c9fbeabde815d137965c2faa90fd43650bfbe83f1c18db3801e51eeef4e81f08[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

c9fbeabde815d137965c2faa90fd43650bfbe83f1c18db3801e51eeef4e81f08.exe
Size

25.8MB
MD5

024fcdaecff76843fa408b8f9ee663b9
SHA1

60f4f6b2cdc658242cebbb63e52ecbf7c3e43755
SHA256

c9fbeabde815d137965c2faa90fd43650bfbe83f1c18db3801e51eeef4e81f08
SHA512

a5234221438d6c0f09dff8548cd94aeab79c77cbc1dc3329754db8a2137d0858e1436fa1f97c4425e32344830320c259443eee8e1579c491d524e6c6dda4007f
SSDEEP

393216:BZVLYyDmovyawIyiaeAxVJOzI6lroveYYbDQYrKFdu9CwJsv6tuftL:BZVLYCmoKawIqeAxVJOzVtoveYYJktL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c9fbeabde815d137965c2faa90fd43650bfbe83f1c18db3801e51eeef4e81f08.exe

Files

c9fbeabde815d137965c2faa90fd43650bfbe83f1c18db3801e51eeef4e81f08.exe
.exe windows:6 windows x86 arch:x86

60ba67d82a5cb6717eebb0312bb6f596

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

uxtheme

IsAppThemed
IsThemeActive
SetWindowTheme
GetThemePropertyOrigin
GetThemeMargins
GetThemeEnumValue
GetThemeInt
GetThemeBool
GetThemeColor
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
GetThemeBackgroundRegion
ord47
CloseThemeData
OpenThemeData

dwmapi

DwmGetWindowAttribute
DwmEnableBlurBehindWindow
DwmSetWindowAttribute

imm32

ImmReleaseContext
ImmAssociateContext
ImmGetContext
ImmGetDefaultIMEWnd
ImmAssociateContextEx
ImmGetCompositionStringW
ImmGetOpenStatus
ImmNotifyIME
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetVirtualKey

oleaut32

VariantInit
SysAllocString
SafeArrayCreateVector
SafeArrayPutElement
SysFreeString
VariantClear

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW
SetupDiOpenDevRegKey
SetupDiOpenDeviceInterfaceW

shlwapi

AssocQueryStringW

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor
GetProcessDpiAwareness
SetProcessDpiAwareness

comdlg32

GetOpenFileNameW
GetSaveFileNameW

d3d9

Direct3DCreate9

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory2

dcomp

DCompositionCreateDevice

gdi32

GetDIBits
GetObjectW
GetBitmapBits
SwapBuffers
GetPixelFormat
CombineRgn
CreateRectRgn
DeleteObject
GetRegionData
DeleteDC
GetStockObject
CreateCompatibleDC
CreateFontIndirectW
EnumFontFamiliesExW
GetFontData
AddFontResourceExW
RemoveFontResourceExW
AddFontMemResourceEx
RemoveFontMemResourceEx
SelectObject
GetTextMetricsW
GetTextFaceW
GetCharABCWidthsW
GetCharABCWidthsFloatW
GetGlyphOutlineW
GetOutlineTextMetricsW
GetTextExtentPoint32W
GetCharWidthI
GetCharABCWidthsI
SetBkMode
SetGraphicsMode
SetTextColor
SetTextAlign
SetWorldTransform
ExtTextOutW
GetDeviceCaps
CreateDIBSection
GdiFlush
BitBlt
ChoosePixelFormat
SetPixelFormat
OffsetRgn
SetLayout
CreateCompatibleBitmap
CreateDCW
CreateBitmap
DescribePixelFormat

dwrite

DWriteCreateFactory

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressSingle
WakeByAddressAll

userenv

GetUserProfileDirectoryW

advapi32

RegEnumValueW
SystemFunction036
OpenProcessToken
AddAccessAllowedAceEx
AddAccessDeniedAceEx
AllocateAndInitializeSid
CopySid
DuplicateToken
FreeSid
GetLengthSid
GetTokenInformation
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
LookupAccountSidW
GetNamedSecurityInfoW
GetSidSubAuthority
GetSidSubAuthorityCount
RegEnumKeyExW
RegQueryInfoKeyW
RegNotifyChangeKeyValue
GetUserNameW
LookupAccountNameW
RegSetValueExW
RegOpenKeyExW
RegFlushKey
RegQueryValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey

authz

AuthzFreeResourceManager
AuthzAccessCheck
AuthzInitializeResourceManager
AuthzFreeContext
AuthzInitializeContextFromToken
AuthzInitializeContextFromSid

kernel32

HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
EncodePointer
SetEnvironmentVariableW
EnumSystemLocalesW
ReadConsoleW
GetConsoleOutputCP
ExitProcess
GetStdHandle
IsValidLocale
LCMapStringW
CompareStringW
HeapReAlloc
HeapFree
GetProcessHeap
WriteConsoleW
GetSystemDirectoryW
GetUserDefaultLocaleName
DecodePointer
LCMapStringEx
GetCommandLineW
GetCurrentProcessId
LocalFree
AllocConsole
FreeConsole
AttachConsole
CompareStringEx
OutputDebugStringW
GetConsoleWindow
GetLastError
CloseHandle
DuplicateHandle
SetEvent
WaitForSingleObject
CreateEventW
Sleep
WaitForMultipleObjects
GetCurrentProcess
SwitchToThread
CreateThread
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
GetThreadPriority
TerminateThread
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemInfo
TerminateProcess
IsProcessorFeaturePresent
GetModuleFileNameW
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTime
GetLocalTime
LocalAlloc
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetACP
CreateFileW
FlushFileBuffers
GetFileType
GetLogicalDrives
ReadFile
SetEndOfFile
SetFilePointerEx
WriteFile
SetErrorMode
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
GetLongPathNameW
RemoveDirectoryW
SetFileTime
GetTempPathW
GetVolumePathNamesForVolumeNameW
DeviceIoControl
CopyFileW
MoveFileW
MoveFileExW
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
GetFileInformationByHandleEx
FreeLibrary
GetModuleHandleExW
GetProcAddress
LoadLibraryW
GetModuleHandleW
ResetEvent
WaitForSingleObjectEx
PeekNamedPipe
GetOverlappedResult
CancelIoEx
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GetCurrencyFormatW
GetUserDefaultLCID
GetUserPreferredUILanguages
GetTimeZoneInformation
GetGeoInfoW
GetUserGeoID
FindFirstFileExW
FindNextFileW
GetCurrentPackageFullName
GetComputerNameExW
GetExitCodeProcess
OpenProcess
K32GetModuleFileNameExW
GetUserDefaultLangID
GetFileSizeEx
WTSGetActiveConsoleSessionId
GlobalAlloc
GlobalSize
GlobalUnlock
GlobalLock
CheckRemoteDebuggerPresent
ExpandEnvironmentStringsW
CreateProcessW
LoadLibraryA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
HeapAlloc
VirtualQuery
VirtualAlloc
VirtualProtect
VirtualFree
DisconnectNamedPipe
WaitNamedPipeW
WaitForMultipleObjectsEx
GlobalFree
GetSystemTimeAsFileTime
GetConsoleMode
SetFileAttributesW
SetStdHandle
FreeLibraryAndExitThread
ExitThread
GetCommandLineA
LoadLibraryExW
SetLastError
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
InitializeCriticalSection
ReleaseMutex
CreateMutexW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
RaiseException

netapi32

NetApiBufferFree
NetShareEnum

ole32

CoCreateGuid
StringFromGUID2
CoTaskMemFree
DoDragDrop
CoInitializeEx
CoUninitialize
CoCreateInstance
OleInitialize
CoIncrementMTAUsage
CoCreateFreeThreadedMarshaler
OleUninitialize
ReleaseStgMedium
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleSetClipboard
OleGetClipboard
OleFlushClipboard
OleIsCurrentClipboard
CoGetMalloc

user32

IsIconic
SetFocus
RegisterTouchWindow
UnregisterTouchWindow
IsTouchWindow
GetCapture
SetCapture
ReleaseCapture
GetSystemMetricsForDpi
GetMenu
GetSystemMenu
EnableMenuItem
GetForegroundWindow
SetForegroundWindow
BeginPaint
EndPaint
GetUpdateRect
SetWindowRgn
SetWindowTextW
GetWindowRect
AdjustWindowRectEx
AdjustWindowRectExForDpi
SetCursor
SetParent
GetWindowThreadProcessId
GetWindow
DestroyCursor
MonitorFromPoint
MonitorFromWindow
GetMonitorInfoW
GetDpiForWindow
GetAncestor
LoadIconW
IsHungAppWindow
SetClipboardViewer
ChangeClipboardChain
AddClipboardFormatListener
RemoveClipboardFormatListener
SetMenu
DrawMenuBar
CreateMenu
CreatePopupMenu
DestroyMenu
InsertMenuW
AppendMenuW
ModifyMenuW
RemoveMenu
TrackPopupMenu
GetMenuItemInfoW
SetMenuItemInfoW
GetDisplayConfigBufferSizes
QueryDisplayConfig
DisplayConfigGetDeviceInfo
EnumDisplayMonitors
SetDisplayAutoRotationPreferences
GetMessageW
SendInput
GetPointerInfo
GetKeyboardLayout
IsWindowEnabled
CreateCaret
DestroyCaret
ShowCaret
SetCaretPos
FindWindowA
GetKeyState
GetKeyboardState
ToAscii
ToUnicode
MapVirtualKeyW
HiliteMenuItem
TrackPopupMenuEx
SetMenuDefaultItem
SetCursorPos
GetCursor
LoadCursorW
CreateCursor
CreateIconIndirect
GetIconInfo
GetCursorInfo
TrackMouseEvent
GetMessageExtraInfo
GetAsyncKeyState
GetTouchInputInfo
CloseTouchInputHandle
GetPointerType
GetPointerFrameTouchInfo
GetPointerFrameTouchInfoHistory
GetPointerPenInfo
GetPointerPenInfoHistory
SkipPointerFrameMessages
GetPointerDeviceRects
ChangeWindowMessageFilterEx
DrawIconEx
SetWindowPlacement
MoveWindow
FlashWindowEx
SetLayeredWindowAttributes
UpdateLayeredWindow
ShowWindow
IsChild
AttachThreadInput
SendMessageW
EnumDisplayDevicesW
GetClipboardFormatNameW
RegisterClipboardFormatW
ChangeWindowMessageFilter
SetProcessDpiAwarenessContext
EnableNonClientDpiScaling
AreDpiAwarenessContextsEqual
GetAwarenessFromDpiAwarenessContext
GetWindowDpiAwarenessContext
GetThreadDpiAwarenessContext
LoadImageW
GetParent
ChildWindowFromPointEx
WindowFromPoint
ScreenToClient
ClientToScreen
GetCursorPos
GetClientRect
InvalidateRect
GetFocus
IsZoomed
GetWindowPlacement
SetWindowPos
RegisterClassExW
GetClassInfoW
UnregisterPowerSettingNotification
RegisterPowerSettingNotification
RegisterWindowMessageW
GetKeyboardLayoutList
UpdateLayeredWindowIndirect
DestroyIcon
GetCaretBlinkTime
MessageBeep
IsWindow
GetDoubleClickTime
GetDesktopWindow
GetSysColor
GetSystemMetrics
ReleaseDC
CharNextExA
SystemParametersInfoW
SystemParametersInfoForDpi
MessageBoxW
SetWindowLongW
GetWindowLongW
KillTimer
SetCoalescableTimer
SetTimer
MsgWaitForMultipleObjectsEx
GetQueueStatus
DestroyWindow
CreateWindowExW
UnregisterClassW
RegisterClassW
IsWindowVisible
DefWindowProcW
PostMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
GetDC

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

winmm

PlaySoundW
timeSetEvent
timeKillEvent

api-ms-win-core-winrt-string-l1-1-0

WindowsPromoteStringBuffer
WindowsDeleteStringBuffer
WindowsPreallocateStringBuffer
WindowsCreateStringReference
WindowsCreateString
WindowsGetStringRawBuffer
WindowsDeleteString

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

shell32

CommandLineToArgvW
SHCreateItemFromParsingName
SHParseDisplayName
ord155
Shell_NotifyIconGetRect
Shell_NotifyIconW
SHBrowseForFolderW
SHGetKnownFolderIDList
SHGetPathFromIDListW
SHGetMalloc
SHCreateItemFromIDList
ShellExecuteW
ord727
SHGetStockIconInfo
SHGetFileInfoW
SHGetKnownFolderPath

iphlpapi

ConvertInterfaceIndexToLuid
ConvertInterfaceLuidToGuid
GetAdaptersAddresses
ConvertInterfaceNameToLuidW
ConvertInterfaceLuidToNameW
ConvertInterfaceLuidToIndex

winhttp

WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetDefaultProxyConfiguration
WinHttpGetProxyForUrl
WinHttpOpen
WinHttpCloseHandle

ws2_32

getsockopt
WSAIoctl
WSAHtonl
WSAConnect
WSAAccept
WSAGetLastError
setsockopt
select
WSANtohl
htons
getsockname
getpeername
closesocket
bind
__WSAFDIsSet
listen
getnameinfo
freeaddrinfo
getaddrinfo
ntohl
htonl
WSACleanup
WSAStartup
WSAAsyncSelect
WSANtohs
WSARecv
WSARecvFrom
WSASend
WSASendTo
WSASocketW

crypt32

CertFindCertificateInStore
CertAddStoreToCollection
CertCloseStore
CertOpenSystemStoreW
CertGetCertificateChain
CertFreeCertificateChain
CertFindChainInStore
PFXImportCertStore
CertDuplicateCertificateContext
CertOpenStore
CertFreeCertificateContext
CertVerifyTimeValidity

secur32

AcceptSecurityContext
DeleteSecurityContext
InitializeSecurityContextW
ApplyControlToken
QueryContextAttributesW
FreeContextBuffer
EncryptMessage
DecryptMessage
AcquireCredentialsHandleW
FreeCredentialsHandle
InitSecurityInterfaceW

bcrypt

BCryptEncrypt
BCryptDecrypt
BCryptDestroyKey
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptGenerateSymmetricKey

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
GetRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

Exports

Exports

qt_qmlDebugClearBuffer
qt_qmlDebugConnectionBlocker
qt_qmlDebugConnectorOpen
qt_qmlDebugDisableService
qt_qmlDebugEnableService
qt_qmlDebugMessageAvailable
qt_qmlDebugMessageBuffer
qt_qmlDebugMessageLength
qt_qmlDebugObjectAvailable
qt_qmlDebugSendDataToService
qt_qmlDebugSetStreamVersion
qt_startup_hook

Sections

.text
Size: 16.6MB - Virtual size: 16.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7.1MB - Virtual size: 7.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.1MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmimed
Size: 332KB - Virtual size: 331KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 674KB - Virtual size: 673KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

60ba67d82a5cb6717eebb0312bb6f596

Headers

DLL Characteristics

File Characteristics

Imports

uxtheme

dwmapi

imm32

oleaut32

setupapi

shlwapi

wtsapi32

api-ms-win-shcore-scaling-l1-1-1

comdlg32

d3d9

d3d11

dxgi

dcomp

gdi32

dwrite

api-ms-win-core-synch-l1-2-0

userenv

advapi32

authz

kernel32

netapi32

ole32

user32

version

winmm

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

shell32

iphlpapi

winhttp

ws2_32

crypt32

secur32

bcrypt

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

Exports

Exports

Sections

.text Size: 16.6MB - Virtual size: 16.6MB

.rdata Size: 7.1MB - Virtual size: 7.1MB

.data Size: 1.1MB - Virtual size: 1.2MB

.qtmimed Size: 332KB - Virtual size: 331KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 674KB - Virtual size: 673KB

.text
Size: 16.6MB - Virtual size: 16.6MB

.rdata
Size: 7.1MB - Virtual size: 7.1MB

.data
Size: 1.1MB - Virtual size: 1.2MB

.qtmimed
Size: 332KB - Virtual size: 331KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 674KB - Virtual size: 673KB