561f614b1ea286e0e2bbfc42c7841b04793a9c780f089f08eba36af290279ec8

Sharing

Copy URL Twitter E-mail

General

Target

561f614b1ea286e0e2bbfc42c7841b04793a9c780f089f08eba36af290279ec8
Size

3.3MB
MD5

1bf1180c98f199b2a3d6aaefc8f3091e
SHA1

9270f368f2221916f3d4848d38b3f2821eddbd68
SHA256

561f614b1ea286e0e2bbfc42c7841b04793a9c780f089f08eba36af290279ec8
SHA512

396eddb18a65959ab147d7554b0008653ab573e1cc069b3893c9409680d4ef90dc38c8e353523bcd9baf8c2ecfce8a2548d38a0bb1c47d6f02bde17a1b5b7101
SSDEEP

49152:13C3EKGJxWmTtcckaI5uJz9lNi8txHM+5YjCpVJJJJDX3BG3UF2Akn:1E+VqElo0xHM+5YjIXpkn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
561f614b1ea286e0e2bbfc42c7841b04793a9c780f089f08eba36af290279ec8

Files

561f614b1ea286e0e2bbfc42c7841b04793a9c780f089f08eba36af290279ec8
.exe windows:4 windows x86 arch:x86

c58a690c8826c25e33ef057b51b49fc7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

waveOutClose
waveOutOpen
waveInAddBuffer
mixerGetNumDevs
waveInUnprepareHeader
waveInReset
waveInStart
waveOutUnprepareHeader
waveOutWrite
waveOutPrepareHeader
waveInOpen
waveInClose
sndPlaySoundA
PlaySoundA
waveInPrepareHeader

wininet

InternetQueryDataAvailable
InternetQueryOptionA
InternetGetLastResponseInfoA
HttpQueryInfoA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetOpenUrlA
InternetCloseHandle
InternetOpenA
InternetCanonicalizeUrlA
InternetCrackUrlA

iphlpapi

GetAdaptersInfo
SendARP

shlwapi

PathFileExistsA

kernel32

SetErrorMode
WritePrivateProfileStringA
GetOEMCP
RtlUnwind
GetTimeZoneInformation
HeapFree
HeapAlloc
RaiseException
HeapReAlloc
TerminateProcess
SetStdHandle
GetFileType
HeapSize
GetACP
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
SetHandleCount
GetStdHandle
CompareStringA
CompareStringW
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetEnvironmentVariableA
GetCPInfo
GetProcessVersion
TlsGetValue
LocalReAlloc
TlsSetValue
TlsFree
GlobalHandle
TlsAlloc
GlobalFlags
GetCurrentThread
GetDiskFreeSpaceA
LocalFileTimeToFileTime
GetFileTime
LocalAlloc
IsBadWritePtr
SuspendThread
SetThreadPriority
MoveFileA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
DuplicateHandle
GetThreadLocale
GetProfileIntA
SetLastError
lstrcpynA
FileTimeToLocalFileTime
FileTimeToSystemTime
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
GetModuleHandleA
GetExitCodeThread
WideCharToMultiByte
UnmapViewOfFile
GetFileSize
CreateFileMappingA
MapViewOfFile
IsBadReadPtr
GetPrivateProfileStringA
TerminateThread
SetEvent
ResetEvent
MulDiv
CreateEventA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedIncrement
GetVolumeInformationA
LocalFlags
GetSystemTime
GetComputerNameA
lstrcmpA
GetCurrentThreadId
CopyFileA
GetCommandLineA
CreateMutexA
ExitProcess
InterlockedDecrement
GetWindowsDirectoryA
SizeofResource
lstrcatA
lstrlenA
GetDriveTypeA
FindNextFileA
CreatePipe
GetStartupInfoA
CreateProcessA
ReadFile
FormatMessageA
LocalFree
GetTempFileNameA
MultiByteToWideChar
GlobalUnlock
GetTempPathA
IsDBCSLeadByte
GetFullPathNameA
FindFirstFileA
FindClose
GetFileInformationByHandle
GetFileAttributesA
SystemTimeToFileTime
lstrcpyA
GlobalAlloc
GlobalReAlloc
GlobalFree
LoadResource
LockResource
LoadLibraryA
GetProcAddress
FreeLibrary
GlobalSize
GetSystemDirectoryA
WinExec
GetCurrentProcess
SetProcessWorkingSetSize
WaitForSingleObject
WriteFile
CreateDirectoryA
CreateFileA
SetFileAttributesA
SetFileTime
CloseHandle
DeleteFileA
ExitThread
GetTickCount
CreateThread
ResumeThread
GetLocalTime
GetVersionExA
Sleep
GetLastError
FindResourceA
WriteProfileStringA
GetProfileStringA
GetModuleFileNameA
GlobalLock
GetVersion
InterlockedExchange
GetCurrentDirectoryA

user32

EndPaint
GetDCEx
CharNextA
CharUpperA
ValidateRect
LoadStringA
PostQuitMessage
SetWindowContextHelpId
MapDialogRect
WaitMessage
CopyAcceleratorTableA
GetNextDlgGroupItem
LockWindowUpdate
SetParent
MapWindowPoints
EqualRect
DeferWindowPos
BeginDeferWindowPos
EndDeferWindowPos
GetScrollInfo
SetScrollInfo
GetScrollPos
SetScrollPos
GetTopWindow
WinHelpA
RegisterClassA
GetWindowTextLengthA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetLastActivePopup
GetWindow
GetWindowPlacement
EndDialog
SetActiveWindow
CreateDialogIndirectParamA
GetDlgItem
IsWindowEnabled
GetAsyncKeyState
SetWindowPos
TrackMouseEvent
DeleteMenu
CreatePopupMenu
EnableMenuItem
CheckMenuItem
RegisterClipboardFormatA
SetMenu
PostThreadMessageA
SetWindowRgn
ClipCursor
HideCaret
GetSysColorBrush
GetClassInfoA
DestroyWindow
CreateWindowExA
DefWindowProcA
SetFocus
keybd_event
GetWindowDC
GetLastInputInfo
GetWindowTextA
GetClassNameA
FindWindowExA
EnumWindows
SetClassLongA
TrackPopupMenu
RegisterWindowMessageA
GetSystemMenu
UnregisterHotKey
RegisterHotKey
FindWindowA
CopyImage
CopyIcon
GetCursor
IsChild
AdjustWindowRectEx
BeginPaint
DrawEdge
ChildWindowFromPoint
GetMessagePos
GetMessageA
GetDlgCtrlID
DrawFrameControl
ScrollDC
GetDC
ReleaseDC
AppendMenuA
GetMenuState
GetTabbedTextExtentA
GetIconInfo
TrackPopupMenuEx
ClientToScreen
WindowFromPoint
GetNextDlgTabItem
DestroyMenu
IsWindow
mouse_event
MessageBeep
SetWindowLongA
GetKeyState
SetCursorPos
GetMenuItemCount
GetMenuItemID
ScreenToClient
PostMessageA
GetFocus
FlashWindow
IsZoomed
ShowWindow
GetForegroundWindow
SetForegroundWindow
GetWindowThreadProcessId
PeekMessageA
TranslateMessage
DispatchMessageA
IsClipboardFormatAvailable
GetClipboardData
LoadMenuA
GetSubMenu
ModifyMenuA
KillTimer
DrawIconEx
DestroyIcon
IsWindowVisible
UpdateWindow
GetDesktopWindow
SetRectEmpty
SetTimer
SystemParametersInfoA
wsprintfA
InvalidateRgn
GetCursorPos
IsRectEmpty
MessageBoxA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsIconic
DrawIcon
GetWindowRect
SetRect
LoadIconA
GrayStringA
DrawTextA
TabbedTextOutA
GetWindowLongA
CopyRect
FrameRect
InflateRect
FillRect
GetSysColor
OffsetRect
DrawStateA
DrawFocusRect
GetActiveWindow
GetCapture
SetCapture
wvsprintfA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
MoveWindow
SetWindowTextA
IsDialogMessageA
PtInRect
ReleaseCapture
LoadImageA
RedrawWindow
DestroyCursor
LoadBitmapA
SetCursor
GetMenu
ShowScrollBar
InvalidateRect
GetParent
GetSystemMetrics
GetClientRect
LoadCursorA
SendMessageA
EnableWindow
UnionRect
SendDlgItemMessageA
IsWindowUnicode
DefDlgProcA
ExcludeUpdateRgn
ShowCaret
UnregisterClassA
IntersectRect

gdi32

SetStretchBltMode
EnumFontFamiliesA
GetTextCharsetInfo
PatBlt
PolyBezier
ExtFloodFill
CreateRoundRectRgn
CreateEllipticRgn
MoveToEx
LineTo
FillRgn
GetDCOrgEx
SaveDC
RestoreDC
SetBkMode
SetROP2
SetMapMode
SetViewportOrgEx
DPtoLP
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
SelectClipRgn
ExcludeClipRect
IntersectClipRect
StretchDIBits
GetViewportExtEx
GetWindowExtEx
SetRectRgn
UnrealizeObject
SetPixel
GetTextColor
GetCurrentObject
CreateSolidBrush
GetClipBox
SelectPalette
GetDIBits
CreateHalftonePalette
GetDIBColorTable
CreatePalette
GetBkColor
RealizePalette
CreateBitmap
SetBkColor
SetTextColor
SetDIBitsToDevice
CreateDIBitmap
PtInRegion
CreatePolygonRgn
FrameRgn
CreatePatternBrush
Ellipse
Polygon
CreatePen
RoundRect
CreateFontA
CreateFontIndirectA
CreateRectRgnIndirect
CombineRgn
GetTextMetricsA
GetTextExtentPoint32A
GetDeviceCaps
GetStockObject
Rectangle
GetPixel
CreateDCA
DeleteDC
CreateRectRgn
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
SelectObject
GetObjectA
StretchBlt
DeleteObject
LPtoDP
GetTextExtentPointA
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
GetMapMode

comdlg32

GetSaveFileNameA
ChooseColorA
GetFileTitleA
ChooseFontA
GetOpenFileNameA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegSetValueExA
RegOpenKeyA
RegDeleteValueA
RegQueryValueExA
RegOpenKeyExA
RegQueryValueA
RegRestoreKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegSaveKeyA
GetUserNameA
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegEnumValueA
SetFileSecurityA
GetFileSecurityA
RegCloseKey

shell32

ShellExecuteExA
SHChangeNotify
SHGetSpecialFolderLocation
Shell_NotifyIconA
ExtractIconA
ShellExecuteA
SHFileOperationA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetFileInfoA
DragQueryFileA
DragFinish

comctl32

ImageList_AddMasked
ImageList_GetIcon
ImageList_GetImageCount
ImageList_ReplaceIcon
ImageList_Remove
_TrackMouseEvent
ImageList_Draw
ImageList_GetImageInfo
ImageList_GetIconSize
ord17
ImageList_Destroy
ImageList_LoadImageA
ImageList_Create

oledlg

ord8

ole32

OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
StgOpenStorageOnILockBytes
CoGetClassObject
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromString
CLSIDFromProgID
CoUninitialize
CoInitialize
CoCreateInstance
OleCreateStaticFromData
OleDuplicateData
ReleaseStgMedium
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
OleSetContainedObject
CoCreateGuid
CreateStreamOnHGlobal

olepro32

ord251
ord253

oleaut32

SysAllocStringByteLen
SysAllocString
VariantCopy
SysAllocStringLen
SysFreeString
VariantClear
VariantChangeType
VariantTimeToSystemTime
SysStringLen

wsock32

setsockopt
WSASetLastError
getpeername
connect
accept
htonl
ioctlsocket
inet_addr
WSAGetLastError
send
select
recv
closesocket
ntohl
gethostbyname
gethostname
recvfrom
listen
htons
inet_ntoa
bind
socket
WSAStartup
WSACleanup
WSAAsyncSelect
sendto

msimg32

GradientFill

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 316KB - Virtual size: 314KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 100KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c58a690c8826c25e33ef057b51b49fc7

Headers

File Characteristics

Imports

winmm

wininet

iphlpapi

shlwapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

wsock32

msimg32

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 316KB - Virtual size: 314KB

.data Size: 100KB - Virtual size: 135KB

.rsrc Size: 1.3MB - Virtual size: 1.3MB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 316KB - Virtual size: 314KB

.data
Size: 100KB - Virtual size: 135KB

.rsrc
Size: 1.3MB - Virtual size: 1.3MB