3161e4c5c7a66a25b1d578ac016fb285558dd3b031d39f49a0f10a778fcf6cb9

Sharing

Copy URL

Twitter E-mail

General

Target

3161e4c5c7a66a25b1d578ac016fb285558dd3b031d39f49a0f10a778fcf6cb9
Size

5.7MB
MD5

4e6e5accf00fe5345f55bff9d7a41357
SHA1

09605fcc61b72d07ba3c9cdb8615e0e6f7244628
SHA256

3161e4c5c7a66a25b1d578ac016fb285558dd3b031d39f49a0f10a778fcf6cb9
SHA512

7279edbc85726b1a4628588c78648fd051bf31aba42a540cea9fcaa22ed29adff66f1d17aa0a33960ef7c83230396826d11659a580da893a79817d75add71c83
SSDEEP

98304:UZgSCwBpZGLTA7ketohe4mAo+H3DXCKv5HG9R2lJvBBOIGAUjUig3zIWhex:4gdwBpg8khVmA737Ci50YlhatQ3Ep

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3161e4c5c7a66a25b1d578ac016fb285558dd3b031d39f49a0f10a778fcf6cb9

Files

3161e4c5c7a66a25b1d578ac016fb285558dd3b031d39f49a0f10a778fcf6cb9
.exe windows:5 windows x86 arch:x86

775659a019925b5736abd597488e1e1a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32FirstW
CreateToolhelp32Snapshot
QueryDosDeviceW
GetLogicalDriveStringsW
GetCurrentProcessId
OpenProcess
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetDiskFreeSpaceExW
GetTempPathW
WriteFile
LockResource
MultiByteToWideChar
FindResourceW
GetModuleHandleW
LoadLibraryExW
LoadLibraryW
lstrcmpiW
Process32NextW
LoadResource
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
GetProcAddress
FreeLibrary
InterlockedDecrement
InterlockedIncrement
DecodePointer
WritePrivateProfileStringW
GetModuleFileNameW
lstrlenW
CreateEventW
WaitForSingleObject
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetExitCodeThread
TerminateThread
CreateThread
WideCharToMultiByte
CreateEventA
ReleaseSemaphore
SetThreadPriority
SizeofResource
ReadFile
GetFileSize
SetEndOfFile
GetFullPathNameW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
FlushFileBuffers
GetTimeZoneInformation
GetConsoleMode
DeleteFileW
CreateFileW
RemoveDirectoryW
GetSystemDirectoryW
GetPrivateProfileStringW
CloseHandle
DeviceIoControl
Sleep
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
SetFilePointerEx
FreeLibraryAndExitThread
ExitThread
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
WriteConsoleW
GetModuleHandleExW
RtlUnwind
ExpandEnvironmentStringsW
PeekNamedPipe
GetStdHandle
GetFileType
WaitForMultipleObjects
GetSystemDirectoryA
LoadLibraryA
SleepEx
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
ResetEvent
UnhandledExceptionFilter
IsProcessorFeaturePresent
FindClose
CreateDirectoryW
FindFirstFileW
FindNextFileW
MoveFileExW
CopyFileW
GetWindowsDirectoryW
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
GetVolumeInformationW
GetTickCount
GetCurrentProcess
GetCurrentThreadId
GetSystemInfo
FormatMessageW
GetVersionExW
GetLongPathNameW
lstrcpyW
FileTimeToSystemTime
GlobalAlloc
GlobalFree
TerminateProcess
GetExitCodeProcess
CreateProcessW
ReleaseMutex
CreateMutexW
GetFileAttributesW
AreFileApisANSI
SetUnhandledExceptionFilter
SetErrorMode
GetLocalTime
GetCommandLineW
OutputDebugStringA
SetPriorityClass
GetACP
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
SetFilePointer
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
FreeResource
ExitProcess
MulDiv
VerSetConditionMask
VerifyVersionInfoW
lstrcpynW
QueryPerformanceCounter
EncodePointer
SetLastError
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
FindFirstFileA
FindNextFileA
ExpandEnvironmentStringsA
OutputDebugStringW
CreateFileA
CreateSemaphoreA

user32

SetRectEmpty
CharNextW
SetForegroundWindow
IsWindow
SetWindowLongW
GetWindowLongW
InvalidateRect
SetTimer
SetWindowPos
ShowWindow
MessageBoxA
MapVirtualKeyExW
GetKeyNameTextW
IsRectEmpty
PostQuitMessage
PostMessageW
FindWindowW
wsprintfW
LoadStringW
GetKeyState
SetCursor
InflateRect
UnionRect
OffsetRect
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
CreateWindowExW
DestroyWindow
IsWindowVisible
IsIconic
IsZoomed
SetFocus
GetActiveWindow
GetFocus
SetCapture
ReleaseCapture
KillTimer
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
GetClientRect
GetWindowRect
GetCursorPos
ScreenToClient
MapWindowPoints
GetSysColor
IntersectRect
PtInRect
GetParent
GetWindow
LoadImageW
MonitorFromWindow
GetMonitorInfoW
CharPrevW
DrawTextW
FillRect
SetRect
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
UpdateWindow
SetWindowRgn
MessageBoxW
UpdateLayeredWindow
MoveWindow
IsWindowEnabled
GetWindowRgn
CreatePopupMenu
DestroyMenu
EnableMenuItem
AppendMenuW
TrackPopupMenu
CreateCaret
GetCaretBlinkTime
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
EqualRect
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
wsprintfA
DrawTextA
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
GetKeyboardLayout

advapi32

RegEnumKeyExW
CreateServiceW
CloseServiceHandle
OpenSCManagerW
RegFlushKey
DeleteService
StartServiceW
OpenServiceW
DuplicateTokenEx
RevertToSelf
ImpersonateLoggedOnUser
OpenProcessToken
GetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryInfoKeyW
RegQueryValueExA
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyW
RegEnumKeyW
RegCloseKey
LookupAccountSidW

shell32

SHGetFolderPathW
ShellExecuteW
DragQueryFileW
SHBrowseForFolderW
SHGetSpecialFolderPathW
SHGetPathFromIDListW

ole32

OleDuplicateData
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
OleLockRunning
ReleaseStgMedium
DoDragDrop
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoInitialize
CoUninitialize

oleaut32

VarUI4FromStr
SysFreeString
VariantClear
VariantInit
SysAllocString

iphlpapi

GetAdaptersInfo

comctl32

_TrackMouseEvent
InitCommonControlsEx
ord17

gdiplus

GdipAddPathLine
GdipDeletePath
GdipCreatePath
GdiplusShutdown
GdiplusStartup
GdipDrawImageRectI
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
ord1
GdipCloneImage
GdipDeleteBrush
GdipAlloc
GdipCreateSolidFill
GdipCreatePen1
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipSetStringFormatTrimming
GdipDisposeImage
GdipDeletePen
GdipSetPenMode
GdipLoadImageFromStream
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipDrawRectangleI
GdipDrawPath
GdipFillRectangleI
GdipFillPath
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipFree

imm32

ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext

shlwapi

PathFileExistsW

urlmon

URLDownloadToFileW

psapi

GetModuleFileNameExW
EnumProcessModules
GetProcessImageFileNameW

crypt32

CryptMsgClose
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CertCloseStore
CryptMsgGetParam

ws2_32

sendto
recvfrom
select
__WSAFDIsSet
getservbyname
getservbyport
gethostbyaddr
inet_ntoa
inet_addr
htonl
WSASetLastError
listen
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
socket
closesocket
WSAGetLastError
send
recv
WSACleanup
WSAStartup
gethostname
ioctlsocket
gethostbyname
accept
setsockopt

gdi32

SetBkColor
SetBkMode
StretchBlt
ExtSelectClipRgn
SetStretchBltMode
SetTextColor
CreateDIBSection
GetObjectA
MoveToEx
SelectClipRgn
RectVisible
LineTo
GetTextExtentPoint32W
GetClipBox
GetCharABCWidthsW
CreateSolidBrush
CreateRoundRectRgn
CreateRectRgnIndirect
CreatePenIndirect
CreateBitmap
CombineRgn
SetWindowOrgEx
GetObjectW
GetTextMetricsW
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateEnhMetaFileW
CloseEnhMetaFile
SelectObject
SaveDC
RestoreDC
Rectangle
RemoveFontMemResourceEx
AddFontMemResourceEx
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateDIBitmap
TextOutW
SetBitmapBits
GetBitmapBits
GetTextExtentPointA
GdiFlush
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
StretchDIBits
CreatePatternBrush
PtInRegion
CreateRectRgn

Exports

Exports

AddInjectPreventDll
AddProtectFile
AddProtectProcess
AddProtectReg
AddTrustProcess
ClearInjectPreventDll
ClearProtectFile
ClearProtectProcess
ClearProtectReg
ClearTrustProcess
DeleteInjectPreventDll
DeleteProtectFile
DeleteProtectProcess
DeleteProtectReg
DeleteTrustProcess
GetAndShowProtectFileOperate
GetInjectPreventDllList
GetProcessInformation
GetProtectFileList
GetProtectProcessList
GetProtectRegList
GetTrustProcessList
SHDeleteFile
SHDeleteSelfProtectService
SHGetDumpPath
SHRegDeleteKey
SHRegDeleteValueKey
SHRegSetValueKey
SHStartSelfProtectService
SHTerminateProcessById
StartCreateProcessCallBack
StartLoadImageCallBack
StartMiniFilter
StartObjectCallBack
StartRegCallBack
StopCreateProcessCallBack
StopLoadImageCallBack
StopMiniFilter
StopObjectCallBack
StopRegCallBack

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 222KB - Virtual size: 221KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13.6MB - Virtual size: 13.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

775659a019925b5736abd597488e1e1a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

iphlpapi

comctl32

gdiplus

imm32

shlwapi

urlmon

psapi

crypt32

ws2_32

gdi32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 222KB - Virtual size: 221KB

.data Size: 10KB - Virtual size: 28KB

.rsrc Size: 13.6MB - Virtual size: 13.6MB

.reloc Size: 59KB - Virtual size: 59KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 222KB - Virtual size: 221KB

.data
Size: 10KB - Virtual size: 28KB

.rsrc
Size: 13.6MB - Virtual size: 13.6MB

.reloc
Size: 59KB - Virtual size: 59KB