Macro1[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Macro1.exe
Size

457KB
MD5

c6c03e916ccb8b326cc716eb29f55f00
SHA1

2f4e64b8d3a359d42aca770a422c6bc168a14c8f
SHA256

ef4e0e9cbe92a9650aabfcc2680e53f95a3614ab97d3fa672a22c04cbe782707
SHA512

4539ae9ecd7f82afdb01af630287a5c13cb9bd19f9236ad758d2fad3c667537cebd256a3a767ae5e2d5194cd2d9169c26d695077eac1c82f28ad2a824c7db2e9
SSDEEP

12288:GMdKihqHJL4j9N+v0tTpuOBeTqnz37bITV:G6uHFWiv0tMoNzrbITV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Macro1.exe

Files

Macro1.exe
.exe windows:5 windows x86 arch:x86

2058fccd57b94a8b1a53226a61098ea1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetDateFormatW
MulDiv
CreateEventA
GetTickCount
SetThreadAffinityMask
GetCurrentProcess
GetProcessAffinityMask
SetLastError
GetCurrentProcessId
ProcessIdToSessionId
WTSGetActiveConsoleSessionId
VirtualFree
QueryPerformanceCounter
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
lstrlenW
GlobalSize
GlobalUnlock
GetCurrentThread
GetThreadPriority
SetThreadPriority
SetHandleInformation
QueueUserAPC
ResumeThread
GetCurrentThreadId
GetTimeFormatW
GetLocalTime
SystemTimeToFileTime
FileTimeToSystemTime
FreeLibrary
LoadLibraryA
lstrcmpiW
LockResource
LoadResource
FindResourceW
GetComputerNameW
OpenMutexA
LoadLibraryW
GetStringTypeW
GetStringTypeA
TlsGetValue
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
InitializeCriticalSectionAndSpinCount
InterlockedExchange
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetStdHandle
InterlockedDecrement
InterlockedIncrement
CreateThread
ExitThread
HeapReAlloc
HeapSize
GetCommandLineA
RaiseException
RtlUnwind
HeapAlloc
HeapFree
DuplicateHandle
WaitForMultipleObjectsEx
SleepEx
OpenProcess
FindClose
GetExitCodeProcess
SetSystemPowerState
Beep
lstrcpynW
SetEvent
GetProcAddress
VirtualAlloc
HeapDestroy
HeapCreate
GetSystemDirectoryA
GlobalFindAtomW
GetLocaleInfoA
CreateToolhelp32Snapshot
IsValidCodePage
CompareStringW
OutputDebugStringA
GetFullPathNameW
FormatMessageW
SizeofResource
WaitForSingleObjectEx
VirtualProtect
VirtualQuery
ReadFile
GetSystemTimeAsFileTime
GetVersionExW
LocalAlloc
LocalFree
GetModuleHandleExW
GetModuleFileNameA
TlsFree
GlobalDeleteAtom
IsProcessorFeaturePresent
GetSystemInfo
GlobalAddAtomA
GetModuleFileNameW
TerminateThread
TlsAlloc
QueryPerformanceFrequency
TlsSetValue
GetStringTypeExA
WideCharToMultiByte
GetModuleHandleA
SetErrorMode
GetDriveTypeA
GetCommandLineW
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
GetDiskFreeSpaceExA
CreateSemaphoreA
WriteFile
UnmapViewOfFile
lstrcpyW
MapViewOfFile
OpenFileMappingA
GetModuleHandleW
FindFirstFileW
FindNextFileW
GetFileAttributesW
SetFileAttributesW
GetFileAttributesExW
CreateFileW
ReleaseSemaphore
ReleaseMutex
CloseHandle
ExitProcess
Sleep
CreateMutexA
GetLastError
WaitForSingleObject
LoadLibraryExW
LCMapStringW
GetStartupInfoA
WritePrivateProfileStringW
GetPrivateProfileStructW
WritePrivateProfileStructW
GetPrivateProfileIntW
DeleteFileW
MoveFileExW
CopyFileW
CreateDirectoryW
GetPrivateProfileStringW
SetEndOfFile
ExpandEnvironmentStringsW
GetTempPathW
SearchPathW
GetShortPathNameW
GetLongPathNameW

user32

DefWindowProcW
RegisterHotKey
UnregisterHotKey
DestroyWindow
PostMessageA
PeekMessageW
FindWindowA
PostMessageW
PostQuitMessage
KillTimer
SetTimer
CreateWindowExA
SendMessageW
EnumThreadWindows
PostThreadMessageA
OpenClipboard
CloseClipboard
GetClipboardData
EmptyClipboard
GetClipboardOwner
ChangeClipboardChain
SendNotifyMessageW
IsZoomed
SetFocus
AttachThreadInput
GetGUIThreadInfo
GetSystemMenu
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetMenuState
IsWindowEnabled
LoadCursorA
GetCursorInfo
SendMessageTimeoutW
SendMessageCallbackA
MsgWaitForMultipleObjectsEx
WaitForInputIdle
GetWindowRect
OffsetRect
AllowSetForegroundWindow
LockWorkStation
ExitWindowsEx
MessageBeep
EnumChildWindows
BringWindowToTop
RegisterWindowMessageA
DispatchMessageW
GetMessageW
GetDlgCtrlID
FindWindowExW
GetPropA
ReplyMessage
GetParent
GetClassLongW
GetSysColor
SetWindowPos
GetClientRect
CopyImage
CreateIconFromResourceEx
GetIconInfo
PrintWindow
GetWindowDC
DestroyIcon
FillRect
CharUpperA
CharLowerA
GetDlgItem
RegisterClassExW
GetClassInfoExW
GetClassNameW
GetClassNameA
GetWindowPlacement
SetWindowPlacement
ScreenToClient
ClientToScreen
MapWindowPoints
SetWindowLongA
IsWindowUnicode
GetAncestor
WindowFromPoint
GetCursorPos
InvalidateRect
MonitorFromRect
GetMonitorInfoA
EnumDisplayMonitors
MonitorFromWindow
CallWindowProcW
RealChildWindowFromPoint
CreateWindowExW
CharLowerW
CharLowerBuffW
CharUpperBuffW
SetPropA
RemovePropA
TranslateMessage
MsgWaitForMultipleObjects
PrivateExtractIconsW
CreateIcon
GetAsyncKeyState
MapVirtualKeyW
GetKeyNameTextW
EndMenu
TrackPopupMenuEx
MessageBoxW
MessageBoxIndirectW
DialogBoxIndirectParamA
CreateDialogIndirectParamA
DialogBoxIndirectParamW
CreateDialogIndirectParamW
DrawTextW
InsertMenuItemW
GetWindowTextW
GetWindowTextLengthW
InternalGetWindowText
wvsprintfA
EnableWindow
EndDialog
LockSetForegroundWindow
IsDlgButtonChecked
SetMenuItemInfoW
GetMenuItemInfoW
EnumWindows
FindWindowW
IsCharAlphaA
IsCharUpperA
IsCharLowerA
SetRect
IsWindow
DrawIconEx
ReleaseDC
GetDC
IsIconic
ShowWindow
PtInRect
MonitorFromPoint
GetSystemMetrics
VkKeyScanExW
MapVirtualKeyExW
GetWindow
GetDesktopWindow
SetForegroundWindow
SendInput
GetWindowThreadProcessId
GetKeyboardLayout
IsHungAppWindow
GetForegroundWindow
SystemParametersInfoA
GetProcessWindowStation
OpenInputDesktop
GetUserObjectInformationA
CloseDesktop
LoadImageW
IsWindowVisible
GetKeyState
RegisterClipboardFormatA
GetClipboardSequenceNumber
GetOpenClipboardWindow
SetWindowLongW
SetClipboardViewer
GetWindowLongW
SetClipboardData

gdi32

CreateDIBitmap
SetViewportOrgEx
GetDIBits
GetStockObject
GetObjectA
BitBlt
DeleteObject
GetDeviceCaps
CreateCompatibleDC
DeleteDC
CreateCompatibleBitmap
CreateFontIndirectW
GetObjectW
GetPixel
SelectObject

advapi32

GetSidSubAuthority
RegDeleteValueW
RegDeleteKeyW
InitiateSystemShutdownW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
GetUserNameW
GetTokenInformation
OpenProcessToken
GetSidSubAuthorityCount
AdjustTokenPrivileges
LookupPrivilegeValueA
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

ole32

CoGetObject
IIDFromString
CLSIDFromProgID
CoCreateInstance
CoGetClassObject
CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemRealloc
CreateBindCtx
GetRunningObjectTable
CoTaskMemFree
ReleaseStgMedium
RegisterDragDrop
RevokeDragDrop
OleInitialize
OleUninitialize

oleaut32

GetActiveObject
SafeArrayAllocData
SafeArrayGetDim
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayUnlock
SafeArrayLock
SafeArrayPtrOfIndex
OleCreateFontIndirect
VariantInit
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserSize
SysStringLen
SysReAllocStringLen
SysAllocStringLen
VarBstrCmp
VarBstrCat
VarCmp
VarFix
VarRound
VarDiv
VarMul
VarSu
VarAdd
VarCyCmp
VarCyFix
VarCyRound
VarCyMul
VarCySu
VarCyAdd
VarDecCmp
VarDecFix
VarDecRound
VarDecDiv
VarDecMul
VarDecSu
VarDecAdd
VarBstrFromDate
VarBstrFromCy
VarBstrFromDec
VarBstrFromR4
SafeArrayCreate
VarDateFromUI4
VarDateFromI4
VarDateFromR8
VarDateFromUI1
VarDateFromUI2
VarDateFromCy
VarDateFromDec
VarDateFromR4
SafeArrayDestroyDescriptor
VarCyFromUI4
VarCyFromI4
VarCyFromR8
VarCyFromUI1
VarCyFromUI2
VarCyFromDec
VarCyFromDate
VarCyFromR4
VarCyFromStr
VarDecFromUI4
VarDecFromI4
VarDecFromR8
VarDecFromUI1
VarDecFromUI2
VarDecFromCy
VarDecFromDate
VarDecFromR4
VarDecFromStr
VarR4FromCy
VarR4FromDec
VarR4FromDate
VarR4FromStr
VarR8FromStr
VarR8FromCy
VarR8FromDec
VariantTimeToSystemTime
VariantChangeTypeEx
VarI4FromStr
VarI4FromDate
VarI4FromCy
VarI4FromDec
VarI4FromR4
VarNot
VarNeg
VarDecNeg
VarCyNeg
SafeArrayCreateEx
SafeArrayGetVartype
VariantCopy
SafeArrayCopy
SystemTimeToVariantTime
VarUdateFromDate
OleCreatePictureIndirect
SafeArrayAllocDescriptor
SafeArrayRedim
GetErrorInfo
SysAllocString
VarBstrFromR8
VarDateFromStr
VarR8Round
SysFreeString
SafeArrayDestroy
VariantClear
SysReAllocString
OleLoadPicture

shlwapi

PathSkipRootA
PathFindFileNameA
ord158
StrCatW
StrChrW
StrCmpW
StrCmpIW
StrRChrA
SHDeleteEmptyKeyW
SHDeleteKeyW
SHCreateStreamOnFileW
StrStrIW
PathGetArgsW
StrCmpLogicalW

comctl32

ord413
ImageList_GetIcon
ImageList_ReplaceIcon
ImageList_Create
ImageList_Add
ord410
ord412
InitCommonControlsEx

winmm

timeEndPeriod
PlaySoundW
timeGetTime
timeBeginPeriod

rpcrt4

NdrOleAllocate
NdrOleFree
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
NdrCStdStubBuffer_Release
NdrDllGetClassObject

Exports

Exports

AdjustWindowPos
AllowActivateWindows
Brac2
ConvertSignedUnsigned
Crc32
CreateCsScript
CreateCsv
CreateEnumFiles
CreateFileU
CreateShortcutEx
CreateStringMap
CreateXml
DetectStringEncoding
DialogBoxIndirectParamU
DllGetClassObject
DpiClientToScreen
DpiGetDPI
DpiGetWindowRect
DpiIsWindowScaled
DpiMapWindowPoints
DpiScale
DpiScreenToClient
DrawTextU
EditReplaceSel
EnsureLoggedOn
EnumProcessesEx
EnumQmThreads
ExeExtractFile
ExeGetResourceData
FileExists
FindFirstFileU
FindNextFileU
FormatKeyString
GetCPU
GetCallStack
GetDiskUsage
GetExeResHandle
GetFileIcon
GetFileOrFolderSize
GetFullPath
GetMod
GetProcessExename
GetProcessIntegrityLevel
GetProcessUacInfo
GetQmThreadInfo
GetSecurityAttributes
GetShortcutInfoEx
GetToolbarOwner
GetUserInfo
HtmlHelpU
InitWindowsDll
InsertMenuItemU
InterfaceForDll
IsExtendedKey
IsLoggedOn
IsThreadRunning
IsUserAdmin
IsValidCallback
IsWindow64Bit
LoadPictureFile
MemCompare
MenuGetString
MenuSetString
MonitorFromIndex
MonitorIndex
PerfFirst
PerfNext
PerfOut
PidlFromStr
PidlToStr
ProcessHandleToId
ProcessNameToId
QmKeyCodeFromVK
QmKeyCodeToVK
QmRegisterDropTarget
QmSetWindowClassFlags
QmUnregisterDropTarget
RandomInt
RandomNumber
RealGetKeyState
RealGetParent
RedirectQmOutput
RegisterComComponent
RichEditLoad
RichEditSave
Round
RtOptions
SaveBitmap
SelStr
SetPrivilege
SetWinStyle
Statement
StrCompare
StrCompareEx
StrCompareN
SubclassWindow
WaitForAnActiveWindow
__CDD_CanHaveText
__CDD_LoadControlDllOnDemand
__CompileDialogDefinition
__Crc
__GetQmItemIcon
__ImageListLoad
__SetAutoSizeControls
__SfMap
__Str_GetNotThis
__SysLinkOnClick
__Test
__TrackPopupMenu
__Val
__VarProp_Get
__VarProp_GetVar
__VarProp_Remove
__VarProp_Set
__WinTest
q_calloc
q_free
q_isalnum
q_iscsym
q_isdigit
q_malloc
q_memicmp
q_msize
q_printf
q_realloc
q_sort
q_strdup
q_stricmp
q_strnicmp

Sections

.text
Size: 372KB - Virtual size: 371KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 135B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2058fccd57b94a8b1a53226a61098ea1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shlwapi

comctl32

winmm

rpcrt4

Exports

Exports

Sections

.text Size: 372KB - Virtual size: 371KB

.orpc Size: 512B - Virtual size: 135B

.rdata Size: 70KB - Virtual size: 69KB

.data Size: 7KB - Virtual size: 19KB

.rsrc Size: 7KB - Virtual size: 6KB

.text
Size: 372KB - Virtual size: 371KB

.orpc
Size: 512B - Virtual size: 135B

.rdata
Size: 70KB - Virtual size: 69KB

.data
Size: 7KB - Virtual size: 19KB

.rsrc
Size: 7KB - Virtual size: 6KB