4b4e4f5293fafbf5e858b2fd564cfed860488c44512019c4e39da44f65e8f82e

Sharing

Copy URL Twitter E-mail

General

Target

4b4e4f5293fafbf5e858b2fd564cfed860488c44512019c4e39da44f65e8f82e
Size

11.2MB
MD5

4dd7803e991a6d101c70d639db08a475
SHA1

b6fdbf48f386a0a4f3721fed9baea9c0f5d11d44
SHA256

4b4e4f5293fafbf5e858b2fd564cfed860488c44512019c4e39da44f65e8f82e
SHA512

56ff2511580976b8bfeb185e387f415a9cf12b22e5ade8ef6fadd0ca5770a703919997bcfc1555d254b747689c6a7b6c34aa4fcbe5d6035d4ec42cd625272913
SSDEEP

98304:C0MOqdInuDOqq3m839lLBQ0kZ/bU7PGGDb4vLtZy3ujVXzlJsv6tWKFdu9CCv77j:dqZ6E8tl1z4v1lJsv6tWKFdu9CCT7O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4b4e4f5293fafbf5e858b2fd564cfed860488c44512019c4e39da44f65e8f82e

Files

4b4e4f5293fafbf5e858b2fd564cfed860488c44512019c4e39da44f65e8f82e
.exe windows:6 windows x86 arch:x86

61ebb27f6b8b77ac07bf9a2c02202e92

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

imm32

ImmReleaseContext
ImmGetDefaultIMEWnd
ImmAssociateContext
ImmGetContext
ImmAssociateContextEx
ImmGetCompositionStringW
ImmGetOpenStatus
ImmNotifyIME
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetVirtualKey

oleaut32

SysAllocString
SafeArrayCreateVector
SafeArrayPutElement

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

gdi32

SelectObject
CreateDIBSection
GdiFlush
BitBlt
OffsetRgn
GetDeviceCaps
CreateCompatibleBitmap
CreateDCW
CreateBitmap
ChoosePixelFormat
SelectClipRgn
GetPixelFormat
SetPixelFormat
SwapBuffers
GetBitmapBits
GetObjectW
CreateFontIndirectW
EnumFontFamiliesExW
GetFontData
GetStockObject
AddFontResourceExW
RemoveFontResourceExW
AddFontMemResourceEx
RemoveFontMemResourceEx
GetTextMetricsW
GetTextFaceW
GetCharABCWidthsW
GetCharABCWidthsFloatW
GetGlyphOutlineW
GetOutlineTextMetricsW
GetTextExtentPoint32W
GetCharABCWidthsI
SetBkMode
SetGraphicsMode
SetTextColor
SetTextAlign
SetWorldTransform
ExtTextOutW
GetRegionData
DeleteObject
DeleteDC
CreateRectRgn
CreateCompatibleDC
CombineRgn
GetDIBits
DescribePixelFormat

uxtheme

GetThemeEnumValue
GetThemeMargins
GetThemePropertyOrigin
GetThemePartSize
GetThemeColor
GetThemeTransitionDuration
GetThemeInt
GetCurrentThemeName
IsAppThemed
IsThemeActive
SetWindowTheme
GetThemeBool
IsThemeBackgroundPartiallyTransparent
GetThemeBackgroundRegion
ord47
CloseThemeData
OpenThemeData

dwmapi

DwmIsCompositionEnabled
DwmEnableBlurBehindWindow

ole32

DoDragDrop
CoTaskMemFree
ReleaseStgMedium
CoGetMalloc
OleIsCurrentClipboard
StringFromGUID2
CoUninitialize
CoCreateInstance
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleInitialize
CoCreateGuid
OleFlushClipboard
OleGetClipboard
OleSetClipboard
CoInitialize
CoInitializeEx
OleUninitialize

advapi32

MapGenericMask
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
LookupAccountSidW
SystemFunction036
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegFlushKey
RegQueryInfoKeyW
RegSetValueExW
OpenProcessToken
AccessCheck
AllocateAndInitializeSid
CopySid
DuplicateToken
GetEffectiveRightsFromAclW
GetNamedSecurityInfoW
BuildTrusteeWithSidW
GetTokenInformation
GetLengthSid
FreeSid

user32

SetMenuItemInfoW
GetMenuItemInfoW
TrackPopupMenu
RemoveMenu
ModifyMenuW
AppendMenuW
InsertMenuW
DestroyMenu
CreatePopupMenu
CreateMenu
DrawMenuBar
SetMenu
LoadImageW
GetSysColorBrush
ChildWindowFromPointEx
GetCursorPos
GetClientRect
GetFocus
RegisterClassExW
GetClassInfoW
UnregisterClassW
GetKeyboardLayoutList
GetAncestor
MonitorFromPoint
DestroyIcon
DestroyCursor
GetWindow
GetWindowThreadProcessId
SetParent
GetParent
SetWindowLongW
GetWindowLongW
ScreenToClient
ClientToScreen
SetCursor
AdjustWindowRectEx
GetWindowRect
SetWindowTextW
InvalidateRect
SetWindowRgn
GetUpdateRect
EndPaint
GetMenu
SetForegroundWindow
GetForegroundWindow
EnableMenuItem
GetSystemMenu
ReleaseCapture
SetCapture
MonitorFromWindow
IsTouchWindow
UnregisterTouchWindow
RegisterTouchWindow
SetFocus
PeekMessageW
IsWindowVisible
SetWindowPlacement
GetWindowPlacement
SetWindowPos
MoveWindow
FlashWindowEx
SetLayeredWindowAttributes
UpdateLayeredWindow
ShowWindow
IsChild
CreateWindowExW
AttachThreadInput
PostMessageW
SendMessageW
UpdateLayeredWindowIndirect
GetCaretBlinkTime
MessageBeep
IsWindow
GetDoubleClickTime
GetDesktopWindow
GetSysColor
ReleaseDC
GetDC
DestroyWindow
DefWindowProcW
SystemParametersInfoW
GetSystemMetrics
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
KillTimer
SetTimer
MsgWaitForMultipleObjectsEx
GetQueueStatus
DispatchMessageW
TranslateMessage
GetTouchInputInfo
IsZoomed
TrackPopupMenuEx
SetCursorPos
GetCursor
LoadCursorW
CreateCursor
CreateIconIndirect
GetMonitorInfoW
EnumDisplayMonitors
LoadIconW
IsHungAppWindow
SetClipboardViewer
ChangeClipboardChain
RegisterClipboardFormatW
GetKeyboardLayout
RegisterWindowMessageW
IsWindowEnabled
CreateCaret
DestroyCaret
ShowCaret
SetCaretPos
GetCapture
GetIconInfo
GetCursorInfo
RegisterClassW
EnumDisplayDevicesW
GetClipboardFormatNameW
TrackMouseEvent
GetMessageExtraInfo
GetAsyncKeyState
RegisterDeviceNotificationW
UnregisterDeviceNotification
CharNextExA
FindWindowA
GetKeyState
GetKeyboardState
ToAscii
ToUnicode
IsIconic
MapVirtualKeyW
DrawIconEx
MessageBoxW
ChangeWindowMessageFilterEx
RealGetWindowClassW
EnumWindows
GetWindowTextW
CloseTouchInputHandle
BeginPaint

netapi32

NetApiBufferFree
NetShareEnum

userenv

GetUserProfileDirectoryW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

InitializeSListHead
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
VirtualFree
GetUserGeoID
GetGeoInfoW
GetTimeZoneInformation
GetModuleHandleExW
FreeLibrary
FindNextFileW
FindFirstFileExW
MultiByteToWideChar
FindNextChangeNotification
FindFirstChangeNotificationW
FindCloseChangeNotification
RegisterWaitForSingleObject
UnregisterWaitEx
SetFilePointerEx
SetEndOfFile
VirtualAlloc
CreateMutexW
GetExitCodeProcess
ReleaseMutex
GetFileType
FlushFileBuffers
GetFileInformationByHandleEx
SystemTimeToFileTime
FileTimeToSystemTime
TzSpecificLocalTimeToSystemTime
MoveFileExW
MoveFileW
CopyFileW
DeviceIoControl
GetVolumePathNamesForVolumeNameW
GetTempPathW
SetFileTime
RemoveDirectoryW
GetLogicalDrives
GetFullPathNameW
GetFileInformationByHandle
GetFileAttributesW
FindFirstFileW
FindClose
DeleteFileW
CreateDirectoryW
GetCurrentDirectoryW
GetModuleFileNameW
GetStartupInfoW
CompareStringW
GetTickCount64
QueryPerformanceFrequency
QueryPerformanceCounter
GetFileAttributesExW
GetUserPreferredUILanguages
GetUserDefaultLCID
GetCurrencyFormatW
GetTimeFormatW
GetDateFormatW
ResetEvent
GetSystemInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread
TerminateThread
GetThreadPriority
SetThreadPriority
GetCurrentThread
CreateThread
WaitForMultipleObjects
DuplicateHandle
LoadLibraryW
GetSystemDirectoryW
CreateEventW
WaitForSingleObjectEx
SetEvent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
OutputDebugStringW
GetLocalTime
GetSystemTime
GetCommandLineW
CompareStringEx
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
ExitProcess
GetConsoleWindow
GetDriveTypeW
GetVolumeInformationW
GetLongPathNameW
WideCharToMultiByte
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
WriteFile
ReadFile
CreateFileW
LocalAlloc
GetUserDefaultLangID
GetCurrentProcessId
GlobalSize
LoadLibraryA
GetLocaleInfoW
GlobalLock
GlobalUnlock
GlobalAlloc
CheckRemoteDebuggerPresent
CreateProcessW
CloseHandle
ExpandEnvironmentStringsW
SetErrorMode
WTSGetActiveConsoleSessionId
FormatMessageW
LocalFree
GetProcAddress
GetModuleHandleW
GetCurrentThreadId
GetLastError
lstrcmpW
K32GetModuleBaseNameW
K32EnumProcessModulesEx
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
VirtualFreeEx
WriteProcessMemory
ReadProcessMemory
VirtualAllocEx
OpenProcess
CreateRemoteThread
WaitForSingleObject
Sleep
IsDebuggerPresent

shell32

SHGetKnownFolderPath
CommandLineToArgvW
Shell_NotifyIconGetRect
Shell_NotifyIconW
SHBrowseForFolderW
SHGetKnownFolderIDList
SHGetPathFromIDListW
SHGetMalloc
SHCreateItemFromParsingName
SHCreateItemFromIDList
ShellExecuteW
ord727
SHGetStockIconInfo
SHGetFileInfoW

msvcp140

??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Xlength_error@std@@YAXPBD@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Cnd_signal
_Cnd_wait
_Cnd_destroy
_Cnd_init
_Mtx_unlock
_Mtx_lock
_Mtx_destroy
_Mtx_init
_Thrd_id
_Thrd_join
_Thrd_start
?_Throw_C_error@std@@YAXH@Z
?classic@locale@std@@SAABV12@XZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?tolower@?$ctype@D@std@@QBEDD@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?id@?$ctype@D@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ

vcruntime140

__std_exception_copy
__std_exception_destroy
_except_handler4_common
memchr
longjmp
strrchr
_CxxThrowException
strstr
wcsstr
memmove
_purecall
memcpy
strchr
wcsrchr
__CxxFrameHandler3
__std_terminate
_setjmp3
memset

api-ms-win-crt-runtime-l1-1-0

abort
strerror
_exit
exit
_invalid_parameter_noinfo_noreturn
_controlfp_s
_crt_atexit
_endthreadex
_register_onexit_function
_initialize_onexit_table
terminate
__p___argc
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_app_type
__p___argv
_configure_narrow_argv
_initialize_narrow_environment
_get_narrow_winmain_command_line
_initterm
_initterm_e
_errno
_c_exit
_cexit

api-ms-win-crt-heap-l1-1-0

_callnewh
realloc
malloc
calloc
free
_set_new_mode

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
_write
__p__commode
_read
_fseeki64
fgets
_open_osfhandle
_close
_lseeki64
fwrite
_fileno
_set_fmode
feof
_get_osfhandle
__stdio_common_vsscanf
__stdio_common_vsprintf
__stdio_common_vsnprintf_s
__stdio_common_vfprintf
ftell
fflush
__stdio_common_vswprintf_s
fseek
fread
fopen
fclose
_ftelli64

api-ms-win-crt-string-l1-1-0

strcpy_s
isdigit
wcsncmp
strncmp
strncpy
isspace
toupper

api-ms-win-crt-math-l1-1-0

_libm_sse2_log10_precise
_except1
ceil
__setusermatherr
_libm_sse2_atan_precise
_libm_sse2_cos_precise
_libm_sse2_sin_precise
_libm_sse2_tan_precise
_libm_sse2_log_precise
_libm_sse2_exp_precise
floor
_libm_sse2_sqrt_precise
lround
_libm_sse2_asin_precise
_CIatan2
_libm_sse2_pow_precise
_libm_sse2_acos_precise
_dtest

api-ms-win-crt-utility-l1-1-0

qsort
rand_s
bsearch
rand

api-ms-win-crt-convert-l1-1-0

atol
atoi

api-ms-win-crt-environment-l1-1-0

_wgetenv_s
getenv_s
getenv

api-ms-win-crt-filesystem-l1-1-0

_wchmod
_waccess

api-ms-win-crt-time-l1-1-0

_localtime64_s
_mktime64
_tzset
_get_tzname
_get_timezone

api-ms-win-crt-locale-l1-1-0

setlocale
_configthreadlocale

winmm

timeKillEvent
timeSetEvent

ws2_32

WSAAsyncSelect

Sections

.text
Size: 7.4MB - Virtual size: 7.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 91KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmetad
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 1024B - Virtual size: 548B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 266KB - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 245KB - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

61ebb27f6b8b77ac07bf9a2c02202e92

Headers

DLL Characteristics

File Characteristics

Imports

imm32

oleaut32

wtsapi32

gdi32

uxtheme

dwmapi

ole32

advapi32

user32

netapi32

userenv

version

kernel32

shell32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

winmm

ws2_32

Sections

.text Size: 7.4MB - Virtual size: 7.4MB

.rdata Size: 3.2MB - Virtual size: 3.2MB

.data Size: 91KB - Virtual size: 150KB

.qtmetad Size: 1KB - Virtual size: 1KB

_RDATA Size: 1024B - Virtual size: 548B

.rsrc Size: 266KB - Virtual size: 265KB

.reloc Size: 245KB - Virtual size: 244KB

.text
Size: 7.4MB - Virtual size: 7.4MB

.rdata
Size: 3.2MB - Virtual size: 3.2MB

.data
Size: 91KB - Virtual size: 150KB

.qtmetad
Size: 1KB - Virtual size: 1KB

_RDATA
Size: 1024B - Virtual size: 548B

.rsrc
Size: 266KB - Virtual size: 265KB

.reloc
Size: 245KB - Virtual size: 244KB