b9c828610ad7054fdf6f86f863dcebde868b52511708888a248a4feef90b8448

Sharing

Copy URL Twitter E-mail

General

Target

b9c828610ad7054fdf6f86f863dcebde868b52511708888a248a4feef90b8448
Size

644KB
MD5

0835d2e2386beda56ab9acc743dfb51c
SHA1

9c48b09b6d30f57cdff20ec1f965db5b8669ca96
SHA256

b9c828610ad7054fdf6f86f863dcebde868b52511708888a248a4feef90b8448
SHA512

a20585e02d87694bd2a9e8d073da91214a3fe796a653e2dd6c00f0eb5fa511061ed5c99103c6864e0cc4167a9060fa28356cf3f2b7d66e9c77569bd5d26b08f8
SSDEEP

12288:2M4/NVxRZx/E39/e1anOxMjmaTxlJYRnEs2udaEopCrmGBheTu:23/NVxRr/Y9jnVdfxEo2mG7e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b9c828610ad7054fdf6f86f863dcebde868b52511708888a248a4feef90b8448

Files

b9c828610ad7054fdf6f86f863dcebde868b52511708888a248a4feef90b8448
.exe windows:4 windows x86 arch:x86

a67992d2aff8916400eadfc3e31fd68a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

comctl32

InitCommonControls

comdlg32

ChooseColorW
GetOpenFileNameW
GetSaveFileNameW

gdi32

BitBlt
CombineRgn
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreateDIBitmap
CreateEllipticRgnIndirect
CreateFontW
CreateHatchBrush
CreatePatternBrush
CreatePen
CreatePolygonRgn
CreateRectRgnIndirect
CreateRoundRectRgn
CreateSolidBrush
DeleteDC
DeleteObject
FillRgn
FrameRgn
GetCharWidth32W
GetCharWidthW
GetClipBox
GetDIBits
GetRgnBox
GetStockObject
GetTextExtentExPointW
GetTextExtentPoint32W
GetTextMetricsW
LineTo
MoveToEx
OffsetRgn
OffsetViewportOrgEx
OffsetWindowOrgEx
PaintRgn
PtInRegion
PtVisible
RectInRegion
RectVisible
SelectObject
SetBkColor
SetBkMode
SetBrushOrgEx
SetROP2
SetTextColor
TextOutW

iphlpapi

GetIpAddrTable

kernel32

Beep
CancelIo
CloseHandle
CopyFileW
CreateDirectoryW
CreateEventW
CreateFileW
CreatePipe
CreateProcessW
CreateSemaphoreW
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
FileTimeToSystemTime
FindClose
FindFirstFileW
FindNextFileW
FindResourceW
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetLastError
GetModuleFileNameW
GetModuleHandleW
GetOverlappedResult
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetSystemTimeAsFileTime
GetTempFileNameW
GetTempPathW
GetTickCount
GlobalAlloc
GlobalLock
GlobalSize
GlobalUnlock
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LoadResource
LockResource
Module32FirstW
Module32NextW
MoveFileExW
MultiByteToWideChar
QueryPerformanceCounter
ReadDirectoryChangesW
ReadFile
ReleaseSemaphore
RemoveDirectoryW
ResetEvent
SetHandleInformation
SetUnhandledExceptionFilter
SizeofResource
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile

msvcrt

__getmainargs
__initenv
__lconv_init
__p__acmdln
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_atoi64
_cexit
_exit
_initterm
_iob
time
_ui64toa
_msize
_onexit
mktime
_snwprintf
_stricmp
localtime
_vsnprintf
_wfopen
abort
calloc
exit
fclose
feof
fprintf
fread
free
fseek
fwprintf
fwrite
isspace
isxdigit
malloc
memchr
memcmp
memcpy
memmove
printf
raise
rand
realloc
signal
sprintf
srand
sscanf
strcpy
strftime
strlen
strncmp
strncpy
strtol
strtoul
vfprintf
wcscpy
wcslen
_write
_read
_open
_lseek
_close

ole32

CoCreateInstance
CoInitialize
DoDragDrop
OleGetClipboard
OleInitialize
OleSetClipboard
RegisterDragDrop
ReleaseStgMedium
RevokeDragDrop

shell32

DragQueryFileW
SHGetSpecialFolderPathW
ShellExecuteW

user32

AdjustWindowRectEx
BeginDeferWindowPos
BeginPaint
CallWindowProcW
ClientToScreen
CloseClipboard
CreateIconIndirect
CreateMenu
CreatePopupMenu
CreateWindowExW
DefWindowProcW
DeferWindowPos
DeleteMenu
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageW
DrawEdge
DrawFocusRect
DrawIconEx
DrawStateW
DrawTextW
EmptyClipboard
EnableMenuItem
EnableWindow
EndDeferWindowPos
EndPaint
FillRect
FrameRect
GetCapture
GetClassLongW
GetClassNameW
GetClientRect
GetClipboardData
GetClipboardFormatNameA
GetCursor
GetCursorPos
GetDC
GetDCEx
GetDesktopWindow
GetFocus
GetKeyState
GetMenuItemCount
GetMessageW
GetMonitorInfoW
GetParent
GetScrollInfo
GetScrollPos
GetSysColor
GetSystemMetrics
GetWindow
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
InsertMenuItemW
InvalidateRect
IsChild
IsClipboardFormatAvailable
IsWindowEnabled
IsWindowVisible
KillTimer
LoadBitmapW
LoadCursorW
LoadImageW
LockWindowUpdate
MessageBoxW
MonitorFromRect
MsgWaitForMultipleObjectsEx
OpenClipboard
PostMessageW
PostQuitMessage
PostThreadMessageW
RegisterClassW
RegisterClipboardFormatA
RegisterClipboardFormatW
ReleaseCapture
ReleaseDC
ScreenToClient
ScrollWindowEx
SendMessageW
SetActiveWindow
SetCapture
SetClipboardData
SetClipboardViewer
SetCursor
SetFocus
SetMenuInfo
SetMenuItemInfoW
SetScrollInfo
SetScrollPos
SetTimer
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowTextW
ShowCursor
ShowWindow
TrackPopupMenuEx
TranslateMessage
UpdateWindow
WindowFromPoint
wsprintfW

winmm

mciGetErrorStringW
mciSendCommandW

ws2_32

WSAAsyncGetHostByAddr
WSAAsyncGetHostByName
WSAAsyncSelect
WSACancelAsyncRequest
WSAGetLastError
WSAStartup
bind
closesocket
connect
htonl
htons
inet_addr
inet_ntoa
ntohl
ntohs
recvfrom
send
sendto
setsockopt
socket

Exports

Exports

_Z18sizeOfAllocatedMemPKv
_Z4endlR7ostream
_ZN3ios4setfEjj
_ZN7ostream3putEc
_ZN7ostream5flushEv
_ZN7ostream5seekpEj
_ZN7ostream5seekpEjj
_ZN7ostream5tellpEv
_ZN7ostream5writeEPKcj
_ZlsR7ostreamP9streambuf
_ZlsR7ostreamPKc
_ZlsR7ostreamPKv
_ZlsR7ostreamb
_ZlsR7ostreamc
_ZlsR7ostreamd
_ZlsR7ostreami
_ZlsR7ostreamj
_ZlsR7ostreamx
_ZlsR7ostreamy
__cxa_pure_virtual
cerr
cout

Sections

.text
Size: 399KB - Virtual size: 399KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 83KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 647B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a67992d2aff8916400eadfc3e31fd68a

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

comctl32

comdlg32

gdi32

iphlpapi

kernel32

msvcrt

ole32

shell32

user32

winmm

ws2_32

Exports

Exports

Sections

.text Size: 399KB - Virtual size: 399KB

.data Size: 512B - Virtual size: 228B

.rdata Size: 79KB - Virtual size: 78KB

.bss Size: - Virtual size: 83KB

.edata Size: 1024B - Virtual size: 647B

.idata Size: 9KB - Virtual size: 9KB

.CRT Size: 512B - Virtual size: 52B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 133KB - Virtual size: 133KB

.reloc Size: 19KB - Virtual size: 19KB

.text
Size: 399KB - Virtual size: 399KB

.data
Size: 512B - Virtual size: 228B

.rdata
Size: 79KB - Virtual size: 78KB

.bss
Size: - Virtual size: 83KB

.edata
Size: 1024B - Virtual size: 647B

.idata
Size: 9KB - Virtual size: 9KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 133KB - Virtual size: 133KB

.reloc
Size: 19KB - Virtual size: 19KB