97fe129c293d38ff789bcc24a4d560cbe5cd02c5c6b66a094ad7734f124cf19d

Sharing

Copy URL

Twitter E-mail

General

Target

97fe129c293d38ff789bcc24a4d560cbe5cd02c5c6b66a094ad7734f124cf19d
Size

15.5MB
MD5

890b62780942bf21b517cc718f150ef5
SHA1

26570b634230bdbdf4b5b1ab86c447c999f40ffc
SHA256

97fe129c293d38ff789bcc24a4d560cbe5cd02c5c6b66a094ad7734f124cf19d
SHA512

e8f3c7539e3e11eeff4ddbed74340a24db36f2bb9af8113ce8a64ae330e130c6eaf90b335c87e6e4c87986486618315c366d20f340b003c34447b9f396f35b48
SSDEEP

393216:H/YniKCGKywxux2L+s+u5wlgF+uG6tUTM:Hgn1l8uxqqu5wkG6K4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
97fe129c293d38ff789bcc24a4d560cbe5cd02c5c6b66a094ad7734f124cf19d

Files

97fe129c293d38ff789bcc24a4d560cbe5cd02c5c6b66a094ad7734f124cf19d
.exe windows:5 windows x86 arch:x86

0de68a2c93bb1c00ce3825bf27b0db67

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryW
GetVersionExW
FreeLibrary
VirtualAlloc
VirtualFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetCurrentDirectoryW
FreeLibraryAndExitThread
ExitThread
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
DeleteFileW
GetTempPathW
Sleep
WriteFile
SizeofResource
LoadResource
LockResource
SetCurrentDirectoryW
ExpandEnvironmentStringsW
PeekNamedPipe
WaitForMultipleObjects
GetSystemDirectoryA
SleepEx
ResetEvent
lstrlenA
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
GetFileSizeEx
GetFileInformationByHandle
InterlockedCompareExchange
FindResourceW
HeapAlloc
HeapFree
GetProcessHeap
MulDiv
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetModuleHandleW
GetLastError
GetCurrentProcessId
LocalFree
LocalAlloc
WideCharToMultiByte
OutputDebugStringA
InterlockedDecrement
InterlockedIncrement
CreateFileW
WritePrivateProfileStringW
GetModuleFileNameW
ReadFile
GetFileSize
CreateEventW
MultiByteToWideChar
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetPrivateProfileStringW
GlobalFree
GetExitCodeProcess
CreateProcessW
DecodePointer
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
InitializeCriticalSectionAndSpinCount
GetSystemInfo
FormatMessageW
GetSystemDirectoryW
GetVolumeInformationW
GetTickCount
GetLongPathNameW
FindClose
lstrcpyW
FindFirstFileW
FindNextFileW
CreateDirectoryW
GetProcAddress
MoveFileExW
FileTimeToSystemTime
ReleaseMutex
CreateMutexW
AreFileApisANSI
DeviceIoControl
SetPriorityClass
FlushInstructionCache
HeapCreate
FreeResource
GetFullPathNameW
GetLocalTime
GetVersionExA
GetSystemTime
GetModuleHandleA
EncodePointer
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetACP
GetFileType
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
OutputDebugStringW
WaitForSingleObjectEx
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
FlushFileBuffers
WriteConsoleW
SetEndOfFile
WaitForSingleObject
SetLastError
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetExitCodeThread
TerminateThread
CreateThread
QueryDosDeviceW
GetWindowsDirectoryW
GetLogicalDriveStringsW
lstrcmpiW
CloseHandle
OpenProcess
LoadLibraryA
lstrlenW

user32

GetCursorPos
ScreenToClient
GetClassNameW
DestroyIcon
LoadBitmapW
CreateIconFromResource
LoadImageW
CharNextW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
ClientToScreen
SetRect
EnableMenuItem
GetSysColor
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetSystemMetrics
IsWindowVisible
DrawTextW
SystemParametersInfoA
CharLowerBuffW
MapVirtualKeyA
UpdateLayeredWindow
IsMenu
IsWindowEnabled
CreatePopupMenu
DestroyMenu
GetMenuItemCount
AppendMenuW
TrackPopupMenu
GetMenuInfo
SetMenuInfo
GetMenuItemInfoW
SetMenuContextHelpId
MapWindowPoints
InvalidateRect
CreateWindowExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
GetWindowLongW
GetFocus
SetFocus
PtInRect
EqualRect
IsRectEmpty
UnionRect
CopyRect
SetCursor
KillTimer
SetTimer
DestroyWindow
DestroyCursor
LoadCursorW
IntersectRect
GetKeyState
LoadStringW
wsprintfW
UnregisterClassW
GetIconInfo
DrawIconEx
OffsetRect
InflateRect
GetDC
SendMessageW
ShowWindow
SetWindowPos
SetWindowTextW
IsWindow
SetForegroundWindow
FindWindowW
EndPaint
ReleaseDC
BeginPaint
UpdateWindow
ReleaseCapture
SetCapture
GetCapture
IsZoomed
IsIconic
SetLayeredWindowAttributes
AnimateWindow
PostQuitMessage
PostMessageW
TrackMouseEvent
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW
GetWindow
GetParent
GetWindowRect
SetWindowLongW
GetClientRect
GetActiveWindow
GetDlgItem

advapi32

LookupAccountSidW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegOpenKeyW
RegEnumKeyW
ImpersonateLoggedOnUser
RevertToSelf
DuplicateTokenEx
CreateProcessAsUserW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCreateKeyExW
RegSetValueExW
SetTokenInformation
GetTokenInformation
OpenProcessToken
RegQueryValueExW

shell32

SHBrowseForFolderW
SHGetSpecialFolderPathW
ShellExecuteW
SHGetPathFromIDListW
SHGetFolderPathW
SHChangeNotify

ole32

CoInitialize
CoUninitialize
CoCreateInstance
OleInitialize
OleUninitialize
CreateStreamOnHGlobal
OleLockRunning
CLSIDFromString
CLSIDFromProgID
CreateBindCtx
CoCreateGuid

shlwapi

SHDeleteKeyW
SHDeleteValueW
SHGetValueW
SHSetValueW
StrToIntExW
PathFileExistsW

psapi

EnumProcessModules
GetModuleFileNameExW
EnumProcesses
GetProcessImageFileNameW

crypt32

CryptMsgGetParam
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CryptMsgClose

gdiplus

GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipCloneImage
GdipImageGetFrameDimensionsCount
GdipGetPropertyItem
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipGetImageHeight
GdipDisposeImage
GdipImageGetFrameDimensionsList
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectI
GdipGraphicsClear
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDrawImageI
GdipSaveImageToFile
GdipDeleteGraphics

imm32

ImmGetContext
ImmAssociateContext
ImmReleaseContext
ImmDestroyContext
ImmCreateContext

gdi32

ExtTextOutW
GetTextFaceW
GdiFlush
CreateFontIndirectW
GetDeviceCaps
CreateBitmap
EnumFontsW
BitBlt
GetViewportOrgEx
CreateSolidBrush
GetCurrentObject
SetViewportOrgEx
GetObjectW
CreateDIBSection
SetWorldTransform
SetGraphicsMode
SelectObject
SelectClipRgn
IntersectClipRect
GetStockObject
Rectangle
StretchBlt
CreateCompatibleDC
EnumFontFamiliesExW
GetCharABCWidthsW
GetFontData
GetGlyphOutlineW
GetOutlineTextMetricsW
GetFontUnicodeRanges
GetGlyphIndicesW
GetTextExtentPointI
AddFontMemResourceEx
RemoveFontMemResourceEx
SetTextColor
SetTextAlign
ExtCreateRegion
DeleteObject
DeleteDC
SetBkMode
GetTextMetricsW

oleaut32

SysAllocString
SysFreeString

iphlpapi

GetAdaptersInfo

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

ws2_32

connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSASetLastError
htonl
inet_addr
inet_ntoa
gethostbyaddr
gethostbyname
getservbyport
getservbyname
__WSAFDIsSet
select
recvfrom
sendto
accept
listen
bind
gethostname
WSAStartup
WSACleanup
ioctlsocket
recv
send
WSAGetLastError
closesocket
socket

usp10

ScriptItemize
ScriptShape
ScriptFreeCache

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 493KB - Virtual size: 492KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 444B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12.9MB - Virtual size: 12.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0de68a2c93bb1c00ce3825bf27b0db67

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

psapi

crypt32

gdiplus

imm32

gdi32

oleaut32

iphlpapi

userenv

ws2_32

usp10

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 493KB - Virtual size: 492KB

.data Size: 60KB - Virtual size: 162KB

.gfids Size: 512B - Virtual size: 444B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 12.9MB - Virtual size: 12.9MB

.reloc Size: 127KB - Virtual size: 126KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 493KB - Virtual size: 492KB

.data
Size: 60KB - Virtual size: 162KB

.gfids
Size: 512B - Virtual size: 444B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 12.9MB - Virtual size: 12.9MB

.reloc
Size: 127KB - Virtual size: 126KB