3609bdb02c8319e87b14e92d1a8197c80d9bd8004c4b530f2b29b5c9fe714994

Sharing

Copy URL Twitter E-mail

General

Target

3609bdb02c8319e87b14e92d1a8197c80d9bd8004c4b530f2b29b5c9fe714994
Size

4.2MB
MD5

f241a5e0fbf770cb1066417cb77f93e1
SHA1

0cabd89e6f9f523ae83a298512eebaff359d8195
SHA256

3609bdb02c8319e87b14e92d1a8197c80d9bd8004c4b530f2b29b5c9fe714994
SHA512

bc43c7fd8d4fa8d4c04af04476d45151d7f70f41b8bb6c0482a1612c0e1e53fb8326d238415d67eb64005c47e601d37bb3f2f13844d243bfc38f60b1ca579fdf
SSDEEP

98304:m5tEsszPCGTs3RAW8dYBHspDfuvmeNPLRcPyE:TssbCGo3yW8dLfZeNjR2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3609bdb02c8319e87b14e92d1a8197c80d9bd8004c4b530f2b29b5c9fe714994

Files

3609bdb02c8319e87b14e92d1a8197c80d9bd8004c4b530f2b29b5c9fe714994
.exe windows:6 windows x86 arch:x86

e5db47083f44f9a06eeb1aa24006f602

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\bld_area\fsd_5_36_0_4\VS141\Bin\Win32\Release\FSDUI.pdb

Imports

gdiplus

GdipFree
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipDeleteBrush
GdipCloneBrush
GdipCreateSolidFill
GdipDisposeImage
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipCreatePath
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipImageRotateFlip
GdipLoadImageFromStream
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDrawImagePointRectI
GdipDeletePath
GdipResetPath
GdipClosePathFigure
GdipAddPathLineI
GdipAlloc
GdipAddPathArcI
GdipCreateFromHDC
GdipDrawImageRectRect
GdipDrawImagePointsI
GdipDrawImageRectI
GdipFillPath
GdipGraphicsClear
GdipDrawPath
GdipSetPageUnit
GdipSetSmoothingMode
GdipDeleteGraphics
GdipGetImageGraphicsContext

kernel32

FileTimeToSystemTime
DeviceIoControl
CreateProcessW
GetExitCodeProcess
SetFileAttributesW
FindFirstFileW
FindNextFileW
CopyFileW
OpenProcess
GetSystemDirectoryW
GetLocaleInfoW
GetLocalTime
GetFileAttributesExW
SetFileTime
VirtualFree
VirtualAlloc
GetProcessAffinityMask
GetSystemInfo
GlobalMemoryStatus
WaitForMultipleObjects
GetFileSize
SetFilePointer
MoveFileW
GetTempPathW
GetModuleHandleA
SystemTimeToFileTime
GetSystemTime
ProcessIdToSessionId
WTSGetActiveConsoleSessionId
CreateFileA
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileAttributesA
ExpandEnvironmentStringsW
GetSystemDefaultLCID
ResumeThread
GetThreadContext
LoadLibraryW
TerminateProcess
GetCurrentThread
VirtualQuery
GlobalMemoryStatusEx
QueryDosDeviceW
DecodePointer
ExitProcess
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetFileType
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
RtlUnwind
FormatMessageA
CreateWaitableTimerA
OpenEventA
GetStartupInfoW
UnhandledExceptionFilter
FindClose
lstrcmpA
SetUnhandledExceptionFilter
ReadProcessMemory
ReleaseMutex
CreateMutexW
WaitForMultipleObjectsEx
UnregisterWaitEx
SetWaitableTimer
CancelWaitableTimer
GetProcessTimes
lstrlenA
GetLongPathNameW
GetCommandLineW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
lstrcpyW
OpenEventW
DuplicateHandle
GetCPInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
AreFileApisANSI
FindFirstFileExW
GetStringTypeW
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
OutputDebugStringW
IsDebuggerPresent
IsWow64Process
GetTempFileNameW
EncodePointer
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemDefaultLangID
WaitForSingleObjectEx
SetDllDirectoryW
LoadLibraryExA
VirtualProtect
GetModuleFileNameW
lstrcmpiW
GetCurrentProcess
GetSystemTimeAsFileTime
WideCharToMultiByte
GetModuleHandleW
IsProcessorFeaturePresent
DeleteFileW
CompareStringW
SetLastError
WaitForSingleObject
RemoveDirectoryW
CreateDirectoryW
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
ReleaseSemaphore
GetCurrentProcessId
RaiseException
MultiByteToWideChar
lstrlenW
LocalAlloc
FormatMessageW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
CloseHandle
CreateEventA
SetEvent
ResetEvent
CreateSemaphoreW
CreateEventW
InitializeCriticalSection
LCMapStringW
MoveFileExW
GetFileInformationByHandle
FlushFileBuffers
SetEndOfFile
GetFileSizeEx
SetFilePointerEx
WriteFile
ReadFile
InitializeCriticalSectionAndSpinCount
GlobalLock
GlobalAlloc
GlobalFree
lstrcmpW
GlobalUnlock
GetCurrentThreadId
InitializeCriticalSectionEx
VerSetConditionMask
VerifyVersionInfoW
Sleep
GetTickCount
LocalFree
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetPrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileSectionNamesW
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
GetLastError
CreateFileW
GetFileAttributesW
GetProcAddress
FreeLibrary
LoadLibraryExW
GetStdHandle
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
SetStdHandle
IsValidCodePage
GetUserDefaultLCID
GetACP

user32

DestroyMenu
MonitorFromPoint
TrackPopupMenuEx
SetMenuInfo
AppendMenuW
CreateDialogParamW
GetCursorPos
CreateMenu
LoadIconW
SetMenuDefaultItem
PeekMessageW
CharNextW
EqualRect
CopyRect
CharPrevW
MsgWaitForMultipleObjectsEx
IsWindowUnicode
GetMessageA
DispatchMessageA
FindWindowW
EndDialog
GetDesktopWindow
DialogBoxParamW
GetFocus
GetSysColor
SetRectEmpty
ScreenToClient
DispatchMessageW
TranslateMessage
DrawFocusRect
GetMessageW
ExitWindowsEx
GetWindowTextLengthW
GetWindowTextW
OffsetRect
ReleaseDC
SetCapture
ReleaseCapture
PtInRect
ClientToScreen
GetCapture
SetTimer
GetDlgCtrlID
KillTimer
CreateWindowExW
GetClassNameW
IsWindowEnabled
DestroyWindow
IsWindowVisible
IsDialogMessageW
AttachThreadInput
GetWindowThreadProcessId
SetForegroundWindow
GetForegroundWindow
MessageBoxW
SetRect
GetDC
DrawTextW
FrameRect
FillRect
EnableMenuItem
GetSystemMenu
MoveWindow
SetFocus
AdjustWindowRectEx
EndPaint
BeginPaint
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
MapWindowPoints
SetWindowPos
SystemParametersInfoW
SetScrollPos
UpdateWindow
ScrollWindow
GetScrollInfo
SetScrollInfo
GetClientRect
ShowWindow
PostQuitMessage
GetKeyState
InvalidateRect
PostMessageW
GetWindow
SetWindowTextW
EnableWindow
GetDlgItem
GetMenu
SendMessageW
RegisterClassExW
GetSystemMetrics
GetClassInfoExW
RegisterWindowMessageW
LoadImageW
SetCursor
LoadCursorW
UnregisterClassW
CallWindowProcW
DefWindowProcW
GetWindowLongW
SetWindowLongW
GetParent
wsprintfW
CharUpperW
IsCharAlphaNumericW
IsWindow
GetWindowDC

gdi32

GetDeviceCaps
CreateFontW
BitBlt
GetTextColor
SetBkMode
SetTextColor
CreateSolidBrush
CreatePen
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetTextExtentPoint32W
DeleteDC
GetStockObject
DeleteObject
RoundRect
CreateFontIndirectW
SetLayout
GetObjectW

advapi32

RevertToSelf
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
ControlTraceW
ConvertStringSidToSidW
GetNamedSecurityInfoW
QueryServiceStatus
ImpersonateLoggedOnUser
DuplicateTokenEx
EnumerateTraceGuids
QueryTraceW
FlushTraceW
StopTraceW
EnableTrace
StartTraceW
FreeSid
AllocateAndInitializeSid
MapGenericMask
SetSecurityInfo
GetSecurityInfo
OpenProcessToken
DuplicateToken
RegNotifyChangeKeyValue
LookupPrivilegeNameW
QueryServiceStatusEx
InitializeSecurityDescriptor
MakeAbsoluteSD
SetSecurityDescriptorDacl
RegEnumValueW
CryptDecrypt
CryptDestroyKey
CryptSetKeyParam
CryptImportKey
StartServiceW
ControlService
RegFlushKey
OpenServiceW
OpenSCManagerW
CloseServiceHandle
SetNamedSecurityInfoW
GetSecurityDescriptorControl
GetSecurityDescriptorLength
MakeSelfRelativeSD
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetAce
GetAclInformation
AddAce
InitializeAcl
IsValidSid
GetLengthSid
CopySid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
TraceMessage
CryptAcquireContextW
CryptReleaseContext
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
SetTokenInformation
CreateProcessAsUserW
ConvertSidToStringSidW
OpenThreadToken
CryptGenRandom
UnregisterTraceGuids
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
EqualSid
LookupPrivilegeValueW
AdjustTokenPrivileges
GetTokenInformation
CheckTokenMembership
RegisterTraceGuidsW

ole32

CLSIDFromString
CoUninitialize
CoInitializeEx
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CreateStreamOnHGlobal
CoCreateGuid
StringFromGUID2
CoTaskMemFree
StringFromIID
PropVariantClear
IIDFromString

oleaut32

SysAllocStringLen
SysAllocString
VariantClear
VariantCopy
SysFreeString
VariantInit
SysStringLen
SysAllocStringByteLen
SysStringByteLen
VariantCopyInd
SafeArrayCreate
SafeArrayUnlock
SafeArrayPtrOfIndex
SafeArrayLock
SafeArrayCreateVector
SafeArrayUnaccessData
SafeArrayAccessData
VarUI4FromStr

shlwapi

PathFindFileNameW
PathSkipRootW
SHDeleteEmptyKeyW
PathIsUNCW
PathIsUNCServerW
SHDeleteKeyW
PathIsDirectoryW
PathAppendW
PathMatchSpecW
UrlCanonicalizeW
PathRemoveFileSpecW
PathFileExistsW
PathAddBackslashW

comctl32

_TrackMouseEvent
InitCommonControlsEx

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW

psapi

GetProcessImageFileNameW

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 552KB - Virtual size: 552KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 154KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e5db47083f44f9a06eeb1aa24006f602

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdiplus

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shlwapi

comctl32

rpcrt4

psapi

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 552KB - Virtual size: 552KB

.data Size: 13KB - Virtual size: 34KB

.rsrc Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 154KB - Virtual size: 154KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 552KB - Virtual size: 552KB

.data
Size: 13KB - Virtual size: 34KB

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 154KB - Virtual size: 154KB