64cae2ded239be65b1dc9e848277040addde54fb7df0d38d48f3895a4fcb6e17

Sharing

Copy URL Twitter E-mail

General

Target

64cae2ded239be65b1dc9e848277040addde54fb7df0d38d48f3895a4fcb6e17
Size

3.6MB
MD5

71e6229189254e784ac5b312d6dd0b92
SHA1

0694a53acef04be86f10cb36e107203a956d5def
SHA256

64cae2ded239be65b1dc9e848277040addde54fb7df0d38d48f3895a4fcb6e17
SHA512

1a058d73b2e171685470c601630f02f0451f3b1964f33319105e1ef33ba427d1407403d0266e2e771bd38ae3400c57fdc0ace5b02c85211dd6ba11ebad206a75
SSDEEP

98304:ZyeKaQk9AXJCYGjnnLlrpO39Gevl7nM9p+N:Y5aF+XZsptgGNS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64cae2ded239be65b1dc9e848277040addde54fb7df0d38d48f3895a4fcb6e17

Files

64cae2ded239be65b1dc9e848277040addde54fb7df0d38d48f3895a4fcb6e17
.exe windows:6 windows x86 arch:x86

449a2abce0409a95c5a90dc25470c8ca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OutputDebugStringW
lstrlenW
lstrcmpiW
lstrcpyW
GetTickCount
FreeLibrary
LoadLibraryW
GetProcAddress
GlobalLock
GlobalAlloc
GlobalUnlock
QueryPerformanceCounter
QueryPerformanceFrequency
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentThreadId
FindResourceW
LoadResource
GetModuleHandleW
SizeofResource
LockResource
GetDriveTypeW
MoveFileExW
SetEnvironmentVariableW
Sleep
CopyFileW
GetSystemWow64DirectoryW
SetCurrentDirectoryW
FormatMessageA
GetModuleFileNameA
LoadLibraryExA
OutputDebugStringA
CreateMutexW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
ReleaseMutex
WaitForMultipleObjects
LocalFree
SetEndOfFile
SetEnvironmentVariableA
WriteConsoleW
SetStdHandle
EnumSystemLocalesEx
IsValidLocaleName
LCMapStringEx
GetUserDefaultLocaleName
CreateThread
EnterCriticalSection
GetTimeFormatEx
GetLocaleInfoEx
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount64
LoadLibraryExW
GetTimeZoneInformation
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreatePipe
GetCurrentProcessId
GetConsoleCP
FlushFileBuffers
GetStartupInfoW
InitOnceExecuteOnce
GetFileType
SetFilePointer
ReadConsoleW
GetConsoleMode
GetStdHandle
HeapSize
SetLastError
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
IsDebuggerPresent
RaiseException
GetCommandLineA
GetModuleHandleExW
ExitProcess
GetSystemTimeAsFileTime
AreFileApisANSI
CreateProcessA
DuplicateHandle
GetTempPathA
RtlUnwind
IsProcessorFeaturePresent
GetFileAttributesExW
HeapReAlloc
DecodePointer
EncodePointer
TlsAlloc
DeleteCriticalSection
CreateEventW
FindClose
GetTempPathW
CreateFileW
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
InterlockedDecrement
InterlockedIncrement
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetLastError
TerminateProcess
GetExitCodeProcess
GetVersionExW
OpenProcess
K32GetModuleFileNameExW
WaitForSingleObject
GetCurrentProcess
SetFileAttributesW
DeleteFileW
CloseHandle
FindNextFileW
GetDateFormatEx
RemoveDirectoryW
ReadFile
GetFileAttributesW
WriteFile
CreateDirectoryW
SetFilePointerEx
FindFirstFileW
MultiByteToWideChar
CompareStringEx
WideCharToMultiByte

user32

MapWindowPoints
GetSystemMetrics
GetActiveWindow
MoveWindow
PtInRect
ExitWindowsEx
MessageBoxW
EndPaint
PostThreadMessageW
DispatchMessageW
TranslateMessage
AnimateWindow
UpdateLayeredWindow
SetWindowRgn
SetCapture
GetFocus
SetFocus
BeginPaint
InvalidateRect
ReleaseCapture
UpdateWindow
GetCaretBlinkTime
IsIconic
TrackMouseEvent
CallNextHookEx
IsWindowEnabled
LoadIconW
EnableWindow
GetTopWindow
GetWindowLongW
SetWindowLongW
SetTimer
KillTimer
GetWindowRect
SetActiveWindow
GetCursorPos
SetWindowsHookExW
UnhookWindowsHookEx
FillRect
DrawTextW
SetCursor
CloseClipboard
GetKeyState
IsClipboardFormatAvailable
LoadCursorW
GetClipboardData
EmptyClipboard
OpenClipboard
SetClipboardData
DestroyWindow
RegisterClassExW
CreateWindowExW
DefWindowProcW
IsWindow
OffsetRect
IntersectRect
SendMessageW
GetClientRect
PeekMessageW
SetWindowPos
ShowWindow
IsWindowVisible
ClientToScreen
GetMessageW
PostQuitMessage
PostMessageW
ScreenToClient

gdi32

CreateRoundRectRgn
SetBkMode
SaveDC
RestoreDC
BitBlt
CreateDIBSection
StretchBlt
GetCharWidth32W
GetClipRgn
SetTextColor
SelectClipRgn
CreateRectRgnIndirect
GetTextMetricsW
DeleteDC
SelectObject
CreateCompatibleDC
CreateSolidBrush
CreateFontIndirectW
DeleteObject
GetObjectW
GetStockObject
CreateRectRgn

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
RegCreateKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetSecurityInfo
GetSecurityDescriptorSacl
RegSetValueExW

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
ShellExecuteW
ShellExecuteExW

ole32

CoCreateInstance
OleUninitialize
OleInitialize
CoInitialize
CoUninitialize
RevokeDragDrop

shlwapi

PathIsDirectoryEmptyW
SHDeleteKeyW

imm32

ImmGetContext
ImmGetDefaultIMEWnd
ImmNotifyIME
ImmReleaseContext

Sections

.text
Size: 514KB - Virtual size: 514KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 417KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data
.rsrc/GROUP_ICON/2
.rsrc/ICON/1.ico
.rsrc/MANIFEST/1
.xml
.rsrc/_6ROOMRESC/111
.rsrc/_6ROOMRESC/113
.rsrc/_6ROOMRESC/114
.rsrc/_6ROOMRESC/115
.rsrc/_6ROOMRESC/116
.rsrc/version.txt
.text

Sharing

General

Malware Config

Signatures

Files

449a2abce0409a95c5a90dc25470c8ca

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

imm32

Sections

.text Size: 514KB - Virtual size: 514KB

.data Size: 12KB - Virtual size: 417KB

.rsrc Size: 3.1MB - Virtual size: 3.1MB

.text
Size: 514KB - Virtual size: 514KB

.data
Size: 12KB - Virtual size: 417KB

.rsrc
Size: 3.1MB - Virtual size: 3.1MB