4625403ceec01c994b8737f3163340bc4c60239c77bfbb2ee564c17df7260938

Sharing

Copy URL Twitter E-mail

General

Target

4625403ceec01c994b8737f3163340bc4c60239c77bfbb2ee564c17df7260938
Size

513KB
MD5

20e32ec0ce897e432faddbdc0b7d5698
SHA1

e5c5a96523a6ad242361e0fcd1660fd2cafe8a63
SHA256

4625403ceec01c994b8737f3163340bc4c60239c77bfbb2ee564c17df7260938
SHA512

69aa649cc9414404dc595c373fc02f20693d5542a6e0230fdd338da04209ff9a4410ee94bd6b27412e3392ddab1d5f7873ea85489ff41bd3571c46f448d6707d
SSDEEP

12288:aDlc7pTflblbFXhQL1nJGJougHGBrQx052himSY50aLI2:4GpTFlp6nMJougn0Y50KI2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4625403ceec01c994b8737f3163340bc4c60239c77bfbb2ee564c17df7260938

Files

4625403ceec01c994b8737f3163340bc4c60239c77bfbb2ee564c17df7260938
.exe windows:6 windows x86 arch:x86

6da2a98f6e33c7e7a988af285995c7c2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

GWXConfigManager.pdb

Imports

advapi32

EventWrite
CryptDecrypt
CryptGetKeyParam
CryptSetKeyParam
CryptImportKey
CryptDestroyKey
CryptExportKey
CryptGetUserKey
CryptDeriveKey
CryptHashData
CryptCreateHash
CryptDestroyHash
CryptAcquireContextW
CryptReleaseContext
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetKeySecurity
RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
EventRegister
EventUnregister
RegDeleteValueW
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
CryptGenRandom
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
DuplicateTokenEx
CreateProcessAsUserW
InitiateSystemShutdownExW
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
OpenThreadToken
GetTokenInformation
EqualSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
AddAccessAllowedAce
GetLengthSid

kernel32

DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetOverlappedResult
UnlockFileEx
LockFileEx
GetSystemDefaultUILanguage
OpenEventW
SetEvent
DecodePointer
WaitForMultipleObjects
ProcessIdToSessionId
GetCurrentProcessId
RaiseException
MultiByteToWideChar
LocalAlloc
GetVersionExA
WideCharToMultiByte
SetFilePointer
FindClose
FindFirstFileW
FindNextFileW
GlobalFree
VerifyVersionInfoW
VerSetConditionMask
GetCurrentProcess
SetLastError
EncodePointer
HeapSize
HeapDestroy
HeapReAlloc
DeleteFileW
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
GetFileSizeEx
DeleteFileA
DebugBreak
GetVersion
CreateMutexA
LoadLibraryExA
GetModuleFileNameA
GetSystemInfo
CreateFileMappingA
ExpandEnvironmentStringsA
InitializeCriticalSectionAndSpinCount
TerminateProcess
SetUnhandledExceptionFilter
CreateFileA
TlsFree
GetWindowsDirectoryW
TlsAlloc
CreateFileMappingW
GetLocalTime
TlsSetValue
InitializeCriticalSection
UnmapViewOfFile
MapViewOfFile
TlsGetValue
GetTempFileNameW
ExitProcess
GetSystemTime
IsDebuggerPresent
CreateEventW
GetExitCodeThread
lstrcmpW
GetTimeZoneInformation
GetPriorityClass
WriteFile
OutputDebugStringW
SetFilePointerEx
SystemTimeToTzSpecificLocalTime
SetEndOfFile
VirtualQuery
SetPriorityClass
UnhandledExceptionFilter
GetStartupInfoW
Sleep
GetModuleFileNameW
ExpandEnvironmentStringsW
GetFileAttributesW
GetUserDefaultLocaleName
GetUserDefaultUILanguage
DeviceIoControl
FlushFileBuffers
GetTempPathW
GetFullPathNameW
CreateThread
ResetEvent
FormatMessageW
GetUserGeoID
GetGeoInfoW
CreateMutexW
WaitForSingleObject
LocalFree
CreateFileW
GetCurrentThread
CreateDirectoryW
GetFileSize
ReadFile
GetLastError
GetModuleHandleW
LoadLibraryExW
CompareStringW
ReleaseMutex
CloseHandle
GetProcAddress
GetProcessHeap
GetModuleHandleExW
HeapFree
HeapAlloc
OutputDebugStringA
FreeLibrary

msvcrt

__CxxFrameHandler3
_CxxThrowException
memmove
_vsnwprintf
wcschr
_ftime64_s
free
_XcptFilter
__p__commode
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
__p__fmode
__setusermatherr
_initterm
_wcmdln
_lock
towlower
fclose
wcstok_s
_except_handler4_common
_controlfp
?terminate@@YAXXZ
realloc
_errno
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_wcsicmp
bsearch
wcstoul
_wcsnicmp
_purecall
iswspace
_vscwprintf
_vsnprintf
wcsrchr
memcpy
memset
memcmp
_wcstoui64
iswctype
feof
_wtoi
_wfopen
fgetws
swscanf_s
_ftol2

ole32

CoCreateInstance
StringFromGUID2
CoCreateGuid
CoUninitialize
CoInitializeEx
CoTaskMemFree

oleaut32

SysAllocStringLen
SysAllocString
SysFreeString
VariantTimeToSystemTime
VariantClear
VariantInit
SystemTimeToVariantTime

ntdll

NtYieldExecution
RtlDowncaseUnicodeChar
RtlGetVersion
RtlAdjustPrivilege
RtlEnterCriticalSection
NtWriteFile
RtlFreeHeap
RtlInitUnicodeString
NtWaitForSingleObject
NtCreateFile
RtlNtStatusToDosError
NtClose
RtlReAllocateHeap
RtlAllocateHeap
NtShutdownSystem
NtSetInformationThread
NtSetInformationProcess
RtlDeleteCriticalSection
RtlLeaveCriticalSection
RtlInitializeCriticalSection
RtlDosPathNameToNtPathName_U
DbgPrintEx
RtlRaiseStatus

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust

user32

UnregisterClassA

slc

SLGetWindowsInformation

setupapi

SetupIterateCabinetW

winhttp

WinHttpCrackUrl
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpSetOption
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpConnect
WinHttpOpen
WinHttpCloseHandle

rpcrt4

UuidToStringW
UuidCreate
I_RpcMapWin32Status
UuidFromStringW
RpcStringFreeW

crypt32

CertVerifyCertificateChainPolicy

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

wtsapi32

WTSFreeMemory
WTSQueryUserToken
WTSEnumerateSessionsW

netapi32

NetGetJoinInformation
NetApiBufferFree

shlwapi

PathStripPathW
PathCombineW
PathRemoveFileSpecW
StrStrIW
ord615

shell32

SHFileOperationW

Sections

.text
Size: 470KB - Virtual size: 470KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6da2a98f6e33c7e7a988af285995c7c2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

ole32

oleaut32

ntdll

wintrust

user32

slc

setupapi

winhttp

rpcrt4

crypt32

userenv

wtsapi32

netapi32

shlwapi

shell32

Sections

.text Size: 470KB - Virtual size: 470KB

.data Size: 10KB - Virtual size: 11KB

.idata Size: 8KB - Virtual size: 8KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 20KB

.text
Size: 470KB - Virtual size: 470KB

.data
Size: 10KB - Virtual size: 11KB

.idata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 20KB