ad86b2c1bb694e40082b2b4f42c6c13d28da4777c655ab08db7e2676277282b7

Sharing

Copy URL Twitter E-mail

General

Target

ad86b2c1bb694e40082b2b4f42c6c13d28da4777c655ab08db7e2676277282b7
Size

2.5MB
MD5

b43b38418a0bdd85a8dddeec1110b7d9
SHA1

8d91527300d38683eff2e1b51ae594f6da08c07e
SHA256

ad86b2c1bb694e40082b2b4f42c6c13d28da4777c655ab08db7e2676277282b7
SHA512

caede87f78ad39b903906cbfb79e0c2828afb91848f1d506d2c9831923642bfba58232aef79d6ffed78e8194175ad7d471bd1707394923e7f2f0360a6c1911e0
SSDEEP

49152:4nYLbV6216xebH/giXFAX0LWZ9WkJjo0T1LBpdoqVsP3yHhsU9:qwwMrM0wDo0Tn/OKHu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad86b2c1bb694e40082b2b4f42c6c13d28da4777c655ab08db7e2676277282b7

Files

ad86b2c1bb694e40082b2b4f42c6c13d28da4777c655ab08db7e2676277282b7
.exe windows:5 windows x86 arch:x86

a5c5b6abe7348247d5d5df8679d289e0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetConsoleCtrlHandler
CompareStringA
CompareStringW
SetEnvironmentVariableA
VirtualProtect
HeapSize
GetACP
GetCommandLineA
GetStartupInfoA
ExitThread
RaiseException
HeapReAlloc
GetSystemTime
GetTimeZoneInformation
TerminateProcess
HeapAlloc
HeapFree
RtlUnwind
SetErrorMode
SystemTimeToFileTime
GetFileTime
GetFileSize
GetFileAttributesA
GetConsoleMode
SetConsoleMode
ReadConsoleInputA
AreFileApisANSI
CreateFileW
CreateFileMappingA
CreateFileMappingW
CreateMutexW
DeleteFileW
FormatMessageW
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetFileAttributesW
GetFileAttributesExW
GetFullPathNameW
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetVersionExW
HeapValidate
HeapCompact
LoadLibraryW
LockFileEx
MapViewOfFile
UnlockFileEx
UnmapViewOfFile
WaitForSingleObjectEx
OutputDebugStringW
GetProcessHeap
InterlockedCompareExchange
FlushViewOfFile
InterlockedExchange
FlushConsoleInputBuffer
QueryPerformanceCounter
GlobalMemoryStatus
GetCurrentProcessId
VirtualQuery
GetOEMCP
GetCPInfo
GetProcessVersion
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
GlobalFlags
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFullPathNameA
GetVolumeInformationA
DeleteFileA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileA
DuplicateHandle
GetModuleFileNameA
lstrcmpA
lstrcpynA
MulDiv
SetLastError
FormatMessageA
GetVersion
lstrcatA
GetCurrentThreadId
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrlenA
GetSystemInfo
PostQueuedCompletionStatus
InterlockedIncrement
GetQueuedCompletionStatus
InterlockedDecrement
CreateIoCompletionPort
OutputDebugStringA
SetEvent
CloseHandle
CreateEventA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LoadLibraryA
LocalAlloc
LocalFree
FreeLibrary
GetLocalTime
MultiByteToWideChar
InterlockedExchangeAdd
GetProcAddress
WideCharToMultiByte
FindFirstFileA
FindClose
IsBadReadPtr
ResumeThread
WaitForSingleObject
CreateThread
GetCurrentProcess
GetCurrentThread
SetThreadPriority
SuspendThread
ExitProcess
GetLastError
lstrcpyA
GetModuleHandleA
Sleep
GetTickCount
WritePrivateProfileStringA
GetWindowsDirectoryA
GetPrivateProfileStringA
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
FindResourceA
SizeofResource
LoadResource
LockResource
SetStdHandle
FlushInstructionCache
GetCurrentProcess
FreeLibrary
TerminateProcess
GetSystemInfo
CreateToolhelp32Snapshot
Thread32First
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
GetTickCount
GetLocalTime
GlobalFree
GetProcAddress
LocalAlloc
LoadLibraryA
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
FlushFileBuffers
GetCurrentProcessId
GetLastError
GetModuleFileNameW
CreateEventA
GetModuleHandleA
GetSystemTimeAsFileTime
VirtualQuery
LocalFree
CreateFileA
ReadFile
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
SendDlgItemMessageA
MapWindowPoints
GetSysColor
AdjustWindowRectEx
ScreenToClient
EqualRect
IsWindowVisible
GetScrollInfo
SetScrollInfo
ShowScrollBar
GetScrollRange
GetMenuCheckMarkDimensions
GetScrollPos
SetScrollPos
GetTopWindow
SendMessageA
EnableWindow
GetClientRect
LoadIconA
SetWindowLongA
GetWindowLongA
DrawIcon
GetSystemMetrics
IsDialogMessageA
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
TrackPopupMenu
SetDlgItemTextA
SetScrollRange
GetDlgCtrlID
GetKeyState
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
IsIconic
InvalidateRect
DispatchMessageA
TranslateMessage
SetFocus
GetFocus
GetWindowTextA
GetWindowTextLengthA
GetMessageA
UpdateWindow
SetForegroundWindow
SetWindowTextA
SetWindowPos
CreateWindowExA
GetWindowRect
UnregisterClassA
MoveWindow
ClientToScreen
GetWindowDC
BeginPaint
EndPaint
TabbedTextOutA
DrawTextA
GrayStringA
InflateRect
SetCursor
GetCursorPos
ValidateRect
CharUpperA
GetClassNameA
PtInRect
GetSysColorBrush
DestroyMenu
LoadStringA
SetCapture
ReleaseCapture
GetCapture
SetRectEmpty
GetProcessWindowStation
GetUserObjectInformationW
GetUpdateRect
GetWindowInfo
GetWindowRgn
GetSystemMenu
IsZoomed
SetTimer
MenuItemFromPoint
GetMenuItemRect
GetComboBoxInfo
TrackMouseEvent
DrawStateA
DestroyIcon
KillTimer
GetIconInfo
DrawIconEx
IsRectEmpty
SetWindowRgn
WindowFromDC
EnableScrollBar
GetScrollBarInfo
GetDCEx
GetWindowLongW
SetWindowLongW
IsMenu
GetMenuItemInfoA
SetMenuItemInfoA
EnumChildWindows
EnumThreadWindows
SetRect
FindWindowExA
GetDesktopWindow
MessageBoxA
RegisterClassExA
LoadCursorA
GetClassInfoExA
PostQuitMessage
DestroyWindow
PostMessageA
DefWindowProcA
PeekMessageA
wsprintfA
IsWindowEnabled
GetDlgItem
GetParent
CreateDialogIndirectParamA
IsWindow
SetActiveWindow
GetActiveWindow
EndDialog
GetNextDlgTabItem
ReleaseDC
GetDC
CopyRect
GetWindowPlacement
SystemParametersInfoA
OffsetRect
RegisterWindowMessageA
GetWindow
GetForegroundWindow
GetLastActivePopup
GetMessagePos
GetMessageTime
RemovePropA
SetMenu
ShowWindow
CharUpperBuffW
MessageBoxW

gdi32

SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
SelectClipRgn
GetClipRgn
SelectClipPath
GetDeviceCaps
CreateSolidBrush
CreatePatternBrush
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
CombineRgn
GetTextExtentPoint32A
SetBkMode
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetClipBox
PatBlt
DeleteObject
CreateFontIndirectA
CreateDIBSection
GetPixel
ExtCreateRegion
ExtTextOutW
GetTextColor
OffsetRgn
PtInRegion
EndPath
Rectangle
BeginPath
StretchBlt
CreateRoundRectRgn
GetTextExtentPointA
SetPixel
CreateCompatibleDC
BitBlt
CreateRectRgn
GetBkColor
SetMapMode
CreateCompatibleBitmap
CreatePen
GetMapMode

comdlg32

GetOpenFileNameA
GetFileTitleA
GetSaveFileNameA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegCreateKeyExA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
CloseServiceHandle
QueryServiceConfigW
OpenServiceW
EnumServicesStatusExW
OpenSCManagerW
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

shell32

ShellExecuteA

comctl32

ImageList_Destroy
ord17
ImageList_GetIcon
ImageList_Draw
ImageList_GetIconSize
ImageList_GetImageInfo

ole32

CreateStreamOnHGlobal

oleaut32

SysAllocStringLen
SysFreeString

gdiplus

GdipAlloc
GdipFree
GdipDrawImageRectI
GdipGetImageHeight
GdipGetImageWidth
GdipReleaseDC
GdipDeleteGraphics
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipCreateFromHDC
GdipLoadImageFromStreamICM
GdipLoadImageFromStream

wininet

HttpQueryInfoA

ws2_32

WSAGetLastError
WSAGetOverlappedResult
WSAStartup
WSARecv

iphlpapi

GetAdaptersInfo

winhttp

WinHttpQueryOption
WinHttpSetOption
WinHttpOpenRequest
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpOpen
WinHttpCrackUrl
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle

msimg32

TransparentBlt

msvfw32

DrawDibOpen
DrawDibDraw

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 246KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata0
Size: - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata1
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a5c5b6abe7348247d5d5df8679d289e0

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

ole32

oleaut32

gdiplus

wininet

ws2_32

iphlpapi

winhttp

msimg32

msvfw32

wtsapi32

Sections

.text Size: - Virtual size: 1.2MB

.rdata Size: - Virtual size: 246KB

.data Size: - Virtual size: 85KB

.edata0 Size: - Virtual size: 1.8MB

.edata1 Size: 2.5MB - Virtual size: 2.5MB

.reloc Size: 4KB - Virtual size: 264B

.rsrc Size: 24KB - Virtual size: 73KB

.text
Size: - Virtual size: 1.2MB

.rdata
Size: - Virtual size: 246KB

.data
Size: - Virtual size: 85KB

.edata0
Size: - Virtual size: 1.8MB

.edata1
Size: 2.5MB - Virtual size: 2.5MB

.reloc
Size: 4KB - Virtual size: 264B

.rsrc
Size: 24KB - Virtual size: 73KB