b9cad209ea54278aa75232bfe63460eb4132ad5523fb1d48a5b126545c1506fb

Sharing

Copy URL Twitter E-mail

General

Target

b9cad209ea54278aa75232bfe63460eb4132ad5523fb1d48a5b126545c1506fb
Size

1.0MB
MD5

8aaeecc42bf7e007a2c424b8e533e394
SHA1

86f232ea615064904162d867b6fdde8d16af57c3
SHA256

b9cad209ea54278aa75232bfe63460eb4132ad5523fb1d48a5b126545c1506fb
SHA512

cd22c92528f6aa16ac064167d31b3c036f1fe1ac47b901238dcab0ce0ba0c80bcc0db601ba16bed2f3e822f6aab9c81f8d832052bc79988e3f48c66a37ef6c9c
SSDEEP

12288:3jFtY8xEge8IlTLwcmN9OM35vAwIXGKshvEUcq2bXo58uXTWE6+V:35tY8ugQlTLwxN9OM3XIWfyUcBXOV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b9cad209ea54278aa75232bfe63460eb4132ad5523fb1d48a5b126545c1506fb

Files

b9cad209ea54278aa75232bfe63460eb4132ad5523fb1d48a5b126545c1506fb
.exe windows:6 windows x86 arch:x86

b3a1e1eedd162df005602efe1225abee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\work\video_clip\develop\ImageShow\Output\bin\Release\Win32\IShowSU.pdb

Imports

kernel32

SetFileAttributesW
DeviceIoControl
ReadFile
lstrlenA
GetSystemInfo
GetNativeSystemInfo
GetSystemTime
GetFileSize
ResetEvent
PostQueuedCompletionStatus
GetExitCodeThread
CreateIoCompletionPort
GetQueuedCompletionStatus
GetThreadLocale
SetThreadLocale
TerminateProcess
GetCurrentProcess
lstrcmpA
GetFileAttributesExW
CreateFileA
FlushFileBuffers
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
GetConsoleOutputCP
SetStdHandle
ReadConsoleW
GetConsoleMode
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
RemoveDirectoryW
CreateMutexW
SetFilePointer
GetStdHandle
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Process32NextW
GetSystemTimeAsFileTime
LCMapStringEx
GetCPInfo
QueryPerformanceFrequency
QueryPerformanceCounter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetStringTypeW
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
IsDebuggerPresent
MoveFileExW
GetTimeFormatW
GetFileSizeEx
ProcessIdToSessionId
MultiByteToWideChar
CreateToolhelp32Snapshot
SetEndOfFile
GetFileTime
TerminateThread
InitializeCriticalSection
WriteFile
CreateFileW
Sleep
GetVersion
GlobalFree
GlobalAlloc
MulDiv
VerSetConditionMask
VerifyVersionInfoW
GetVersionExW
GetCurrentProcessId
GetLogicalDriveStringsW
K32GetProcessImageFileNameW
K32GetModuleFileNameExW
GetLongPathNameW
QueryDosDeviceW
lstrlenW
GetFullPathNameW
LoadLibraryExW
lstrcmpiW
GetModuleHandleW
GetFileType
Process32FirstW
GetPrivateProfileIntW
SystemTimeToFileTime
GetTickCount
SetEvent
CreateEventW
WaitForSingleObject
SizeofResource
WaitForMultipleObjects
CopyFileW
CreateThread
RaiseException
CloseHandle
DeleteFileW
GetCurrentThreadId
FindClose
FindNextFileW
SetLastError
FindFirstFileW
CreateDirectoryW
WideCharToMultiByte
FreeLibrary
GetProcessHeap
DeleteCriticalSection
GetProcAddress
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
LoadResource
FindResourceExW
LoadLibraryW
HeapReAlloc
LockResource
OutputDebugStringW
GetLastError
GetPrivateProfileStringW
HeapSize
InitializeCriticalSectionEx
LeaveCriticalSection
GetModuleFileNameW
OpenProcess
ReleaseMutex
EnterCriticalSection
HeapFree
GetDateFormatW
WriteConsoleW

user32

SetWindowLongW
GetClassInfoExW
FindWindowExW
UnregisterClassW
IsWindow
SetFocus
LoadCursorW
RegisterClassExW
SendMessageW
CreateWindowExW
DestroyWindow
CallWindowProcW
DefWindowProcW
GetWindowLongW
GetParent
IsWindowVisible
EnableWindow
GetWindowTextW
PostQuitMessage
IsZoomed
MonitorFromRect
OffsetRect
SetLayeredWindowAttributes
UpdateLayeredWindow
GetCursor
SetWindowTextW
GetDlgItem
GetClientRect
MoveWindow
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
SetWindowPos
GetWindowRect
SetForegroundWindow
KillTimer
SetTimer
TranslateMessage
CharNextW
PeekMessageW
DispatchMessageW
GetMessageW
GetAncestor
EnumDisplaySettingsW
GetDesktopWindow
GetForegroundWindow
GetWindowInfo
WindowFromPoint
GetShellWindow
MonitorFromPoint
GetWindowThreadProcessId
CopyRect
SetRectEmpty
EqualRect
SetCursor
ClientToScreen
GetCursorPos
PtInRect
ScreenToClient
GetDoubleClickTime
IntersectRect
PostMessageW
GetDC
ReleaseDC
ShowWindow
IsRectEmpty
GetIconInfo
SystemParametersInfoW
GetWindowTextLengthW
GetFocus
DrawTextW
FillRect
UpdateWindow
SetActiveWindow
AttachThreadInput
BringWindowToTop
GetCaretBlinkTime
CreateCaret
SetCaretPos
GetSysColor
RegisterClipboardFormatW
BeginPaint
EndPaint
IsIconic
InvalidateRect
TrackMouseEvent
IsClipboardFormatAvailable
wsprintfW
SetCapture
ReleaseCapture
GetWindow
SetWindowRgn

gdi32

GetViewportOrgEx
RestoreDC
ExtSelectClipRgn
CreateRectRgnIndirect
SaveDC
SetTextCharacterExtra
GetCurrentObject
GetTextColor
CreateFontIndirectW
Rectangle
CreatePen
CreateSolidBrush
SetBkMode
SetBkColor
SetTextColor
SetBitmapBits
CreateRectRgn
CombineRgn
CreateRoundRectRgn
GetBitmapBits
StretchBlt
SetStretchBltMode
DeleteDC
BitBlt
SetPixel
SelectObject
CreateCompatibleDC
GetObjectW
CreateDIBSection
DeleteObject
GetStockObject
GetDeviceCaps

advapi32

LookupPrivilegeValueW
DuplicateTokenEx
RegDeleteValueW
CreateProcessAsUserW
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
OpenProcessToken
RegOpenKeyExW
GetTokenInformation

shell32

SHGetSpecialFolderPathW
ShellExecuteW
SHGetSpecialFolderPathA
ord165
SHCreateDirectoryExW

ole32

CoTaskMemAlloc
CoUninitialize
CoCreateInstance
CoInitialize
CoTaskMemFree
CoTaskMemRealloc
CreateStreamOnHGlobal
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
RegisterDragDrop
CoCreateGuid

oleaut32

LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
SysFreeString
SysStringLen
SysAllocStringLen
VarBstrCmp
SysAllocStringByteLen
SysStringByteLen
SysAllocString

shlwapi

PathSearchAndQualifyW
StrCmpIW
PathFileExistsW
PathRemoveFileSpecW
PathAppendW
PathIsDirectoryW
StrStrIW
PathFindFileNameW
PathIsRootW
PathCombineW
SHGetValueW

comctl32

ord17
DrawShadowText
InitCommonControlsEx

msimg32

AlphaBlend

wininet

InternetOpenW
InternetCrackUrlW
HttpQueryInfoW
InternetReadFile
InternetSetOptionW
InternetConnectW
HttpSendRequestW
InternetCloseHandle
HttpOpenRequestW

gdiplus

GdiplusStartup
GdipFree
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDrawString
GdipSetTextRenderingHint
GdipCreateSolidFill
GdipDeleteBrush
GdipBitmapLockBits
GdipCreateBitmapFromHICON
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipAlloc
GdipDrawImageRectI
GdipSetInterpolationMode
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipCreateFromHDC
GdipDisposeImage
GdipCloneImage

crypt32

CryptBinaryToStringW
CryptStringToBinaryW

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory
WTSQueryUserToken

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

netapi32

Netbios

iphlpapi

GetAdaptersInfo
GetIpAddrTable

Sections

.text
Size: 793KB - Virtual size: 792KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b3a1e1eedd162df005602efe1225abee

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

wininet

gdiplus

crypt32

wtsapi32

userenv

netapi32

iphlpapi

Sections

.text Size: 793KB - Virtual size: 792KB

.rdata Size: 144KB - Virtual size: 143KB

.data Size: 17KB - Virtual size: 97KB

.rsrc Size: 47KB - Virtual size: 46KB

.reloc Size: 42KB - Virtual size: 42KB

.text
Size: 793KB - Virtual size: 792KB

.rdata
Size: 144KB - Virtual size: 143KB

.data
Size: 17KB - Virtual size: 97KB

.rsrc
Size: 47KB - Virtual size: 46KB

.reloc
Size: 42KB - Virtual size: 42KB