0eec2d98b21b7959f4a8c6f5d95ad6bae43115a2ec5fd0dc30b5a08e318576ab

Sharing

Copy URL Twitter E-mail

General

Target

0eec2d98b21b7959f4a8c6f5d95ad6bae43115a2ec5fd0dc30b5a08e318576ab
Size

950KB
MD5

1f38cd1f3b6f47b843193371ab21ac00
SHA1

46f272c6f1c3eb9626a6977a96b80dcff748bbb3
SHA256

0eec2d98b21b7959f4a8c6f5d95ad6bae43115a2ec5fd0dc30b5a08e318576ab
SHA512

2652dedeb32eb0f08983e59e49c968bbde5883d89867ff8c75ac0f5b6a89553a552c79cc7659d1fb482a67365b5680b61b27e2a12075109cfb2863aea7e38ac5
SSDEEP

24576:Q8VljR+9SUoIbscBv0ldFu8hod/zodl7N:Q8TLIbscoFadkd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0eec2d98b21b7959f4a8c6f5d95ad6bae43115a2ec5fd0dc30b5a08e318576ab

Files

0eec2d98b21b7959f4a8c6f5d95ad6bae43115a2ec5fd0dc30b5a08e318576ab
.exe windows:6 windows x86 arch:x86

bf55a733814ee4d47ba68efc38a5adac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Rizonesoft\Develop\Notepad3\Bin\Release_x86_v143\minipath.pdb

Imports

shlwapi

PathGetDriveNumberW
StrCmpNIW
StrDupW
StrChrA
PathRelativePathToW
PathIsPrefixW
PathUnExpandEnvStringsW
PathIsRootW
PathCanonicalizeW
PathFindExtensionW
PathCommonPrefixW
PathCompactPathExW
PathRemoveExtensionW
PathFindFileNameW
StrStrIW
StrFormatByteSizeW
PathStripPathW
PathRemoveBackslashW
StrRetToBufW
PathMatchSpecW
StrCatBuffW
PathUnquoteSpacesW
StrChrW
StrTrimW
SHAutoComplete
StrCpyNW
PathQuoteSpacesW
PathRenameExtensionW
PathIsDirectoryW
StrRChrW
PathAppendW
PathIsRelativeW
PathFileExistsW
PathAddBackslashW
PathRemoveFileSpecW
PathIsSameRootW

psapi

EnumProcessModules
GetModuleFileNameExW

user32

ShowWindowAsync
GetMessagePos
LoadMenuW
CharUpperW
GetKeyState
DefWindowProcW
GetMenuItemInfoW
DeferWindowPos
GetMessageW
EqualRect
MessageBoxW
CopyImage
ShowOwnedPopups
DeleteMenu
LoadAcceleratorsW
TrackPopupMenu
GetSubMenu
BeginDeferWindowPos
OpenClipboard
OffsetRect
SetTimer
CloseClipboard
SetMenuItemInfoW
EmptyClipboard
RegisterClassW
SetWindowPlacement
FrameRect
SetMenuDefaultItem
EnumWindows
GetMessageTime
IntersectRect
SetFocus
BringWindowToTop
TranslateAcceleratorW
GetWindowDC
EndDeferWindowPos
SetClipboardData
CheckMenuItem
IsZoomed
KillTimer
PostQuitMessage
GetSysColorBrush
EnableMenuItem
RegisterWindowMessageW
UpdateWindow
IsIconic
GetWindowThreadProcessId
IsWindowVisible
SetWindowCompositionAttribute
SystemParametersInfoW
SetPropW
RedrawWindow
SendMessageW
wsprintfW
GetSysColor
CharPrevW
GetWindowPlacement
GetSystemMetrics
DrawAnimatedRects
FindWindowExW
GetDC
MonitorFromRect
SetActiveWindow
LoadStringA
SetWindowTextW
LoadStringW
DdeCreateStringHandleW
DdeConnect
GetMonitorInfoW
DdeInitializeW
DdeUninitialize
DialogBoxIndirectParamW
SetLayeredWindowAttributes
CharUpperBuffW
SetRect
DdeDisconnect
DdeFreeStringHandle
SetForegroundWindow
LoadImageW
ReleaseDC
GetPropW
RemovePropW
DispatchMessageW
PeekMessageW
TranslateMessage
GetWindowLongW
GetWindowTextLengthW
GetSystemMenu
AdjustWindowRectEx
PostMessageW
CheckMenuRadioItem
GetWindowRect
GetFocus
DestroyWindow
SetWindowPos
CheckRadioButton
MessageBoxExW
CreateWindowExW
EndDialog
MessageBeep
CreatePopupMenu
WindowFromPoint
DestroyCursor
ShowWindow
DestroyIcon
GetDlgCtrlID
SetDlgItemTextW
MapWindowPoints
GetDlgItemTextW
SendDlgItemMessageW
IsWindowEnabled
IsDlgButtonChecked
DestroyMenu
GetMenuStringW
CharNextW
LoadIconW
LoadCursorW
GetClassNameW
SetCapture
InsertMenuW
SetCursor
SetWindowLongW
TrackPopupMenuEx
GetComboBoxInfo
GetClientRect
GetDlgItem
AppendMenuW
CheckDlgButton
GetParent
ReleaseCapture
InvalidateRect
ChildWindowFromPoint
GetCursorPos
EnableWindow
GetWindowTextW
DdeClientTransaction

kernel32

RaiseException
GetSystemInfo
VirtualQuery
GetModuleHandleW
LoadLibraryExA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
DecodePointer
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
ReadConsoleW
GetConsoleMode
VirtualProtect
CompareStringOrdinal
FreeLibrary
LoadLibraryExW
ReadFile
lstrlenW
WriteFile
lstrcpynW
ExpandEnvironmentStringsW
GetModuleFileNameW
SetFilePointer
SetEndOfFile
UnlockFileEx
CreateFileW
GetSystemDirectoryW
MultiByteToWideChar
lstrcatW
CloseHandle
LockFileEx
GetFileSize
WideCharToMultiByte
lstrcpyW
lstrcmpiW
lstrcmpW
FlushFileBuffers
GetShortPathNameW
LocalAlloc
GetFileAttributesW
SetFileAttributesW
FormatMessageW
GetLastError
GetCurrentDirectoryW
LocalFree
WaitForSingleObject
CreateEventW
SetEvent
GlobalAlloc
GlobalFree
ResetEvent
SizeofResource
SearchPathW
GetLocaleInfoEx
FreeResource
OpenProcess
LockResource
LoadLibraryW
LoadResource
FindResourceW
GetWindowsDirectoryW
GetProcAddress
GlobalLock
GlobalUnlock
MulDiv
CreateDirectoryW
FindFirstFileW
GetCommandLineW
SetThreadUILanguage
SetErrorMode
FindClose
GetUserPreferredUILanguages
FindFirstChangeNotificationW
GetVersion
ResolveLocaleName
GlobalSize
FileTimeToSystemTime
FindCloseChangeNotification
FileTimeToLocalFileTime
FindNextChangeNotification
SetCurrentDirectoryW
GetTimeFormatW
VerSetConditionMask
CopyFileW
VerifyVersionInfoW
SetThreadPreferredUILanguages
IsValidLocaleName
GetDateFormatW
MapViewOfFile
CreateFileMappingW
LocaleNameToLCID
FindResourceExW
LCIDToLocaleName
UnmapViewOfFile
GetVersionExW
GetLocaleInfoW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
SetLastError
SetUnhandledExceptionFilter
GetConsoleOutputCP
HeapReAlloc
HeapSize
SetFilePointerEx
GetFileSizeEx
GetStringTypeW
SetStdHandle
OutputDebugStringW
SetConsoleCtrlHandler
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
CompareStringW
InitializeCriticalSectionEx
IsThreadAFiber
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetTempPathW
GetFileType
HeapAlloc
HeapFree
GetCurrentThread
GetStdHandle
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
WriteConsoleW

gdi32

GetStockObject
SetBkColor
ExtTextOutW
EnumFontsW
GetDeviceCaps
SetTextColor
GetObjectW
DeleteObject
CreateSolidBrush
CreateFontIndirectW

comdlg32

GetOpenFileNameW
ChooseColorW
GetSaveFileNameW

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW
ShellExecuteW
SHCreateDirectoryExW
SHFileOperationW
SHBrowseForFolderW
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW
SHGetFileInfoW
SHGetDesktopFolder
ord180
SHAppBarMessage
DragQueryFileW
Shell_NotifyIconW
DragAcceptFiles
DragFinish
SHGetDataFromIDListW

ole32

OleUninitialize
CoCreateInstance
OleInitialize
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
CoInitialize
DoDragDrop

ntdll

RtlGetNtVersionNumbers

comctl32

ImageList_Create
ord381
PropertySheetW
ord410
ord413
ImageList_Destroy
InitCommonControlsEx
InitMUILanguage
ImageList_AddMasked

Sections

.text
Size: 515KB - Virtual size: 515KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fptable
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 321KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bf55a733814ee4d47ba68efc38a5adac

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

psapi

user32

kernel32

gdi32

comdlg32

advapi32

shell32

ole32

ntdll

comctl32

Sections

.text Size: 515KB - Virtual size: 515KB

.rdata Size: 87KB - Virtual size: 86KB

.data Size: 4KB - Virtual size: 27KB

.fptable Size: 512B - Virtual size: 128B

.rsrc Size: 321KB - Virtual size: 320KB

.reloc Size: 21KB - Virtual size: 20KB

.text
Size: 515KB - Virtual size: 515KB

.rdata
Size: 87KB - Virtual size: 86KB

.data
Size: 4KB - Virtual size: 27KB

.fptable
Size: 512B - Virtual size: 128B

.rsrc
Size: 321KB - Virtual size: 320KB

.reloc
Size: 21KB - Virtual size: 20KB