3c304150da812384c57a3e4bce1b5224ee45935fde05192ae55d97e5ed128741

Sharing

Copy URL Twitter E-mail

General

Target

3c304150da812384c57a3e4bce1b5224ee45935fde05192ae55d97e5ed128741
Size

12.8MB
MD5

613b834a62cced18fca4e37c387c290b
SHA1

fa82524be5b47a02d581ed69c1eb1db86013772a
SHA256

3c304150da812384c57a3e4bce1b5224ee45935fde05192ae55d97e5ed128741
SHA512

fd6c44ff8104ba6355c521cc54ef48f9611f538f53c0710949ae8f6c22722beaa3c23b04fb5c9e9f2aa75978f9faaf03f0aebcc9ce54c78f85a3c306fc394ad7
SSDEEP

393216:TDSlMVq/HPhkxXYM49vI1X2vjAaUGo6RVdiPZES:TDZGPqxCcXyjBdo67YP9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3c304150da812384c57a3e4bce1b5224ee45935fde05192ae55d97e5ed128741

Files

3c304150da812384c57a3e4bce1b5224ee45935fde05192ae55d97e5ed128741
.exe windows:5 windows x86 arch:x86

41b3e3eb6bb804310eb9d0ad64a262ab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForSingleObject
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CreateThread
DecodePointer
CloseHandle
IsBadReadPtr
LoadLibraryA
lstrlenW
GetNativeSystemInfo
HeapReAlloc
HeapSize
RaiseException
Sleep
InitializeCriticalSectionAndSpinCount
SetLastError
GetProcessHeap
HeapFree
HeapAlloc
VirtualProtect
VirtualFree
VirtualAlloc
GetProcAddress
GetSystemDirectoryW
LocalAlloc
LocalFree
OpenProcess
GetCurrentProcessId
GetLogicalDriveStringsW
GetModuleHandleW
QueryDosDeviceW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
WriteFile
lstrcpyW
LoadLibraryW
DeleteFileW
CreateEventW
GetFileSize
ReadFile
GetModuleFileNameW
GetLastError
CreateFileW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
InterlockedIncrement
InterlockedDecrement
LoadResource
GetDiskFreeSpaceExW
lstrcmpW
WinExec
GetTempPathW
LockResource
MultiByteToWideChar
FindResourceW
LoadLibraryExW
lstrcmpiW
SizeofResource
WriteConsoleW
SetEndOfFile
FlushFileBuffers
ReadConsoleW
GetConsoleCP
GetTimeZoneInformation
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStringTypeW
SetConsoleMode
ReadConsoleInputA
GetConsoleMode
SetConsoleCtrlHandler
GetDriveTypeW
SetFilePointerEx
FreeLibraryAndExitThread
ExitThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
GetACP
GetTickCount
GetCurrentDirectoryW
GetVersionExW
FreeResource
ExitProcess
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
MulDiv
GetFileType
SetFilePointer
SetFileTime
DuplicateHandle
SystemTimeToFileTime
DosDateTimeToFileTime
CreateDirectoryW
WideCharToMultiByte
GetLocalTime
GetLongPathNameW
GetFileAttributesW
GetTempFileNameW
CopyFileW
GetExitCodeProcess
FindClose
RemoveDirectoryW
SetFileAttributesW
FindFirstFileW
FindNextFileW
MoveFileExW
ReadProcessMemory
CreateProcessW
FileTimeToSystemTime
GetFileAttributesExW
ReleaseMutex
CreateMutexW
GetVolumeInformationW
GetWindowsDirectoryW
AreFileApisANSI
DeviceIoControl
OutputDebugStringA
SetPriorityClass
VerSetConditionMask
SetErrorMode
SystemTimeToTzSpecificLocalTime
GetVersion
VirtualAllocEx
VirtualFreeEx
WriteProcessMemory
lstrcpynW
GetFileAttributesExA
SleepEx
GetModuleHandleA
GetSystemDirectoryA
QueryPerformanceFrequency
VerifyVersionInfoA
ExpandEnvironmentStringsA
WaitForMultipleObjects
GetStdHandle
PeekNamedPipe
FormatMessageA
GetSystemTime
FlushConsoleInputBuffer
GlobalMemoryStatus
RtlUnwind
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetFullPathNameW
FindFirstFileExW
GetPrivateProfileIntW

user32

SetCursor
InflateRect
OffsetRect
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
DestroyWindow
UpdateLayeredWindow
SetFocus
GetFocus
GetKeyState
SetCapture
ReleaseCapture
KillTimer
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
GetClientRect
GetCursorPos
ScreenToClient
MapWindowPoints
IsRectEmpty
PtInRect
GetParent
GetWindow
wsprintfW
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
MonitorFromWindow
GetMonitorInfoW
IsIconic
IsZoomed
SetWindowRgn
IntersectRect
ShowWindow
DrawTextW
FillRect
SetRect
SetWindowPos
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
GetSysColor
GetDoubleClickTime
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
CreateAcceleratorTableW
InvalidateRgn
GetDesktopWindow
GetWindowThreadProcessId
FindWindowExW
GetClassNameW
GetShellWindow
SystemParametersInfoW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
PostQuitMessage
PostMessageW
SendMessageW
GetWindowLongW
SetWindowLongW
InvalidateRect
LoadIconW
LoadStringW
IsWindow
SetForegroundWindow
FindWindowW
CharNextW
MoveWindow
GetForegroundWindow
GetWindowRect
CharPrevW
SetTimer
CreateCaret

advapi32

CryptDestroyKey
CryptSignHashA
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptReleaseContext
RegCloseKey
RegCreateKeyExW
RevertToSelf
ImpersonateLoggedOnUser
OpenProcessToken
GetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupAccountSidW
DuplicateTokenEx
RegEnumKeyW
RegOpenKeyW
DeregisterEventSource
RegisterEventSourceA
ReportEventA
CryptAcquireContextA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegEnumValueA
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
CryptEnumProvidersA

shell32

SHAppBarMessage
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFolderPathW
ShellExecuteW
ord155
SHGetFolderLocation
SHGetDesktopFolder
SHGetDataFromIDListW
SHGetFileInfoW
SHGetSpecialFolderPathW

ole32

OleLockRunning
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
CoTaskMemRealloc
CoTaskMemAlloc
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemFree

oleaut32

SysFreeString
VariantClear
VarUI4FromStr
VariantInit
SysAllocString

gdiplus

GdipCreateFromHDC
GdiplusShutdown
GdipDrawImageRectI
GdipAlloc
GdipFree
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCloneBrush
GdipDeleteBrush
GdipCreateLineBrushI
GdipSetTextRenderingHint
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipDrawImageRectRectI
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdiplusStartup
GdipDeleteGraphics

shlwapi

StrCpyW
PathFileExistsW
PathAppendW
PathFindFileNameW

psapi

EnumProcessModules
GetModuleFileNameExW
GetProcessImageFileNameW

crypt32

CertFreeCertificateContext
CertGetCertificateContextProperty
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertGetNameStringW
CertFindCertificateInStore
CryptMsgClose
CertOpenStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext

msimg32

AlphaBlend

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wininet

InternetOpenW
InternetCloseHandle
InternetSetOptionW
InternetReadFile
HttpQueryInfoW
InternetOpenUrlW

urlmon

URLDownloadToFileW

comctl32

_TrackMouseEvent
ord17

ws2_32

bind
getservbyname
gethostbyname
htonl
shutdown
getaddrinfo
freeaddrinfo
WSACleanup
gethostname
ioctlsocket
accept
listen
WSAGetLastError
socket
__WSAFDIsSet
select
WSASetLastError
recv
send
closesocket
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSAIoctl
WSAStartup
sendto
recvfrom

wldap32

ord211
ord50
ord41
ord22
ord46
ord217
ord143
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord60

gdi32

BitBlt
CreateCompatibleDC
CreateFontIndirectW
CreatePen
DeleteDC
DeleteObject
GetStockObject
Rectangle
RestoreDC
SaveDC
SelectObject
GetTextMetricsW
CreateDIBSection
GetObjectW
SetWindowOrgEx
CreateRoundRectRgn
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
RoundRect
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
MoveToEx
TextOutW
GetDeviceCaps
GetObjectA
GetDIBits
CreateBitmap
CreateDCW
CreateCompatibleBitmap

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 509KB - Virtual size: 509KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 41.4MB - Virtual size: 41.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

41b3e3eb6bb804310eb9d0ad64a262ab

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

gdiplus

shlwapi

psapi

crypt32

msimg32

version

wininet

urlmon

comctl32

ws2_32

wldap32

gdi32

imm32

iphlpapi

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 509KB - Virtual size: 509KB

.data Size: 50KB - Virtual size: 85KB

.gfids Size: 512B - Virtual size: 436B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 41.4MB - Virtual size: 41.4MB

.reloc Size: 99KB - Virtual size: 98KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 509KB - Virtual size: 509KB

.data
Size: 50KB - Virtual size: 85KB

.gfids
Size: 512B - Virtual size: 436B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 41.4MB - Virtual size: 41.4MB

.reloc
Size: 99KB - Virtual size: 98KB