ee62ac2d12ef5f5aea8cccbcfd31478cf349fce6bc9220a3327b9693f4ee16d9

Sharing

Copy URL

Twitter E-mail

General

Target

ee62ac2d12ef5f5aea8cccbcfd31478cf349fce6bc9220a3327b9693f4ee16d9
Size

2.0MB
MD5

dca80c1efa35ad9b2131d2d923a48e05
SHA1

ab28464b6ff50fcddf1e006338d70220e5806c8a
SHA256

ee62ac2d12ef5f5aea8cccbcfd31478cf349fce6bc9220a3327b9693f4ee16d9
SHA512

f8a85ee3c0d1de07c5ccc9745b8613fe80f3d3e6a73d92d4b631aab397e6dfdcad5ba94356fba089fc1cbc45fbe00a335931034f72418ba2e30385c52e16198b
SSDEEP

49152:jq9IOOYXGiU1E17d4Wnto+aydTrKYnHWc5DxC5JPAU7xVGvClzCB:jqWsw1m7d4WntPayBrvHWcJG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ee62ac2d12ef5f5aea8cccbcfd31478cf349fce6bc9220a3327b9693f4ee16d9

Files

ee62ac2d12ef5f5aea8cccbcfd31478cf349fce6bc9220a3327b9693f4ee16d9
.exe windows:5 windows x86 arch:x86

fbfb4983fc53e51db9d73831e4062d04

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\Tools-source\trunk\SwallowExtension\SwallowExtension\Package_Win32\MultiBrowserServices.pdb

Imports

kernel32

FreeLibrary
DeleteFileW
WriteFile
ReadFile
SetFilePointer
GetFileSize
GetProcAddress
LoadLibraryA
GetModuleHandleA
CreateFileW
GetPrivateProfileStringA
GetFileSizeEx
SetFilePointerEx
GetSystemTimeAsFileTime
MulDiv
LocalFree
FormatMessageW
GlobalSize
CopyFileW
SetLastError
GetVersionExA
GetModuleHandleW
lstrcmpW
CompareStringW
LoadLibraryW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
FreeResource
InterlockedIncrement
GetThreadLocale
InterlockedExchange
CompareStringA
GetLocaleInfoW
lstrcmpA
EnumResourceLanguagesW
ConvertDefaultLocale
GetCurrentThread
GetPrivateProfileIntW
WritePrivateProfileStringW
SetThreadPriority
ResumeThread
GetCurrentProcessId
InterlockedDecrement
GetTickCount
FindClose
FindNextFileW
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileW
LocalAlloc
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalGetAtomNameW
lstrlenA
GlobalFlags
GetCurrentDirectoryW
lstrcpyW
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetCurrentProcess
GetVolumeInformationW
GetFullPathNameW
SetErrorMode
GetTempFileNameW
GetTempPathW
SearchPathW
GetProfileIntW
VirtualProtect
FindResourceExW
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
CreateThread
HeapFree
ExitProcess
HeapAlloc
DeleteFileA
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
HeapReAlloc
GetDriveTypeA
FindFirstFileA
RtlUnwind
RaiseException
HeapSize
VirtualAlloc
GetSystemInfo
VirtualQuery
SetStdHandle
GetFileType
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetTimeFormatA
GetDateFormatA
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetFullPathNameA
GetCurrentDirectoryA
LCMapStringA
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetProcessHeap
SetEnvironmentVariableA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetModuleFileNameA
lstrlenW
OutputDebugStringA
CloseHandle
WaitForSingleObject
GetLastError
Sleep
GetVersionExW
ReleaseSemaphore
CreateSemaphoreW
GetCurrentThreadId
OpenSemaphoreW
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WideCharToMultiByte
MultiByteToWideChar
CreateDirectoryW
GetFileAttributesW
FindResourceW
LoadResource
LockResource
GetFileTime
SizeofResource

user32

GetActiveWindow
TranslateMessage
GetMessageW
SetCursor
ShowOwnedPopups
GetWindowThreadProcessId
RegisterClipboardFormatW
GetSysColorBrush
ReleaseDC
GetDC
InflateRect
GetMenuItemInfoW
DestroyMenu
ClientToScreen
FillRect
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
GetWindowDC
BeginPaint
EndPaint
IsRectEmpty
CopyAcceleratorTableW
InvalidateRect
InvalidateRgn
SetCapture
ReleaseCapture
WaitMessage
DeleteMenu
SetRectEmpty
LoadMenuW
PostThreadMessageW
ToUnicodeEx
MapVirtualKeyW
GetKeyboardLayout
GetKeyboardState
CharUpperW
GetAsyncKeyState
DestroyAcceleratorTable
LoadAcceleratorsW
CreateAcceleratorTableW
SetWindowRgn
NotifyWinEvent
CreatePopupMenu
SetParent
SetClassLongW
GetSystemMenu
IsMenu
SetTimer
KillTimer
BringWindowToTop
LockWindowUpdate
EnumChildWindows
DrawStateW
OpenClipboard
CopyImage
DestroyIcon
LoadImageW
SetClipboardData
CloseClipboard
EmptyClipboard
GetNextDlgGroupItem
GetNextDlgTabItem
UnregisterClassW
TranslateAcceleratorW
InsertMenuItemW
ReuseDDElParam
UnpackDDElParam
DrawIconEx
DrawEdge
DrawFrameControl
DrawFocusRect
SetCursorPos
UnionRect
EnableScrollBar
UpdateLayeredWindow
SetMenuDefaultItem
SetWindowTextW
IsCharLowerW
GetKeyNameTextW
MapVirtualKeyExW
ValidateRect
DefFrameProcW
DefMDIChildProcW
DrawMenuBar
TranslateMDISysAccel
FrameRect
GetUpdateRect
EndDialog
CreateDialogIndirectParamW
CharUpperBuffW
CopyIcon
SubtractRect
GetIconInfo
GetDoubleClickTime
CreateMenu
GetWindowRgn
DestroyCursor
DrawIcon
RegisterClassW
GetSysColor
AdjustWindowRectEx
GetParent
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetDlgCtrlID
SendMessageW
DefWindowProcW
CallWindowProcW
CopyRect
PtInRect
GetMenu
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetMenuState
GetMenuStringW
AppendMenuW
GetMenuItemID
InsertMenuW
GetMenuItemCount
GetSubMenu
RemoveMenu
EnableWindow
GetSystemMetrics
SetProcessDPIAware
GetClientRect
LoadCursorW
LoadIconW
SetRect
GetWindowLongW
GetWindowRect
IsDialogMessageW
CheckDlgButton
CharNextW
CheckMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
GetClassInfoW
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
SetWindowContextHelpId
MapDialogRect
SystemParametersInfoW
MessageBeep
RedrawWindow
IsZoomed
PostQuitMessage
IsClipboardFormatAvailable
IsWindowEnabled
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetFocus
IsWindow
GetWindowTextLengthW
GetWindowTextW
GetLastActivePopup
SetActiveWindow
DispatchMessageW
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
MoveWindow
SetFocus
ShowWindow
PostMessageW
UpdateWindow
SetWindowPos
SetWindowLongW
GetCursorPos
SetForegroundWindow
ShowScrollBar
IsWindowVisible
WindowFromPoint
GetClassNameW
GetDesktopWindow
MessageBoxW
CreateWindowExW
GetMenuDefaultItem
GetClassInfoExW
SwitchToThisWindow
GetForegroundWindow
GetWindowTextA
GetWindow

gdi32

LineTo
GetDeviceCaps
MoveToEx
SetTextAlign
IntersectClipRect
SelectClipRgn
SetMapMode
SetROP2
SetPolyFillMode
SetBkMode
ExcludeClipRect
SetPixelV
GetTextFaceW
CreateSolidBrush
EnumFontFamiliesExW
RestoreDC
GetNearestPaletteIndex
SetPaletteEntries
ExtFloodFill
LPtoDP
GetViewportOrgEx
GetBoundsRect
FrameRgn
SaveDC
DeleteObject
GetTextExtentPoint32W
ExtTextOutW
BitBlt
CreateCompatibleDC
CreateFontIndirectW
GetTextColor
FillRgn
PtInRegion
GetWindowOrgEx
GetPaletteEntries
CreatePalette
RoundRect
Rectangle
Polygon
Ellipse
Polyline
CreatePolygonRgn
CreateEllipticRgn
DPtoLP
GetMapMode
SetRectRgn
CreateDIBSection
SetPixel
StretchBlt
CombineRgn
RealizePalette
GetDIBits
PatBlt
SetDIBColorTable
CreateRoundRectRgn
GetTextCharsetInfo
EnumFontFamiliesW
GetTextMetricsW
CreateCompatibleBitmap
CreateDIBitmap
OffsetRgn
GetRgnBox
CreateRectRgnIndirect
CreateHatchBrush
CreatePen
CreateRectRgn
GetViewportExtEx
GetObjectType
GetBkColor
GetStockObject
CreateBitmap
GetObjectW
SetBkColor
SetTextColor
GetClipBox
GetDCOrgEx
CopyMetaFileW
GetSystemPaletteEntries
SelectPalette
CreatePatternBrush
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutW
RectVisible
PtVisible
GetPixel
GetWindowExtEx

shell32

ShellExecuteW
DragQueryFileW
DragFinish
SHGetFileInfoW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFolderPathA
SHGetFolderPathW
SHAppBarMessage

ole32

IsAccelerator
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoInitializeEx
CoUninitialize
OleGetClipboard
DoDragDrop
OleLockRunning
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
CreateStreamOnHGlobal
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CLSIDFromString
CLSIDFromProgID
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CoTaskMemFree
CoCreateGuid
CoCreateInstance

oleaut32

VariantInit
SysAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
SysStringLen
SysFreeString
VariantClear
VariantChangeType
OleCreateFontIndirect
SysAllocString
VariantCopy

advapi32

RegEnumKeyExW
RegQueryValueW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyW
RegQueryValueExW
RegDeleteValueW
RegCloseKey

ws2_32

getsockname
ntohs
getpeername
WSAGetLastError
bind
htons
setsockopt
select
ioctlsocket
getprotobyname
WSAIoctl
gethostbyname
inet_addr
WSAEventSelect
getaddrinfo
recv
recvfrom
send
sendto
WSAStartup
WSACreateEvent
WSACloseEvent
WSAAddressToStringW
WSACleanup
closesocket
shutdown
listen
socket
gethostname
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
WSASetEvent
connect
accept
freeaddrinfo
getsockopt

iphlpapi

GetTcpTable

msimg32

AlphaBlend
TransparentBlt

comctl32

ImageList_GetIconSize
InitCommonControlsEx

shlwapi

PathRemoveFileSpecW
PathFileExistsA
PathFileExistsW
PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathIsUNCW
SHDeleteKeyW

oledlg

OleUIBusyW

gdiplus

GdipFree
GdipAlloc
GdipDeleteGraphics
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipBitmapLockBits
GdipBitmapUnlockBits
GdiplusStartup
GdiplusShutdown
GdipGetImageGraphicsContext
GdipDrawImageI
GdipCloneImage
GdipCreateBitmapFromScan0
GdipGetImagePalette

version

VerQueryValueW
GetFileVersionInfoA
GetFileVersionInfoSizeA

imm32

ImmGetOpenStatus
ImmGetContext
ImmReleaseContext

winmm

PlaySoundW

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

comdlg32

GetFileTitleW

Exports

Exports

OPENSSL_Applink

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 345KB - Virtual size: 344KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fbfb4983fc53e51db9d73831e4062d04

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

ws2_32

iphlpapi

msimg32

comctl32

shlwapi

oledlg

gdiplus

version

imm32

winmm

winspool.drv

comdlg32

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 345KB - Virtual size: 344KB

.data Size: 27KB - Virtual size: 58KB

.rsrc Size: 103KB - Virtual size: 102KB

.reloc Size: 152KB - Virtual size: 152KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 345KB - Virtual size: 344KB

.data
Size: 27KB - Virtual size: 58KB

.rsrc
Size: 103KB - Virtual size: 102KB

.reloc
Size: 152KB - Virtual size: 152KB