d8ad9715c9d8cdcc0e94a9cb2984be460befde56e20dd0b90e1fffcc3f35cb71

Sharing

Copy URL Twitter E-mail

General

Target

d8ad9715c9d8cdcc0e94a9cb2984be460befde56e20dd0b90e1fffcc3f35cb71
Size

1.7MB
MD5

9d0ce02acce45a277d09a31ae42df481
SHA1

2467264c8843629104cc93625ffe5fa0c788b0d2
SHA256

d8ad9715c9d8cdcc0e94a9cb2984be460befde56e20dd0b90e1fffcc3f35cb71
SHA512

0f738198610c6895fa83538667d88effeb9017f4a7de250996204538b32e177f1447a62ab8a9c9cb23f96d03829b10899687d245a200c7594299d371188b16ec
SSDEEP

49152:yv95obnI36yr120IXA/T1fkbVCs/2cex8CfdVY36EfrTzb:W9SDI7rs0UAhfjDYKE/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d8ad9715c9d8cdcc0e94a9cb2984be460befde56e20dd0b90e1fffcc3f35cb71

Files

d8ad9715c9d8cdcc0e94a9cb2984be460befde56e20dd0b90e1fffcc3f35cb71
.dll windows:5 windows x86 arch:x86

5b42e1b61133a7227e9d0d94d9d3dafd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\hudson\jobs\pogo_build\workspace\PartnerWrapper\Release\PartnerWrapper.pdb

Imports

uxtheme

IsThemeActive
DrawThemeBackground
CloseThemeData
OpenThemeData

kernel32

HeapFree
GetCPInfo
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
GetCommandLineA
RtlUnwind
RaiseException
HeapReAlloc
ExitProcess
HeapSize
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
SetEnvironmentVariableW
CreateFileA
WritePrivateProfileStringW
GlobalFlags
InterlockedIncrement
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
SetEndOfFile
FlushFileBuffers
SetFilePointer
ReadFile
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
InterlockedExchange
InterlockedDecrement
FreeResource
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LoadLibraryA
lstrcmpW
GetVersionExA
GetCurrentProcessId
GetModuleHandleA
SetLastError
GlobalAlloc
GlobalLock
GlobalUnlock
LocalFree
MultiByteToWideChar
lstrlenA
GlobalFree
WideCharToMultiByte
lstrcpyW
MulDiv
GetACP
Sleep
GetVersionExW
FormatMessageW
FreeLibrary
LoadLibraryW
GetCurrentProcess
GetProcAddress
lstrlenW
GetTempFileNameW
GetModuleFileNameW
RemoveDirectoryW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
GetExitCodeProcess
CloseHandle
WriteFile
CreateFileW
GetModuleHandleW
CreateProcessW
WaitForSingleObject
FindResourceW
LoadResource
LockResource
SizeofResource
GetLocalTime
GetLastError
CreateDirectoryW
GetTempPathW
InterlockedCompareExchange
GetStdHandle
GetProcessHeap

user32

MoveWindow
SetWindowTextW
IsDialogMessageW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetActiveWindow
CreateDialogIndirectParamW
EndDialog
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
SetWindowsHookExW
CallNextHookEx
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextW
SetActiveWindow
DispatchMessageW
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
SetMenu
IsWindowVisible
CreateWindowExW
GetClassInfoExW
RegisterClassW
AdjustWindowRectEx
GetDlgCtrlID
CallWindowProcW
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindow
IsWindowEnabled
MessageBoxW
EndPaint
BeginPaint
ClientToScreen
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetCursorPos
KillTimer
SetTimer
ReleaseCapture
GetCapture
SetCapture
GetKeyState
GetNextDlgTabItem
SetCursor
LoadCursorW
UpdateWindow
DestroyCursor
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
PostMessageW
SetWindowPos
GetClassNameW
IsZoomed
GetWindowThreadProcessId
GetForegroundWindow
SetForegroundWindow
GetLastActivePopup
GetParent
IsRectEmpty
DestroyMenu
GetSysColorBrush
UnregisterClassW
GetMessageW
TranslateMessage
ValidateRect
PostQuitMessage
ShowWindow
IsWindow
GetDC
GetDesktopWindow
SetWindowLongW
ReleaseDC
RedrawWindow
CopyRect
SystemParametersInfoW
GetSysColor
MessageBeep
WaitForInputIdle
InvalidateRect
PtInRect
ScreenToClient
DrawFrameControl
DefWindowProcW
GetClassInfoW
GetWindowLongW
LoadImageW
DestroyIcon
GetSystemMetrics
GetWindowRect
GetClientRect
EnableWindow
SendMessageW
LoadBitmapW
LoadIconW
GetMenu

gdi32

SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
GetClipBox
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
SetMapMode
BitBlt
CreateCompatibleDC
CreateSolidBrush
CreateFontIndirectW
SetTextColor
SetBkMode
SetBkColor
RestoreDC
SaveDC
GetStockObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
CreateCompatibleBitmap
DeleteObject
SelectObject
GetTextExtentPoint32W
EnumFontFamiliesExW
GetDeviceCaps
TranslateCharsetInfo
CreateBitmap
GetObjectW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegQueryValueW
RegOpenKeyW
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyW

shell32

ShellExecuteW
ShellExecuteExW

shlwapi

PathFindFileNameW
PathFindExtensionW

ole32

CoCreateGuid
StringFromGUID2

oleaut32

VariantClear
VariantChangeType
VariantInit

gdiplus

GdipAlloc
GdipLoadImageFromFile
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipDisposeImage
GdipFree
GdiplusStartup
GdipDrawImageRectI
GdipDeleteGraphics
GdipCreateFromHDC
GdiplusShutdown

Exports

Exports

??4CPartnerWrapper@@QAEAAV0@ABV0@@Z
APNInstall

Sections

.text
Size: 256KB - Virtual size: 256KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5b42e1b61133a7227e9d0d94d9d3dafd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

uxtheme

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

gdiplus

Exports

Exports

Sections

.text Size: 256KB - Virtual size: 256KB

.rdata Size: 58KB - Virtual size: 57KB

.data Size: 10KB - Virtual size: 27KB

.rsrc Size: 4.0MB - Virtual size: 4.0MB

.reloc Size: 47KB - Virtual size: 47KB

.text
Size: 256KB - Virtual size: 256KB

.rdata
Size: 58KB - Virtual size: 57KB

.data
Size: 10KB - Virtual size: 27KB

.rsrc
Size: 4.0MB - Virtual size: 4.0MB

.reloc
Size: 47KB - Virtual size: 47KB