2b902ec8d423b1f26ff310a5578ef99230001bdf963c62f5a80d2284ac27bf24

Sharing

Copy URL Twitter E-mail

General

Target

2b902ec8d423b1f26ff310a5578ef99230001bdf963c62f5a80d2284ac27bf24
Size

903KB
MD5

e4cce37bc6253212a4ca9c1830d44ebe
SHA1

45838a9950e5cd13c5608dd86cc3e52937ac3379
SHA256

2b902ec8d423b1f26ff310a5578ef99230001bdf963c62f5a80d2284ac27bf24
SHA512

ace407d0b2d537c7874aadfffa4ee94cdb81dbfd677e29ae5229ef7a9047faeef1843f0c557f1b5ca57545656020e98e3b29c458d0b37490e8608e7a553c2c5e
SSDEEP

24576:kGObe/JvgDmKPwWrkpy05Cz9AhOiPDviKjNY3y6XO:6EJoDmKPwWopjg9A09

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b902ec8d423b1f26ff310a5578ef99230001bdf963c62f5a80d2284ac27bf24

Files

2b902ec8d423b1f26ff310a5578ef99230001bdf963c62f5a80d2284ac27bf24
.exe windows:5 windows x86 arch:x86

b67524c72a83584365c8ef6210ad0128

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\po\trunk\modules\gxonecli\Release\gxonecli.pdb

Imports

kernel32

CloseHandle
GetDriveTypeW
GetLogicalDrives
lstrcpynW
LocalAlloc
lstrlenW
GetDiskFreeSpaceExW
WaitForSingleObject
CreateEventW
CreateThread
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlushFileBuffers
lstrcmpiA
GetWindowsDirectoryW
lstrcpyA
SetFileAttributesW
Module32NextW
OpenEventW
GetFileAttributesExW
CreateToolhelp32Snapshot
FindNextFileW
lstrcatW
GetConsoleMode
GetConsoleCP
GetModuleFileNameW
GetModuleHandleW
OutputDebugStringW
GetModuleHandleA
Process32NextW
ExitProcess
lstrcpyW
DeleteFileW
GetVersionExW
LocalFree
GetCommandLineW
lstrcmpiW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
HeapFree
HeapAlloc
Sleep
GetProcAddress
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapSize
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
FreeLibrary
InterlockedExchange
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetLocaleInfoW
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetFileSize
ReadFile
CreateFileW
LoadLibraryW
GetCurrentDirectoryW
FreeResource
FindResourceW
LoadResource
SizeofResource
LockResource
DosDateTimeToFileTime
SetFilePointer
SystemTimeToFileTime
MulDiv
GetLocalTime
GlobalLock
GlobalAlloc
GlobalUnlock
CreateFileA
lstrcmpA
FindFirstFileW
lstrlenA
VirtualQuery
lstrcpynA
CreateProcessW
GlobalSize
SetEvent
GetDriveTypeA
InitializeCriticalSection
OpenProcess
CopyFileW
GetFileAttributesW
FileTimeToSystemTime
lstrcmpW
GlobalFree
FindClose
Process32FirstW
QueryDosDeviceW
DeviceIoControl
Module32FirstW
WriteConsoleW

user32

ReleaseDC
InvalidateRect
IntersectRect
GetDC
GetUpdateRect
PtInRect
BeginPaint
TrackMouseEvent
GetFocus
GetKeyState
KillTimer
SetCapture
EndPaint
MoveWindow
SetWindowTextW
GetCaretBlinkTime
GetCaretPos
GetWindowTextW
GetWindowTextLengthW
SetRect
CharPrevW
DrawTextW
FillRect
SetCaretPos
CreateCaret
GetSysColor
ShowCaret
HideCaret
ClientToScreen
GetGUIThreadInfo
CreateAcceleratorTableW
InvalidateRgn
SetClipboardData
OpenClipboard
GetDesktopWindow
EndDialog
EmptyClipboard
CloseClipboard
GetDlgItem
SetDlgItemTextW
GetDlgItemTextW
SendDlgItemMessageW
DialogBoxIndirectParamW
GetActiveWindow
ReleaseCapture
MapWindowPoints
IsRectEmpty
SetCursor
wvsprintfW
OffsetRect
UnionRect
GetWindowRect
IsIconic
LoadImageW
SetFocus
GetClassInfoExW
wsprintfW
SetPropW
MonitorFromWindow
RegisterClassW
GetMonitorInfoW
CallWindowProcW
GetWindow
CharNextW
IsWindowVisible
MessageBoxW
IsWindow
ShowWindow
GetCursorPos
EnableWindow
GetClientRect
GetParent
ScreenToClient
GetPropW
SetTimer
DestroyIcon
GetIconInfo
SetWindowPos
PostMessageW
GetForegroundWindow
FindWindowW
SetForegroundWindow
DispatchMessageW
DefWindowProcW
UpdateWindow
CreateWindowExW
SetWindowLongW
SetClassLongW
GetWindowLongW
CreateDialogIndirectParamW
LoadIconW
RegisterClassExW
GetSystemMetrics
DestroyWindow
GetMessageW
PostQuitMessage
LoadCursorW
TranslateMessage
IsDialogMessageW
SendMessageW

gdi32

GetTextMetricsW
RestoreDC
GetStockObject
CreatePen
SaveDC
GetObjectW
DeleteObject
Rectangle
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
CreateFontIndirectW
DeleteDC
BitBlt
SetWindowOrgEx
CreateDIBSection
CreateSolidBrush
GetDeviceCaps
MoveToEx
GetTextExtentPoint32W
LineTo
StretchBlt
SetBkColor
GdiFlush
SelectClipRgn
CreatePenIndirect
CreateRectRgnIndirect
CombineRgn
CreatePatternBrush
SetBkMode
SetTextColor
GetObjectA
TextOutW
ExtSelectClipRgn
RoundRect
ExtTextOutW
GetCharABCWidthsW
SetStretchBltMode
CreateRoundRectRgn
GetClipBox

shell32

ShellExecuteA
SHGetSpecialFolderPathW
ord165
SHOpenFolderAndSelectItems
SHAppBarMessage
SHGetDesktopFolder
CommandLineToArgvW
ord727
SHGetFileInfoW
ShellExecuteW

ole32

GetHGlobalFromStream
CoTaskMemFree
CoCreateGuid
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
CoUninitialize
OleLockRunning
CoCreateInstance
CoInitialize

gdiplus

GdipSetSmoothingMode
GdipFree
GdipGetImageHeight
GdipCreateBitmapFromHICON
GdipGetImagePixelFormat
GdipCreateBitmapFromScan0
GdiplusStartup
GdipGetImageWidth
GdipCloneImage
GdipBitmapLockBits
GdipSaveImageToFile
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdipSetPageUnit
GdipAlloc
GdipGetImageEncodersSize
GdipDisposeImage
GdiplusShutdown
GdipDeleteBrush
GdipCloneBrush
GdipCreateFontFromLogfontA
GdipSetStringFormatLineAlign
GdipSetTextRenderingHint
GdipDeleteFont
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipDrawImageRectI
GdipSetStringFormatAlign
GdipGraphicsClear
GdipDrawImage
GdipImageGetFrameCount
GdipGetFamily
GdipDeleteFontFamily
GdipDrawString
GdipCreateFromHDC
GdipSetCompositingQuality
GdipCreateLineBrushI
GdipSetInterpolationMode
GdipCreateStringFormat
GdipSetPixelOffsetMode
GdipDeleteStringFormat
GdipCreateFontFromDC
GdipLoadImageFromStream
GdipImageGetFrameDimensionsList
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameDimensionsCount
GdipLoadImageFromFile

comctl32

ord17

imm32

ImmSetCompositionWindow
ImmSetCompositionFontW
ImmReleaseContext
ImmGetContext

shlwapi

PathFindFileNameW
PathFileExistsW
SHDeleteValueW
PathIsDirectoryW
PathAppendW
SHCreateStreamOnFileW
PathFileExistsA
StrCatBuffW
wnsprintfW
wvnsprintfW
PathFindExtensionW
SHGetValueA
PathRemoveFileSpecW
StrStrIW
StrChrW
SHGetValueW
SHDeleteKeyW
StrCmpNIW
SHSetValueW
StrChrA
wnsprintfA
StrCmpNIA
wvnsprintfA

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

ws2_32

WSAStartup

psapi

GetProcessImageFileNameW

imagehlp

ImageGetCertificateData
ImageEnumerateCertificates

crypt32

CertGetNameStringW
CryptDecodeObjectEx
CertCloseStore
CertEnumCertificatesInStore
CryptQueryObject
CryptMsgClose

comdlg32

GetOpenFileNameW

advapi32

InitializeSecurityDescriptor
SetFileSecurityW
AllocateAndInitializeSid
SetEntriesInAclW
RegEnumValueW
FreeSid
RegOpenKeyExW
RegCreateKeyExW
SetSecurityDescriptorDacl
GetUserNameW
RegSetValueExW
RegCloseKey

oleaut32

SysFreeString
SysAllocString
VariantClear
VariantInit

Sections

.text
Size: 626KB - Virtual size: 626KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 126KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b67524c72a83584365c8ef6210ad0128

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

ole32

gdiplus

comctl32

imm32

shlwapi

version

ws2_32

psapi

imagehlp

crypt32

comdlg32

advapi32

oleaut32

Sections

.text Size: 626KB - Virtual size: 626KB

.rdata Size: 126KB - Virtual size: 126KB

.data Size: 16KB - Virtual size: 39KB

.rsrc Size: 85KB - Virtual size: 85KB

.reloc Size: 47KB - Virtual size: 46KB

.text
Size: 626KB - Virtual size: 626KB

.rdata
Size: 126KB - Virtual size: 126KB

.data
Size: 16KB - Virtual size: 39KB

.rsrc
Size: 85KB - Virtual size: 85KB

.reloc
Size: 47KB - Virtual size: 46KB