b7d41e400f60233788fc0089c50370be651a5e93bc0402a10e8448093bcd1648

Sharing

Copy URL Twitter E-mail

General

Target

b7d41e400f60233788fc0089c50370be651a5e93bc0402a10e8448093bcd1648
Size

9.1MB
MD5

94a5233ccf7d47090540a408dbdd5257
SHA1

6d6fdbad0898e9a685eff6aeeb69890a22ccd215
SHA256

b7d41e400f60233788fc0089c50370be651a5e93bc0402a10e8448093bcd1648
SHA512

b565c056381c418e55b10318e2e7efa337a02db3cf7dddb2659c7470a44d83302a720b7e2f41ae7bd9d23a2c36d9f631b38d4f1d5ab1de7ae49b9595a79e00c9
SSDEEP

196608:9QbxF08BqvfCAuP11uBeH1VSTNtSU47wEweJSC0T5Atfa3DeF7E6k:9UxF08Bjzdv1gZ747wEsJT5AZa3Devk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b7d41e400f60233788fc0089c50370be651a5e93bc0402a10e8448093bcd1648

Files

b7d41e400f60233788fc0089c50370be651a5e93bc0402a10e8448093bcd1648
.exe windows:6 windows x86 arch:x86

0d6bd9ccaf2a7934140acf1ee8e28386

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Workspace\WindowsActivator\Source\Release\WindowsActivator-Installer.pdb

Imports

kernel32

FreeLibrary
InterlockedIncrement
InterlockedDecrement
FlushInstructionCache
HeapCreate
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
MulDiv
FreeResource
SetLastError
GetFullPathNameW
GetVersionExW
GetVersionExA
LoadLibraryA
GetModuleHandleA
IsBadReadPtr
CreateEventW
SetFilePointer
GetExitCodeProcess
FlushFileBuffers
ReadProcessMemory
FindResourceW
LoadResource
FindResourceExW
LockResource
ResumeThread
GetPrivateProfileSectionNamesW
InitializeCriticalSectionEx
CreateMutexW
PeekNamedPipe
CreatePipe
GetPrivateProfileIntW
ExpandEnvironmentStringsW
SetHandleInformation
SizeofResource
ReadFile
GetDriveTypeW
GetTickCount
MapViewOfFile
CreateFileMappingW
GetTempFileNameW
CopyFileW
GetModuleHandleW
CreateProcessW
GetCurrentProcessId
MoveFileExW
LocalFree
GetProcAddress
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
LoadLibraryW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetConsoleCtrlHandler
GetTimeZoneInformation
ReadConsoleW
SetStdHandle
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetCurrentThread
GetStdHandle
ExitProcess
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileType
GetFileInformationByHandle
GetFileAttributesExW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
IsDebuggerPresent
FindCloseChangeNotification
FindFirstChangeNotificationW
GetLogicalDriveStringsW
MoveFileW
RemoveDirectoryW
CreateDirectoryW
GetCurrentDirectoryW
GetWindowsDirectoryW
SetEndOfFile
WriteFile
GetFileSize
WaitForMultipleObjects
QueryPerformanceCounter
GetCurrentThreadId
CreateSemaphoreW
ReleaseSemaphore
ResetEvent
FileTimeToLocalFileTime
GetSystemInfo
GlobalMemoryStatus
DosDateTimeToFileTime
FileTimeToDosDateTime
VirtualFree
VirtualAlloc
LocalFileTimeToFileTime
CompareFileTime
SetFileAttributesW
SetFileTime
GlobalUnlock
GlobalLock
GlobalAlloc
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
Process32FirstW
OutputDebugStringW
Process32NextW
MultiByteToWideChar
CreateToolhelp32Snapshot
OpenProcess
UnmapViewOfFile
GetSystemDirectoryW
GetFileAttributesW
CreateFileW
WaitForSingleObject
FindClose
GetTempPathW
GetModuleFileNameW
TerminateProcess
GetDiskFreeSpaceW
GetCurrentProcess
FindNextFileW
GetCommandLineW
FindFirstFileW
GetLogicalDrives
WideCharToMultiByte
GetLocalTime
GetProcessHeap
WritePrivateProfileStringW
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
CloseHandle
HeapReAlloc
DeleteFileW
SetEvent
GetLastError
Sleep
GetPrivateProfileStringW
HeapSize
InitializeCriticalSectionAndSpinCount
CompareStringW
EncodePointer
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
FormatMessageW
SetCurrentDirectoryW
OutputDebugStringA
HeapFree
GetCommandLineA
lstrlenA

user32

GetWindowLongW
SendMessageW
IsIconic
SetForegroundWindow
BringWindowToTop
IsWindow
SetWindowPos
OffsetRect
ShowWindow
GetActiveWindow
DestroyWindow
GetWindow
GetDlgItem
GetClientRect
GetWindowRect
MapWindowPoints
SetWindowLongW
LoadCursorW
MonitorFromWindow
CharPrevExA
CreateWindowExW
UnregisterClassW
RegisterClassExW
GetForegroundWindow
GetWindowThreadProcessId
PostMessageW
wsprintfW
GetParent
GetAncestor
CallWindowProcW
DefWindowProcW
FindWindowW
CharUpperW
MsgWaitForMultipleObjects
SetMenuContextHelpId
GetMenuItemInfoW
SetMenuInfo
GetMenuInfo
TrackPopupMenu
DeleteMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
CheckMenuItem
DestroyMenu
CreatePopupMenu
IsMenu
UpdateLayeredWindow
MapVirtualKeyA
CharLowerBuffW
SystemParametersInfoA
DrawTextW
IsWindowVisible
GetWindowPlacement
LoadIconW
MessageBoxW
GetSystemMetrics
GetSysColor
EnableMenuItem
ClientToScreen
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetIconInfo
CharNextW
LoadImageW
CreateIconFromResource
LoadBitmapW
DestroyIcon
GetClassNameW
ScreenToClient
SetCaretPos
HideCaret
GetCaretBlinkTime
CreateCaret
GetCursorPos
SetWindowTextW
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
UpdateWindow
ReleaseCapture
SetCapture
GetCapture
IsZoomed
SetLayeredWindowAttributes
AnimateWindow
TrackMouseEvent
GetDesktopWindow
SetActiveWindow
IsWindowEnabled
EnableWindow
PostQuitMessage
EqualRect
UnionRect
SetRect
KillTimer
SetTimer
SetCursor
GetKeyState
GetFocus
SetFocus
DestroyCursor
PtInRect
IsRectEmpty
IntersectRect
InflateRect
CopyRect
GetMonitorInfoW
FillRect
InvertRect
DrawIconEx

gdi32

GetCurrentObject
Polyline
ExtCreatePen
SetViewportOrgEx
CreateCompatibleBitmap
StretchBlt
GetDCOrgEx
GetObjectW
SetBkMode
Rectangle
GetStockObject
GetClipBox
CreateSolidBrush
CreateFontIndirectW
SetGraphicsMode
GetDeviceCaps
SelectObject
DeleteDC
CreateCompatibleDC
CreateBitmap
EnumFontsW
DeleteObject
CreateRoundRectRgn
BitBlt
CreateDIBSection
Arc
CombineRgn
CreateEllipticRgnIndirect
CreatePen
CreatePatternBrush
CreateRectRgn
CreateRectRgnIndirect
Ellipse
ExcludeClipRect
GetClipRgn
GetRgnBox
GetTextColor
GetTextExtentPoint32W
IntersectClipRect
OffsetRgn
Pie
PtInRegion
RectInRegion
RestoreDC
RoundRect
SaveDC
ExtSelectClipRgn
SetRectRgn
SetROP2
SetTextColor
GetWorldTransform
SetWorldTransform
GetViewportOrgEx

comdlg32

GetOpenFileNameW

advapi32

RegQueryValueExW
DuplicateTokenEx
RegDeleteValueW
CreateProcessAsUserW
RegQueryInfoKeyW
RegEnumValueW
RegCloseKey
AllocateAndInitializeSid
RegCreateKeyExW
RegSetValueExW
OpenProcessToken
FreeSid
CheckTokenMembership
RegOpenKeyExW

shell32

ShellExecuteExW
ShellExecuteW
SHCreateDirectoryExW
SHBrowseForFolderW
SHGetPathFromIDListW
SHFileOperationW
SHGetSpecialFolderPathW
CommandLineToArgvW
ord165

ole32

CoCreateGuid
CoInitialize
CreateStreamOnHGlobal
CoCreateInstance
CoInitializeSecurity
OleUninitialize
CreateBindCtx
CLSIDFromProgID
CLSIDFromString
OleLockRunning
OleInitialize
CoUninitialize
CoInitializeEx

oleaut32

SysStringLen
CreateErrorInfo
SetErrorInfo
VariantChangeType
VariantClear
SysAllocString
SysFreeString
VariantInit
SysAllocStringLen
GetErrorInfo
VariantCopy
SysAllocStringByteLen

shlwapi

SHDeleteKeyW
PathRemoveExtensionW
PathRenameExtensionW
ord176
SHCreateStreamOnFileEx
StrToIntExW

setupapi

SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

imm32

ImmReleaseContext
ImmAssociateContext
ImmGetContext

gdiplus

GdipGraphicsClear
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetPropertyItem
GdipDrawImageRectI
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipSaveImageToFile
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipGetPropertyItemSize

msimg32

GradientFill
AlphaBlend

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 497KB - Virtual size: 497KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 357KB - Virtual size: 356KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0d6bd9ccaf2a7934140acf1ee8e28386

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

setupapi

version

imm32

gdiplus

msimg32

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 497KB - Virtual size: 497KB

.data Size: 36KB - Virtual size: 134KB

.rsrc Size: 357KB - Virtual size: 356KB

.reloc Size: 121KB - Virtual size: 120KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 497KB - Virtual size: 497KB

.data
Size: 36KB - Virtual size: 134KB

.rsrc
Size: 357KB - Virtual size: 356KB

.reloc
Size: 121KB - Virtual size: 120KB