ee87288e2d80a024f71111a38e0cbaea8969f3206529e39832dbdda4c4b87296

Sharing

Copy URL Twitter E-mail

General

Target

ee87288e2d80a024f71111a38e0cbaea8969f3206529e39832dbdda4c4b87296
Size

5.7MB
MD5

cc2f139b385fec9ec6772b18e7c2d291
SHA1

22a87b578ddefcc7a903134f6c4bd30978b2ac23
SHA256

ee87288e2d80a024f71111a38e0cbaea8969f3206529e39832dbdda4c4b87296
SHA512

a0f3c2137f32ae732dc0c245744812cbafb7eed30bc2ea2be4a073cee21931a3294ee28bd473b97acb7e7a6c024b361b56d2b25b5ce3117842c0439a70ac0c16
SSDEEP

98304:Fc8cA9z+GF/NtFSwijBxI2v38Fswdqd9kbl+u4QHBR+HCmDE/Fir0b/yP:C8x9+GpNjzjEwQE9qlDBT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ee87288e2d80a024f71111a38e0cbaea8969f3206529e39832dbdda4c4b87296

Files

ee87288e2d80a024f71111a38e0cbaea8969f3206529e39832dbdda4c4b87296
.exe windows:6 windows x86 arch:x86

20a3c3adfd0e2c370ad6b09370ae2755

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
SetFilePointerEx
CreateDirectoryW
FindFirstFileW
SetLastError
GetCommandLineW
FindNextFileW
GetCurrentProcess
TerminateProcess
RemoveDirectoryW
CreatePipe
PeekNamedPipe
FindClose
GetFileAttributesW
GetFileAttributesExW
GlobalFlags
DeleteFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
CreateProcessW
IsBadReadPtr
VirtualQuery
GetExitCodeProcess
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
ResetEvent
FileTimeToSystemTime
GetLocalTime
GetSystemTimeAsFileTime
VirtualProtect
VirtualFree
VirtualAlloc
OpenFileMappingW
UnmapViewOfFile
LoadLibraryA
CreateFileMappingW
MapViewOfFile
GetModuleFileNameA
LoadLibraryExA
FormatMessageA
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
GetFileInformationByHandle
OpenProcess
SetFileAttributesW
ReleaseSemaphore
PostQueuedCompletionStatus
CreateIoCompletionPort
CreateSemaphoreW
GetSystemInfo
GetQueuedCompletionStatus
IsDebuggerPresent
CreateThread
SetEvent
SetThreadPriority
WaitForSingleObject
GetModuleFileNameW
GetTempPathW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetTickCount64
MultiByteToWideChar
WideCharToMultiByte
Sleep
TryEnterCriticalSection
EnterCriticalSection
WriteConsoleW
HeapSize
SetFilePointer
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetStdHandle
GetFullPathNameW
MoveFileExW
FlushFileBuffers
GetTimeZoneInformation
EnumSystemLocalesW
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
FreeLibraryAndExitThread
ExitThread
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
DuplicateHandle
GetCommandLineA
GetModuleHandleExW
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RaiseException
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetStringTypeW
WriteFile
ReadFile
FreeLibrary
LoadLibraryW
GetUserDefaultLCID
GetTickCount
FindResourceW
LoadResource
LockResource
FreeResource
GetCurrentThreadId
SizeofResource
MulDiv
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
ExitProcess
OpenEventW
SetWaitableTimer
CreateWaitableTimerW
CreateEventW
LCMapStringEx
DecodePointer
GetModuleHandleW
EncodePointer
GetFileSizeEx
CreateFileA
VerifyVersionInfoA
FormatMessageW
WaitForMultipleObjects
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
GetModuleHandleA
GetSystemDirectoryA
QueryPerformanceFrequency
SleepEx
InitializeCriticalSectionEx
QueryPerformanceCounter
CreateFileW
WriteProcessMemory
SetEndOfFile
GetCurrentProcessId
CloseHandle
GetProcAddress
VirtualProtectEx
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

user32

SetWindowsHookExW
CallNextHookEx
GetAsyncKeyState
GetSystemMetrics
GetCursorPos
GetFocus
GetActiveWindow
GetDesktopWindow
MessageBoxW
SetFocus
GetMessageW
ReleaseDC
GetDC
LoadImageW
GetParent
LoadCursorW
LoadIconW
SetPropW
RegisterClassW
GetClassInfoW
LoadStringW
SendMessageW
CreateWindowExW
DefWindowProcW
GetWindowLongW
EnumWindows
MonitorFromWindow
wsprintfW
MessageBoxA
DestroyWindow
RemovePropW
FindWindowExW
GetWindowTextW
GetWindowTextLengthW
SetProcessDPIAware
PeekMessageW
TranslateMessage
DispatchMessageW
GetPropW
IsWindowVisible
GetClassNameW
GetWindowThreadProcessId
MsgWaitForMultipleObjects
IsWindow

gdi32

GetObjectW
SelectObject
CreateDIBSection
SetDIBColorTable
CreateCompatibleDC
GetStockObject
GetDeviceCaps
DeleteDC
DeleteObject

advapi32

CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptEncrypt
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash

shell32

SHGetSpecialFolderPathW

ole32

CreateStreamOnHGlobal
CoInitialize
OleRun
CLSIDFromString
CoSetProxyBlanket
CLSIDFromProgID
CoInitializeEx
CoCreateInstance
CoUninitialize

oleaut32

LoadTypeLi
VariantInit
LHashValOfNameSys
SystemTimeToVariantTime
RegisterTypeLi
SysAllocString
VarCmp
VariantChangeType
VariantCopy
VariantCopyInd
VariantClear

comctl32

ImageList_Destroy
ImageList_Create
ImageList_AddMasked

ntdll

VerSetConditionMask

psapi

GetModuleFileNameExW
GetModuleBaseNameW
EnumProcessModulesEx
GetModuleInformation

winmm

timeSetEvent
timeKillEvent
PlaySoundW

wldap32

ord143
ord211
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord46
ord32
ord33
ord35
ord79
ord301
ord30
ord200

ws2_32

WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
recvfrom
getaddrinfo
ioctlsocket
listen
htonl
ntohl
socket
send
recv
closesocket
accept
WSAIoctl
sendto
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
WSASetLastError
select
__WSAFDIsSet
inet_pton
WSAGetLastError
WSACleanup
WSAStartup
WSAEventSelect
gethostname
freeaddrinfo
setsockopt

gdiplus

GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipGetImageWidth
GdipSetCompositingMode
GdipGetImagePalette
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipBitmapLockBits
GdipFree
GdipGetImagePixelFormat
GdipDisposeImage
GdipDrawImageRectI
GdipAlloc
GdipCreateBitmapFromStream
GdipBitmapUnlockBits
GdipCloneImage
GdipGetImagePaletteSize
GdipGetImageHeight
GdiplusShutdown
GdiplusStartup

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain

Sections

.text
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.<K/
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

._sp
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

."h_
Size: 5.6MB - Virtual size: 5.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

20a3c3adfd0e2c370ad6b09370ae2755

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

ntdll

psapi

winmm

wldap32

ws2_32

gdiplus

crypt32

Sections

.text Size: - Virtual size: 1.4MB

.rdata Size: - Virtual size: 2.0MB

.data Size: - Virtual size: 17KB

.<K/ Size: - Virtual size: 1.1MB

._sp Size: 2KB - Virtual size: 1KB

."h_ Size: 5.6MB - Virtual size: 5.6MB

.reloc Size: 7KB - Virtual size: 6KB

.rsrc Size: 68KB - Virtual size: 2.9MB

.text
Size: - Virtual size: 1.4MB

.rdata
Size: - Virtual size: 2.0MB

.data
Size: - Virtual size: 17KB

.<K/
Size: - Virtual size: 1.1MB

._sp
Size: 2KB - Virtual size: 1KB

."h_
Size: 5.6MB - Virtual size: 5.6MB

.reloc
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 68KB - Virtual size: 2.9MB