4103b1fc4de7637953641d704c7a8536760ccc585152d32e0f5138bf1e9b435f

Sharing

Copy URL Twitter E-mail

General

Target

4103b1fc4de7637953641d704c7a8536760ccc585152d32e0f5138bf1e9b435f
Size

4.8MB
MD5

1849d94cb3d1c866eb6209180c0907ac
SHA1

7d9a36dfe9c1c2eb11fafa54d8fe8c8392e95f46
SHA256

4103b1fc4de7637953641d704c7a8536760ccc585152d32e0f5138bf1e9b435f
SHA512

3989d50c0efdeb3ecca75d8e7af22a3fe9bf93e987d73dc2d162b786e8b4d214f35d3c96eba2a39bfe401a66189d05291432707c255dd68c32a9dc7cd92b8b5e
SSDEEP

98304:6HMJrzlBefCCYAuK0ufFwYM8YNDnHSYwc5Jq5:6HMVZB4CCYXK0u9wBVH545

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4103b1fc4de7637953641d704c7a8536760ccc585152d32e0f5138bf1e9b435f

Files

4103b1fc4de7637953641d704c7a8536760ccc585152d32e0f5138bf1e9b435f
.exe windows:5 windows x86 arch:x86

c3d6d407ef3affe1772a2edc1a52121f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SizeofResource
GetCurrentDirectoryW
FreeLibraryAndExitThread
ExitThread
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
ExpandEnvironmentStringsW
PeekNamedPipe
WaitForMultipleObjects
LoadResource
LockResource
SetCurrentDirectoryW
WriteFile
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetModuleHandleW
GetSystemDirectoryA
SleepEx
ResetEvent
lstrlenA
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
GetTempPathW
GetFileInformationByHandle
InterlockedCompareExchange
MulDiv
FindResourceW
GetLastError
GetCurrentProcessId
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
WideCharToMultiByte
OutputDebugStringA
InterlockedDecrement
InterlockedIncrement
CreateFileW
WritePrivateProfileStringW
GetModuleFileNameW
ReadFile
GetFileSize
CreateEventW
Sleep
WaitForSingleObject
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteFileW
GlobalAlloc
GlobalLock
GlobalUnlock
GetFileSizeEx
MultiByteToWideChar
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetPrivateProfileStringW
lstrcpyW
MoveFileExW
RemoveDirectoryW
GlobalFree
GetExitCodeProcess
CreateProcessW
DecodePointer
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
GetSystemInfo
FormatMessageW
GetVolumeInformationW
GetTickCount
GetLongPathNameW
FileTimeToSystemTime
ReleaseMutex
CreateMutexW
AreFileApisANSI
DeviceIoControl
SetPriorityClass
FlushInstructionCache
HeapCreate
FreeResource
SetLastError
GetFullPathNameW
GetLocalTime
GetVersionExA
GetSystemTime
LoadLibraryA
GetModuleHandleA
RtlUnwind
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetACP
GetFileType
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
OutputDebugStringW
WaitForSingleObjectEx
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
FlushFileBuffers
WriteConsoleW
SetEndOfFile
GetExitCodeThread
TerminateThread
CreateThread
QueryDosDeviceW
GetWindowsDirectoryW
LoadLibraryW
GetLogicalDriveStringsW
lstrcmpiW
CloseHandle
OpenProcess
GetProcAddress
FreeLibrary
GetVersionExW
CopyFileW
FindNextFileW
FindFirstFileW
CreateDirectoryW
GetSystemDirectoryW
lstrlenW
WinExec
FindClose

user32

UpdateWindow
BeginPaint
EndPaint
InvalidateRect
GetCursorPos
ScreenToClient
GetClassNameW
DestroyIcon
LoadBitmapW
CreateIconFromResource
LoadImageW
CharNextW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
ClientToScreen
SetRect
EnableMenuItem
GetSysColor
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetSystemMetrics
IsWindowVisible
DrawTextW
SystemParametersInfoA
CharLowerBuffW
MapVirtualKeyA
UpdateLayeredWindow
IsMenu
IsWindowEnabled
CreatePopupMenu
DestroyMenu
GetMenuItemCount
ReleaseCapture
TrackPopupMenu
GetMenuInfo
SetMenuInfo
GetMenuItemInfoW
SetMenuContextHelpId
SetCursor
KillTimer
SetTimer
DestroyWindow
DestroyCursor
LoadCursorW
IntersectRect
wsprintfW
UnregisterClassW
LoadStringW
GetKeyState
GetIconInfo
DrawIconEx
OffsetRect
InflateRect
ReleaseDC
GetDC
SetCapture
GetCapture
IsZoomed
IsIconic
SetLayeredWindowAttributes
AnimateWindow
PostQuitMessage
PostMessageW
SendMessageW
ShowWindow
SetWindowPos
SetWindowTextW
CopyRect
IsWindow
SetForegroundWindow
FindWindowW
TrackMouseEvent
GetMonitorInfoW
MonitorFromWindow
GetWindow
GetParent
SetWindowLongW
MapWindowPoints
GetWindowRect
GetClientRect
SystemParametersInfoW
GetActiveWindow
GetDlgItem
CreateWindowExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
GetWindowLongW
GetFocus
SetFocus
PtInRect
EqualRect
IsRectEmpty
UnionRect
AppendMenuW

advapi32

CreateProcessAsUserW
RegSetValueW
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyW
RegCloseKey
RegOpenKeyW
RegEnumKeyW
DuplicateTokenEx
RegSetValueExW
LookupAccountSidW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetTokenInformation
GetTokenInformation
OpenProcessToken
ImpersonateLoggedOnUser
RevertToSelf

shell32

SHGetFolderPathW
SHGetPathFromIDListW
ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderPathW
SHBrowseForFolderW
SHFileOperationW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
OleLockRunning
CLSIDFromString
CLSIDFromProgID
CreateBindCtx
CoCreateGuid

shlwapi

PathFileExistsW
StrToIntExW

psapi

EnumProcessModules
EnumProcesses
GetProcessImageFileNameW
GetModuleFileNameExW

crypt32

CryptMsgClose
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CryptMsgGetParam

gdiplus

GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipAlloc
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdiplusShutdown
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipSaveImageToFile
GdipGraphicsClear
GdipDrawImageRectI
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipDrawImageI

imm32

ImmAssociateContext
ImmGetContext
ImmDestroyContext
ImmCreateContext
ImmReleaseContext

gdi32

CreateSolidBrush
CreateFontIndirectW
GetDeviceCaps
CreateBitmap
BitBlt
GetViewportOrgEx
GetCurrentObject
SetViewportOrgEx
GetObjectW
GetStockObject
Rectangle
SetBkMode
CreateCompatibleDC
StretchBlt
EnumFontsW
EnumFontFamiliesExW
GetCharABCWidthsW
GetFontData
GetGlyphOutlineW
GetOutlineTextMetricsW
GetFontUnicodeRanges
GetGlyphIndicesW
GetTextExtentPointI
CreateDIBSection
GdiFlush
GetTextFaceW
ExtTextOutW
GetTextMetricsW
SetTextAlign
SetTextColor
RemoveFontMemResourceEx
AddFontMemResourceEx
SetWorldTransform
SetGraphicsMode
SelectObject
SelectClipRgn
IntersectClipRect
ExtCreateRegion
DeleteObject
DeleteDC

oleaut32

SysFreeString
SysAllocString

iphlpapi

GetAdaptersInfo

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

ws2_32

connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSASetLastError
htonl
inet_addr
inet_ntoa
gethostbyaddr
gethostbyname
getservbyport
getservbyname
__WSAFDIsSet
select
recvfrom
bind
accept
listen
ioctlsocket
gethostname
WSAStartup
WSACleanup
recv
send
WSAGetLastError
closesocket
socket
sendto

usp10

ScriptShape
ScriptItemize
ScriptFreeCache

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 492KB - Virtual size: 491KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 61KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 444B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33.0MB - Virtual size: 33.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c3d6d407ef3affe1772a2edc1a52121f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

psapi

crypt32

gdiplus

imm32

gdi32

oleaut32

iphlpapi

userenv

ws2_32

usp10

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 492KB - Virtual size: 491KB

.data Size: 61KB - Virtual size: 158KB

.gfids Size: 512B - Virtual size: 444B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 33.0MB - Virtual size: 33.0MB

.reloc Size: 127KB - Virtual size: 126KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 492KB - Virtual size: 491KB

.data
Size: 61KB - Virtual size: 158KB

.gfids
Size: 512B - Virtual size: 444B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 33.0MB - Virtual size: 33.0MB

.reloc
Size: 127KB - Virtual size: 126KB