521a4deab12910ae81c47ceffe69ff701dd550bb8a21e7c68034e3f9148719e0

Sharing

Copy URL Twitter E-mail

General

Target

521a4deab12910ae81c47ceffe69ff701dd550bb8a21e7c68034e3f9148719e0
Size

1.9MB
MD5

2b9f347c9768d09fadd4f6c1e3871c7a
SHA1

bf5702d0a93e545d05d01bab1cafacfa07e3e35e
SHA256

521a4deab12910ae81c47ceffe69ff701dd550bb8a21e7c68034e3f9148719e0
SHA512

f53b4e83f9cc6279e76c3ab49d8afbc70173b96649898c68867b433e88cc069cef7057b13eda019dcf99863d935bd72c2070e568713fa114e0b2e5b870096c3f
SSDEEP

49152:+G8G83YCUj7Xv41ByCNAkHmrqFbA/0x2YS6RQQyWCDw:+G8Gv4rvS6RQG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
521a4deab12910ae81c47ceffe69ff701dd550bb8a21e7c68034e3f9148719e0

Files

521a4deab12910ae81c47ceffe69ff701dd550bb8a21e7c68034e3f9148719e0
.exe windows:5 windows x86 arch:x86

747b45e80ec9c87d040f6c0384f9352d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\code_version\code_3.2.5.1\src\New_Screener\Release\Screener.pdb

Imports

kernel32

IsBadReadPtr
RemoveDirectoryW
FindFirstFileW
GetFileSizeEx
SetFilePointer
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
FlushViewOfFile
lstrcpynA
lstrlenA
MoveFileExW
GetFileSize
SetFileAttributesW
HeapSize
HeapDestroy
InterlockedIncrement
InterlockedDecrement
GetThreadLocale
SetThreadLocale
OutputDebugStringA
VerSetConditionMask
DeleteCriticalSection
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetSystemInfo
GetWindowsDirectoryW
GetSystemDirectoryW
FormatMessageW
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
GetCurrentThreadId
WideCharToMultiByte
SetEndOfFile
WriteConsoleW
FlushFileBuffers
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
SetConsoleCtrlHandler
GetConsoleCP
SetStdHandle
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetFileType
GetCurrentThread
GetACP
GetStdHandle
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindNextFileW
FindFirstFileExW
FindClose
ReadFile
InterlockedFlushSList
RtlUnwind
QueryPerformanceCounter
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetVolumeInformationW
GetLongPathNameW
SystemTimeToFileTime
GetSystemTime
lstrlenW
GetVersionExW
DeleteFileW
CreateDirectoryW
CreateDirectoryA
lstrcatA
lstrcpynW
GetTempPathW
GetTickCount
lstrcatW
GetPrivateProfileStringW
GetLocalTime
GetPrivateProfileIntW
GetCommandLineW
GetCurrentProcess
TerminateProcess
LocalFree
CloseHandle
WriteFile
CreateFileW
LocalAlloc
MulDiv
GlobalFree
GlobalUnlock
SetLastError
lstrcmpW
FreeResource
GlobalLock
GlobalAlloc
DecodePointer
OutputDebugStringW
CreateMutexW
FindResourceExW
LockResource
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
GetLastError
EnterCriticalSection
RaiseException
LeaveCriticalSection
lstrcmpiW
GetModuleHandleW
VerifyVersionInfoW
GetModuleHandleA
OpenProcess
GetCurrentProcessId
GetTempFileNameW
GetVersion
WaitForSingleObjectEx
ResetEvent
SetEvent
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
LoadLibraryW
SetFileTime
GetFileTime
InitializeCriticalSection
WaitForSingleObject
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
IsDebuggerPresent
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
GetProcAddress
FreeLibrary
GetEnvironmentStringsW
TerminateThread
Sleep
TlsGetValue
TlsAlloc
CreateEventW
GetCPInfo
EncodePointer
GetStringTypeW
CopyFileW
GlobalSize
CreateThread
GetProfileIntW

user32

FindWindowW
DestroyCursor
LoadStringW
LoadMenuW
LoadAcceleratorsW
UnregisterClassW
GetDC
GetDCEx
UpdateWindow
SetCapture
GetCapture
InvalidateRect
SetRect
SetCursor
PeekMessageW
SetWindowLongW
RegisterClassExW
LoadImageW
GetClassInfoExW
CreateWindowExW
GetDesktopWindow
GetWindowRect
SendMessageW
MapWindowPoints
TrackMouseEvent
SetWindowPos
GetWindowLongW
BeginPaint
EndPaint
IsClipboardFormatAvailable
RegisterClipboardFormatW
GetSysColor
SetCaretPos
CreateCaret
GetCaretBlinkTime
KillTimer
SetTimer
wsprintfW
GetMessageW
DispatchMessageW
TranslateMessage
ShowWindow
CharNextW
DefWindowProcW
ReleaseCapture
ReleaseDC
CreateDialogParamW
GetSysColorBrush
CopyRect
PtInRect
InflateRect
DrawTextW
LoadCursorW
FillRect
GetCursorPos
ScreenToClient
GetMessagePos
SystemParametersInfoW
MonitorFromRect
MonitorFromPoint
CreatePopupMenu
DestroyMenu
TrackPopupMenuEx
AppendMenuW
GetMenuItemCount
RemoveMenu
GetMenuItemInfoW
MessageBeep
TranslateAcceleratorW
PostQuitMessage
LoadStringA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
SendMessageTimeoutW
SetWindowTextW
IsRectEmpty
SetForegroundWindow
GetSystemMetrics
FindWindowExW
GetWindowTextW
GetWindowTextLengthW
CallWindowProcW
GetWindow
MonitorFromWindow
GetMonitorInfoW
MoveWindow
IsWindowVisible
IsWindow
PostMessageW
GetKeyState
DestroyWindow
GetClientRect
SetFocus
GetDlgItem
SetClassLongW
GetParent
IsIconic
SetLayeredWindowAttributes
ClientToScreen
SetWindowRgn
EnableWindow
GetForegroundWindow
IsZoomed
OffsetRect
UpdateLayeredWindow
SetRectEmpty
GetDoubleClickTime
IntersectRect
GetWindowThreadProcessId
AttachThreadInput
BringWindowToTop
SetActiveWindow
GetIconInfo
DrawIconEx
GetFocus
EqualRect

gdi32

CreateRectRgn
GetBitmapBits
SetBitmapBits
CreateDCW
StretchBlt
EnumFontFamiliesExW
CreateCompatibleBitmap
CreateFontW
CreateDIBSection
BitBlt
CreateCompatibleDC
GetDIBits
GetObjectW
GetDeviceCaps
GetPixel
SetPixel
RestoreDC
CreateSolidBrush
PatBlt
UnrealizeObject
SetROP2
SetWindowOrgEx
SetViewportOrgEx
SetMapMode
SaveDC
CreatePatternBrush
CreateBitmap
CreatePen
DeleteDC
GetStockObject
Rectangle
SelectObject
SetTextColor
SetBkMode
DeleteObject
LineTo
Polygon
MoveToEx
CreateRoundRectRgn
CombineRgn
ExtSelectClipRgn
CreateRectRgnIndirect
CreateFontIndirectW
SetStretchBltMode
SetBkColor
GetTextColor
GetCurrentObject
SetTextCharacterExtra
GetViewportOrgEx
CopyMetaFileW

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

GetUserNameW
RegQueryValueExW
GetSidIdentifierAuthority
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
GetSidSubAuthority
GetSidSubAuthorityCount
IsValidSid

shell32

SHGetFolderPathW
CommandLineToArgvW
ShellExecuteW
SHGetFolderPathA
SHCreateDirectoryExW
SHGetSpecialFolderPathW
ord165

ole32

RegisterDragDrop
RevokeDragDrop
OleSetContainedObject
OleCreateStaticFromData
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleDuplicateData
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
ReleaseStgMedium

oleaut32

SysFreeString
SysAllocString
OleLoadPicture
VarUI4FromStr
SysAllocStringByteLen
VarBstrCmp
SysAllocStringLen
LoadTypeLi
SysStringByteLen
LoadRegTypeLi
SysStringLen

shlwapi

StrCmpIW
PathAddBackslashW
PathAppendW
SHSetValueW
PathFileExistsW
PathRemoveFileSpecW
PathIsDirectoryW
PathIsRootW
StrFormatByteSizeW
PathRelativePathToW
PathCommonPrefixW
PathIsPrefixW
PathRemoveBackslashW
PathCanonicalizeW
PathCombineW
StrCpyNW
PathSearchAndQualifyW
SHGetValueW

comctl32

ord17
InitCommonControlsEx

msimg32

AlphaBlend

gdiplus

GdipCreateCustomLineCap
GdipDeleteCustomLineCap
GdipSetCustomLineCapWidthScale
GdipSetCustomLineCapStrokeCaps
GdipSetPenCustomEndCap
GdipSetPenStartCap
GdipSetPenBrushFill
GdipDrawLineI
GdipAddPathEllipseI
GdipDrawPath
GdipSetPenEndCap
GdiplusStartup
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipDisposeImage
GdipCloneImage
GdipAddPathLineI
GdipLoadImageFromStreamICM
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageRectRectI
GdipDeletePath
GdipCreatePath
GdipCloneBrush
GdipFree
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDrawString
GdipSetTextRenderingHint
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipGetImagePixelFormat
GdipDrawImageRectI
GdipGetImageGraphicsContext
GdipDeleteBrush
GdipCreateSolidFill
GdipSetSmoothingMode
GdipDeletePen
GdipCreatePen1
GdipDeleteGraphics
GdipCreateFromHDC
GdipLoadImageFromStream
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipSaveImageToFile
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSetInterpolationMode
GdipAlloc

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

crypt32

CryptBinaryToStringA
CryptBinaryToStringW
CryptStringToBinaryA
CryptStringToBinaryW

riched20

ord4

imagehlp

ImageNtHeader

wintrust

CryptCATCatalogInfoFromContext
CryptCATAdminAcquireContext
WinVerifyTrust
CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 225KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 94KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

747b45e80ec9c87d040f6c0384f9352d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

version

crypt32

riched20

imagehlp

wintrust

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 225KB - Virtual size: 225KB

.data Size: 94KB - Virtual size: 170KB

.gfids Size: 2KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 79KB - Virtual size: 78KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 225KB - Virtual size: 225KB

.data
Size: 94KB - Virtual size: 170KB

.gfids
Size: 2KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 79KB - Virtual size: 78KB