b8779702ba640c122ade6c9d1a7cf0b547def6ead33983e11da4a0e20074b9c5

Sharing

Copy URL Twitter E-mail

General

Target

b8779702ba640c122ade6c9d1a7cf0b547def6ead33983e11da4a0e20074b9c5
Size

1.7MB
MD5

6dd54b9368011ffc5173721cb854829d
SHA1

d79b8935a52368a72dd1229b67f338861eb89bb8
SHA256

b8779702ba640c122ade6c9d1a7cf0b547def6ead33983e11da4a0e20074b9c5
SHA512

b8baaf11feac9657dee0236a678ad430d9e2cde8439ad0db4e4b2b9c834c82b495fd8263310f77c20f4d1e810cdf535d6999efdf6a17c223e93d3d314ccc9afa
SSDEEP

49152:dqbflL89U9cMg5eVDZt9Gt3UltxjjC8nJwJ+t:ABoA+5ehZmafxjjCRJy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b8779702ba640c122ade6c9d1a7cf0b547def6ead33983e11da4a0e20074b9c5

Files

b8779702ba640c122ade6c9d1a7cf0b547def6ead33983e11da4a0e20074b9c5
.exe windows:4 windows x86 arch:x86

dcca46c338aa8c0ffab03c1c77371eb7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext

comctl32

InitCommonControlsEx
SetWindowSubclass

gdi32

AddFontMemResourceEx
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
CreateDIBSection
CreateFontIndirectW
CreatePen
CreateSolidBrush
DeleteDC
DeleteObject
Ellipse
GetDeviceCaps
GetObjectW
GetStockObject
GetTextExtentPoint32A
LineTo
MoveToEx
Polyline
Rectangle
RoundRect
SelectObject
SetBkColor
SetBkMode
SetTextColor
TextOutW

gdiplus

GdipAddPathArc
GdipAddPathLine
GdipAddPathString
GdipBitmapGetPixel
GdipBitmapSetPixel
GdipClosePathFigure
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromStream
GdipCreateFontFamilyFromName
GdipCreateFromHDC
GdipCreateHBITMAPFromBitmap
GdipCreateHICONFromBitmap
GdipCreatePath
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipDeleteCustomLineCap
GdipDeleteFontFamily
GdipDeleteGraphics
GdipDeletePath
GdipDeletePen
GdipDisposeImage
GdipDrawImageRect
GdipDrawPath
GdipDrawRectangle
GdipFillPath
GdipFillRectangle
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipGetImageHeight
GdipGetImageWidth
GdipGetMatrixElements
GdipGetPathGradientPointCount
GdipGetPenFillType
GdipSaveImageToFile
GdipSetImageAttributesRemapTable
GdipSetSmoothingMode
GdipWindingModeOutline
GdiplusShutdown
GdiplusStartup

kernel32

CloseHandle
CompareStringW
CreateDirectoryW
CreateFileW
CreateToolhelp32Snapshot
CreateWaitableTimerA
DeleteCriticalSection
EnterCriticalSection
FindClose
FindFirstFileW
FindResourceA
FindResourceW
FreeLibrary
FreeResource
GetConsoleCP
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeThread
GetFileAttributesW
GetFileSize
GetFileSizeEx
GetLargestConsoleWindowSize
GetLastError
GetLocaleInfoA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetNativeSystemInfo
GetPrivateProfileStringW
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetSystemTimeAsFileTime
GetTickCount
GetUserDefaultLangID
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
HeapAlloc
HeapFree
InitializeCriticalSection
IsWow64Process
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LoadResource
LockResource
MoveFileW
MulDiv
MultiByteToWideChar
OpenProcess
Process32First
Process32Next
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
SetConsoleMode
SetConsoleWindowInfo
SetCurrentDirectoryW
SetFileTime
SetUnhandledExceptionFilter
SetWaitableTimer
SizeofResource
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
WritePrivateProfileStringW

msvcrt

__getmainargs
__initenv
__lconv_init
__p__acmdln
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_beginthreadex
_cexit
_controlfp
_errno
_fmode
_fpreset
_i64tow
_initterm
_iob
_itoa
_itow
_onexit
_putenv
_snprintf
_snwprintf
_strdup
_strnicmp
_ui64tow
_ultoa
_ultow
abort
atoi
calloc
exit
fprintf
fputs
free
fwrite
getenv
islower
iswctype
localeconv
log10
malloc
mbstowcs
memset
memcpy
memmove
qsort
rand
realloc
setlocale
signal
sprintf
srand
strchr
strcpy
strlen
strncmp
strtoul
toupper
towupper
vfprintf
wcscmp
wcscspn
wcslen
wcsncmp
wcsstr
wcstod
wcstombs

ole32

CLSIDFromString
CoCreateInstance
CoInitialize
CoTaskMemFree
CoUninitialize
CreateStreamOnHGlobal

oleaut32

SafeArrayAccessData
SafeArrayUnaccessData
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
VarBstrFromDec
VariantClear

psapi

GetModuleFileNameExA
GetModuleFileNameExW

shell32

SHBrowseForFolderW
SHGetFolderPathW
SHGetPathFromIDListW
ShellExecuteW

shlwapi

PathRemoveBackslashW

user32

AdjustWindowRectEx
BeginDeferWindowPos
BeginPaint
CallWindowProcW
CreateIconIndirect
CreateWindowExW
DefWindowProcW
DeferWindowPos
DestroyAcceleratorTable
DestroyCursor
DestroyIcon
DestroyWindow
DispatchMessageW
DrawIconEx
DrawTextW
EnableWindow
EndDeferWindowPos
EndPaint
EnumThreadWindows
FillRect
FindWindowExW
FindWindowW
FlashWindowEx
GetActiveWindow
GetAncestor
GetClassLongW
GetClassNameA
GetClassNameW
GetClientRect
GetDC
GetDesktopWindow
GetDlgCtrlID
GetDlgItem
GetIconInfo
GetMenu
GetMessageW
GetParent
GetPropW
GetScrollInfo
GetSysColor
GetSystemMetrics
GetWindow
GetWindowDC
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextLengthW
GetWindowThreadProcessId
IntersectRect
InvalidateRect
IsDialogMessageW
IsIconic
IsWindow
IsWindowEnabled
IsWindowVisible
IsZoomed
KillTimer
LoadCursorW
LoadImageA
LoadImageW
MapWindowPoints
MessageBoxW
MsgWaitForMultipleObjects
OpenIcon
PeekMessageW
PostMessageW
PostQuitMessage
RegisterClassExW
ReleaseCapture
ReleaseDC
RemovePropW
ScreenToClient
SendMessageA
SendMessageW
SetClassLongW
SetCursor
SetFocus
SetForegroundWindow
SetLayeredWindowAttributes
SetParent
SetPropW
SetRect
SetScrollInfo
SetTimer
SetWindowLongW
SetWindowPlacement
SetWindowPos
ShowWindow
SystemParametersInfoW
TranslateAcceleratorW
TranslateMDISysAccel
TranslateMessage
UnregisterClassW
UpdateWindow

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 316KB - Virtual size: 316KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 26KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

dcca46c338aa8c0ffab03c1c77371eb7

Headers

File Characteristics

Imports

advapi32

comctl32

gdi32

gdiplus

kernel32

msvcrt

ole32

oleaut32

psapi

shell32

shlwapi

user32

version

Sections

.text Size: 316KB - Virtual size: 316KB

.data Size: 7KB - Virtual size: 7KB

.rdata Size: 28KB - Virtual size: 27KB

.bss Size: - Virtual size: 26KB

.idata Size: 10KB - Virtual size: 10KB

.CRT Size: 512B - Virtual size: 52B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 31KB - Virtual size: 30KB

.text
Size: 316KB - Virtual size: 316KB

.data
Size: 7KB - Virtual size: 7KB

.rdata
Size: 28KB - Virtual size: 27KB

.bss
Size: - Virtual size: 26KB

.idata
Size: 10KB - Virtual size: 10KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 31KB - Virtual size: 30KB