f896273015bb483897a4a811995269a84469aa4d2b4049e5badcb3fd5af9eb3d

Sharing

Copy URL Twitter E-mail

General

Target

f896273015bb483897a4a811995269a84469aa4d2b4049e5badcb3fd5af9eb3d
Size

7.5MB
MD5

d54f3d9688c812c26b281d04b84dfc13
SHA1

eaa3d16523394a00c2256e073ca40c62f2a031e3
SHA256

f896273015bb483897a4a811995269a84469aa4d2b4049e5badcb3fd5af9eb3d
SHA512

066628f443e0d93334e4640e1a97c160fd3569f6a3935a7bea15c844f31c9ce1a855fd826e9a2d924b90a6471bc860d3899a4673e70b2a34c8c5de49aa8443fd
SSDEEP

196608:OVHzqMmwpzPHZqthopqkahQn985VkI9yHKRLr3n5:C3mE2kaDvyH0p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f896273015bb483897a4a811995269a84469aa4d2b4049e5badcb3fd5af9eb3d

Files

f896273015bb483897a4a811995269a84469aa4d2b4049e5badcb3fd5af9eb3d
.exe windows:6 windows x86 arch:x86

2ea7b49135ecd57bd1f8fd7df20d2c65

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

H:\work\MH03New\loggerNew\logger\Release\Logger.pdb

Imports

ws2_32

getpeername
connect
bind
send
recv
getsockname
getsockopt
ntohs
WSAIoctl
getaddrinfo
freeaddrinfo
accept
listen
ioctlsocket
gethostname
WSASetLastError
select
__WSAFDIsSet
closesocket
recvfrom
sendto
WSAGetLastError
shutdown
htonl
gethostbyname
getservbyname
socket
htons
WSAStartup
setsockopt
WSACleanup

wldap32

ord33
ord32
ord27
ord26
ord35
ord79
ord41
ord50
ord60
ord211
ord46
ord217
ord143
ord301
ord30
ord200
ord22

normaliz

IdnToAscii

kernel32

GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
VirtualProtect
GetOEMCP
GetCPInfo
FileTimeToLocalFileTime
GetFileAttributesExA
GetFileTime
SetFileTime
GetFileSize
GetFullPathNameA
SetFilePointer
GetVolumeInformationA
DuplicateHandle
GetTempPathA
GetWindowsDirectoryA
SearchPathA
GetProfileIntA
FindResourceExW
SetErrorMode
GetTempFileNameA
GetUserDefaultLCID
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsSetValue
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
VirtualAlloc
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
GetACP
CreateFileW
TzSpecificLocalTimeToSystemTime
RtlUnwind
CompareStringEx
GetStringTypeW
QueryPerformanceFrequency
LCMapStringEx
GetLocaleInfoEx
WakeConditionVariable
InitializeConditionVariable
TryAcquireSRWLockExclusive
RaiseException
OutputDebugStringW
TlsGetValue
TlsAlloc
InitializeCriticalSection
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
lstrcmpA
GetVersionExA
GlobalFlags
SystemTimeToFileTime
LocalReAlloc
GetCurrentDirectoryA
GlobalHandle
GlobalReAlloc
GetDriveTypeW
ResumeThread
GetThreadLocale
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
InitializeCriticalSectionAndSpinCount
CompareStringA
GlobalGetAtomNameA
GlobalFindAtomA
GlobalAddAtomA
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
GetSystemDirectoryW
EncodePointer
GetCurrentThreadId
LoadLibraryW
TlsFree
GetModuleHandleW
GetModuleFileNameW
OutputDebugStringA
MulDiv
GlobalSize
VerifyVersionInfoA
GetModuleHandleA
GetSystemDirectoryA
VerSetConditionMask
PeekNamedPipe
GetFileType
ExpandEnvironmentStringsA
WaitForSingleObjectEx
SleepEx
SetLastError
lstrcatA
lstrcpyA
QueryDosDeviceA
GetLogicalDriveStringsA
K32GetProcessImageFileNameA
GetTickCount64
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
HeapFree
SetConsoleTextAttribute
GetStdHandle
GetCurrentProcessId
CopyFileA
GetCommandLineA
lstrcpynW
lstrcpynA
Sleep
LocalSize
lstrlenA
LocalAlloc
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
FindResourceA
MultiByteToWideChar
FlushFileBuffers
WriteFile
ReadFile
GetFileInformationByHandle
SetEndOfFile
SetFilePointerEx
UnlockFile
LockFile
WaitForSingleObject
CreateProcessA
GetExitCodeThread
WaitForMultipleObjects
GetTickCount
ExitProcess
GetCurrentThread
SetThreadPriority
GetCurrentProcess
Process32Next
TerminateProcess
OpenProcess
Process32First
CreateToolhelp32Snapshot
LocalFree
FormatMessageA
GetLastError
CreateDirectoryA
lstrcmpiA
RemoveDirectoryA
GetFileAttributesA
DeleteFileA
GetFileSizeEx
CreateFileA
FindClose
FindNextFileA
FindFirstFileA
CloseHandle
GetSystemInfo
GetModuleFileNameA
FreeLibrary
FindResourceW
WideCharToMultiByte
GetProcAddress
LoadLibraryA
LockResource
LoadResource
SizeofResource
VirtualQuery
GetCommandLineW
HeapQueryInformation
SetStdHandle
GetFullPathNameW
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
IsValidLocale
EnumSystemLocalesW
GetCurrentDirectoryW
GetTimeZoneInformation
GetFileAttributesExW
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetConsoleCtrlHandler
CreateDirectoryW
WriteConsoleW
FlushConsoleInputBuffer
GlobalMemoryStatus
GetSystemTime
GetConsoleCP
SetConsoleMode
ReadConsoleInputW
IsProcessorFeaturePresent

user32

SetCursor
ShowOwnedPopups
EnumDisplayMonitors
LoadCursorW
LoadCursorA
SetLayeredWindowAttributes
DrawIconEx
IsRectEmpty
DrawFocusRect
GetSysColorBrush
SetWindowRgn
DrawFrameControl
DrawEdge
MapDialogRect
SetWindowContextHelpId
PostQuitMessage
TranslateMessage
GetMessageA
CharNextA
IntersectRect
WindowFromPoint
SetMenuItemInfoA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetMonitorInfoA
MonitorFromWindow
WinHelpA
GetScrollInfo
SetScrollInfo
LoadIconA
GetTopWindow
GetClassLongA
MapWindowPoints
AdjustWindowRectEx
RemovePropA
SetPropA
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
ValidateRect
GetForegroundWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
GetKeyState
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
IsChild
IsMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
CallWindowProcA
DefWindowProcA
GetMessageTime
PeekMessageA
DispatchMessageA
RegisterWindowMessageA
OffsetRect
SetRectEmpty
CopyRect
MapVirtualKeyA
GetKeyNameTextA
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
GetDesktopWindow
SetActiveWindow
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
LoadImageA
SetParent
GetActiveWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamA
DestroyWindow
LoadBitmapW
GetClassNameA
DrawStateA
IsDialogMessageA
GetWindow
SetWindowLongA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
SetFocus
TrackMouseEvent
IsZoomed
CharUpperA
GetAsyncKeyState
SetCapture
ReleaseCapture
SetTimer
KillTimer
LoadMenuW
GetSystemMenu
DeleteMenu
MessageBeep
NotifyWinEvent
CreatePopupMenu
GetMenuItemInfoA
GetMenuDefaultItem
GetDlgCtrlID
SendDlgItemMessageA
SetMenuDefaultItem
UpdateLayeredWindow
DestroyMenu
EnableScrollBar
UnionRect
MonitorFromPoint
DestroyIcon
LoadImageW
CopyImage
IsClipboardFormatAvailable
SetRect
CopyAcceleratorTableA
InvalidateRgn
FrameRect
RealChildWindowFromPoint
CheckDlgButton
GetDlgItem
ShowWindow
FillRect
GetSysColor
ClientToScreen
EndPaint
BeginPaint
GetWindowDC
GetWindowThreadProcessId
IsWindowEnabled
RemoveMenu
AppendMenuA
InsertMenuA
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringA
UnregisterClassA
DrawIcon
LoadIconW
GetMessagePos
RedrawWindow
GetFocus
GetWindowLongA
GetSystemMetrics
InflateRect
SystemParametersInfoA
GrayStringA
DrawTextExA
TabbedTextOutA
InvalidateRect
DrawTextA
EqualRect
GetUserObjectInformationW
GetProcessWindowStation
PtInRect
UpdateWindow
WaitMessage
SetCursorPos
BringWindowToTop
LockWindowUpdate
GetDoubleClickTime
GetIconInfo
CopyIcon
ModifyMenuA
DestroyAcceleratorTable
SetClassLongA
GetUpdateRect
GetKeyboardLayout
GetKeyboardState
ToAsciiEx
LoadAcceleratorsW
CreateAcceleratorTableA
RegisterClipboardFormatA
CharUpperBuffA
LoadAcceleratorsA
TranslateAcceleratorA
LoadMenuA
InsertMenuItemA
UnpackDDElParam
ReuseDDElParam
GetWindowRgn
MessageBoxA
GetWindowRect
PostMessageA
IsWindowVisible
SendMessageA
GetParent
GetClientRect
GetCursorPos
ScreenToClient
EnableWindow
SetWindowPos
GetPropA
EnumWindows
GetLastActivePopup
SetForegroundWindow
IsWindow
IsIconic
MoveWindow
GetDC
ReleaseDC
DestroyCursor
CreateMenu
GetComboBoxInfo
TranslateMDISysAccel
DefMDIChildProcA
DefFrameProcA
DrawMenuBar
MapVirtualKeyExA
IsCharLowerA
SubtractRect
InvertRect
HideCaret
PostThreadMessageA
GetNextDlgGroupItem

gdi32

GetObjectType
GetPixel
GetStockObject
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectObject
SelectPalette
SetBkColor
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextColor
SetTextAlign
ExtCreatePen
GetObjectA
MoveToEx
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
GetClipBox
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateRectRgnIndirect
PatBlt
CombineRgn
GetMapMode
SetRectRgn
DPtoLP
GetBkColor
GetTextColor
CreateEllipticRgn
Ellipse
CreatePolygonRgn
Polygon
GetTextMetricsA
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesA
GetTextCharsetInfo
CreateRoundRectRgn
GetRgnBox
RealizePalette
SetPixel
StretchBlt
SetDIBColorTable
OffsetRgn
RoundRect
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
LPtoDP
EnumFontFamiliesExA
ExtFloodFill
SetPaletteEntries
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
GetViewportOrgEx
GetWindowOrgEx
SetPixelV
GetTextFaceA
ExcludeClipRect
DeleteObject
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateBitmap
CreateDCA
CopyMetaFileA
DeleteDC
Rectangle
Polyline
CreateFontIndirectA
GetTextExtentPoint32A
GetDeviceCaps
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetBkMode
BitBlt
CreateCompatibleDC
CreateDIBSection
OffsetViewportOrgEx
CreateSolidBrush

msimg32

TransparentBlt
AlphaBlend

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

advapi32

DeregisterEventSource
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegDeleteKeyA
CryptEnumProvidersA
CryptSignHashA
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextA
ReportEventA
RegisterEventSourceA
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegEnumKeyA
RegQueryValueA
RegEnumKeyExA
RegEnumValueA

shell32

Shell_NotifyIconA
SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHBrowseForFolderA
SHGetDesktopFolder
SHGetFileInfoA
SHAppBarMessage
DragQueryFileA
DragFinish
ShellExecuteA

comctl32

InitCommonControlsEx
_TrackMouseEvent

shlwapi

PathFileExistsA
PathGetDriveNumberA
PathCanonicalizeA
PathCompactPathA
PathGetArgsA
UrlUnescapeA
PathFindExtensionA
PathFindFileNameA
PathRemoveFileSpecW
PathIsUNCA
PathStripToRootA
StrFormatKBSizeA
PathRemoveFileSpecA

uxtheme

GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
DrawThemeText
DrawThemeParentBackground
GetCurrentThemeName
GetThemeColor
DrawThemeBackground
CloseThemeData
OpenThemeData
IsAppThemed
GetWindowTheme

ole32

CoTaskMemAlloc
CreateStreamOnHGlobal
CoRegisterMessageFilter
CoRevokeClassObject
CoInitializeEx
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoDisconnectObject
CoInitialize
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
CoCreateGuid
CoUninitialize
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree

oleaut32

VariantChangeType
VariantClear
VariantInit
SysAllocStringLen
SysAllocStringByteLen
SysFreeString
SysStringLen
LoadTypeLi
OleCreateFontIndirect
SafeArrayDestroy
VariantCopy
VarBstrFromDate
SysAllocString
SystemTimeToVariantTime
VariantTimeToSystemTime

oledlg

ord8

gdiplus

GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageGraphicsContext
GdiplusStartup
GdiplusShutdown
GdipFillRectangleI
GdipDrawString
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipCreateTexture
GdipFillRectangle
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipDrawImageRectRect
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipReleaseDC
GdipDrawImageRect
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree

oleacc

CreateStdAccessibleObject
LresultFromObject
AccessibleObjectFromWindow

wininet

InternetGetLastResponseInfoA
InternetSetOptionA
InternetQueryOptionA
InternetQueryDataAvailable
InternetWriteFile
InternetSetFilePointer
InternetReadFile
InternetOpenUrlA
InternetCloseHandle
InternetOpenA
InternetSetStatusCallback
InternetCrackUrlA
HttpQueryInfoA
InternetCanonicalizeUrlA

imm32

ImmGetOpenStatus
ImmGetContext
ImmReleaseContext

winmm

PlaySoundA

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 709KB - Virtual size: 709KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 70KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 224KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2ea7b49135ecd57bd1f8fd7df20d2c65

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

wldap32

normaliz

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

oleacc

wininet

imm32

winmm

crypt32

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.rdata Size: 709KB - Virtual size: 709KB

.data Size: 70KB - Virtual size: 105KB

.rsrc Size: 3.4MB - Virtual size: 3.4MB

.reloc Size: 224KB - Virtual size: 223KB

.text
Size: 3.1MB - Virtual size: 3.1MB

.rdata
Size: 709KB - Virtual size: 709KB

.data
Size: 70KB - Virtual size: 105KB

.rsrc
Size: 3.4MB - Virtual size: 3.4MB

.reloc
Size: 224KB - Virtual size: 223KB