541d640896f205c582bf3b8cd2d01318a1c7634ec0dd0e51554b976cc342b278

Sharing

Copy URL Twitter E-mail

General

Target

541d640896f205c582bf3b8cd2d01318a1c7634ec0dd0e51554b976cc342b278
Size

14.2MB
MD5

f6a3f7ae1404d419c1ba2257c7dd037e
SHA1

8e4ecd1babc5a7a4da5615233896ef0dc2e235f6
SHA256

541d640896f205c582bf3b8cd2d01318a1c7634ec0dd0e51554b976cc342b278
SHA512

b53eebbdafc4d07c5c58fb78f51c65e230e3a4cf3fdaeddf44b085a2af6357c8a7257e56a2eff55899ac8def6ca8ba27a2ffbb07ce45d71d62ec77a907c81868
SSDEEP

196608:TspSH2l+RgLr00K7GHDtx2vpGTyAlhHWNstMsKJD+Vse+BnP5EjilermQd6KV1X:T5H6+6P00+qtx2vQBhiseeoP5QiImob

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
541d640896f205c582bf3b8cd2d01318a1c7634ec0dd0e51554b976cc342b278

Files

541d640896f205c582bf3b8cd2d01318a1c7634ec0dd0e51554b976cc342b278
.exe windows:5 windows x86 arch:x86

fe7c8e78dbce2b473ba9655dcd4416f9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateDirectoryW
FindFirstFileW
GlobalUnlock
GlobalLock
GlobalAlloc
DeleteFileW
GetTempPathW
FindResourceW
WriteFile
SizeofResource
LoadResource
LockResource
SetCurrentDirectoryW
MulDiv
Process32NextW
GetCurrentDirectoryW
Process32FirstW
CreateToolhelp32Snapshot
GetModuleHandleW
GetLastError
GetCurrentProcessId
LocalFree
LocalAlloc
Sleep
FreeLibraryAndExitThread
ExitThread
GetSystemDirectoryW
GetDriveTypeW
ExpandEnvironmentStringsW
PeekNamedPipe
WaitForMultipleObjects
GetSystemDirectoryA
SleepEx
ResetEvent
SetEvent
lstrlenA
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
GetFileSizeEx
GetFileInformationByHandle
InterlockedCompareExchange
CreateEventW
FindNextFileW
CopyFileW
GetVersionExW
WideCharToMultiByte
OutputDebugStringA
InterlockedDecrement
InterlockedIncrement
CreateFileW
WritePrivateProfileStringW
GetModuleFileNameW
ReadFile
GetFileSize
CreateThread
QueryDosDeviceW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrlenW
WinExec
SystemTimeToTzSpecificLocalTime
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
MoveFileExW
RemoveDirectoryW
GlobalFree
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
DecodePointer
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
FindClose
DeleteCriticalSection
GetSystemInfo
FormatMessageW
FileTimeToSystemTime
ReleaseMutex
CreateMutexW
GetTickCount
AreFileApisANSI
FlushInstructionCache
HeapCreate
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FreeResource
GetFullPathNameW
GetLocalTime
GetVersionExA
GetSystemTime
GetModuleHandleA
RtlUnwind
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetACP
GetFileType
GetStringTypeW
CompareStringW
LCMapStringW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
OutputDebugStringW
WaitForSingleObjectEx
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
FlushFileBuffers
WriteConsoleW
SetEndOfFile
FreeLibrary
GetWindowsDirectoryW
LoadLibraryW
GetLogicalDriveStringsW
lstrcmpiW
CloseHandle
OpenProcess
LoadLibraryA
SetLastError
GetProcessHeap
HeapFree
HeapAlloc
VirtualFree
VirtualAlloc
GetProcAddress

user32

SetCapture
ReleaseCapture
UpdateWindow
BeginPaint
EndPaint
InvalidateRect
GetCursorPos
ScreenToClient
GetClassNameW
DestroyIcon
LoadBitmapW
CreateIconFromResource
LoadImageW
CharNextW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
ClientToScreen
SetRect
EnableMenuItem
GetSysColor
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetSystemMetrics
IsWindowVisible
DrawTextW
SystemParametersInfoA
CharLowerBuffW
MapVirtualKeyA
UpdateLayeredWindow
IsMenu
IsWindowEnabled
CreatePopupMenu
DestroyMenu
GetMenuItemCount
AppendMenuW
TrackPopupMenu
GetCapture
SetMenuInfo
GetMenuItemInfoW
SetMenuContextHelpId
CallWindowProcW
DefWindowProcW
GetWindowLongW
GetFocus
SetFocus
PtInRect
EqualRect
IsRectEmpty
UnionRect
CopyRect
SetCursor
KillTimer
SetTimer
DestroyWindow
DestroyCursor
LoadCursorW
IntersectRect
UnregisterClassW
LoadStringW
GetKeyState
GetIconInfo
DrawIconEx
OffsetRect
InflateRect
ReleaseDC
SendMessageW
ShowWindow
SetWindowPos
SetWindowTextW
IsWindow
GetDC
SetForegroundWindow
FindWindowW
IsZoomed
IsIconic
SetLayeredWindowAttributes
AnimateWindow
PostQuitMessage
PostMessageW
TrackMouseEvent
GetMonitorInfoW
MonitorFromWindow
GetWindow
GetParent
SetWindowLongW
GetActiveWindow
MapWindowPoints
GetClientRect
GetWindowRect
GetDlgItem
CreateWindowExW
SystemParametersInfoW
GetMenuInfo
RegisterClassExW

advapi32

SetTokenInformation
RegCreateKeyExW
RegCreateKeyW
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueW
RegSetValueExW
DuplicateTokenEx
CreateProcessAsUserW
LookupAccountSidW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
OpenProcessToken
ImpersonateLoggedOnUser
RevertToSelf
RegDeleteKeyW

shell32

SHGetPathFromIDListW
SHFileOperationW
SHGetFolderPathW
ShellExecuteExW
SHBrowseForFolderW
SHGetSpecialFolderPathW
ShellExecuteW

ole32

CoCreateInstance
OleLockRunning
CLSIDFromString
CLSIDFromProgID
OleInitialize
OleUninitialize
CreateStreamOnHGlobal
CreateBindCtx
CoCreateGuid

shlwapi

StrToIntExW
PathFileExistsW

psapi

EnumProcessModules
GetModuleFileNameExW
EnumProcesses
GetProcessImageFileNameW

crypt32

CryptMsgClose
CryptMsgGetParam
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject

gdiplus

GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipDrawImageI
GdipSaveImageToFile
GdipGetImageEncodersSize
GdipGraphicsClear
GdipDrawImageRectI
GdipGetImageEncoders

imm32

ImmAssociateContext
ImmGetContext
ImmDestroyContext
ImmCreateContext
ImmReleaseContext

gdi32

CreateFontIndirectW
CreateCompatibleDC
GetDeviceCaps
CreateBitmap
EnumFontsW
BitBlt
GetViewportOrgEx
GetCurrentObject
SetViewportOrgEx
GetObjectW
CreateSolidBrush
GetStockObject
StretchBlt
SetBkMode
EnumFontFamiliesExW
GetCharABCWidthsW
GetFontData
GetGlyphOutlineW
GetOutlineTextMetricsW
GetFontUnicodeRanges
GetGlyphIndicesW
GetTextExtentPointI
AddFontMemResourceEx
RemoveFontMemResourceEx
SetTextColor
SetTextAlign
GetTextMetricsW
ExtTextOutW
GetTextFaceW
GdiFlush
CreateDIBSection
SetWorldTransform
SetGraphicsMode
SelectObject
SelectClipRgn
IntersectClipRect
ExtCreateRegion
DeleteObject
DeleteDC
Rectangle

oleaut32

SysAllocString
SysFreeString

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

ws2_32

ntohs
setsockopt
WSASetLastError
htonl
inet_addr
inet_ntoa
gethostbyaddr
gethostbyname
getservbyport
htons
__WSAFDIsSet
select
recvfrom
sendto
accept
listen
ioctlsocket
gethostname
getsockopt
getsockname
getpeername
recv
connect
bind
socket
closesocket
WSAGetLastError
send
getservbyname
WSAStartup
WSACleanup

usp10

ScriptItemize
ScriptFreeCache
ScriptShape

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 476KB - Virtual size: 475KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 376B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39.5MB - Virtual size: 39.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe7c8e78dbce2b473ba9655dcd4416f9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

psapi

crypt32

gdiplus

imm32

gdi32

oleaut32

userenv

ws2_32

usp10

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 476KB - Virtual size: 475KB

.data Size: 60KB - Virtual size: 157KB

.gfids Size: 512B - Virtual size: 376B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 39.5MB - Virtual size: 39.5MB

.reloc Size: 123KB - Virtual size: 123KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 476KB - Virtual size: 475KB

.data
Size: 60KB - Virtual size: 157KB

.gfids
Size: 512B - Virtual size: 376B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 39.5MB - Virtual size: 39.5MB

.reloc
Size: 123KB - Virtual size: 123KB