2970cdf3d4332feaed3a44719715f3d10222481662f1c72f0b332d17e7d7e607

Sharing

Copy URL

Twitter E-mail

General

Target

2970cdf3d4332feaed3a44719715f3d10222481662f1c72f0b332d17e7d7e607
Size

2.4MB
MD5

9f7f1bea9c3f48648af00f88b0a67cf6
SHA1

a91357da12378817d2828f1d479b69b7c40ca185
SHA256

2970cdf3d4332feaed3a44719715f3d10222481662f1c72f0b332d17e7d7e607
SHA512

3ca9c07dff9ae909e58da9ba0de98a6b8a90ec1c5113b43d61c68432b9ff4af10be0d7a6d36b4e0abbcc2618e4538bd3b82ee22271aca3f6a7ca1e4b488e150a
SSDEEP

49152:XtMsUX3ml1jJJ1QZS9gWhsj4vBsrdyIOFjwZi:XtMjEkZS9G4vZBwZi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2970cdf3d4332feaed3a44719715f3d10222481662f1c72f0b332d17e7d7e607

Files

2970cdf3d4332feaed3a44719715f3d10222481662f1c72f0b332d17e7d7e607
.exe windows:5 windows x86 arch:x86

a1a5815f94ebc79d97962e26ef7c196c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\My Projects\OnlineTimer\Output\OnlineTimer.pdb

Imports

ws2_32

recvfrom
inet_addr
__WSAFDIsSet
select
closesocket
sendto
WSAIoctl
gethostbyname
htons
socket
WSACancelAsyncRequest
WSAAsyncGetHostByName
inet_ntoa
WSAGetLastError

rasapi32

RasGetProjectionInfoW
RasGetConnectStatusW
RasEnumEntriesW
RasSetEntryDialParamsW
RasConnectionNotificationW
RasGetEntryDialParamsW
RasGetEntryPropertiesW
RasSetEntryPropertiesW
RasGetErrorStringW
RasDialW
RasHangUpW
RasEditPhonebookEntryW
RasEnumConnectionsW

iphlpapi

GetInterfaceInfo
GetAdaptersInfo
GetIfEntry

shlwapi

UrlUnescapeW
PathStripToRootW
PathRemoveFileSpecW
PathFindExtensionW
PathFileExistsW
SHRegGetUSValueW
StrStrIA
PathFileExistsA
SHAutoComplete
PathIsDirectoryW
PathAddBackslashW
PathIsUNCW
StrStrIW
PathIsRootW
PathFindFileNameW

winmm

PlaySoundW

kernel32

GetFullPathNameW
GetModuleHandleA
GetVersionExA
lstrcmpW
LoadLibraryA
CompareStringW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
SetThreadPriority
InterlockedExchange
CompareStringA
lstrcmpA
EnumResourceLanguagesW
ConvertDefaultLocale
GetCurrentThread
GlobalGetAtomNameW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
TlsGetValue
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
SetErrorMode
GetFileSizeEx
GlobalFlags
GetStartupInfoW
GetTimeZoneInformation
GetSystemTimeAsFileTime
ExitProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
RtlUnwind
RaiseException
HeapReAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
ExitThread
HeapSize
SetStdHandle
GetFileType
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringW
GetTimeFormatA
GetDateFormatA
InitializeCriticalSectionAndSpinCount
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
LCMapStringA
GetConsoleCP
GetConsoleMode
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
GetVolumeInformationW
GetTimeFormatW
GetVersionExW
GetCurrentThreadId
GetCurrentProcessId
GetTempPathW
GetTempFileNameW
GetFileTime
GetFileAttributesW
CreateDirectoryW
GetLocaleInfoW
GetPrivateProfileIntW
InterlockedDecrement
CreateFileA
FlushFileBuffers
FormatMessageW
GetModuleHandleW
GetDriveTypeW
OutputDebugStringA
FileTimeToSystemTime
FileTimeToLocalFileTime
TerminateThread
ReleaseSemaphore
CreateSemaphoreW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
FreeResource
GetComputerNameW
ResumeThread
SuspendThread
SetCurrentDirectoryW
GetCurrentDirectoryW
CopyFileW
GetThreadLocale
GetWindowsDirectoryW
GetModuleFileNameW
MoveFileW
DeleteFileW
SetEndOfFile
SetFilePointer
HeapFree
GetProcessHeap
HeapAlloc
WaitForSingleObject
CreateThread
OpenEventW
GetExitCodeThread
GetPrivateProfileStringW
CreateEventW
ResetEvent
SetEvent
WritePrivateProfileStringW
GetACP
GetPrivateProfileStringA
WritePrivateProfileStringA
GetCurrentProcess
CheckRemoteDebuggerPresent
LocalFree
FindResourceW
LoadResource
LockResource
SizeofResource
DeviceIoControl
GetProcAddress
LoadLibraryW
FreeLibrary
Sleep
lstrlenA
SetLastError
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
GetLastError
FindClose
FindNextFileW
FindFirstFileW
LocalAlloc
GetLocalTime
WriteFile
ReadFile
CloseHandle
GetFileSize
CreateFileW
GetTickCount
MulDiv
DuplicateHandle
UnlockFile
GetDateFormatW
LockFile
lstrcpynW
GlobalReAlloc

user32

CallWindowProcW
GetMenu
SystemParametersInfoA
SetDlgItemTextW
SendDlgItemMessageW
GetWindowTextLengthW
EndPaint
BeginPaint
GetLastActivePopup
CharUpperW
GetMenuState
GetMenuItemID
GetSubMenu
GetWindowPlacement
SetMenuItemInfoW
AdjustWindowRect
SetScrollInfo
SetScrollPos
GetScrollPos
GetScrollInfo
ShowCursor
IntersectRect
GetComboBoxInfo
PostQuitMessage
GetIconInfo
GetMessageW
IsDialogMessageW
GetMenuItemCount
GetMenuItemInfoW
GetMenuStringW
LoadMenuW
VkKeyScanW
SetCursor
keybd_event
GetWindowDC
DrawFocusRect
GetNextDlgGroupItem
GetDoubleClickTime
IsWindowEnabled
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
EndDialog
GetAsyncKeyState
GetNextDlgTabItem
MapWindowPoints
IsZoomed
LoadImageW
LoadStringW
GetMonitorInfoW
MonitorFromWindow
MonitorFromPoint
LockSetForegroundWindow
AllowSetForegroundWindow
SetFocus
AttachThreadInput
GetForegroundWindow
GetGUIThreadInfo
ScreenToClient
WaitForInputIdle
GetDlgCtrlID
DispatchMessageW
PeekMessageW
DestroyWindow
CreateWindowExW
RegisterClassExW
WindowFromPoint
UpdateLayeredWindow
GetCapture
SetWindowRgn
GetKeyState
TrackMouseEvent
ClientToScreen
ReleaseCapture
SetCapture
GetParent
BringWindowToTop
GetClassNameW
GetWindow
ExitWindowsEx
GetWindowThreadProcessId
LockWindowUpdate
GetClipboardData
IsClipboardFormatAvailable
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
PtInRect
SetRectEmpty
GetCursorPos
SetForegroundWindow
DrawIcon
IsIconic
ModifyMenuW
InsertMenuW
AppendMenuW
GetSystemMenu
LoadCursorW
DefWindowProcW
GetSysColor
RegisterWindowMessageW
SendMessageTimeoutW
GetDlgItem
ShowWindow
MoveWindow
SetWindowLongW
GetWindowLongW
SetWindowTextW
GetWindowTextW
UpdateWindow
MessageBoxW
FillRect
RegisterWindowMessageA
PostMessageW
DrawFrameControl
GetSystemMetrics
GetFocus
ReleaseDC
GetDC
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
LoadBitmapW
IsWindowVisible
SetTimer
SetWindowPos
GetClassLongW
MessageBeep
InvalidateRgn
CopyAcceleratorTableW
SetRect
IsRectEmpty
CharNextW
PostThreadMessageW
UnregisterClassW
GetSysColorBrush
UnpackDDElParam
ReuseDDElParam
LoadAcceleratorsW
InsertMenuItemW
CreatePopupMenu
TranslateAcceleratorW
DestroyMenu
ValidateRect
SetWindowContextHelpId
MapDialogRect
SetClassLongW
OffsetRect
IsWindow
KillTimer
SystemParametersInfoW
DrawIconEx
LoadIconW
GetDesktopWindow
InvalidateRect
CopyRect
GetClientRect
GetWindowRect
SendMessageW
EnableWindow
RegisterClipboardFormatW
ShowOwnedPopups
InflateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
EnableMenuItem
CheckMenuItem
SendDlgItemMessageA
WinHelpW
IsChild
SetWindowsHookExW
CallNextHookEx
SetPropW
GetPropW
RemovePropW
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
TrackPopupMenu
SetMenu
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
TranslateMessage
DeferWindowPos
DrawAnimatedRects

gdi32

GetDIBits
CreateRectRgn
GdiFlush
SetBrushOrgEx
LineTo
MoveToEx
RoundRect
SelectPalette
SetStretchBltMode
OffsetRgn
SetMapMode
GetClipBox
SetTextCharacterExtra
GetViewportExtEx
GetWindowExtEx
SetViewportOrgEx
OffsetViewportOrgEx
CombineRgn
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
CreateRectRgnIndirect
GetMapMode
GetTextColor
GetRgnBox
SaveDC
RestoreDC
GetPixel
SetROP2
SetDIBits
CreateRoundRectRgn
GetDeviceCaps
ExtCreatePen
CreateFontIndirectW
GetTextMetricsW
CreateDIBSection
StretchBlt
CreateSolidBrush
Rectangle
DeleteDC
DeleteObject
SetTextColor
SetBkColor
CreateBitmap
GetCharABCWidthsW
CreateCompatibleBitmap
EnumFontFamiliesExW
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
BitBlt
CreateCompatibleDC
GetObjectW
CreatePen
GetStockObject
SetViewportExtEx
SelectObject
IntersectClipRect
CreatePatternBrush
GetTextExtentPointW
ExcludeClipRect
RealizePalette
GetDIBColorTable
SetDIBColorTable
LPtoDP
DPtoLP
SetDCPenColor
GetBkColor
GetTextExtentPoint32W
Ellipse
SetBkMode
GetCharWidthW

msimg32

AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegQueryValueW
RegDeleteKeyW
RegOpenKeyW
GetTokenInformation
InitializeAcl
AddAccessDeniedAce
AddAccessAllowedAce
SetSecurityInfo
RegSetValueExW
IsTextUnicode
RegSetValueW
RegEnumKeyW
RegQueryValueExA
RegOpenKeyExA
CheckTokenMembership
RegCreateKeyExW
FreeSid
OpenProcessToken
SetNamedSecurityInfoW
SetEntriesInAclW
CreateWellKnownSid
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueW
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW

shell32

SHFileOperationW
SHGetSpecialFolderPathW
ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
Shell_NotifyIconW
DragFinish
DragQueryFileW
SHCreateDirectoryExW

oledlg

OleUIBusyW

ole32

CoCreateInstance
IIDFromString
StringFromGUID2
CoSetProxyBlanket
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateGuid
CoTaskMemAlloc
CoInitializeEx
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal

oleaut32

OleCreateFontIndirect
VariantCopy
SysStringLen
SysFreeString
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayDestroy
SafeArrayGetElement
VariantClear
VariantInit
VariantChangeType
SysAllocStringLen
VariantTimeToSystemTime
SystemTimeToVariantTime
VarBstrFromDate
SysAllocString
SysStringByteLen
SysAllocStringByteLen
VarBstrFromBool
VarUdateFromDate
GetErrorInfo

rasdlg

RasEntryDlgW

setupapi

SetupDiEnumDeviceInfo
SetupDiOpenDevRegKey
SetupDiSetClassInstallParamsW
SetupDiChangeState
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList

wsock32

WSASetLastError
WSACleanup
WSAStartup

gdiplus

GdipSetStringFormatFlags
GdipDrawString
GdiplusStartup
GdipDeleteGraphics
GdipDisposeImage
GdipDrawImageRectI
GdipSetStringFormatLineAlign
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipAlloc
GdipFree
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipCreateSolidFill
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipDeleteFont
GdipCloneBrush
GdipDeleteBrush
GdipDrawImage
GdipCreateFromHDC
GdiplusShutdown

wininet

InternetCanonicalizeUrlW
InternetOpenW
InternetSetStatusCallbackW
InternetOpenUrlW
InternetReadFileExA
InternetCloseHandle
InternetSetStatusCallbackA
InternetSetOptionW
InternetSetCookieW
HttpAddRequestHeadersA
HttpQueryInfoW
InternetConnectW
HttpOpenRequestA
InternetQueryOptionA
InternetSetOptionA
HttpQueryInfoA
InternetReadFile
HttpSendRequestA
InternetErrorDlg
HttpSendRequestExW
InternetCrackUrlW
InternetWriteFile
HttpEndRequestW

imm32

ImmGetContext
ImmGetOpenStatus
ImmSetOpenStatus
ImmReleaseContext
ImmNotifyIME

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 274KB - Virtual size: 273KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 920KB - Virtual size: 920KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a1a5815f94ebc79d97962e26ef7c196c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

rasapi32

iphlpapi

shlwapi

winmm

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

oledlg

ole32

oleaut32

rasdlg

setupapi

wsock32

gdiplus

wininet

imm32

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 274KB - Virtual size: 273KB

.data Size: 18KB - Virtual size: 91KB

.rsrc Size: 920KB - Virtual size: 920KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 274KB - Virtual size: 273KB

.data
Size: 18KB - Virtual size: 91KB

.rsrc
Size: 920KB - Virtual size: 920KB