af37e99637295cb98f486a59c0e27efb0321a744b301bd3e2993756ef3a9bce4

Sharing

Copy URL Twitter E-mail

General

Target

af37e99637295cb98f486a59c0e27efb0321a744b301bd3e2993756ef3a9bce4
Size

2.4MB
MD5

2fdff170d485c01c1b94492076b09b09
SHA1

fdc4220819747f66454bf8d291b62a355c82b8e1
SHA256

af37e99637295cb98f486a59c0e27efb0321a744b301bd3e2993756ef3a9bce4
SHA512

6e09550d9ec1c0c9ed16406ff2cf5aa066881fd98f4a329ffbda7ff1ba1711e5c81236e9022cc5dbfa444645da2dc1e666ffacfa921e1d0407b8dd017fec0003
SSDEEP

49152:JIXxl4z6ln/3i6vBZRZGAUp2ojBBWmcRzwWx0ao:JCWGPpvz6FotwK8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af37e99637295cb98f486a59c0e27efb0321a744b301bd3e2993756ef3a9bce4

Files

af37e99637295cb98f486a59c0e27efb0321a744b301bd3e2993756ef3a9bce4
.exe windows:5 windows x86 arch:x86

76b40e3295f07868af3a5430bd4dd49c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

inet_addr
WSACleanup
WSAStartup
gethostname
gethostbyname

winmm

joyGetDevCapsA
joyGetPosEx
mciSendStringA
mixerOpen
mixerGetLineInfoA
mixerGetDevCapsA
waveOutSetVolume
mixerClose
mixerGetLineControlsA
mixerGetControlDetailsA
mixerSetControlDetails
waveOutGetVolume

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

comctl32

ImageList_ReplaceIcon
ord6
ImageList_AddMasked
ImageList_Destroy
ImageList_GetIconSize
ImageList_Create

shlwapi

HashData

crypt32

CryptBinaryToStringA

psapi

GetModuleBaseNameA
GetProcessImageFileNameA
GetModuleFileNameExA

wininet

InternetOpenUrlA
InternetOpenA
InternetCloseHandle
InternetReadFileExA
InternetReadFile

kernel32

OpenThread
WideCharToMultiByte
lstrcmpiA
GetStringTypeExA
CreateThread
SetThreadPriority
GetExitCodeThread
CloseHandle
CreateMutexA
GetLastError
MultiByteToWideChar
FreeLibrary
SystemTimeToFileTime
SetFilePointerEx
ReadFile
SetFilePointer
GlobalSize
lstrcpyA
lstrlenA
lstrcmpA
LocalFileTimeToFileTime
CreateDirectoryA
CreateDirectoryW
IsBadReadPtr
CreateFileW
CreateFileA
WriteFile
SetFileTime
DuplicateHandle
LoadResource
LockResource
SizeofResource
GetCurrentDirectoryA
GetLocalTime
FileTimeToDosDateTime
GetFileInformationByHandle
GetFileSize
lstrlenW
FindClose
FindFirstFileA
FindNextFileA
UnmapViewOfFile
LeaveCriticalSection
MapViewOfFile
SetLastError
FlushInstructionCache
GetTempPathA
HeapAlloc
HeapReAlloc
VirtualAlloc
VirtualFree
GetProcessHeap
HeapCreate
HeapFree
HeapDestroy
GetCommandLineA
WaitForSingleObject
GetThreadLocale
VirtualQuery
GetVersionExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCPInfo
GetACP
GetSystemDirectoryA
GetFullPathNameA
GetShortPathNameA
FileTimeToLocalFileTime
SetEnvironmentVariableA
Beep
MoveFileA
OutputDebugStringA
CreateProcessA
GetFileAttributesA
GetExitCodeProcess
WriteProcessMemory
ReadProcessMemory
GetCurrentProcessId
OpenProcess
TerminateProcess
SetPriorityClass
GetEnvironmentVariableA
GetDateFormatA
GetTimeFormatA
GetDiskFreeSpaceExA
SetVolumeLabelA
DeviceIoControl
GetDriveTypeA
GetVolumeInformationA
GetDiskFreeSpaceA
DeleteFileA
SetFileAttributesA
GetFileSizeEx
GetSystemTime
GetSystemDefaultUILanguage
GetComputerNameA
GetSystemWindowsDirectoryA
TryEnterCriticalSection
QueryDosDeviceA
CompareStringA
GetFullPathNameW
RemoveDirectoryA
CopyFileA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetModuleFileNameW
FormatMessageA
GetPrivateProfileStringA
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
WritePrivateProfileStringA
WritePrivateProfileSectionA
HeapWalk
HeapSize
SetEndOfFile
GetFileType
GetStdHandle
FileTimeToSystemTime
VirtualAllocEx
VirtualFreeEx
EnumResourceNamesA
LoadLibraryExA
RemoveVectoredExceptionHandler
ExitProcess
ExitThread
EnterCriticalSection
GetCurrentThreadId
ResumeThread
SuspendThread
GlobalUnlock
GlobalLock
AddVectoredExceptionHandler
LoadLibraryA
SetErrorMode
InitializeCriticalSection
FindResourceA
VirtualProtect
GetSystemTimeAsFileTime
GetProcessTimes
GetCurrentProcess
CheckRemoteDebuggerPresent
GetCurrentThread
GetProcAddress
GlobalFree
_lclose
_lopen
_lread
GetModuleFileNameA
GlobalAlloc
GetModuleHandleA
SetCurrentDirectoryA
Sleep
InitializeSListHead
GetTickCount
MulDiv
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
CreateFileMappingA
OutputDebugStringW
GetModuleHandleW
GetStartupInfoW

user32

CheckMenuItem
BlockInput
IsWindowVisible
SetWindowTextA
GetIconInfo
SetRect
DrawTextA
AdjustWindowRectEx
SystemParametersInfoA
GetClientRect
GetWindowRect
MoveWindow
EnumChildWindows
SetActiveWindow
SetFocus
SetWindowRgn
SetWindowPos
SetLayeredWindowAttributes
InvalidateRect
EnableWindow
GetWindowTextLengthA
ReleaseDC
IsZoomed
IsIconic
EnumDisplayMonitors
GetMonitorInfoA
RegisterWindowMessageA
GetSysColor
GetSysColorBrush
DrawIconEx
FillRect
DefWindowProcA
SetForegroundWindow
DialogBoxParamA
SendDlgItemMessageA
GetDlgItem
SetWindowTextW
SetDlgItemTextA
MessageBeep
ClientToScreen
GetCursorInfo
GetLastInputInfo
GetSystemMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuStringA
ExitWindowsEx
SetScrollInfo
ScrollWindow
SetMenu
FlashWindow
GetPropA
SetPropA
RemovePropA
MapWindowPoints
RedrawWindow
SetParent
SendMessageW
GetClassInfoExA
DefDlgProcA
GetAncestor
UpdateWindow
GetMessagePos
LoadAcceleratorsA
CallWindowProcA
CheckRadioButton
IntersectRect
ChangeClipboardChain
PtInRect
CreateDialogIndirectParamA
CreateAcceleratorTableA
InsertMenuItemA
SetMenuDefaultItem
RemoveMenu
SetMenuItemInfoA
IsMenu
GetMenuItemInfoA
CreateMenu
CreatePopupMenu
SetMenuInfo
AppendMenuA
DestroyMenu
TrackPopupMenuEx
GetDesktopWindow
CopyImage
CreateIconIndirect
CreateIconFromResourceEx
MessageBoxA
EnumClipboardFormats
GetWindow
BringWindowToTop
GetTopWindow
GetQueueStatus
GetDC
OpenClipboard
GetClipboardData
GetClipboardFormatNameA
CloseClipboard
SetClipboardData
EmptyClipboard
PostMessageA
FindWindowA
EndDialog
DispatchMessageA
TranslateMessage
ShowWindow
CountClipboardFormats
SetWindowLongA
ScreenToClient
IsDialogMessageA
WindowFromPoint
SendMessageA
IsWindowEnabled
GetWindowLongA
GetKeyState
TranslateAcceleratorA
KillTimer
PeekMessageA
GetFocus
GetClassNameA
GetWindowThreadProcessId
GetForegroundWindow
GetMessageA
SetTimer
GetScrollInfo
GetParent
GetDlgCtrlID
CharUpperA
IsClipboardFormatAvailable
EnableMenuItem
GetMenu
CreateWindowExA
RegisterClassExA
LoadCursorA
DestroyAcceleratorTable
DestroyIcon
LoadImageA
GetUpdateRect
SetClipboardViewer
DestroyWindow
IsCharAlphaA
UnregisterClassA
MapVirtualKeyA
MapVirtualKeyExA
VkKeyScanExA
GetGUIThreadInfo
GetWindowTextA
mouse_event
GetSystemMetrics
keybd_event
SetKeyboardState
GetKeyboardState
GetCursorPos
PostMessageW
GetAsyncKeyState
AttachThreadInput
SendInput
UnregisterHotKey
RegisterHotKey
PostQuitMessage
SendMessageTimeoutA
UnhookWindowsHookEx
SetWindowsHookExA
PostThreadMessageA
IsCharAlphaNumericA
IsCharUpperA
IsCharLowerA
ToAsciiEx
GetKeyboardLayout
CallNextHookEx
GetClassLongA
CharLowerA
IsWindow
EnumWindows

gdi32

CreateFontA
CreateSolidBrush
CreateDCA
GetStockObject
SelectObject
GetTextFaceA
GetTextMetricsA
GetObjectA
DeleteDC
CreateEllipticRgn
CreateRoundRectRgn
CreateRectRgn
CreatePolygonRgn
CreateCompatibleDC
GetDIBits
GetSystemPaletteEntries
CreateCompatibleBitmap
BitBlt
GetPixel
SetBkColor
SetTextColor
ExcludeClipRect
GetClipRgn
FillRgn
GetClipBox
GetCharABCWidthsA
SetBkMode
CreatePatternBrush
SetBrushOrgEx
EnumFontFamiliesExA
CreateDIBSection
GdiFlush
GetDeviceCaps
DeleteObject

comdlg32

GetOpenFileNameA
CommDlgExtendedError
GetSaveFileNameA

advapi32

RegOpenKeyExA
RegEnumKeyExA
RegCreateKeyExA
CryptReleaseContext
CryptDestroyKey
CryptDestroyHash
CryptDeriveKey
CryptHashData
CryptCreateHash
CryptAcquireContextA
RegDeleteValueA
RegQueryValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CloseServiceHandle
UnlockServiceDatabase
LockServiceDatabase
OpenSCManagerA
GetUserNameA
RegEnumValueA
RegQueryInfoKeyA
RegConnectRegistryA
RegDeleteKeyA
RegCloseKey
RegSetValueExA

shell32

SHGetMalloc
SHGetDesktopFolder
SHGetFolderPathA
SHGetPathFromIDListA
SHFileOperationA
SHEmptyRecycleBinA
ShellExecuteExA
Shell_NotifyIconA
DragFinish
SHBrowseForFolderA
DragQueryPoint
ExtractIconA
DragQueryFileA

ole32

CoGetObject
StringFromGUID2
CreateStreamOnHGlobal
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitialize
CLSIDFromProgID

oleaut32

SysAllocString
SysFreeString
SafeArrayDestroy
GetActiveObject
SysStringLen
SafeArrayCreate
VariantClear
VariantChangeType
SafeArrayCopy
VariantCopyInd
OleLoadPicture
SafeArrayUnaccessData
SafeArrayGetElemsize
SafeArrayAccessData
SafeArrayUnlock
SafeArrayPtrOfIndex
SafeArrayLock
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound

vcruntime140

_except_handler3
__RTDynamicCast
memmove
_CxxThrowException
__std_exception_destroy
__std_exception_copy
memset
__current_exception_context
__current_exception
_except_handler4_common
_purecall
__std_terminate
__CxxFrameHandler3
memcpy

api-ms-win-crt-convert-l1-1-0

_i64toa
wcstombs
_atoi64
_strtoi64
atof
strtoul
_strtoui64
_ultoa
strtol
strtod
_itoa
atoi
mbstowcs

api-ms-win-crt-multibyte-l1-1-0

_mbscmp
_mbscspn
_mbsicmp
_ismbcdigit
_mbsnbicmp
_mbschr
_mbsnbcpy
_mbsupr
_ismbcspace
_mbctoupper
_mbsnbcmp
_mbsrchr
_mbsstr

api-ms-win-crt-heap-l1-1-0

realloc
malloc
free
_callnewh
_set_new_mode
_expand
_msize

api-ms-win-crt-runtime-l1-1-0

__p___argv
_controlfp_s
terminate
__p___argc
_c_exit
_exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
exit
_register_thread_local_exe_atexit_callback
_cexit
_crt_atexit
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_beginthreadex

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
__p__commode
setvbuf
__acrt_iob_func
fwrite
fclose
fread
ftell
fseek
_set_fmode
fopen

api-ms-win-crt-utility-l1-1-0

bsearch
qsort
rand

api-ms-win-crt-string-l1-1-0

isxdigit
_strdup
isdigit
tolower
_isctype
strncpy
_wcsnicmp
toupper
strncmp

api-ms-win-crt-filesystem-l1-1-0

_splitpath

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

AHKASSIGN
AHKEXECUTELINE
AHKFINDFUNC
AHKFINDLABEL
AHKFUNCTION
AHKGETVAR
AHKISUNICODE
AHKLABEL
AHKPAUSE
AHKPOSTFUNCTION
AhkAssign
AhkExecuteLine
AhkExecuteline
AhkFindFunc
AhkFindLabel
AhkFindfunc
AhkFindlabel
AhkFunction
AhkGetVar
AhkGetvar
AhkIsUnicode
AhkIsunicode
AhkLabel
AhkPause
AhkPostFunction
AhkPostfunction
Ahkassign
AhkexecuteLine
Ahkexecuteline
AhkfindFunc
AhkfindLabel
Ahkfindfunc
Ahkfindlabel
Ahkfunction
AhkgetVar
Ahkgetvar
AhkisUnicode
Ahkisunicode
Ahklabel
Ahkpause
AhkpostFunction
Ahkpostfunction
MinHookDisable
MinHookEnable
ahkAssign
ahkExecuteLine
ahkExecuteline
ahkFindFunc
ahkFindLabel
ahkFindfunc
ahkFindlabel
ahkFunction
ahkGetVar
ahkGetvar
ahkIsUnicode
ahkIsunicode
ahkLabel
ahkPause
ahkPostFunction
ahkPostfunction
ahkassign
ahkexecuteLine
ahkexecuteline
ahkfindFunc
ahkfindLabel
ahkfindfunc
ahkfindlabel
ahkfunction
ahkgetVar
ahkgetvar
ahkisUnicode
ahkisunicode
ahklabel
ahkpause
ahkpostFunction
ahkpostfunction

Sections

.text
Size: 720KB - Virtual size: 720KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

76b40e3295f07868af3a5430bd4dd49c

Headers

File Characteristics

Imports

wsock32

winmm

version

comctl32

shlwapi

crypt32

psapi

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

vcruntime140

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 720KB - Virtual size: 720KB

.rdata Size: 71KB - Virtual size: 70KB

.data Size: 9KB - Virtual size: 153KB

.rsrc Size: 1.7MB - Virtual size: 1.7MB

.text
Size: 720KB - Virtual size: 720KB

.rdata
Size: 71KB - Virtual size: 70KB

.data
Size: 9KB - Virtual size: 153KB

.rsrc
Size: 1.7MB - Virtual size: 1.7MB