dfa5cbf9177f707fcba2ccd7a39dd644d1384ffe1ed8a37984727a8831051fcb

Sharing

Copy URL

Twitter E-mail

General

Target

dfa5cbf9177f707fcba2ccd7a39dd644d1384ffe1ed8a37984727a8831051fcb
Size

13.1MB
MD5

835c77b9255aebc1110432d5782e0342
SHA1

f61bee300d425e6f117ff88bf1e30bcc2cc3cd8c
SHA256

dfa5cbf9177f707fcba2ccd7a39dd644d1384ffe1ed8a37984727a8831051fcb
SHA512

473e48389b0273046173814deed5512b500b4a344343e2100fad8178049e7949b256e870d1327af57038fdff434872f41df91031b6570e59ebe21f3ca8b123d2
SSDEEP

393216:eK50i+R1O8wdEOFuWCNrNwu2jj6o81x2am4UYPJ:h5eT9wdEOFUNrKuxo04amlU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dfa5cbf9177f707fcba2ccd7a39dd644d1384ffe1ed8a37984727a8831051fcb

Files

dfa5cbf9177f707fcba2ccd7a39dd644d1384ffe1ed8a37984727a8831051fcb
.exe windows:5 windows x86 arch:x86

2917abf66e5bb1ee3739f90ae30350dc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeLibraryAndExitThread
ExitThread
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
ExpandEnvironmentStringsW
PeekNamedPipe
WaitForMultipleObjects
GetCurrentDirectoryW
SleepEx
lstrlenA
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
GetFileSizeEx
GetFileInformationByHandle
InterlockedCompareExchange
GetSystemDirectoryA
WriteFile
SizeofResource
LoadResource
LockResource
WideCharToMultiByte
SetCurrentDirectoryW
OutputDebugStringA
MulDiv
GetModuleHandleW
FindResourceW
GetCurrentProcessId
InterlockedDecrement
InterlockedIncrement
WritePrivateProfileStringW
ReadFile
GetFileSize
CreateEventW
WaitForSingleObject
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetExitCodeThread
TerminateThread
CreateThread
QueryDosDeviceW
GetWindowsDirectoryW
GetLogicalDriveStringsW
lstrcmpiW
LoadLibraryA
lstrlenW
SetLastError
GetProcessHeap
HeapFree
HeapAlloc
VirtualFree
VirtualAlloc
GetTempPathW
GlobalAlloc
GlobalLock
GlobalUnlock
GetLastError
MultiByteToWideChar
FindFirstFileA
FindNextFileA
ExpandEnvironmentStringsA
FindClose
CreateFileA
MoveFileExW
VerSetConditionMask
CopyFileW
VerifyVersionInfoW
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetPrivateProfileStringW
GlobalFree
GetExitCodeProcess
CreateProcessW
DecodePointer
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
InitializeCriticalSectionAndSpinCount
GetSystemInfo
FormatMessageW
GetVolumeInformationW
GetTickCount
GetLongPathNameW
lstrcpyW
FindFirstFileW
FindNextFileW
CreateDirectoryW
FileTimeToSystemTime
ReleaseMutex
CreateMutexW
AreFileApisANSI
SetPriorityClass
FlushInstructionCache
HeapCreate
FreeResource
GetFullPathNameW
GetLocalTime
GetVersionExA
GetSystemTime
GetModuleHandleA
EncodePointer
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
GetFileType
GetModuleHandleExW
WriteConsoleW
ExitProcess
GetACP
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
FlushFileBuffers
SetEndOfFile
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetVersionExW
DeleteFileW
CreateFileW
GetSystemDirectoryW
OutputDebugStringW
GetModuleFileNameW
LoadLibraryW
CloseHandle
DeviceIoControl
Sleep
GetCurrentProcess
OpenProcess
LocalFree
LocalAlloc
GetProcAddress
FreeLibrary

user32

InvalidateRect
GetCursorPos
ScreenToClient
GetClassNameW
DestroyIcon
LoadBitmapW
CreateIconFromResource
LoadImageW
CharNextW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
ClientToScreen
SetRect
EnableMenuItem
GetSysColor
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetSystemMetrics
IsWindowVisible
DrawTextW
SystemParametersInfoA
CharLowerBuffW
MapVirtualKeyA
UpdateLayeredWindow
IsMenu
IsWindowEnabled
CreatePopupMenu
DestroyMenu
GetMenuItemCount
AppendMenuW
EndPaint
GetMenuInfo
SetMenuInfo
GetMenuItemInfoW
SetMenuContextHelpId
SetTimer
DestroyWindow
DestroyCursor
LoadCursorW
IntersectRect
GetKeyState
UnregisterClassW
LoadStringW
GetIconInfo
DrawIconEx
OffsetRect
InflateRect
ReleaseDC
GetDC
BeginPaint
UpdateWindow
ReleaseCapture
SetCapture
GetCapture
IsZoomed
IsIconic
SetLayeredWindowAttributes
wsprintfW
SendMessageW
ShowWindow
SetWindowPos
SetWindowTextW
IsWindow
SetForegroundWindow
FindWindowW
KillTimer
AnimateWindow
PostQuitMessage
PostMessageW
TrackMouseEvent
GetMonitorInfoW
SystemParametersInfoW
MonitorFromWindow
GetWindow
GetParent
SetWindowLongW
MapWindowPoints
GetWindowRect
GetClientRect
GetActiveWindow
GetDlgItem
CreateWindowExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
GetWindowLongW
GetFocus
SetFocus
PtInRect
EqualRect
IsRectEmpty
UnionRect
CopyRect
SetCursor
TrackPopupMenu

advapi32

OpenServiceW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegCloseKey
CreateProcessAsUserW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
ImpersonateLoggedOnUser
RevertToSelf
RegOpenKeyW
RegEnumKeyW
DuplicateTokenEx
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetTokenInformation
RegQueryValueExA
RegDeleteValueW
CreateServiceW
CloseServiceHandle
OpenSCManagerW
RegFlushKey
StartServiceW
DeleteService
RegSetValueExW

shell32

SHGetFolderPathW
SHBrowseForFolderW
ShellExecuteW
SHChangeNotify
SHGetSpecialFolderPathW
SHGetSpecialFolderLocation
SHGetPathFromIDListW

ole32

CoCreateGuid
CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
CreateStreamOnHGlobal
OleLockRunning
CLSIDFromString
CLSIDFromProgID
CreateBindCtx

shlwapi

SHDeleteKeyW
SHGetValueW
SHSetValueW
StrToIntExW
SHDeleteValueW
PathFileExistsW

psapi

GetModuleFileNameExW
GetProcessImageFileNameW
EnumProcessModules
EnumProcesses

crypt32

CryptMsgClose
CryptMsgGetParam
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject

gdiplus

GdipDisposeImage
GdipGetImageGraphicsContext
GdipFree
GdipAlloc
GdipCloneImage
GdipCreateBitmapFromFile
GdiplusStartup
GdiplusShutdown
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipDrawImageI
GdipSaveImageToFile
GdipGraphicsClear
GdipDrawImageRectI

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

imm32

ImmAssociateContext
ImmGetContext
ImmDestroyContext
ImmCreateContext
ImmReleaseContext

gdi32

CreateSolidBrush
CreatePen
CreateFontIndirectW
GetDeviceCaps
CreateBitmap
EnumFontsW
BitBlt
GetViewportOrgEx
GetCurrentObject
SetViewportOrgEx
GetStockObject
Rectangle
SetBkMode
SetTextColor
StretchBlt
EnumFontFamiliesExW
GetCharABCWidthsW
GetFontData
GetGlyphOutlineW
GetOutlineTextMetricsW
GetObjectW
GdiFlush
GetTextFaceW
ExtTextOutW
GetTextMetricsW
SetTextAlign
RemoveFontMemResourceEx
AddFontMemResourceEx
GetTextExtentPointI
GetGlyphIndicesW
GetFontUnicodeRanges
CreateDIBSection
SetWorldTransform
SetGraphicsMode
SelectObject
SelectClipRgn
IntersectClipRect
ExtCreateRegion
DeleteObject
DeleteDC
CreateCompatibleDC

oleaut32

SysAllocString
SysFreeString

iphlpapi

GetAdaptersInfo

ws2_32

closesocket
socket
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSAStartup
htonl
inet_addr
WSAGetLastError
gethostbyaddr
gethostbyname
getservbyport
getservbyname
__WSAFDIsSet
select
recvfrom
sendto
accept
listen
ioctlsocket
gethostname
send
recv
inet_ntoa
WSACleanup
WSASetLastError

usp10

ScriptFreeCache
ScriptItemize
ScriptShape

Exports

Exports

AddProtectFile
AddProtectReg
AddTrustProcess
ClearProtectFile
ClearProtectReg
ClearTrustProcess
SHDeleteSelfProtectService
SHGetDumpPath
SHStartSelfProtectService

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 497KB - Virtual size: 497KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 464B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 89.3MB - Virtual size: 89.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2917abf66e5bb1ee3739f90ae30350dc

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

psapi

crypt32

gdiplus

userenv

imm32

gdi32

oleaut32

iphlpapi

ws2_32

usp10

Exports

Exports

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 497KB - Virtual size: 497KB

.data Size: 60KB - Virtual size: 158KB

.gfids Size: 512B - Virtual size: 464B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 89.3MB - Virtual size: 89.3MB

.reloc Size: 128KB - Virtual size: 127KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 497KB - Virtual size: 497KB

.data
Size: 60KB - Virtual size: 158KB

.gfids
Size: 512B - Virtual size: 464B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 89.3MB - Virtual size: 89.3MB

.reloc
Size: 128KB - Virtual size: 127KB