8b0c0979fb0bade047c4b92ca19c1523074b1b232a532d709cdefbfa2dac38a1

Sharing

Copy URL Twitter E-mail

General

Target

8b0c0979fb0bade047c4b92ca19c1523074b1b232a532d709cdefbfa2dac38a1
Size

14.4MB
MD5

e5cedac25f8e58e719b846e7b51a7322
SHA1

0f7319d6a52ec700d548ed4a24b7473f69669cd6
SHA256

8b0c0979fb0bade047c4b92ca19c1523074b1b232a532d709cdefbfa2dac38a1
SHA512

f299599392ff33737942541ca99cc58c290790643fbb7297435cb1caa2e8bc6fb1685a01588baa49d82e3cced581368f693b57449b275a3f6d15a171759176b7
SSDEEP

393216:tcGjIu2BugREOzNkLjvFz/9KAqcgZ+zjSp+xfARK:SGjWFYjthMc1s+i0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8b0c0979fb0bade047c4b92ca19c1523074b1b232a532d709cdefbfa2dac38a1

Files

8b0c0979fb0bade047c4b92ca19c1523074b1b232a532d709cdefbfa2dac38a1
.exe windows:5 windows x86 arch:x86

ca22dd0efaa073db28f18fc199d93c85

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExpandEnvironmentStringsW
PeekNamedPipe
WaitForMultipleObjects
GetSystemDirectoryA
SleepEx
lstrlenA
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
GetFileInformationByHandle
InterlockedCompareExchange
GetCurrentDirectoryW
GlobalUnlock
GlobalLock
DeleteFileW
GetTempPathW
FindResourceW
WriteFile
SizeofResource
LoadResource
LockResource
WideCharToMultiByte
SetCurrentDirectoryW
OutputDebugStringA
MulDiv
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetModuleHandleW
GetLastError
GetDriveTypeW
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
WritePrivateProfileStringW
GetModuleFileNameW
ReadFile
GetFileSize
CreateThread
Sleep
GetCurrentProcess
GlobalFree
GlobalAlloc
CreateFileW
GetSystemDirectoryW
DeviceIoControl
QueryDosDeviceW
GetWindowsDirectoryW
LoadLibraryW
GetLogicalDriveStringsW
lstrlenW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FreeLibraryAndExitThread
GetCurrentProcessId
ExitThread
MultiByteToWideChar
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
FindFirstFileA
FindNextFileA
ExpandEnvironmentStringsA
FindClose
CreateFileA
MoveFileExW
VerSetConditionMask
CopyFileW
VerifyVersionInfoW
WaitForSingleObject
CreateProcessW
DecodePointer
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
GetSystemInfo
FormatMessageW
GetVersionExW
GetPrivateProfileIntW
GetPrivateProfileStringW
FindFirstFileW
FindNextFileW
CreateDirectoryW
RemoveDirectoryW
ReleaseMutex
CreateMutexW
GetFileSizeEx
GetTickCount
AreFileApisANSI
SetErrorMode
GetLocalTime
FlushInstructionCache
HeapCreate
FreeResource
SetLastError
GetFullPathNameW
GetVersionExA
GetSystemTime
LoadLibraryA
GetModuleHandleA
EncodePointer
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetACP
GetFileType
WriteConsoleW
GetStringTypeW
CompareStringW
LCMapStringW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
OutputDebugStringW
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
FlushFileBuffers
SetEndOfFile
lstrcmpiW
CloseHandle
OpenProcess
GetProcAddress
FreeLibrary

user32

PostQuitMessage
AnimateWindow
SetLayeredWindowAttributes
IsIconic
IsZoomed
GetCapture
SetCapture
ReleaseCapture
UpdateWindow
BeginPaint
EndPaint
InvalidateRect
ScreenToClient
GetClassNameW
DestroyIcon
LoadBitmapW
CreateIconFromResource
LoadImageW
CharNextW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
ClientToScreen
SetRect
EnableMenuItem
GetSysColor
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
IsWindowVisible
DrawTextW
SystemParametersInfoA
CharLowerBuffW
MapVirtualKeyA
UpdateLayeredWindow
IsMenu
IsWindowEnabled
UnionRect
DestroyMenu
GetMenuItemCount
GetWindow
AppendMenuW
TrackPopupMenu
PostMessageW
SetMenuInfo
GetMenuItemInfoW
SetMenuContextHelpId
GetIconInfo
DrawIconEx
InflateRect
ReleaseDC
GetDC
CopyRect
SetCursor
KillTimer
SetTimer
DestroyWindow
DestroyCursor
LoadCursorW
IntersectRect
SendMessageW
IsWindow
GetActiveWindow
GetSystemMetrics
GetCursorPos
OffsetRect
GetWindowLongW
SystemParametersInfoW
wsprintfW
ShowWindow
SetWindowPos
SetWindowTextW
SetForegroundWindow
FindWindowW
GetParent
SetWindowLongW
MapWindowPoints
GetWindowRect
GetClientRect
GetDlgItem
CreateWindowExW
RegisterClassExW
CallWindowProcW
TrackMouseEvent
GetMonitorInfoW
GetMenuInfo
MonitorFromWindow
DefWindowProcW
GetKeyState
GetFocus
SetFocus
PtInRect
EqualRect
IsRectEmpty
UnregisterClassW
CreatePopupMenu

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
ImpersonateLoggedOnUser
RevertToSelf
DuplicateTokenEx
CreateProcessAsUserW
LookupAccountSidW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetTokenInformation
GetTokenInformation
OpenProcessToken
RegDeleteValueW
CreateServiceW
CloseServiceHandle
OpenSCManagerW
RegFlushKey
DeleteService
RegQueryValueExA
OpenServiceW
StartServiceW

shell32

SHGetPathFromIDListW
SHGetFolderPathW
ShellExecuteW
SHGetSpecialFolderPathW
SHBrowseForFolderW

ole32

CoCreateGuid
CoUninitialize
CoInitialize
OleLockRunning
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
OleInitialize
OleUninitialize
CreateStreamOnHGlobal
CreateBindCtx

shlwapi

PathFileExistsW
StrToIntExW

psapi

EnumProcessModules
GetModuleFileNameExW
EnumProcesses
GetProcessImageFileNameW

crypt32

CryptQueryObject
CertGetNameStringW
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CryptMsgClose

gdiplus

GdipImageGetFrameDimensionsList
GdipGetImageEncoders
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipDrawImageI
GdipSaveImageToFile
GdipGraphicsClear
GdipGetImageEncodersSize
GdipDrawImageRectI

imm32

ImmAssociateContext
ImmGetContext
ImmDestroyContext
ImmCreateContext
ImmReleaseContext

gdi32

StretchBlt
SetBkMode
Rectangle
GetStockObject
CreateSolidBrush
CreateCompatibleDC
GetDeviceCaps
CreateBitmap
EnumFontsW
BitBlt
GetViewportOrgEx
GetCurrentObject
SetViewportOrgEx
GetObjectW
CreateDIBSection
SetWorldTransform
GdiFlush
GetTextFaceW
ExtTextOutW
GetTextMetricsW
SetTextAlign
SetTextColor
RemoveFontMemResourceEx
AddFontMemResourceEx
GetTextExtentPointI
GetGlyphIndicesW
GetFontUnicodeRanges
GetOutlineTextMetricsW
GetGlyphOutlineW
GetFontData
GetCharABCWidthsW
EnumFontFamiliesExW
SetGraphicsMode
SelectObject
SelectClipRgn
IntersectClipRect
ExtCreateRegion
DeleteObject
DeleteDC
CreateFontIndirectW

oleaut32

SysFreeString
SysAllocString

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

ws2_32

bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSASetLastError
htonl
inet_addr
socket
gethostbyaddr
gethostbyname
getservbyport
getservbyname
__WSAFDIsSet
select
recvfrom
sendto
accept
listen
ioctlsocket
gethostname
closesocket
WSAGetLastError
send
recv
WSACleanup
WSAStartup
inet_ntoa

usp10

ScriptShape
ScriptFreeCache
ScriptItemize

Exports

Exports

AddProtectFile
AddProtectReg
AddTrustProcess
ClearProtectFile
ClearProtectReg
ClearTrustProcess
SHDeleteSelfProtectService
SHGetDumpPath
SHStartSelfProtectService

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 472KB - Virtual size: 471KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 59KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 380B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 53.8MB - Virtual size: 53.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 122KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ca22dd0efaa073db28f18fc199d93c85

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

psapi

crypt32

gdiplus

imm32

gdi32

oleaut32

userenv

ws2_32

usp10

Exports

Exports

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 472KB - Virtual size: 471KB

.data Size: 59KB - Virtual size: 158KB

.gfids Size: 512B - Virtual size: 380B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 53.8MB - Virtual size: 53.8MB

.reloc Size: 122KB - Virtual size: 122KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 472KB - Virtual size: 471KB

.data
Size: 59KB - Virtual size: 158KB

.gfids
Size: 512B - Virtual size: 380B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 53.8MB - Virtual size: 53.8MB

.reloc
Size: 122KB - Virtual size: 122KB