9ed83112df539878cd692cf7e773c950N

Sharing

Copy URL Twitter E-mail

General

Target

9ed83112df539878cd692cf7e773c950N
Size

8.2MB
MD5

9ed83112df539878cd692cf7e773c950
SHA1

38074c9b92d3b7ce525f250d62c87160d3daf261
SHA256

1458cda59aa0c88037bb7c9fe41b9eb3d281f93b8bba3015e6df03f2848d41b0
SHA512

e35253bba51451119cd1ac4c26c9d654fdb66117f87733b5e37757d1a5683f538218dfa37d19a2c7ab35599cf095bafe77f4c184b484b499b9b182b2d7182073
SSDEEP

196608:pemj/pA86lutuH2V6D69kXvQUs2cwFsptfy4Bi0vIee2U4jCn1CPwDv3uFSJA57H:pemjxyuEqxtj41CPwDv3uFukPIu1UYa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9ed83112df539878cd692cf7e773c950N

Files

9ed83112df539878cd692cf7e773c950N
.exe windows:5 windows x86 arch:x86

64f2611afc92c104ca6fa1f574e1cf69

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

mpr

WNetGetLastErrorW
WNetAddConnection2W
WNetCancelConnection2W

winmm

waveInUnprepareHeader
waveInAddBuffer
waveInGetDevCapsW
waveInGetNumDevs
waveInStart
waveInClose
waveInReset
waveInOpen
waveInPrepareHeader
waveInStop
waveInGetErrorTextW

oleacc

AccessibleChildren
GetRoleTextW
AccessibleObjectFromPoint
ObjectFromLresult

comctl32

FlatSB_SetScrollInfo
ImageList_DragMove
ImageList_Destroy
_TrackMouseEvent
ImageList_DragShowNolock
ImageList_Add
ImageList_GetDragImage
FlatSB_SetScrollProp
ImageList_Create
ImageList_EndDrag
ImageList_DrawEx
ImageList_SetImageCount
FlatSB_GetScrollPos
FlatSB_SetScrollPos
InitializeFlatSB
FlatSB_GetScrollInfo
ImageList_Write
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_BeginDrag
ImageList_GetIcon
ImageList_GetImageCount
ImageList_DragEnter
ImageList_GetIconSize
ImageList_SetIconSize
ImageList_Read
ImageList_DragLeave
ImageList_Draw
ImageList_Remove

ws2_32

WSAEnumProtocolsW
setsockopt
WSAStartup
WSACleanup

shell32

SHGetMalloc
SHGetFileInfoW
SHGetSpecialFolderLocation
Shell_NotifyIconW
SHGetPathFromIDListW

user32

CopyImage
SetMenuItemInfoW
GetMenuItemInfoW
DefFrameProcW
GetDlgCtrlID
FrameRect
RegisterWindowMessageW
GetMenuStringW
FillRect
SendMessageA
EnumWindows
ShowOwnedPopups
GetClassInfoW
GetScrollRange
SetActiveWindow
GetActiveWindow
DrawEdge
GetKeyboardLayoutList
OemToCharBuffA
LoadBitmapW
EnumChildWindows
UnhookWindowsHookEx
SetCapture
GetCapture
ShowCaret
CreatePopupMenu
GetMenuItemID
wvsprintfW
CharLowerBuffW
PostMessageW
SetWindowLongW
IsZoomed
SetParent
DrawMenuBar
GetClientRect
IsChild
IsIconic
CallNextHookEx
CloseDesktop
ShowWindow
GetWindowTextW
SetForegroundWindow
IsDialogMessageW
DestroyWindow
RegisterClassW
EndMenu
CharNextW
GetFocus
GetDC
SetThreadDesktop
SetFocus
ReleaseDC
GetClassLongW
CharToOemBuffA
SetScrollRange
DrawTextW
PeekMessageA
MessageBeep
SetClassLongW
RemovePropW
GetSubMenu
DestroyIcon
IsWindowVisible
DispatchMessageA
UnregisterClassW
GetTopWindow
SendMessageW
GetLastInputInfo
SendMessageTimeoutW
LoadStringW
CreateMenu
CharLowerW
SetWindowRgn
SetWindowPos
GetMenuItemCount
GetSysColorBrush
GetWindowDC
DrawTextExW
CharLowerBuffA
GetScrollInfo
EnumDesktopsW
SetWindowTextW
GetMessageExtraInfo
GetSysColor
EnableScrollBar
TrackPopupMenu
DrawIconEx
GetClassNameW
GetMessagePos
GetIconInfo
SetScrollInfo
GetKeyNameTextW
GetDesktopWindow
SetCursorPos
GetCursorPos
SetMenu
GetMenuState
GetMenu
SetRect
GetKeyState
GetCursor
KillTimer
WaitMessage
TranslateMDISysAccel
GetWindowPlacement
CreateWindowExW
OpenDesktopW
GetMessageW
GetDCEx
SetProcessWindowStation
PeekMessageW
MonitorFromWindow
SetTimer
WindowFromPoint
BeginPaint
RegisterClipboardFormatW
MapVirtualKeyW
IsWindowUnicode
CharToOemA
DispatchMessageW
DefMDIChildProcW
GetSystemMenu
SetScrollPos
GetScrollPos
OpenWindowStationW
DrawFocusRect
ReleaseCapture
LoadCursorW
GetGUIThreadInfo
ScrollWindow
GetLastActivePopup
GetCursorInfo
MessageBoxIndirectW
GetSystemMetrics
CharUpperBuffW
SetClipboardData
GetClipboardData
ClientToScreen
SetWindowPlacement
GetMonitorInfoW
CheckMenuItem
CharUpperW
DefWindowProcW
GetForegroundWindow
EnableWindow
GetWindowThreadProcessId
RedrawWindow
EndPaint
MsgWaitForMultipleObjectsEx
ToUnicodeEx
LoadKeyboardLayoutW
ActivateKeyboardLayout
GetParent
InsertMenuItemW
GetPropW
MessageBoxW
SetPropW
EnumWindowStationsW
UpdateWindow
MsgWaitForMultipleObjects
OemToCharA
DestroyMenu
SetWindowsHookExW
EmptyClipboard
CloseWindowStation
AdjustWindowRectEx
IsWindow
DrawIcon
EnumThreadWindows
InvalidateRect
GetKeyboardState
OemToCharBuffW
ScreenToClient
DrawFrameControl
SetCursor
CreateIcon
RemoveMenu
GetKeyboardLayoutNameW
OpenClipboard
TranslateMessage
MapWindowPoints
EnumDisplayMonitors
CallWindowProcW
CloseClipboard
DestroyCursor
CharUpperBuffA
PostQuitMessage
GetProcessWindowStation
ShowScrollBar
EnableMenuItem
HideCaret
FindWindowExW
MonitorFromPoint
LoadIconW
SystemParametersInfoW
GetWindow
GetWindowRect
GetWindowLongW
InsertMenuW
PostThreadMessageW
IsWindowEnabled
IsDialogMessageA
FindWindowW
GetKeyboardLayout
DeleteMenu

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

oleaut32

SafeArrayPutElement
GetErrorInfo
VariantInit
VariantClear
SysFreeString
SafeArrayAccessData
SysReAllocStringLen
SafeArrayCreate
SafeArrayGetElement
SysAllocStringLen
SafeArrayUnaccessData
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetUBound
SafeArrayGetLBound
VariantCopyInd
VariantChangeType

advapi32

ControlService
CreateServiceW
OpenThreadToken
RegisterServiceCtrlHandlerExW
EqualSid
DeleteService
LsaRetrievePrivateData
GetTokenInformation
SetTokenInformation
LookupAccountSidW
RegCreateKeyExW
ChangeServiceConfigW
LsaNtStatusToWinError
LsaFreeMemory
SetSecurityDescriptorDacl
RevertToSelf
AdjustTokenPrivileges
QueryServiceConfigW
LookupPrivilegeValueW
OpenSCManagerW
RegOpenKeyExW
AllocateAndInitializeSid
ImpersonateLoggedOnUser
RegFlushKey
RegQueryValueExW
RegEnumValueW
InitializeSecurityDescriptor
EnumServicesStatusW
RegSetValueExW
CloseServiceHandle
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegConnectRegistryW
StartServiceCtrlDispatcherW
LookupAccountNameW
DeregisterEventSource
DuplicateToken
SetServiceStatus
IsValidSid
DuplicateTokenEx
StartServiceW
RegisterEventSourceW
CreateProcessAsUserW
LsaClose
OpenServiceW
OpenProcessToken
LsaOpenPolicy
FreeSid
ReportEventW
ConvertSidToStringSidW
RegCloseKey

netapi32

NetWkstaGetInfo
NetApiBufferFree

msvcrt

memcpy
memset

kernel32

GetFileType
GetFileTime
FlushViewOfFile
GetACP
LocalFree
CloseHandle
SizeofResource
GetCurrentProcessId
GetFullPathNameW
FindNextFileW
GetCPInfoExW
WriteProcessMemory
CreateWaitableTimerW
GetTimeZoneInformation
FileTimeToLocalFileTime
FreeLibrary
HeapDestroy
GetUserDefaultLCID
SetLastError
WaitNamedPipeW
GetModuleFileNameW
GetLastError
GlobalAlloc
GlobalUnlock
SetCommTimeouts
OpenMutexW
CompareStringW
CreateThread
PurgeComm
LoadLibraryA
ResetEvent
GetVolumeInformationW
OpenEventW
RaiseException
FormatMessageW
FindFirstChangeNotificationW
GetCurrentThread
LoadLibraryExW
GetPrivateProfileIntW
FileTimeToSystemTime
VirtualQuery
GlobalFindAtomW
VirtualQueryEx
Sleep
SetFilePointer
FlushFileBuffers
LoadResource
SuspendThread
GetTickCount
WaitForMultipleObjects
lstrcmpiA
GetFileSize
GetStartupInfoW
GetFileAttributesW
GetThreadPriority
SetThreadPriority
VirtualAlloc
GetSystemInfo
GetTempPathW
SetCommState
LeaveCriticalSection
GetCommState
SetWaitableTimer
GetLogicalDriveStringsW
CancelWaitableTimer
GetModuleHandleA
HeapCreate
VerSetConditionMask
GetDiskFreeSpaceW
GetUserDefaultUILanguage
GetConsoleOutputCP
CompareStringA
HeapFree
WideCharToMultiByte
MultiByteToWideChar
FindClose
LoadLibraryW
SetEvent
GetLocaleInfoW
ConnectNamedPipe
GetLocalTime
WaitForSingleObject
GetSystemPowerStatus
DeleteCriticalSection
SetErrorMode
GetComputerNameW
SleepEx
IsValidLocale
LocalAlloc
WaitForMultipleObjectsEx
SetFileAttributesW
QueryDosDeviceW
VirtualProtect
UnlockFile
OpenFileMappingW
lstrcmpiW
QueryPerformanceFrequency
VirtualFree
GetProcessHeap
ExitProcess
HeapAlloc
FindNextChangeNotification
GetLongPathNameW
RtlUnwind
GetCPInfo
GetStdHandle
DisconnectNamedPipe
GetModuleHandleW
ReadFile
FileTimeToDosDateTime
TransactNamedPipe
CreateProcessW
CreateRemoteThread
FindResourceW
CopyFileW
GlobalGetAtomNameW
MapViewOfFile
MulDiv
GetVersion
GetDriveTypeW
FreeResource
Module32NextW
SetThreadExecutionState
MoveFileW
GlobalAddAtomW
OpenProcess
SwitchToThread
GetExitCodeThread
GetFileAttributesExW
SetNamedPipeHandleState
TerminateProcess
LockResource
CancelIo
GetCurrentThreadId
UnhandledExceptionFilter
MoveFileExW
PeekNamedPipe
GlobalFree
ReadConsoleInputW
SetVolumeLabelW
EnterCriticalSection
GetDiskFreeSpaceExW
GetTempFileNameW
GlobalDeleteAtom
SetCurrentDirectoryW
GetCurrentDirectoryW
InitializeCriticalSection
GlobalLock
GetCurrentProcess
AllocConsole
GetCommandLineW
ResumeThread
GetProcAddress
DuplicateHandle
VirtualAllocEx
GetVersionExW
VerifyVersionInfoW
GetProcessTimes
GetWindowsDirectoryW
DeviceIoControl
FindFirstFileW
SetConsoleTitleW
LockFile
UnmapViewOfFile
GetConsoleCP
lstrlenW
QueryPerformanceCounter
SetEndOfFile
CopyFileExW
lstrcatW
lstrcpyW
CreateToolhelp32Snapshot
SystemTimeToFileTime
CreateFileW
GetSystemDirectoryW
DeleteFileW
IsDBCSLeadByteEx
FindCloseChangeNotification
FreeConsole
Module32FirstW
WriteFile
ExitThread
CreateNamedPipeW
CreateFileMappingW
TlsGetValue
GetDateFormatW
TlsSetValue
GetSystemDefaultUILanguage
GetOverlappedResult
CreateDirectoryW
EnumCalendarInfoW
RemoveDirectoryW
GlobalMemoryStatus
CreateEventW
SetThreadLocale
GetThreadLocale

quartz

AMGetErrorTextW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

ole32

IsEqualGUID
OleInitialize
CreateStreamOnHGlobal
OleUninitialize
CoUnmarshalInterface
CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc

secur32

LsaGetLogonSessionData
LsaFreeReturnBuffer

gdi32

Arc
Pie
SetBkMode
SelectPalette
CreateCompatibleBitmap
GetEnhMetaFileHeader
ExcludeClipRect
RectVisible
SetWindowOrgEx
MaskBlt
AngleArc
DeleteEnhMetaFile
Chord
SetTextColor
StretchBlt
SetDIBits
SetViewportOrgEx
CreateRectRgn
RealizePalette
GetDIBColorTable
SetDIBColorTable
RoundRect
RestoreDC
SetRectRgn
GetTextMetricsW
GetWindowOrgEx
CreatePalette
CreateBrushIndirect
PatBlt
SetEnhMetaFileBits
PolyBezierTo
GetStockObject
CreateSolidBrush
Polygon
Rectangle
MoveToEx
DeleteDC
SaveDC
PlayEnhMetaFile
BitBlt
Ellipse
FrameRgn
GetDeviceCaps
GetBitmapBits
GetTextExtentPoint32W
GetClipBox
Polyline
IntersectClipRect
GetEnhMetaFileBits
GetSystemPaletteEntries
CreateBitmap
SetWinMetaFileBits
CreateDIBitmap
GetStretchBltMode
CreateDIBSection
CreatePenIndirect
GetDIBits
SetStretchBltMode
GetEnhMetaFilePaletteEntries
CreateFontIndirectW
PolyBezier
LineTo
GetRgnBox
CreateHalftonePalette
DeleteObject
SelectObject
ExtFloodFill
UnrealizeObject
CopyEnhMetaFileW
SetBkColor
CreateCompatibleDC
GetObjectW
GetBrushOrgEx
GetCurrentPositionEx
GetWinMetaFileBits
SetROP2
GetTextExtentPointW
ExtTextOutW
SetBrushOrgEx
GetEnhMetaFileDescriptionW
GetPixel
ArcTo
GdiFlush
SetPixel
EnumFontFamiliesExW
GetPaletteEntries

Exports

Exports

TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

.text
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 31KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 149B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 68B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 93B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 309KB - Virtual size: 309KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

64f2611afc92c104ca6fa1f574e1cf69

Headers

DLL Characteristics

File Characteristics

Imports

mpr

winmm

oleacc

comctl32

ws2_32

shell32

user32

version

oleaut32

advapi32

netapi32

msvcrt

kernel32

quartz

userenv

ole32

secur32

gdi32

Exports

Exports

Sections

.text Size: 3.9MB - Virtual size: 3.9MB

.itext Size: 26KB - Virtual size: 25KB

.data Size: 3.9MB - Virtual size: 3.9MB

.bss Size: - Virtual size: 31KB

.idata Size: 17KB - Virtual size: 16KB

.didata Size: 3KB - Virtual size: 2KB

.edata Size: 512B - Virtual size: 149B

.tls Size: - Virtual size: 68B

.rdata Size: 512B - Virtual size: 93B

.reloc Size: 309KB - Virtual size: 309KB

.rsrc Size: 35KB - Virtual size: 35KB

.text
Size: 3.9MB - Virtual size: 3.9MB

.itext
Size: 26KB - Virtual size: 25KB

.data
Size: 3.9MB - Virtual size: 3.9MB

.bss
Size: - Virtual size: 31KB

.idata
Size: 17KB - Virtual size: 16KB

.didata
Size: 3KB - Virtual size: 2KB

.edata
Size: 512B - Virtual size: 149B

.tls
Size: - Virtual size: 68B

.rdata
Size: 512B - Virtual size: 93B

.reloc
Size: 309KB - Virtual size: 309KB

.rsrc
Size: 35KB - Virtual size: 35KB