6a9d59df7ae5ed2035028a8aa5198a099dbeb38feaebbafb12424bafb06fbae2

Sharing

Copy URL Twitter E-mail

General

Target

6a9d59df7ae5ed2035028a8aa5198a099dbeb38feaebbafb12424bafb06fbae2
Size

7.7MB
MD5

e06a38f5131199af0e7706f88fd82584
SHA1

bf7cdeb6e3c4db3cbac87487b3b7c4058a112137
SHA256

6a9d59df7ae5ed2035028a8aa5198a099dbeb38feaebbafb12424bafb06fbae2
SHA512

1c1d9d2e5c38d2011d67a08781d59aa1b250f477e03286434f18ac4886a12e93dcd4bf6c4d9db39614305952bf90d981a66f45cc03a0b125927d1385fd99cb89
SSDEEP

98304:Hs5EAFLDSfLXTAiDjPLrn4fG6EC6uXhgYRz4D44HRgSG+AJLA3aqhMj7Tbf73uUG:MHDSfLXTA8jPruXhVR0JLA3TxBSPGK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6a9d59df7ae5ed2035028a8aa5198a099dbeb38feaebbafb12424bafb06fbae2

Files

6a9d59df7ae5ed2035028a8aa5198a099dbeb38feaebbafb12424bafb06fbae2
.exe windows:6 windows x86 arch:x86

832371f23039235632f9fe7272dc58a0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
GetCurrentProcessId
CreateProcessW
SetWaitableTimer
CreateWaitableTimerW
RaiseException
GetCurrentThreadId
GetModuleHandleW
IsDebuggerPresent
CreateEventW
CreateSemaphoreW
SetFilePointer
ReadFile
FindClose
FindFirstFileW
GetModuleFileNameW
GetTempPathW
GetTimeZoneInformation
MultiByteToWideChar
WideCharToMultiByte
GetFileSizeEx
SetFilePointerEx
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetStdHandle
EnumSystemLocalesW
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
DuplicateHandle
GetConsoleOutputCP
TzSpecificLocalTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
ReadConsoleW
GetCommandLineA
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryExA
VirtualFree
CreateFileW
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
GetCPInfo
GetStringTypeW
WaitForMultipleObjects
LCMapStringEx
EncodePointer
SleepConditionVariableSRW
WakeAllConditionVariable
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SetFileTime
SetFileAttributesW
CreateDirectoryExW
CreateFileMappingA
DeviceIoControl
SetFileValidData
AreFileApisANSI
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
CreateMutexW
UnmapViewOfFile
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
DeleteFileA
HeapCompact
UnlockFile
LockFileEx
LoadLibraryExW
lstrcmpiW
VerifyVersionInfoW
VerSetConditionMask
GetSystemTimeAsFileTime
GetLocalTime
FileTimeToSystemTime
ResetEvent
CreateThread
VirtualQuery
GetCurrentDirectoryW
GetSystemInfo
GlobalFlags
GetFileAttributesExW
GetFileAttributesW
PeekNamedPipe
RemoveDirectoryW
GetCurrentProcess
FindNextFileW
GetCommandLineW
SetLastError
CreateDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
GetUserDefaultLCID
GetTickCount
ExitProcess
FindResourceW
LoadResource
LockResource
FreeResource
SizeofResource
GlobalReAlloc
MulDiv
GlobalUnlock
GlobalLock
GlobalFree
WriteFile
ReleaseSemaphore
WaitForSingleObject
CloseHandle
Sleep
DeleteFileW
LeaveCriticalSection
TryEnterCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
GetFileSize
SystemTimeToFileTime
GetSystemTime
CreateFileMappingW
MapViewOfFile
FlushFileBuffers
LocalFree
MoveFileExW
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
WriteConsoleW
GetConsoleMode
GetVersionExA
SetConsoleCtrlHandler
FormatMessageA
CreateFileA
VerifyVersionInfoA
FormatMessageW
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
HeapFree
MoveFileExA
LoadLibraryA
GetModuleHandleA
GetSystemDirectoryA
QueryPerformanceFrequency
SleepEx
InitializeCriticalSectionEx
QueryPerformanceCounter
GlobalAlloc
SetEvent
HeapAlloc
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionAndSpinCount
VirtualAlloc

user32

TranslateMessage
GetMessageW
PeekMessageW
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
ShowWindow
EnableWindow
GetWindowRect
GetParent
ScreenToClient
GetFocus
SetFocus
GetKeyState
SetCursor
GetWindow
AdjustWindowRectEx
MsgWaitForMultipleObjects
ReleaseDC
GetClientRect
GetWindowDC
GetSystemMetrics
GetDC
LoadImageW
GetDesktopWindow
LoadCursorW
LoadIconW
SetPropW
RegisterClassW
SetTimer
GetClassInfoW
GetActiveWindow
LoadStringW
DrawTextW
GetSysColor
DrawFocusRect
FrameRect
RemovePropW
CreateWindowExW
GetPropW
PostMessageW
DefWindowProcW
EnumWindows
MoveWindow
GetMonitorInfoW
WaitForInputIdle
SetActiveWindow
MonitorFromWindow
GetWindowThreadProcessId
DrawStateW
ClientToScreen
IsWindow
DestroyWindow
InvalidateRect
SetWindowLongW
SetWindowPos
SendMessageW
GetWindowLongW
MessageBoxW
UnregisterClassW
IsDialogMessageW
DispatchMessageW
CopyRect
OffsetRect
WindowFromPoint
FillRect
InflateRect
CallWindowProcW
CharNextW
GetClassInfoExW
PostQuitMessage
RegisterClassExW
TranslateAcceleratorW
DestroyMenu
DestroyAcceleratorTable
DeleteMenu
RedrawWindow
FindWindowExW
EndPaint
BeginPaint
IsIconic
wsprintfW
GetDlgItem
DestroyIcon
GetTopWindow
IsZoomed
SetRect
KillTimer
GetCapture
SetCapture
UpdateWindow
ReleaseCapture
MessageBeep
SetParent
PtInRect
GetLastActivePopup
GetSystemMenu
IsWindowVisible
SetWindowRgn
DrawIcon
GetClassNameW
GetDlgCtrlID
IsChild
IsWindowEnabled
SetMenu
WinHelpW
IsRectEmpty
IntersectRect
GetNextDlgTabItem

gdi32

MoveToEx
CreateFontIndirectW
SetPixel
ExtCreateRegion
CreateRectRgn
CombineRgn
PatBlt
GetTextMetricsW
ExcludeClipRect
GetClipBox
CreateRoundRectRgn
CreateEllipticRgn
GetPixel
SetTextColor
SetBkMode
LineTo
CreatePen
DeleteObject
SetBkColor
CreateSolidBrush
CreateBitmap
RoundRect
ExtTextOutW
BitBlt
CreateCompatibleBitmap
SelectObject
CreateDIBSection
SetDIBColorTable
CreateCompatibleDC
GdiAlphaBlend
StretchBlt
GetStockObject
GetDeviceCaps
DeleteDC
GetObjectW
SetStretchBltMode

advapi32

CryptCreateHash
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
LookupPrivilegeValueA
CryptGenRandom
RegQueryInfoKeyW
RegDeleteKeyW
RegEnumKeyExW
RegDeleteValueW
AdjustTokenPrivileges
RegCloseKey
RegQueryValueW
RegCreateKeyExW
RegSetValueExW
OpenProcessToken
RegOpenKeyExW
GetTokenInformation
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptEncrypt

shell32

ShellExecuteW
DragFinish
DragQueryFileW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderPathW
Shell_NotifyIconW
SHBrowseForFolderW

ole32

CoTaskMemFree
CoTaskMemAlloc
CoInitializeEx
CreateStreamOnHGlobal
CoUninitialize
CoCreateInstance
CoInitialize
CoTaskMemRealloc

oleaut32

VariantTimeToSystemTime
SystemTimeToVariantTime
VarUI4FromStr
SysStringLen
SysAllocStringLen
SysAllocString
SysFreeString

comctl32

ImageList_Destroy
ImageList_Create
ImageList_AddMasked
_TrackMouseEvent
InitCommonControlsEx

bcrypt

BCryptGenerateSymmetricKey
BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptGenerateKeyPair
BCryptImportKey
BCryptImportKeyPair
BCryptFinalizeKeyPair
BCryptEncrypt
BCryptDestroySecret
BCryptSignHash
BCryptVerifySignature
BCryptSecretAgreement
BCryptDeriveKey
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptDecrypt
BCryptDestroyKey
BCryptExportKey

wldap32

ord45
ord50
ord41
ord22
ord26
ord211
ord32
ord33
ord35
ord79
ord30
ord60
ord143
ord200
ord301
ord46
ord27

ws2_32

WSAEventSelect
closesocket
recv
send
WSAStartup
WSACleanup
WSAGetLastError
inet_pton
__WSAFDIsSet
select
WSASetLastError
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSAIoctl
socket
htonl
listen
ioctlsocket
ntohl
getaddrinfo
freeaddrinfo
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
recvfrom
sendto
gethostname
accept
shutdown
WSASend
getnameinfo
inet_addr
inet_ntoa
gethostbyaddr
getservbyname
getservbyport
gethostbyname

uxtheme

SetWindowTheme

dsound

ord11

gdiplus

GdipCreateBitmapFromFile
GdipGetImageWidth
GdipSetCompositingMode
GdipGetImagePalette
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipBitmapLockBits
GdipFree
GdipGetImagePixelFormat
GdipDisposeImage
GdipDrawImageRectI
GdipAlloc
GdipCreateBitmapFromStream
GdipBitmapUnlockBits
GdipCloneImage
GdipGetImagePaletteSize
GdipGetImageHeight
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromScan0

winmm

PlaySoundW

secur32

EncryptMessage
FreeContextBuffer
QueryContextAttributesA
ApplyControlToken
DeleteSecurityContext
AcceptSecurityContext
InitializeSecurityContextA
FreeCredentialsHandle
AcquireCredentialsHandleW
DecryptMessage

iphlpapi

GetAdaptersAddresses

crypt32

CryptDecodeObjectEx
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
PFXIsPFXBlob
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain

Sections

.text
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 707KB - Virtual size: 707KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 116KB - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 167KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

832371f23039235632f9fe7272dc58a0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

bcrypt

wldap32

ws2_32

uxtheme

dsound

gdiplus

winmm

secur32

iphlpapi

crypt32

Sections

.text Size: 4.5MB - Virtual size: 4.5MB

.rdata Size: 707KB - Virtual size: 707KB

.data Size: 116KB - Virtual size: 193KB

.rsrc Size: 1.6MB - Virtual size: 1.6MB

.reloc Size: 167KB - Virtual size: 167KB

.text
Size: 4.5MB - Virtual size: 4.5MB

.rdata
Size: 707KB - Virtual size: 707KB

.data
Size: 116KB - Virtual size: 193KB

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

.reloc
Size: 167KB - Virtual size: 167KB