439a3e158cb977f77772fe214d05e093fa1b01986498d4c557a1400012b17230

Sharing

Copy URL Twitter E-mail

General

Target

439a3e158cb977f77772fe214d05e093fa1b01986498d4c557a1400012b17230
Size

9.5MB
MD5

f28ef6b2b4e8793d07646780e04674ba
SHA1

a009b4d081a391fb3b7f615371aeba33579bc7f1
SHA256

439a3e158cb977f77772fe214d05e093fa1b01986498d4c557a1400012b17230
SHA512

51fcaea390ce7e3ab3c7e259f9fb4557ca31c6e1b1c30088d3f1ec9ee6890bc8dc3fe39d7ee857a06fcca60a083fdfbdaa84b049440c03c0c5432988609c7a7b
SSDEEP

196608:lB6qppsEHsg8P24lXTQMvpDBaVYyGBcTtQRlbRq:rsg8PjBDwVVCRfq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
439a3e158cb977f77772fe214d05e093fa1b01986498d4c557a1400012b17230

Files

439a3e158cb977f77772fe214d05e093fa1b01986498d4c557a1400012b17230
.exe windows:6 windows x86 arch:x86

d92fed6e70d5623efc856368be4047b6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
CompareStringW
GetTimeZoneInformation
FileTimeToSystemTime
MoveFileW
CopyFileW
SetDllDirectoryW
FormatMessageW
LocalFree
LocalAlloc
GlobalLock
GlobalUnlock
GlobalAlloc
LoadLibraryW
GetProcAddress
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameW
GetModuleFileNameA
FreeLibrary
DeleteTimerQueue
DeleteTimerQueueTimer
CreateTimerQueueTimer
CreateTimerQueue
GetVersionExW
GetSystemDirectoryW
GetTickCount
GetVersion
GetSystemTime
OpenProcess
GetProcessId
CreateProcessW
TerminateThread
GetCurrentThreadId
WideCharToMultiByte
CreateThread
GetExitCodeProcess
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
Sleep
CreateSemaphoreExW
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
WaitForSingleObject
ReleaseMutex
ReleaseSemaphore
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeviceIoControl
GetProcessHeap
HeapFree
HeapAlloc
CallNamedPipeW
CreatePipe
SetLastError
GetLastError
SetHandleInformation
CloseHandle
OutputDebugStringW
OutputDebugStringA
DebugBreak
IsDebuggerPresent
GetTempPathW
SetFileAttributesW
RemoveDirectoryW
GetSystemDefaultUILanguage
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
K32EnumProcessModules
K32GetModuleBaseNameW
K32GetModuleFileNameExW
K32GetProcessMemoryInfo
K32GetProcessImageFileNameW
GetCurrentThread
ReadFile
QueryDosDeviceW
GetVolumeInformationW
GetLogicalDriveStringsW
GetFileTime
GetFileAttributesExW
GetDriveTypeW
GetDriveTypeA
GetDiskFreeSpaceExW
GetFileAttributesW
LoadLibraryExW
GetEnvironmentVariableW
FormatMessageA
GetStringTypeW
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
GetStdHandle
FreeConsole
AttachConsole
WriteConsoleA
WriteConsoleW
FillConsoleOutputCharacterW
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
ReadConsoleOutputCharacterA
ExitProcess
MulDiv
GetCommandLineW
GlobalSize
GlobalHandle
GlobalFree
SetErrorMode
GetSystemTimeAsFileTime
RaiseException
TryEnterCriticalSection
CreateMutexW
SetThreadPriority
GetExitCodeThread
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemInfo
SetCurrentDirectoryW
GetFileType
WriteFile
SetNamedPipeHandleState
PeekNamedPipe
SetEvent
CreateEventW
WaitForMultipleObjects
GetFileSize
GetLongPathNameW
GetTempFileNameW
SetFileTime
GetNativeSystemInfo
LoadResource
LockResource
SizeofResource
FindResourceW
GetComputerNameW
IsValidCodePage
QueryPerformanceCounter
QueryPerformanceFrequency
GetACP
GetLocaleInfoW
IsBadReadPtr
IsBadStringPtrA
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
SystemTimeToFileTime
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
HeapReAlloc
LoadLibraryA
CreateFileA
FlushViewOfFile
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
GetFullPathNameW
HeapCreate
AreFileApisANSI
GetEnvironmentVariableA
GetSystemDirectoryA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
ResetEvent
GetStartupInfoW
InitializeSListHead
InterlockedPushEntrySList
RtlUnwind
SetEnvironmentVariableW
GetCurrentDirectoryW
GetFileInformationByHandle
SystemTimeToTzSpecificLocalTime
ExitThread
FreeLibraryAndExitThread
MoveFileExW
SetStdHandle
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
SetFilePointerEx
FindFirstFileExW
GetDateFormatW
GetTimeFormatW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileSizeEx
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCommandLineA
GetDiskFreeSpaceW
FindNextFileW
FindFirstFileW
FindClose
FileTimeToLocalFileTime
DeleteFileW
DeleteFileA
CreateFileW
CreateDirectoryW
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA

user32

DestroyCursor
CreateIconIndirect
DestroyIcon
CreateAcceleratorTableW
DestroyAcceleratorTable
TranslateAcceleratorW
GetDoubleClickTime
GetCaretBlinkTime
CreateDialogParamW
GetDlgItem
SetWindowRgn
GetWindowPlacement
SetLayeredWindowAttributes
FlashWindowEx
IsIconic
IsZoomed
CreateDialogIndirectParamW
GetDialogBaseUnits
DrawMenuBar
EnableMenuItem
DrawIconEx
DrawStateW
SetRect
SetRectEmpty
CopyRect
OffsetRect
DrawEdge
DrawFrameControl
GetMenuState
CheckMenuItem
GetSubMenu
GetMenuItemID
SetMenuItemInfoW
GetSysColorBrush
CheckMenuRadioItem
CreateMenu
CreatePopupMenu
DestroyMenu
InsertMenuW
ModifyMenuW
RemoveMenu
SetMenuInfo
InsertMenuItemW
RegisterClipboardFormatW
GetClipboardFormatNameW
GetComboBoxInfo
ChildWindowFromPoint
MessageBeep
GetMessageW
PostThreadMessageW
SetWindowsHookExW
GetWindowDC
BeginPaint
EndPaint
UnionRect
GetDesktopWindow
ValidateRgn
IsRectEmpty
IsClipboardFormatAvailable
ChangeDisplaySettingsExW
EnumDisplaySettingsW
MonitorFromPoint
MonitorFromWindow
LoadImageW
EnumDisplayMonitors
wsprintfW
WaitForInputIdle
MsgWaitForMultipleObjects
SetTimer
KillTimer
DdePostAdvise
DdeNameService
DdeCreateDataHandle
DdeGetData
DdeQueryStringW
SetCursor
SetWindowTextW
keybd_event
GetKeyState
GetFocus
DestroyWindow
IsMenu
GetWindowRect
SetMenu
PostMessageW
RegisterWindowMessageW
SetParent
InflateRect
ChildWindowFromPointEx
WindowFromPoint
MapWindowPoints
ClientToScreen
GetCursorPos
SetCursorPos
EnableScrollBar
ScrollWindow
RedrawWindow
InvalidateRect
GetUpdateRgn
GetMenuItemInfoW
SetActiveWindow
TrackPopupMenu
SendMessageW
AttachThreadInput
ShowWindow
SetWindowPos
IsWindowVisible
BringWindowToTop
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
EnableWindow
GetSystemMetrics
GetSystemMenu
GetMenuItemCount
IsWindowEnabled
ReleaseCapture
HideCaret
SetCapture
GetCapture
MapVirtualKeyW
VkKeyScanW
GetAsyncKeyState
GetActiveWindow
SetFocus
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
MoveWindow
GetIconInfo
LoadIconW
LoadBitmapW
GetScrollInfo
SetScrollInfo
IsDialogMessageW
CallNextHookEx
GetMonitorInfoW
AnimateWindow
IsWindow
CreateWindowExW
CallWindowProcW
PostQuitMessage
DefWindowProcW
GetMessageTime
GetMessagePos
UnregisterHotKey
RegisterHotKey
PeekMessageW
DispatchMessageW
TranslateMessage
LoadCursorW
GetProcessDefaultLayout
UnregisterClassW
RegisterClassW
AppendMenuW
UnhookWindowsHookEx
GetParent
PtInRect
FillRect
DrawFocusRect
GetSysColor
ScreenToClient
DrawTextW
SystemParametersInfoW
ValidateRect
UpdateWindow
DdeFreeStringHandle
DdeCreateStringHandleW
DdeGetLastError
DdeFreeDataHandle
DdeUnaccessData
DdeAccessData
DdeClientTransaction
DdeDisconnect
DdeConnect
DdeUninitialize
DdeInitializeW
GetWindow
GetWindowThreadProcessId
GetClassNameW
GetForegroundWindow
SetForegroundWindow
GetDC
ReleaseDC
GetWindowTextA
EnumWindows
FindWindowExW
FindWindowW
SetWindowLongW
GetWindowLongW
MessageBoxW
MessageBoxA
GetClientRect
GetWindowTextLengthW
GetWindowTextW

gdi32

LPtoDP
Polygon
Polyline
PolyBezier
SetViewportExtEx
SetWindowExtEx
SetWindowOrgEx
CreateICW
GetBkColor
LineTo
MoveToEx
CombineRgn
EqualRgn
GetRgnBox
PtInRegion
RectInRegion
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
CreateRectRgnIndirect
ExtCreatePen
GetTextExtentExPointW
CreateDIBitmap
GetDIBits
CreateDIBSection
GetDIBColorTable
SetDIBColorTable
GetSystemPaletteEntries
CreateDCW
DPtoLP
CreatePolygonRgn
ExtTextOutW
ModifyWorldTransform
CreateSolidBrush
GetWorldTransform
SetROP2
StretchDIBits
SetPolyFillMode
SetPixel
GetLayout
Arc
SetLayout
SetMapMode
SetGraphicsMode
ExtSelectClipRgn
CreatePen
CreatePatternBrush
CreateHatchBrush
CreateCompatibleBitmap
CreateBitmapIndirect
CreateBitmap
BitBlt
GetTextExtentPoint32W
SelectClipRgn
RoundRect
Rectangle
PolyPolygon
Pie
MaskBlt
GetWindowExtEx
GetViewportExtEx
GetPixel
EndPage
StartPage
EndDoc
StartDocW
SetAbortProc
PlayEnhMetaFile
GetEnhMetaFileHeader
GetEnhMetaFileW
DeleteEnhMetaFile
CreateEnhMetaFileW
CloseEnhMetaFile
GetDeviceCaps
GetStockObject
SetBkMode
SetTextColor
SetViewportOrgEx
GetObjectType
GetGraphicsMode
GetClipBox
ExtFloodFill
Ellipse
EnumFontFamiliesExW
SetBkColor
OffsetRgn
GetRegionData
ExtCreateRegion
GetOutlineTextMetricsW
CreateFontIndirectW
SetStretchBltMode
StretchBlt
DeleteDC
CreateCompatibleDC
GetObjectW
GdiFlush
SetBrushOrgEx
GetTextMetricsW
SelectPalette
RealizePalette
ExcludeClipRect
CreateRectRgn
SelectObject
DeleteObject
GetCharABCWidthsW
SetWorldTransform

advapi32

RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
IsValidSid
IsValidSecurityDescriptor
InitializeSecurityDescriptor
InitializeAcl
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
GetLengthSid
FreeSid
DuplicateToken
AllocateAndInitializeSid
AddAccessAllowedAce
AccessCheck
OpenThreadToken
OpenProcessToken
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
RegGetValueW
GetUserNameW
RegEnumKeyW

shell32

SHGetFileInfoW
ord6
CommandLineToArgvW
ExtractIconExW
ExtractIconW
DragAcceptFiles
DragFinish
DragQueryPoint
DragQueryFileW
SHChangeNotify
SHGetFolderPathW
SHGetSpecialFolderLocation
SHCreateDirectoryExW
SHGetPathFromIDListW
Shell_NotifyIconW
SHEmptyRecycleBinW
ShellExecuteExW
SHFileOperationW
ShellExecuteW

ole32

OleIsCurrentClipboard
CoInitialize
CoTaskMemFree
RevokeDragDrop
OleInitialize
CoTaskMemAlloc
ReleaseStgMedium
OleSetContainedObject
OleRun
OleLockRunning
CoLockObjectExternal
RegisterDragDrop
CoCreateInstance
CoInitializeEx
OleUninitialize
CoCreateFreeThreadedMarshaler
OleFlushClipboard
OleGetClipboard
OleSetClipboard
CoUninitialize

oleaut32

VarBstrFromCy
SafeArrayGetVartype
VariantTimeToSystemTime
SafeArrayUnlock
SysAllocString
SysFreeString
VariantInit
VariantClear
LoadTypeLi
SysStringLen
SafeArrayLock
SystemTimeToVariantTime
GetErrorInfo
SafeArrayPtrOfIndex
SafeArrayDestroy
SafeArrayCreate
SetErrorInfo

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate
UuidToStringA

uxtheme

DrawThemeBackground
GetThemeBackgroundContentRect
IsThemeBackgroundPartiallyTransparent
CloseThemeData
GetCurrentThemeName
GetThemeColor
DrawThemeParentBackground
GetThemeMargins
GetThemePartSize
IsThemePartDefined
GetThemeInt
GetThemeBackgroundExtent
SetWindowTheme
GetThemeSysColor
GetThemeFont
IsAppThemed
IsThemeActive
GetThemeSysFont
OpenThemeData

shlwapi

UrlCanonicalizeW
AssocQueryStringW
SHCreateStreamOnFileEx
ord12
SHAutoComplete
StrToIntW

client

Release
GetClientManager
SetClientCallback

wininet

HttpQueryInfoW
InternetSetOptionW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
FindCloseUrlCache
InternetOpenW
InternetCloseHandle
InternetConnectW
InternetOpenUrlW
InternetReadFile
InternetQueryDataAvailable
InternetQueryOptionW
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW

ws2_32

WSAGetLastError
WSACleanup
WSAAsyncSelect
ioctlsocket
WSASetLastError
WSASocketW
getservbyport
ntohl
htons
htonl
socket
shutdown
send
select
recv
listen
getservbyname
inet_addr
inet_ntoa
ntohs
recvfrom
sendto
setsockopt
gethostbyaddr
gethostbyname
gethostname
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
getsockname
getsockopt

crypt32

CertCloseStore
CertFindCertificateInStore
CertVerifySubjectCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertGetNameStringW
CertOpenStore

dwmapi

DwmSetWindowAttribute

iphlpapi

IcmpSendEcho2
IcmpCreateFile
GetAdaptersInfo
SetIfEntry
GetTcpTable
GetIpForwardTable
GetIpNetTable
GetIfTable
GetIfEntry

vpn

GetVPNManager
SetCallback

libshred

shred_WipeFileList

winspool.drv

DocumentPropertiesW
GetPrinterW
OpenPrinterW
ClosePrinter

comdlg32

CommDlgExtendedError
GetSaveFileNameW
GetOpenFileNameW
PageSetupDlgW
PrintDlgW
ChooseFontW

msimg32

GradientFill
AlphaBlend

oleacc

LresultFromObject

comctl32

ImageList_Create
ord16
ImageList_GetImageInfo
ImageList_Replace
ImageList_SetBkColor
ImageList_Add
ImageList_Destroy
ord17
ImageList_GetIconSize
ImageList_Draw
ImageList_GetImageCount

Exports

Exports

pcre2_code_copy_16
pcre2_code_copy_with_tables_16
pcre2_code_free_16
pcre2_compile_16
pcre2_compile_context_copy_16
pcre2_compile_context_create_16
pcre2_compile_context_free_16
pcre2_config_16
pcre2_convert_context_copy_16
pcre2_convert_context_create_16
pcre2_convert_context_free_16
pcre2_general_context_copy_16
pcre2_general_context_create_16
pcre2_general_context_free_16
pcre2_get_error_message_16
pcre2_get_mark_16
pcre2_get_match_data_size_16
pcre2_get_ovector_count_16
pcre2_get_ovector_pointer_16
pcre2_get_startchar_16
pcre2_jit_compile_16
pcre2_jit_free_unused_memory_16
pcre2_jit_match_16
pcre2_jit_stack_assign_16
pcre2_jit_stack_create_16
pcre2_jit_stack_free_16
pcre2_match_16
pcre2_match_context_copy_16
pcre2_match_context_create_16
pcre2_match_context_free_16
pcre2_match_data_create_16
pcre2_match_data_create_from_pattern_16
pcre2_match_data_free_16
pcre2_set_bsr_16
pcre2_set_callout_16
pcre2_set_character_tables_16
pcre2_set_compile_extra_options_16
pcre2_set_compile_recursion_guard_16
pcre2_set_depth_limit_16
pcre2_set_glob_escape_16
pcre2_set_glob_separator_16
pcre2_set_heap_limit_16
pcre2_set_match_limit_16
pcre2_set_max_pattern_length_16
pcre2_set_newline_16
pcre2_set_offset_limit_16
pcre2_set_parens_nest_limit_16
pcre2_set_recursion_limit_16
pcre2_set_recursion_memory_management_16
pcre2_set_substitute_callout_16
sqlite3_carray_init
sqlite3_csv_init
sqlite3_fileio_init
sqlite3_regexp_init
sqlite3_series_init
sqlite3_shathree_init
sqlite3_uuid_init
sqlite3_vsv_init

Sections

.text
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 111KB - Virtual size: 339KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d92fed6e70d5623efc856368be4047b6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

rpcrt4

uxtheme

shlwapi

client

wininet

ws2_32

crypt32

dwmapi

iphlpapi

vpn

libshred

winspool.drv

comdlg32

msimg32

oleacc

comctl32

Exports

Exports

Sections

.text Size: 6.1MB - Virtual size: 6.1MB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 111KB - Virtual size: 339KB

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.text
Size: 6.1MB - Virtual size: 6.1MB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 111KB - Virtual size: 339KB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB