e09c2b479223078036acf467dbc6bd15b3a8fafa1262acd503bdc971afdefae4

Sharing

Copy URL Twitter E-mail

General

Target

e09c2b479223078036acf467dbc6bd15b3a8fafa1262acd503bdc971afdefae4
Size

8.1MB
MD5

d877157bd755a5969689bb92ee82034a
SHA1

9dcb65908fb607bfac5ed4fb8497d13211b00875
SHA256

e09c2b479223078036acf467dbc6bd15b3a8fafa1262acd503bdc971afdefae4
SHA512

dc511d2b650056e7c7cbc8145329a959753feb6f589100643148533268f710cbd6f41d40dc0318166ddb0d44ec9c25876276f6d390bf4b3e1e29b94b2f2cf6c9
SSDEEP

98304:3xyurTXDcrDvx3rTqG96uHVzNYAI3DxjmTfpr0fpTiSgNL3VfyG0yDSFLOAkGkzI:bTebcVeaTgNL3VfyG3DSFLOyomFHKnP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e09c2b479223078036acf467dbc6bd15b3a8fafa1262acd503bdc971afdefae4

Files

e09c2b479223078036acf467dbc6bd15b3a8fafa1262acd503bdc971afdefae4
.exe windows:6 windows x86 arch:x86

60a820ca3909659cc6fe979a81e950de

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenW
MapViewOfFileEx
CreateFileMappingW
GetFileSize
CreateFileW
VirtualFree
VirtualProtect
VirtualAlloc
TlsFree
TlsSetValue
TlsGetValue
WaitForMultipleObjects
SwitchToThread
UnmapViewOfFile
InitializeSRWLock
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindFirstFileExW
FindResourceExW
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
lstrcpyW
GetDriveTypeW
GetVolumeInformationW
GetSystemTimeAsFileTime
InitializeCriticalSectionEx
FileTimeToLocalFileTime
FileTimeToSystemTime
ResetEvent
SetEvent
CreateEventW
SetThreadPriority
VirtualQuery
HeapFree
CopyFileW
CreateProcessW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetSystemInfo
GlobalFlags
GetFileAttributesExW
GetSystemDirectoryW
GetFileAttributesW
WaitForSingleObject
PeekNamedPipe
TerminateProcess
GetCommandLineW
SetLastError
FreeLibrary
GetUserDefaultLCID
FreeResource
GetCurrentThreadId
GlobalReAlloc
MulDiv
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
GlobalSize
IsDebuggerPresent
WriteFile
SetFilePointer
ReadFile
SetFilePointerEx
GetModuleFileNameW
GetVersionExW
GetLocalTime
WritePrivateProfileStringW
GetPrivateProfileStringW
GetTickCount
FindResourceW
LoadResource
LockResource
SizeofResource
LoadLibraryW
Sleep
MultiByteToWideChar
WideCharToMultiByte
TryEnterCriticalSection
ExitProcess
GetCurrentThread
GetTimeZoneInformation
EnumSystemLocalesW
IsValidLocale
LCMapStringW
GetConsoleOutputCP
HeapQueryInformation
SetStdHandle
GetFileInformationByHandle
SetConsoleCtrlHandler
FreeLibraryAndExitThread
ExitThread
GetModuleHandleExW
ResumeThread
lstrcmpiW
GetEnvironmentVariableW
GetACP
GetStdHandle
GetFileType
GetSystemDirectoryA
LoadLibraryA
FormatMessageA
QueryPerformanceCounter
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetSystemTime
SystemTimeToFileTime
SleepEx
QueryPerformanceFrequency
GetModuleHandleA
DeleteFileW
GetTimeFormatW
GetDateFormatW
CreateThread
CloseHandle
SetPriorityClass
GetCurrentProcess
GetCurrentProcessId
GetProcAddress
GetModuleHandleW
GetCommandLineA
RtlUnwind
GetCPInfo
GetStringTypeW
LCMapStringEx
OutputDebugStringW
GetStartupInfoW
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTempFileNameW
GetWindowsDirectoryW
SetErrorMode
GetTempPathW
SearchPathW
FindClose
FindNextFileW
FindFirstFileW
InitializeCriticalSection
DeleteCriticalSection
GetFileTime
SystemTimeToTzSpecificLocalTime
DuplicateHandle
UnlockFile
SetEndOfFile
LockFile
GetFullPathNameW
FlushFileBuffers
VerifyVersionInfoW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalGetAtomNameW
GetProfileIntW
GetThreadLocale
GetPrivateProfileIntW
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionAndSpinCount
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
CompareStringA
lstrcmpA
LocalFree
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
EncodePointer
OutputDebugStringA
GetFileSizeEx
CreateFileA
VerifyVersionInfoA
FormatMessageW
TlsAlloc

user32

GetClientRect
GetWindowDC
GetSystemMetrics
GetDC
LoadImageW
GetDesktopWindow
LoadIconW
UnregisterClassW
InvalidateRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
FindWindowExW
IsWindow
GetWindowThreadProcessId
GetClassNameW
IsWindowVisible
EnumChildWindows
GetPropW
CallWindowProcW
RemovePropW
GetWindowRect
UnhookWindowsHookEx
ShowScrollBar
ShutdownBlockReasonCreate
ShutdownBlockReasonDestroy
SendMessageW
EnableWindow
SetLayeredWindowAttributes
PostMessageW
SetWindowLongW
GetWindowLongW
RedrawWindow
GetSysColor
LoadCursorW
GetCursorPos
SetPropW
RegisterClassW
SetTimer
GetClassInfoW
GetActiveWindow
LoadStringW
CreateWindowExW
DestroyWindow
DefWindowProcW
CopyImage
EnumDisplaySettingsW
SetClipboardData
MoveWindow
EmptyClipboard
CloseClipboard
GetMonitorInfoW
OpenClipboard
WaitForInputIdle
MonitorFromWindow
CreateMenu
EnableMenuItem
AppendMenuW
CheckMenuItem
InsertMenuW
TranslateAcceleratorW
DestroyMenu
CreateAcceleratorTableW
DestroyAcceleratorTable
GetSubMenu
TrackPopupMenu
CreatePopupMenu
DeleteMenu
GetMenuItemCount
GetMenu
ModifyMenuW
wsprintfW
SystemParametersInfoW
DrawMenuBar
LoadBitmapW
SetMenu
CopyRect
IsMenu
OffsetRect
SetWindowPos
GetMenuItemID
DrawTextW
DrawTextExW
WindowFromDC
FillRect
GrayStringW
TabbedTextOutW
ReleaseCapture
PtInRect
SetCapture
IsRectEmpty
GetCapture
UpdateWindow
ClientToScreen
DispatchMessageW
GetMessageW
KillTimer
DestroyIcon
ScreenToClient
GetNextDlgTabItem
DrawFocusRect
FrameRect
DrawStateW
WindowFromPoint
InflateRect
IsIconic
SetScrollPos
SetScrollRange
SetParent
SetFocus
IntersectRect
WinHelpW
IsWindowEnabled
GetTopWindow
IsChild
GetDlgCtrlID
GetScrollRange
SetCursorPos
GetParent
EqualRect
SetActiveWindow
SetForegroundWindow
GetKeyState
SetCursor
GetWindow
ShowWindow
AdjustWindowRectEx
PeekMessageW
MessageBoxW
DrawIcon
GetDoubleClickTime
TranslateMessage
GetCursor
ClipCursor
IsClipboardFormatAvailable
MsgWaitForMultipleObjects
GetProcessWindowStation
GetUserObjectInformationW
RegisterWindowMessageW
GetMessageTime
GetClassInfoExW
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
GetDlgItem
GetForegroundWindow
BeginPaint
EndPaint
ValidateRect
ScrollWindow
MapWindowPoints
GetClassLongW
GetLastActivePopup
SetWindowsHookExW
CallNextHookEx
SetScrollInfo
GetScrollInfo
GetMenuStringW
GetMenuState
RemoveMenu
CheckDlgButton
IsDialogMessageW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadMenuW
GetKeyNameTextW
MapVirtualKeyW
RegisterClipboardFormatW
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
ShowOwnedPopups
CreateDialogIndirectParamW
EndDialog
CharNextW
NotifyWinEvent
SendDlgItemMessageA
SetRectEmpty
GetMenuItemInfoW
MonitorFromPoint
GetSysColorBrush
RealChildWindowFromPoint
GetAsyncKeyState
BringWindowToTop
LoadAcceleratorsW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
EnumDisplayMonitors
TrackMouseEvent
CharUpperW
PostThreadMessageW
WaitMessage
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
CopyAcceleratorTableW
LockWindowUpdate
SetClassLongW
InvalidateRgn
GetNextDlgGroupItem
DrawEdge
DrawFrameControl
DrawIconEx
UnionRect
GetIconInfo
CharUpperBuffW
UpdateLayeredWindow
EnableScrollBar
GetMenuDefaultItem
SetMenuDefaultItem
CopyIcon
GetScrollPos
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
IsCharLowerW
MapVirtualKeyExW
SubtractRect
GetUpdateRect
HideCaret
DestroyCursor
GetComboBoxInfo
GetWindowRgn
GetMessagePos
InvertRect
ChildWindowFromPointEx
IsZoomed
SetRect
GetSystemMenu
GetFocus
SetWindowRgn
MessageBeep
ReleaseDC

gdi32

Rectangle
Ellipse
CreateSolidBrush
CreateEllipticRgn
CreatePen
RoundRect
PatBlt
GetCurrentObject
RectVisible
GetClipBox
GetPixel
TextOutW
CreateRoundRectRgn
SetBkColor
CreateBitmap
Escape
PtVisible
ExtTextOutW
GetTextExtentPoint32W
BitBlt
CreateCompatibleBitmap
SelectObject
CreateDIBSection
SetDIBColorTable
CreateCompatibleDC
GdiAlphaBlend
StretchBlt
RealizePalette
GetStockObject
GetDIBits
GetDeviceCaps
GetSystemPaletteEntries
SelectPalette
CreatePalette
GetObjectW
SetStretchBltMode
CreateFontIndirectW
DeleteObject
DeleteDC
CopyMetaFileW
ExcludeClipRect
GetObjectType
GetViewportExtEx
IntersectClipRect
LineTo
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
GetViewportOrgEx
CombineRgn
CreateRectRgn
ExtCreateRegion
CreatePatternBrush
GetWindowOrgEx
CreateHatchBrush
CreateBrushIndirect
SetPixel
GetWindowExtEx
DPtoLP
LPtoDP
Polygon
CreateDCW
CreateFontW
SetBrushOrgEx
GetBkColor
GetTextMetricsW
SetTextColor
GetTextFaceW
PtInRegion
GetBoundsRect
FrameRgn
FillRgn
SetPaletteEntries
ExtFloodFill
GetPaletteEntries
GetNearestPaletteIndex
EnumFontFamiliesExW
Polyline
CreatePolygonRgn
OffsetRgn
GetRgnBox
GetTextCharsetInfo
EnumFontFamiliesW
CreateDIBitmap
GetTextColor
SetRectRgn
GetMapMode
CreateRectRgnIndirect
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
MoveToEx
SetPixelV

advapi32

CryptAcquireContextW
RegEnumValueW
RegEnumKeyExW
RegEnumKeyW
CryptEncrypt
CryptImportKey
CryptHashData
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegCreateKeyW
RegQueryValueW
RegCreateKeyExW
RegQueryValueExW
RegDeleteValueW
RegDeleteKeyW
RegCloseKey
RegSetValueExW

shell32

SHGetFileInfoW
SHGetDesktopFolder
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
SHAppBarMessage
DragQueryFileW
ShellExecuteW
Shell_NotifyIconW
DragFinish

ole32

OleSetClipboard
OleFlushClipboard
OleIsCurrentClipboard
DoDragDrop
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
CoDisconnectObject
CoGetClassObject
CoRevokeClassObject
CoRegisterMessageFilter
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
OleLockRunning
OleCreateMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleGetClipboard
CoCreateGuid
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CoFreeUnusedLibraries
OleInitialize
OleUninitialize
CLSIDFromString
OleRun
CLSIDFromProgID
CoCreateInstance
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
OleDestroyMenuDescriptor
CoInitializeEx

oleaut32

LHashValOfNameSys
SafeArrayGetDim
VariantInit
SafeArrayGetUBound
LoadTypeLi
SafeArrayGetLBound
VariantCopyInd
SysFreeString
OleCreateFontIndirect
RegisterTypeLi
SysAllocString
VariantCopy
VarDateFromStr
SafeArrayUnaccessData
SafeArrayCreate
VarCmp
SafeArrayAccessData
VariantChangeType
VariantClear
SystemTimeToVariantTime
VariantTimeToSystemTime
VarBstrFromDate
VarUdateFromDate
SafeArrayGetElemsize
SafeArrayDestroy
SysAllocStringLen
SysStringLen

comctl32

ImageList_AddMasked
ImageList_Create
ImageList_Destroy
ImageList_GetImageInfo
ImageList_GetImageCount
ImageList_Draw
ImageList_ReplaceIcon
ImageList_GetIcon
_TrackMouseEvent
InitCommonControlsEx

ws2_32

WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSACloseEvent
gethostbyaddr
getservbyport
getservbyname
InetNtopW
freeaddrinfo
getaddrinfo
WSAStringToAddressW
select
WSAIoctl
WSASetLastError
shutdown
ntohl
getsockopt
getsockname
__WSAFDIsSet
WSACreateEvent
WSAGetLastError
accept
bind
closesocket
listen
inet_pton
gethostname
getpeername
inet_addr
send
socket
ntohs
connect
recvfrom
recv
htonl
htons
sendto
ioctlsocket
setsockopt
WSACleanup
WSAStartup
inet_ntoa
gethostbyname
WSAWaitForMultipleEvents

crypt32

CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFindCertificateInStore
CertFreeCertificateChain

shlwapi

StrFormatKBSizeW
StrChrW
PathFindExtensionW
PathFindFileNameW
PathRemoveFileSpecW
PathIsUNCW
PathStripToRootW

wldap32

ord200
ord30
ord79
ord35
ord33
ord301
ord27
ord26
ord22
ord50
ord45
ord60
ord211
ord46
ord143
ord32
ord41

msimg32

AlphaBlend
GradientFill
TransparentBlt

uxtheme

OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemePartSize
IsAppThemed
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
GetCurrentThemeName
GetThemeColor
DrawThemeParentBackground
DrawThemeText
GetWindowTheme
SetWindowTheme

oledlg

OleUIBusyW

gdiplus

GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdiplusStartup
GdipGetImageHeight
GdipGetImagePaletteSize
GdipCloneImage
GdipBitmapUnlockBits
GdipCreateBitmapFromStream
GdipAlloc
GdipDrawImageRectI
GdipDisposeImage
GdipGetImagePixelFormat
GdipFree
GdipBitmapLockBits
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipGetImagePalette
GdipSetCompositingMode
GdipGetImageWidth
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdiplusShutdown
GdipSetInterpolationMode

ntdll

VerSetConditionMask

winmm

timeGetDevCaps
timeBeginPeriod
timeGetTime
PlaySoundW
timeEndPeriod

bcrypt

BCryptGenRandom

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

Sections

.text
Size: 4.7MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 346KB - Virtual size: 345KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

60a820ca3909659cc6fe979a81e950de

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

crypt32

shlwapi

wldap32

msimg32

uxtheme

oledlg

gdiplus

ntdll

winmm

bcrypt

oleacc

imm32

winspool.drv

Sections

.text Size: 4.7MB - Virtual size: 4.7MB

.rdata Size: 1.6MB - Virtual size: 1.6MB

.data Size: 56KB - Virtual size: 223KB

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.reloc Size: 346KB - Virtual size: 345KB

.text
Size: 4.7MB - Virtual size: 4.7MB

.rdata
Size: 1.6MB - Virtual size: 1.6MB

.data
Size: 56KB - Virtual size: 223KB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

.reloc
Size: 346KB - Virtual size: 345KB