e0ee8c9e5f05ef590e09669cd9f8af0b1f73fdc2a923c6311404f7d345dfcb2d

Sharing

Copy URL Twitter E-mail

General

Target

e0ee8c9e5f05ef590e09669cd9f8af0b1f73fdc2a923c6311404f7d345dfcb2d
Size

5.4MB
MD5

d01448339533ef1ea7e13b7015f9c128
SHA1

a3021d56d32e055f24e041ddc19b4c163d3cc734
SHA256

e0ee8c9e5f05ef590e09669cd9f8af0b1f73fdc2a923c6311404f7d345dfcb2d
SHA512

77675845781066121f810bc332b95fbf9321a349419642db11df56175f1d93aa0ab8dfd7a5557569c072101ce62c3447f8c5b65c723a831a0cb278e9bf18095a
SSDEEP

49152:WtRVEVBTIyFz4jFZ3DkgWnsmkegND9GdluwwRrx0VrPj1eFXvx7gGhHEHz+8uZJn:WtRVuay94r3DkgWnChpFzXZ7fEC8ujV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e0ee8c9e5f05ef590e09669cd9f8af0b1f73fdc2a923c6311404f7d345dfcb2d

Files

e0ee8c9e5f05ef590e09669cd9f8af0b1f73fdc2a923c6311404f7d345dfcb2d
.exe windows:6 windows x86 arch:x86

7632dc610f3d19861110c860668e586a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\build.tc\agent\work\14d10ba45c29ec39\-\rescue\Applet\native\bin\x86\lmi_applet_711.pdb

Imports

comctl32

ord345

ws2_32

htons
send
sendto
closesocket
socket
WSAStartup
WSACleanup
getaddrinfo
freeaddrinfo
getsockopt
shutdown
select
recv
gethostbyaddr
getservbyport
inet_ntoa
getservbyname
gethostbyname
inet_addr
connect
setsockopt
inet_pton
ioctlsocket
getsockname
WSAGetLastError
WSASetLastError
ntohs
htonl

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW
WTSQuerySessionInformationW

winmm

PlaySoundA

crypt32

CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CryptProtectData
CryptUnprotectData

kernel32

GetEnvironmentVariableW
GetSystemTime
GetDateFormatA
GetTimeFormatA
lstrlenW
GetPrivateProfileStringA
WritePrivateProfileStringA
WritePrivateProfileSectionA
GetTickCount64
SystemTimeToTzSpecificLocalTime
CompareStringEx
MulDiv
FileTimeToLocalFileTime
GetFileTime
OutputDebugStringA
InitializeCriticalSection
GetCurrentThread
SetThreadPriority
WaitForMultipleObjects
MoveFileW
GetComputerNameW
SetCriticalSectionSpinCount
TryEnterCriticalSection
GetEnvironmentVariableA
GetCurrentDirectoryA
CreateDirectoryA
CreateFileA
DeleteFileA
GetFileAttributesA
SetUnhandledExceptionFilter
SuspendThread
GetThreadContext
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExW
GetModuleFileNameA
GetUserDefaultLangID
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetTimeZoneInformation
GetLocaleInfoW
GetExitCodeThread
ResumeThread
TlsAlloc
SetProcessShutdownParameters
TlsSetValue
TlsFree
GetStdHandle
ResetEvent
GetFileAttributesW
lstrcmpiA
GetProductInfo
FormatMessageA
ExitProcess
GetProcessTimes
OpenThread
GetThreadTimes
GetModuleHandleExW
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetFileType
VirtualAlloc
VirtualFree
SwitchToFiber
DeleteFiber
CreateFiberEx
GetACP
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
ConvertFiberToThread
ConvertThreadToFiberEx
LCMapStringEx
GetStringTypeW
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
WaitForSingleObjectEx
LoadLibraryExA
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
IsDebuggerPresent
CreateSemaphoreW
ProcessIdToSessionId
ReleaseMutex
ReleaseSemaphore
SetEvent
SetCurrentDirectoryA
SetErrorMode
SetEndOfFile
CreateThread
MoveFileExW
IsWow64Process
GetSystemDirectoryW
OpenProcess
GetProcessId
CreateProcessW
WaitNamedPipeW
FlushFileBuffers
GetOverlappedResult
DisconnectNamedPipe
FormatMessageW
SetLastError
LoadLibraryA
GetModuleHandleW
GetModuleHandleA
GetLocalTime
GetCurrentProcess
Sleep
RemoveDirectoryW
CreateDirectoryW
SetCurrentDirectoryW
GetTimeFormatW
GetDateFormatW
FileTimeToSystemTime
LocalAlloc
VirtualQuery
CreateEventW
CreateMutexW
GetCurrentProcessId
CreateFileW
WideCharToMultiByte
MultiByteToWideChar
WriteFile
SetFilePointer
ReadFile
GetFileSize
GetCurrentThreadId
GetThreadId
WaitForSingleObject
CloseHandle
GlobalFree
GlobalUnlock
GlobalLock
LoadLibraryW
GetTickCount
LeaveCriticalSection
EnterCriticalSection
WriteConsoleW
LocalFree
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
VerifyVersionInfoW
VerSetConditionMask
OutputDebugStringW
SetThreadExecutionState
LoadLibraryExW
GetProcAddress
GetModuleFileNameW
FreeLibrary
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
GetLocaleInfoEx
GetCPInfo
UnhandledExceptionFilter
TerminateProcess
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
RtlUnwind
ExitThread
FreeLibraryAndExitThread
GetCommandLineA
GetCommandLineW
SetConsoleCtrlHandler
GetDriveTypeW
PeekNamedPipe
CompareStringW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleCP
SetFilePointerEx
SetStdHandle
GetCurrentDirectoryW
GetFullPathNameW
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
TlsGetValue

user32

FrameRect
GetDialogBaseUnits
GetActiveWindow
IsIconic
EqualRect
IntersectRect
CopyRect
IsChild
GetScrollBarInfo
GetScrollInfo
SetScrollInfo
NotifyWinEvent
LoadImageW
DestroyIcon
GetWindowThreadProcessId
GetWindowTextLengthW
SetForegroundWindow
SetActiveWindow
GetFocus
GetClipboardData
CloseClipboard
SetWindowPlacement
AttachThreadInput
UnregisterHotKey
RegisterHotKey
SystemParametersInfoA
GetCursorPos
SetCursorPos
RegisterWindowMessageW
LockWorkStation
GetKeyboardState
ExitWindowsEx
PeekMessageW
DispatchMessageW
TranslateMessage
GetAncestor
GetForegroundWindow
IsWindow
GetClassInfoExW
RegisterClassExW
FlashWindowEx
GetDlgCtrlID
IsWindowVisible
GetWindowPlacement
GetIconInfo
InflateRect
SetRectEmpty
DrawFocusRect
RedrawWindow
InvalidateRect
ReleaseCapture
TrackMouseEvent
GetSysColorBrush
GetSysColor
DialogBoxIndirectParamW
PostMessageW
FillRect
ReleaseDC
GetDC
DrawTextW
LoadCursorW
CallNextHookEx
UnhookWindowsHookEx
GetCapture
ClientToScreen
IsWindowEnabled
EndMenu
MonitorFromRect
MonitorFromWindow
SystemParametersInfoW
UnregisterClassW
GetKeyNameTextW
MapVirtualKeyW
FindWindowW
ScreenToClient
GetMonitorInfoW
OpenClipboard
GetKeyState
WindowFromPoint
SetCapture
GetKeyboardLayout
CharUpperW
MapVirtualKeyExW
SetRect
OffsetRect
IsRectEmpty
SetWindowsHookExW
GetClassNameW
EnumChildWindows
PtInRect
SendMessageW
ShowWindow
MoveWindow
SetWindowPos
DialogBoxParamW
EndDialog
GetWindowDC
SetCaretPos
GetDlgItem
SetFocus
SetTimer
KillTimer
EnableWindow
GetSystemMetrics
GetMessagePos
GetMessageTime
BeginPaint
EndPaint
SetWindowRgn
AdjustWindowRectEx
CharLowerA
CharLowerW
CharNextExA
GetProcessWindowStation
GetUserObjectInformationW
SetClassLongW
SetWindowTextW
GetWindowTextW
GetParent
GetCursor
SetCursor
MessageBoxW
DestroyWindow
CreateWindowExW
CallWindowProcW
DefWindowProcW
GetDesktopWindow
SetWindowLongW
GetWindowLongW
MapWindowPoints
GetWindowRect
GetClientRect

gdi32

ExtCreatePen
FrameRgn
GetStockObject
OffsetWindowOrgEx
SetWindowOrgEx
CreatePolygonRgn
SetDIBits
ExtSelectClipRgn
PtInRegion
OffsetRgn
GetWindowOrgEx
GetRgnBox
GetDIBits
GetClipRgn
CreateRoundRectRgn
CreateRectRgn
CreateEllipticRgn
CombineRgn
CreateBrushIndirect
ExtTextOutW
SetBkMode
SelectClipRgn
GetTextExtentPoint32W
GetDeviceCaps
GetTextExtentExPointW
CreateFontW
DeleteObject
CreateFontIndirectW
BitBlt
CreateCompatibleDC
DeleteDC
SelectObject
CreateDIBSection
CreateCompatibleBitmap
CreatePen
CreateSolidBrush
LineTo
StretchBlt
MoveToEx
EnumFontFamiliesExW
GetObjectW
CreateDCW
CreateRectRgnIndirect
SetTextColor
SetBkColor

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

OpenProcessToken
RegQueryValueExW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptGetProvParam
CryptSetHashParam
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptExportKey
CryptGetKeyParam
CryptGetUserKey
CryptDestroyKey
CryptImportKey
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CryptAcquireContextW
ConvertSidToStringSidW
ConvertSidToStringSidA
IsValidSid
CopySid
RegQueryValueExA
LookupAccountNameW
RevertToSelf
SetEntriesInAclW
SetKernelObjectSecurity
RegGetValueW
LookupAccountSidW
GetTokenInformation
FreeSid
EqualSid
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegDeleteKeyExW
RegCreateKeyExW
LookupPrivilegeValueW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
DuplicateTokenEx
AllocateAndInitializeSid
AdjustTokenPrivileges
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegEnumValueW
RegOpenKeyExA
RegQueryInfoKeyW
AddAce

shell32

ShellExecuteExW
SHGetFolderPathW
SHGetKnownFolderPath
ShellExecuteW
SHGetSpecialFolderPathA

ole32

CoCreateInstance
RevokeDragDrop
CoTaskMemFree
CoInitializeEx
RegisterDragDrop
CoUninitialize

oleaut32

VariantInit
SysStringLen
SysFreeString
SysAllocStringLen
SysAllocString
VariantClear
LoadTypeLi
LoadRegTypeLi

shlwapi

PathAppendW
PathRemoveFileSpecW
StrChrW
PathFileExistsW

oleacc

AccessibleObjectFromWindow
WindowFromAccessibleObject
LresultFromObject

dwmapi

DwmIsCompositionEnabled
ord102

winhttp

WinHttpCloseHandle
WinHttpOpen
WinHttpGetProxyForUrl

wininet

InternetQueryOptionA

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

netapi32

NetApiBufferFree
NetWkstaUserGetInfo

secur32

AcquireCredentialsHandleA
InitializeSecurityContextA
CompleteAuthToken
DeleteSecurityContext
FreeCredentialsHandle
FreeContextBuffer
QuerySecurityPackageInfoA

bcrypt

BCryptGenRandom

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 683KB - Virtual size: 682KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7632dc610f3d19861110c860668e586a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

ws2_32

wtsapi32

winmm

crypt32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

oleacc

dwmapi

winhttp

wininet

version

netapi32

secur32

bcrypt

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

.rdata Size: 683KB - Virtual size: 682KB

.data Size: 41KB - Virtual size: 115KB

.rsrc Size: 1.7MB - Virtual size: 1.7MB

.reloc Size: 135KB - Virtual size: 134KB

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 683KB - Virtual size: 682KB

.data
Size: 41KB - Virtual size: 115KB

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

.reloc
Size: 135KB - Virtual size: 134KB