91efef1a4c7425d5ea660cdf8c9f99f86e1ef720e33b923289fb1940b68f5afe

Sharing

Copy URL Twitter E-mail

General

Target

91efef1a4c7425d5ea660cdf8c9f99f86e1ef720e33b923289fb1940b68f5afe
Size

13.0MB
MD5

3556cb5e2bfafd0a8b5c30d006d8f46d
SHA1

738d4ae0467cf25b8a1fb544e376960f9568ff6b
SHA256

91efef1a4c7425d5ea660cdf8c9f99f86e1ef720e33b923289fb1940b68f5afe
SHA512

228346a9b660de1ce9693f897f60eef928312f01adade8db1a6e06e7b58285bf6f9e4d232a2b2baa9114fcff124de33dc5f05e3d00ac8cfdd0cf2dd7fa49c24d
SSDEEP

196608:zE2gBzoSq/SceW/cKWMxxMqlXqjv0pfjoZChD2d/WRHgr8hX7ddjDfcLmuIey:oVBzKKceW/nWMxxrqg7fDLRHg8D3kZy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
91efef1a4c7425d5ea660cdf8c9f99f86e1ef720e33b923289fb1940b68f5afe

Files

91efef1a4c7425d5ea660cdf8c9f99f86e1ef720e33b923289fb1940b68f5afe
.exe windows:6 windows x86 arch:x86

f2bef91fb73cbf721d9c78f563b78f44

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForMultipleObjects
SetThreadPriority
GetLocaleInfoW
GetFileAttributesW
ReleaseMutex
GetSystemDirectoryW
GetModuleHandleA
DisconnectNamedPipe
GetLogicalDriveStringsW
CreateEventW
FormatMessageW
GetFileAttributesExW
OutputDebugStringW
SetEvent
GetCurrentThread
TerminateThread
QueryPerformanceFrequency
LoadLibraryW
ResetEvent
GetCurrentDirectoryW
GetOverlappedResult
ExitProcess
VerSetConditionMask
FreeLibrary
VerifyVersionInfoW
QueryPerformanceCounter
GetDriveTypeW
IsDebuggerPresent
ConnectNamedPipe
SetUnhandledExceptionFilter
FlushFileBuffers
GlobalSize
GlobalAlloc
GlobalLock
GetCurrentProcessId
GlobalUnlock
MultiByteToWideChar
WideCharToMultiByte
SetFilePointerEx
UnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LockResource
InterlockedPopEntrySList
SetThreadAffinityMask
VirtualProtect
VirtualFree
VirtualAlloc
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
ReadConsoleW
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetFileType
SetEnvironmentVariableA
GetACP
GetStdHandle
GetModuleFileNameA
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
GetTimeZoneInformation
LoadLibraryExW
RtlUnwind
InterlockedFlushSList
InterlockedPushEntrySList
GetCPInfo
LCMapStringW
CompareStringW
EncodePointer
InitializeCriticalSectionAndSpinCount
SetLastError
DuplicateHandle
GetStringTypeW
FindFirstFileExW
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
IsProcessorFeaturePresent
WaitForSingleObjectEx
RemoveDirectoryW
CancelIo
GetVolumeInformationW
UnregisterWaitEx
TryEnterCriticalSection
HeapSize
FreeResource
FindClose
InitializeCriticalSectionEx
GetTempPathW
GetCommandLineW
GetCurrentThreadId
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateProcessW
MoveFileExW
GetProcAddress
GetDiskFreeSpaceExW
WaitForSingleObject
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
MoveFileW
GetTickCount
CopyFileW
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
FindResourceW
RaiseException
LoadResource
HeapReAlloc
ReleaseSemaphore
DeleteFileW
GetEnvironmentVariableW
FindNextFileW
HeapFree
FindFirstFileW
SizeofResource
CreateDirectoryW
GetVersionExW
CreateFileW
SetFilePointer
WriteFile
ReadFile
CloseHandle
GetLastError
Sleep
QueryDepthSList
CreateMutexW

user32

FindWindowW
UnregisterClassW
MessageBoxW
PostMessageW
SetForegroundWindow
GetForegroundWindow
AttachThreadInput
ShowWindow
SetWindowPos
GetWindowThreadProcessId
GetWindowTextW
MsgWaitForMultipleObjectsEx
GetSystemMenu
SetWindowLongW
TranslateMessage
SetFocus
EnumWindows
PeekMessageW
DispatchMessageW
RegisterClassExW
CreateWindowExW
DestroyWindow
GetFocus
SendMessageTimeoutW
DefWindowProcW
GetMessageW
GetWindowLongW
EndPaint
BeginPaint
GetCursorPos
ReleaseDC
SetCursorPos
GetAncestor
InvalidateRect
ReleaseCapture
GetParent
SystemParametersInfoW
EnableMenuItem
GetDesktopWindow
ShowCaret
GetClientRect
SetCursor
ToUnicode
SetClipboardData
SetCapture
DestroyCaret
LoadCursorW
GetClipboardData
SetLayeredWindowAttributes
GetMessageTime
TrackMouseEvent
CreateCaret
IsChild
EmptyClipboard
CloseClipboard
CreateIconIndirect
GetMonitorInfoW
GetWindowInfo
DestroyIcon
RedrawWindow
GetCapture
OpenClipboard
GetAsyncKeyState
GetActiveWindow
SetCaretPos
GetKeyboardState
PostQuitMessage
GetMessageExtraInfo
GetUpdateRgn
GetMessagePos
MapVirtualKeyW
GetWindowRect
GetDC
IsWindowVisible
EnumChildWindows
EnumDisplayMonitors
GetIconInfo
ScreenToClient
SendMessageW
GetSystemMetrics
SetWindowTextW
MessageBeep
WindowFromPoint
GetWindowPlacement
DestroyCursor

gdi32

CreateDIBSection
StretchDIBits
CreateRectRgnIndirect
GetPixel
CreateRectRgn
GetRegionData
GetObjectW
ExcludeClipRect
RestoreDC
CreateBitmap
CombineRgn
SelectObject
GetKerningPairsW
CreateCompatibleDC
EnumFontFamiliesExW
GetDeviceCaps
GetTextMetricsW
DeleteDC
SetMapperFlags
GetGlyphIndicesW
GetGlyphOutlineW
DeleteObject
RemoveFontMemResourceEx
SetMapMode
CreateFontIndirectW
GetOutlineTextMetricsW
SaveDC

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW

shell32

ExtractAssociatedIconW
SHGetMalloc
ShellExecuteW
SHGetPathFromIDListW
SHFileOperationW
ord165
SHGetKnownFolderPath
SHGetSpecialFolderPathW
CommandLineToArgvW
SHBrowseForFolderW

ole32

RevokeDragDrop
RegisterDragDrop
DoDragDrop
CoTaskMemAlloc
OleInitialize
OleUninitialize
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize
CoCreateGuid

shlwapi

PathFileExistsW
PathRemoveFileSpecW
PathStripToRootW

ws2_32

select
inet_ntoa
recv
getsockopt
send
setsockopt
accept
__WSAFDIsSet
WSAStartup
closesocket

winmm

timeGetTime
timeKillEvent
timeBeginPeriod

imm32

ImmNotifyIME
ImmGetCompositionStringW
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 344KB - Virtual size: 343KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 102.2MB - Virtual size: 102.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f2bef91fb73cbf721d9c78f563b78f44

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

shlwapi

ws2_32

winmm

imm32

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 344KB - Virtual size: 343KB

.data Size: 30KB - Virtual size: 43KB

.tls Size: 512B - Virtual size: 13B

.gfids Size: 3KB - Virtual size: 2KB

.rsrc Size: 102.2MB - Virtual size: 102.2MB

.reloc Size: 94KB - Virtual size: 94KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 344KB - Virtual size: 343KB

.data
Size: 30KB - Virtual size: 43KB

.tls
Size: 512B - Virtual size: 13B

.gfids
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 102.2MB - Virtual size: 102.2MB

.reloc
Size: 94KB - Virtual size: 94KB