1da9c311a2bf6530479e65bd8567f32d92cd9ca182ea6d225ca38fced98d76e6

Sharing

Copy URL Twitter E-mail

General

Target

1da9c311a2bf6530479e65bd8567f32d92cd9ca182ea6d225ca38fced98d76e6
Size

5.1MB
MD5

f36edef1a5d4500a554b3ab6283ec383
SHA1

dad8f611369196df9a2233dd84e1c9f024e37cdc
SHA256

1da9c311a2bf6530479e65bd8567f32d92cd9ca182ea6d225ca38fced98d76e6
SHA512

a2de68e5f094fcff3d89cec2b50311434849f3d7d86429aecee5d104fd29e6aeb43df7a6f6882b009553a54247a0aab744fa61e846dff278f4083a47b3df5c08
SSDEEP

98304:yILoHyin4vcCPiYTtLtHzergMNqwNT70aYW2YV8kXdJcyjXAnVDqi0:yWeyi4vXhRzUHYW2Y+kYyjXA5qi0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1da9c311a2bf6530479e65bd8567f32d92cd9ca182ea6d225ca38fced98d76e6

Files

1da9c311a2bf6530479e65bd8567f32d92cd9ca182ea6d225ca38fced98d76e6
.exe windows:6 windows x86 arch:x86

6c2e8329e8e3be1c836e99be73973bc2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\TeamCity-Agent\work\e104a45820af422\common\setup\BootstrapperNative\Win32\Release\NativeBootStrapper.pdb

Imports

wininet

HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW
HttpQueryInfoW
InternetCanonicalizeUrlW
InternetSetStatusCallbackW
InternetGetLastResponseInfoW
InternetSetOptionW
InternetCrackUrlW
InternetOpenW
InternetCloseHandle
InternetConnectW
InternetReadFile
InternetSetFilePointer
InternetWriteFile
InternetQueryDataAvailable

msi

ord70
ord45

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wldap32

ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord60
ord211
ord46
ord143
ord301

crypt32

CertOpenStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertCloseStore

kernel32

IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualAlloc
FreeLibraryAndExitThread
UnhandledExceptionFilter
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SignalObjectAndWait
TryEnterCriticalSection
LCMapStringW
SwitchToThread
GetCPInfo
GetStringTypeW
InitializeSListHead
GetUserDefaultLCID
SetUnhandledExceptionFilter
GetThreadTimes
GetProfileIntW
SearchPathW
GetWindowsDirectoryW
SetErrorMode
VerifyVersionInfoW
lstrcpyW
VirtualProtect
GlobalGetAtomNameW
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetCurrentDirectoryW
LocalReAlloc
GlobalHandle
GlobalReAlloc
InitializeCriticalSection
GetFileTime
GetFileSizeEx
GetFileAttributesExW
lstrcmpiW
DuplicateHandle
UnlockFile
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
FlushFileBuffers
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FileTimeToLocalFileTime
MulDiv
GlobalSize
SetThreadPriority
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
EncodePointer
GlobalUnlock
WritePrivateProfileStringW
GetPrivateProfileIntW
lstrcmpW
lstrcmpA
GlobalDeleteAtom
GlobalLock
GetCurrentThread
OutputDebugStringA
SetConsoleMode
ReadConsoleW
ReadConsoleA
GetConsoleMode
GlobalMemoryStatus
GetCurrentProcessId
QueryPerformanceCounter
ConvertThreadToFiber
ConvertFiberToThread
GetModuleHandleExW
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetSystemTime
CreateFiber
DeleteFiber
SwitchToFiber
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
VerifyVersionInfoA
GetModuleHandleA
GetSystemDirectoryA
VerSetConditionMask
FormatMessageA
SetLastError
ExpandEnvironmentStringsA
PeekNamedPipe
GetFileType
GetStdHandle
SleepEx
WaitForSingleObjectEx
GetTickCount64
GlobalFree
GlobalAlloc
GetTickCount
WaitForMultipleObjects
ResumeThread
GetOverlappedResult
WriteFile
SetFilePointer
GetPrivateProfileStringW
EndUpdateResourceW
UpdateResourceW
BeginUpdateResourceW
GetUserDefaultLangID
GetTempFileNameW
OutputDebugStringW
LoadLibraryExW
RemoveDirectoryW
FindClose
DeleteFileW
SetEvent
ResetEvent
CreateEventW
GetExitCodeProcess
GetThreadLocale
FindResourceExW
GetModuleHandleW
EnumResourceLanguagesW
GetLocaleInfoW
GetDiskFreeSpaceExW
CopyFileW
SizeofResource
LockResource
FreeResource
LoadResource
FindResourceW
FindNextFileW
FindFirstFileW
CreateDirectoryW
FreeLibrary
K32GetProcessImageFileNameW
MultiByteToWideChar
TerminateProcess
LoadLibraryA
ReadFile
CreateProcessW
CreatePipe
GetSystemDirectoryW
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
IsWow64Process
GetSystemInfo
GetFileSize
CreateFileW
GetTempPathW
GetFileAttributesW
GetVersionExW
GetEnvironmentVariableW
GetModuleFileNameW
SetEnvironmentVariableW
WideCharToMultiByte
LocalFree
LocalAlloc
K32EnumProcesses
GetCommandLineW
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
HeapFree
WaitForSingleObject
ExitProcess
FormatMessageW
Sleep
CreateThread
GetCurrentProcess
CloseHandle
ReleaseMutex
GetLastError
CreateMutexW
GetProcAddress
LoadLibraryW
GetDriveTypeW
GetFileInformationByHandle
MoveFileExW
ExitThread
SetFilePointerEx
SetConsoleCtrlHandler
GetCommandLineA
HeapQueryInformation
QueryPerformanceFrequency
SetStdHandle
VirtualQuery
GetConsoleCP
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW

user32

SetLayeredWindowAttributes
DestroyIcon
MapDialogRect
GetAsyncKeyState
LoadCursorW
GetSysColorBrush
InflateRect
GetMenuItemInfoW
DestroyMenu
KillTimer
SetTimer
RealChildWindowFromPoint
DeleteMenu
SystemParametersInfoW
CopyImage
GetSystemMetrics
CharUpperW
OffsetRect
SetRectEmpty
SendDlgItemMessageA
LoadMenuW
ClientToScreen
ReleaseDC
GetDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
FillRect
InvalidateRect
DrawStateW
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuState
GetMenuStringW
GetWindowThreadProcessId
SetCursor
ShowOwnedPopups
GetCursorPos
TranslateMessage
GetMessageW
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
LoadIconW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
SetRect
SetParent
BringWindowToTop
LockWindowUpdate
SetClassLongW
OpenClipboard
CloseClipboard
SetClipboardData
EnumDisplayMonitors
GetTopWindow
GetClassNameW
GetClassLongW
PtInRect
EqualRect
CopyRect
GetSysColor
MapWindowPoints
ScreenToClient
AdjustWindowRectEx
GetClientRect
RemovePropW
EmptyClipboard
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
ValidateRect
EndPaint
BeginPaint
SetForegroundWindow
GetForegroundWindow
UpdateWindow
TrackPopupMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
SetMenu
GetMenu
GetCapture
GetKeyState
IsIconic
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
IsChild
IsMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
PeekMessageW
DispatchMessageW
RegisterWindowMessageW
GetDesktopWindow
SetActiveWindow
GetActiveWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
DestroyWindow
IsDialogMessageW
GetWindow
GetParent
IntersectRect
TrackMouseEvent
IsZoomed
SetCapture
ReleaseCapture
GetSystemMenu
SetWindowRgn
MessageBeep
WindowFromPoint
NotifyWinEvent
CreatePopupMenu
GetMenuDefaultItem
SetMenuDefaultItem
IsRectEmpty
UpdateLayeredWindow
EnableScrollBar
UnionRect
MonitorFromPoint
LoadImageW
DrawEdge
DrawFrameControl
DrawFocusRect
DrawIconEx
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
MapVirtualKeyW
LoadAcceleratorsW
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
GetLastActivePopup
RegisterClipboardFormatW
CharUpperBuffW
ModifyMenuW
TranslateAcceleratorW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
CopyIcon
FrameRect
PostThreadMessageW
WaitMessage
GetNextDlgGroupItem
SendMessageW
PostMessageW
PostQuitMessage
EnableWindow
GetWindowRect
GetWindowDC
UnregisterClassW
ExitWindowsEx
MessageBoxW
wsprintfW
GetProcessWindowStation
GetUserObjectInformationW
IsWindow
ShowWindow
MoveWindow
SetWindowPos
GetDlgItem
GetIconInfo
SetDlgItemTextW
CheckDlgButton
GetDlgCtrlID
SetFocus
GetFocus
IsWindowEnabled
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
HideCaret
InvertRect
GetKeyNameTextW
DrawIcon
GetDoubleClickTime
IsCharLowerW
MapVirtualKeyExW
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
IsClipboardFormatAvailable
GetUpdateRect
SubtractRect
CreateMenu
DestroyCursor
GetComboBoxInfo
SetCursorPos
SetWindowLongW
GetWindowLongW
GetWindowRgn
GetPropW

gdi32

SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateFontIndirectW
GetTextMetricsW
CreateCompatibleBitmap
CreateDIBitmap
CreateRectRgnIndirect
EnumFontFamiliesW
GetTextCharsetInfo
CombineRgn
PatBlt
SetRectRgn
DPtoLP
CreateRoundRectRgn
CreateDIBSection
EnumFontFamiliesExW
CreateEllipticRgn
Ellipse
GetBkColor
GetTextColor
CreatePolygonRgn
Polygon
Polyline
RealizePalette
SetPixel
StretchBlt
SetDIBColorTable
GetRgnBox
OffsetRgn
Rectangle
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
LPtoDP
RoundRect
ExtFloodFill
SetPaletteEntries
FillRgn
GetBoundsRect
PtInRegion
GetWindowOrgEx
GetViewportOrgEx
SetPixelV
GetTextFaceW
SetTextAlign
SetROP2
SetPolyFillMode
GetLayout
SetMapMode
SetBkMode
SelectPalette
SelectObject
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
ExtTextOutW
TextOutW
MoveToEx
FrameRgn
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateCompatibleDC
BitBlt
GetStockObject
DeleteObject
CreateSolidBrush
GetDeviceCaps
CreateDCW
CopyMetaFileW
CreateBitmap
GetObjectW
SetTextColor
SetBkColor
DeleteDC
SetLayout
GetTextExtentPoint32W

msimg32

TransparentBlt
AlphaBlend

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegDeleteValueW
RegDeleteKeyW
CryptEnumProvidersW
CryptSignHashW
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptGenRandom
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
QueryServiceStatus
ControlService
DeleteService
OpenServiceW
CloseServiceHandle
CreateServiceW
OpenSCManagerW
QueryServiceConfig2W
QueryServiceConfigW
ConvertStringSecurityDescriptorToSecurityDescriptorW
InitiateSystemShutdownExW
LookupPrivilegeDisplayNameW
LookupPrivilegeNameW
ImpersonateLoggedOnUser
DuplicateTokenEx
LookupAccountSidW
ConvertSidToStringSidW
RegCreateKeyExW
RevertToSelf
RegQueryValueExW
RegOpenKeyExW
RegOpenCurrentUser
RegCloseKey
RegSetValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
EqualSid
FreeSid
GetTokenInformation
AllocateAndInitializeSid
OpenProcessToken

shell32

ord165
CommandLineToArgvW
SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHPathPrepareForWriteW
SHGetFileInfoW
ShellExecuteW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHBrowseForFolderW
DragFinish
DragQueryFileW
SHAppBarMessage
SHGetFolderPathW

shlwapi

PathBuildRootW
PathRemoveFileSpecW
PathFindFileNameW
PathRemoveExtensionW
PathGetDriveNumberW
PathFindExtensionW
UrlUnescapeW
PathIsUNCW
PathStripToRootW
StrFormatKBSizeW
SHCreateStreamOnFileEx

uxtheme

GetThemePartSize
IsThemeBackgroundPartiallyTransparent
IsAppThemed
DrawThemeText
DrawThemeParentBackground
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
GetThemeSysColor
GetWindowTheme

ole32

RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
CreateStreamOnHGlobal
DoDragDrop
CoDisconnectObject
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoCreateGuid
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoUninitialize

oleaut32

VariantClear
VariantChangeType
LoadTypeLi
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantInit
VariantCopy
SysAllocStringLen
VarBstrFromDate
SysAllocString
SysFreeString

urlmon

URLDownloadToFileW

gdiplus

GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDrawImageI
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDrawImageRectI
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipCloneImage
GdipAlloc
GdiplusStartup
GdipFree
GdiplusShutdown

ws2_32

gethostname
ioctlsocket
select
getnameinfo
shutdown
WSAGetLastError
recv
send
WSAStartup
WSACleanup
htons
WSASetLastError
getaddrinfo
freeaddrinfo
bind
closesocket
connect
getpeername
getsockname
getsockopt
ntohs
setsockopt
socket
__WSAFDIsSet
accept
listen
recvfrom
sendto
WSAIoctl

iphlpapi

GetIpForwardTable

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory
WTSQueryUserToken
WTSEnumerateSessionsW

dbghelp

ImageNtHeader

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 793KB - Virtual size: 792KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 65KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 213KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6c2e8329e8e3be1c836e99be73973bc2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wininet

msi

version

wldap32

crypt32

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

urlmon

gdiplus

ws2_32

iphlpapi

wtsapi32

dbghelp

oleacc

imm32

winmm

Sections

.text Size: 3.0MB - Virtual size: 3.0MB

.rdata Size: 793KB - Virtual size: 792KB

.data Size: 65KB - Virtual size: 95KB

.rsrc Size: 1.0MB - Virtual size: 1.0MB

.reloc Size: 213KB - Virtual size: 213KB

.text
Size: 3.0MB - Virtual size: 3.0MB

.rdata
Size: 793KB - Virtual size: 792KB

.data
Size: 65KB - Virtual size: 95KB

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

.reloc
Size: 213KB - Virtual size: 213KB