQuitMessage
PostMessageW
GetActiveWindow
LoadStringW

advapi32

RevertToSelf
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegOpenKeyW
RegEnumKeyW
ImpersonateLoggedOnUser
DuplicateTokenEx
CreateProcessAsUserW
SetSecurityDescriptorDacl
CloseServiceHandle
InitializeSecurityDescriptor
ControlService
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
StartServiceW
OpenProcessToken
GetTokenInformation
LookupAccountSidW
RegDeleteKeyW
SetTokenInformation

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetSpecialFolderPathW
SHGetFolderPathW
SHChangeNotify

ole32

CoCreateInstance
OleLockRunning
CLSIDFromString
CLSIDFromProgID
CreateBindCtx
CoInitialize
CoUninitialize
OleInitialize
OleUninitialize
CreateStreamOnHGlobal
CoCreateGuid

shlwapi

SHDeleteValueW
SHDeleteKeyW
PathAppendW
StrStrIW
SHSetValueW
SHGetValueW
StrToIntExW
PathFileExistsW

psapi

GetProcessImageFileNameW
EnumProcessModules
GetModuleFileNameExW
EnumProcesses

crypt32

CertCloseStore
CryptMsgGetParam
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CryptMsgClose

gdiplus

GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageEncoders
GdipCreateBitmapFromFile
GdipImageSelectActiveFrame
GdipGetImageEncodersSize
GdipDrawImageRectI
GdipGraphicsClear
GdipSaveImageToFile
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageHeight

imm32

ImmAssociateContext
ImmGetContext
ImmDestroyContext
ImmCreateContext
ImmReleaseContext

gdi32

GetStockObject
CreateSolidBrush
Rectangle
GetObjectW
CreateDIBSection
SetBkMode
StretchBlt
GetViewportOrgEx
GetCurrentObject
SetViewportOrgEx
EnumFontFamiliesExW
GetCharABCWidthsW
GetFontData
DeleteDC
DeleteObject
ExtCreateRegion
IntersectClipRect
SelectClipRgn
SelectObject
SetGraphicsMode
SetWorldTransform
CreateFontIndirectW
GetDeviceCaps
CreateBitmap
EnumFontsW
BitBlt
CreateCompatibleDC
GdiFlush
GetTextFaceW
ExtTextOutW
GetTextMetricsW
SetTextAlign
SetTextColor
RemoveFontMemResourceEx
AddFontMemResourceEx
GetTextExtentPointI
GetGlyphIndicesW
GetFontUnicodeRanges
GetOutlineTextMetricsW
GetGlyphOutlineW

oleaut32

SysAllocString
SysFreeString

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

ws2_32

getsockopt
htons
ntohs
setsockopt
WSASetLastError
htonl
inet_addr
inet_ntoa
gethostbyaddr
gethostbyname
getservbyport
getservbyname
__WSAFDIsSet
select
recvfrom
sendto
accept
listen
ioctlsocket
gethostname
recv
WSACleanup
WSAStartup
WSAGetLastError
closesocket
socket
send
bind
connect
getpeername
getsockname

usp10

ScriptFreeCache
ScriptItemize
ScriptShape

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 495KB - Virtual size: 495KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 444B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9.5MB - Virtual size: 9.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0326debfd3f236404adc459ed5e3a842

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

psapi

crypt32

gdiplus

imm32

gdi32

oleaut32

userenv

ws2_32

usp10

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 495KB - Virtual size: 495KB

.data Size: 64KB - Virtual size: 165KB

.gfids Size: 512B - Virtual size: 444B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 9.5MB - Virtual size: 9.5MB

.reloc Size: 130KB - Virtual size: 129KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 495KB - Virtual size: 495KB

.data
Size: 64KB - Virtual size: 165KB

.gfids
Size: 512B - Virtual size: 444B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 9.5MB - Virtual size: 9.5MB

.reloc
Size: 130KB - Virtual size: 129KB