1fd4920d181068307645bf87205ea78db6d0537f251b6c5ad1d362891b90210f

Sharing

Copy URL Twitter E-mail

General

Target

1fd4920d181068307645bf87205ea78db6d0537f251b6c5ad1d362891b90210f
Size

2.4MB
MD5

4c17154a9291d817303f512e8bdef0c3
SHA1

b9d9612e0080e43477cf576b6c7b6c27fc58a4e4
SHA256

1fd4920d181068307645bf87205ea78db6d0537f251b6c5ad1d362891b90210f
SHA512

78c4aa82a52b7aae6704291d7e9fce18e6a75440e25e095eabe060051de2ac2102fed606ce859722cf55f273b188e7b6142793115b6f07cdbb85448c1a372463
SSDEEP

24576:JVI5Ie9QT+mokcovMb0BBTQ49JU3ai7aGF7zR4TyvnoEnNAwiek:45VQTFcor3UKiPlN0iJK/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1fd4920d181068307645bf87205ea78db6d0537f251b6c5ad1d362891b90210f

Files

1fd4920d181068307645bf87205ea78db6d0537f251b6c5ad1d362891b90210f
.dll windows:4 windows x86 arch:x86

e12efcd9237b315aa4bcfdfe09ef070c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

FindWindowExA
GetDesktopWindow
GetWindow
IsWindowVisible
GetWindowTextA
GetClassNameA
GetWindowThreadProcessId
GetWindowTextLengthA
PostMessageA
CallWindowProcA
GetCursorPos
OpenClipboard
GetForegroundWindow
ClientToScreen
GetWindowLongA
SetWindowLongA
SetLayeredWindowAttributes
SetCursorPos
EnumDisplaySettingsA
UnhookWindowsHookEx
keybd_event
GetWindowRect
CharUpperA
FindWindowA
GetDlgItem
SetCapture
MapVirtualKeyA
AttachThreadInput
SetActiveWindow
GetGUIThreadInfo
ExitWindowsEx
mouse_event
GetParent
IsWindow
GetPropA
RemovePropA
DestroyWindow
SetPropA
CreateWindowExA
ShowWindow
IsZoomed
IsIconic
MoveWindow
GetDC
UpdateLayeredWindow
ReleaseDC
DefWindowProcA
ReleaseCapture
SetWindowsHookExA
CallNextHookEx
FlashWindowEx
EnableWindow
GetClientRect
GetWindowInfo
EnumWindows
SendInput
MsgWaitForMultipleObjects
ShowCursor
SendMessageTimeoutA
CreateWindowStationA
SetParent
UpdateWindow
SetTimer
GetFocus
GetKeyState
SetForegroundWindow
GetAncestor
SetWindowTextA
GetNextDlgTabItem
SetFocus
InvalidateRect
KillTimer
GetActiveWindow
GetDoubleClickTime
CharLowerA
wvsprintfA
SwapMouseButton
ChangeDisplaySettingsA
OpenIcon
EnumThreadWindows
ClipCursor
GetAsyncKeyState
GetKeyboardState
LoadCursorFromFileA
SetClassLongA
WindowFromPoint
ShowWindowAsync
SetWindowPos
GetDlgCtrlID
GetCaretPos
FlashWindow
PrintWindow
RegisterWindowMessageA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
PostThreadMessageA
UnloadKeyboardLayout
GetKeyboardLayoutList
SystemParametersInfoA
GetKeyboardLayout
ActivateKeyboardLayout
GetKeyboardLayoutNameA
LoadKeyboardLayoutA
MessageBoxA
wsprintfA
CloseClipboard
GetClipboardData
PostQuitMessage
SetClipboardData
EmptyClipboard
GetSystemMetrics
SetCursor
EndDialog
CreateDialogIndirectParamA
DestroyMenu
LoadStringA
GetSysColorBrush
LoadCursorA
LoadIconA
MapWindowPoints
GetSysColor
AdjustWindowRectEx
CopyRect
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetSubMenu
GetMenuItemID
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
RegisterClipboardFormatA
GetClassLongA
GetMessageTime
GetMessagePos
GetWindowPlacement
IsDialogMessageA
UnregisterClassA
ValidateRect
PtInRect
GetMenuItemCount
TabbedTextOutA
DrawTextA
GrayStringA
GetLastActivePopup
EnumChildWindows
SendDlgItemMessageA
SendMessageA
IsWindowEnabled
PostQuitMessage
IsZoomed
GetClassInfoA
DefWindowProcA
GetMenu
SetMenu
PeekMessageA
IsIconic
SetFocus
GetActiveWindow
GetWindow
DestroyAcceleratorTable
SetWindowRgn
GetMessagePos
ScreenToClient
ChildWindowFromPointEx
CopyRect
LoadBitmapA
WinHelpA
KillTimer
SetTimer
ReleaseCapture
GetCapture
SetCapture
GetScrollRange
SetScrollRange
SetScrollPos
SetRect
InflateRect
IntersectRect
DestroyIcon
PtInRect
OffsetRect
IsWindowVisible
EnableWindow
RedrawWindow
GetWindowLongA
SetWindowLongA
GetSysColor
SetActiveWindow
SetCursorPos
LoadCursorA
SetCursor
GetDC
FillRect
IsRectEmpty
ReleaseDC
IsChild
DestroyMenu
SetForegroundWindow
GetWindowRect
EqualRect
UpdateWindow
ValidateRect
InvalidateRect
GetClientRect
GetFocus
GetParent
GetTopWindow
PostMessageA
CopyAcceleratorTableA
SetParent
DestroyCursor
SendMessageA
SetWindowPos
MessageBoxA
GetCursorPos
GetSystemMetrics
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
wsprintfA
GetKeyState
TranslateAcceleratorA
IsWindowEnabled
ShowWindow
GetWindowTextA
GetWindowTextLengthA
CharUpperA
GetWindowDC
BeginPaint
EndPaint
SystemParametersInfoA
LoadImageA
EnumDisplaySettingsA
ClientToScreen
EnableMenuItem
GetSubMenu
TabbedTextOutA
DrawTextA
GrayStringA
GetDlgItem
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetNextDlgTabItem
GetWindowPlacement
RegisterWindowMessageA
GetForegroundWindow
GetLastActivePopup
GetMessageTime
RemovePropA
CallWindowProcA
GetPropA
UnhookWindowsHookEx
SetPropA
GetClassLongA
CallNextHookEx
SetWindowsHookExA
CreateWindowExA
GetMenuItemID
GetMenuItemCount
RegisterClassA
GetScrollPos
AdjustWindowRectEx
MapWindowPoints
SendDlgItemMessageA
ScrollWindowEx
IsDialogMessageA
MoveWindow
CheckMenuItem
SetMenuItemBitmaps
GetMenuState
GetMenuCheckMarkDimensions
GetClassNameA
GetDesktopWindow
UnregisterClassA
LoadStringA
GetSysColorBrush
GetDlgCtrlID
CreateAcceleratorTableA
CreateMenu
ModifyMenuA
AppendMenuA
CreatePopupMenu
DrawIconEx
CreateIconFromResource
CreateIconFromResourceEx
RegisterClipboardFormatA
SetRectEmpty
DispatchMessageA
GetMessageA
WindowFromPoint
DrawFocusRect
DrawEdge
DrawFrameControl
TranslateMessage
LoadIconA
SetWindowTextA
IsWindow

kernel32

GetCommandLineA
GetOEMCP
GetCPInfo
IsBadCodePtr
SetStdHandle
FlushFileBuffers
GetProcessVersion
FindResourceA
LoadResource
LockResource
RtlUnwind
GlobalAddAtomA
GlobalFindAtomA
SetLastError
GlobalFlags
MulDiv
lstrcpyA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
IsBadWritePtr
LCMapStringW
RaiseException
HeapSize
GetACP
SetHandleCount
GetStdHandle
GlobalGetAtomNameA
GlobalReAlloc
GetEnvironmentVariableA
HeapDestroy
HeapCreate
GetVersion
Process32Next
Process32First
HeapAlloc
GetProcessHeap
MultiByteToWideChar
GetVolumeInformationA
GetCurrentProcess
WriteProcessMemory
DeleteFileA
lstrcatA
lstrcmpiA
SetErrorMode
TlsGetValue
LocalReAlloc
FreeLibrary
WritePrivateProfileStringA
GetCurrentDirectoryA
SetLocalTime
SetFileAttributesA
RemoveDirectoryA
GetFileAttributesA
IsDebuggerPresent
CreateEventA
GetShortPathNameA
Module32Next
GetCurrentThreadId
VirtualAllocEx
CreateDirectoryA
FindClose
FindFirstFileA
FindNextFileA
GetStartupInfoA
GetTickCount
GetFileSize
GetUserDefaultLCID
IsBadReadPtr
HeapReAlloc
ExitProcess
VirtualFree
VirtualAlloc
lstrcpynA
IsDBCSLeadByteEx
InterlockedIncrement
InterlockedDecrement
GetLongPathNameA
WriteFile
DebugActiveProcess
HeapFree
GlobalFree
GlobalSize
GlobalUnlock
GlobalLock
GlobalAlloc
GetExitCodeProcess
ReadFile
PeekNamedPipe
CreateProcessA
CreatePipe
GetComputerNameA
GetVersionExA
DeviceIoControl
CreateFileA
TerminateThread
VirtualFreeEx
GetModuleFileNameA
OpenThread
CreateWaitableTimerA
SetWaitableTimer
GetCurrentProcessId
ResumeThread
WaitForSingleObject
CopyFileA
InitializeCriticalSection
GetProcessTimes
OpenEventA
GetDateFormatA
GetTimeFormatA
CreateThread
GetLastError
SetFilePointer
SetEndOfFile
MoveFileA
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
ReadProcessMemory
OpenProcess
FileTimeToSystemTime
GetLocalTime
FormatMessageA
LCMapStringA
lstrlenA
GetCurrentThread
GetModuleHandleA
GetExitCodeThread
CreateRemoteThread
lstrcpyn
GetProcAddress
LoadLibraryA
LocalFree
WideCharToMultiByte
RtlMoveMemory
LocalAlloc
CloseHandle
Module32First
CreateToolhelp32Snapshot
TlsSetValue
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
RtlFillMemory
lstrcmpA
SuspendThread
SetThreadContext
TerminateProcess
Thread32First
Thread32Next
DeleteCriticalSection
GlobalDeleteAtom
GetFileType
EnterCriticalSection
LeaveCriticalSection
TlsAlloc
GlobalHandle
TlsFree
SetProcessWorkingSetSize
VirtualProtectEx
Sleep
VirtualQueryEx
GetThreadTimes
EnterCriticalSection
ReleaseSemaphore
ResumeThread
CreateSemaphoreA
IsBadCodePtr
IsBadReadPtr
CompareStringW
CompareStringA
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
IsBadWritePtr
VirtualAlloc
LCMapStringW
LCMapStringA
SetEnvironmentVariableA
LeaveCriticalSection
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetStdHandle
SetHandleCount
GetFileType
SetStdHandle
GetACP
HeapSize
TerminateProcess
GetLocalTime
GetSystemTime
RaiseException
RtlUnwind
GetOEMCP
GetCPInfo
GetProcessVersion
SetErrorMode
GlobalFlags
GetCurrentThread
GetFileTime
GetFileSize
TlsGetValue
LocalReAlloc
TlsSetValue
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
lstrcmpA
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpiA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
GetCurrentProcess
DuplicateHandle
lstrcpynA
FileTimeToLocalFileTime
LocalFree
InterlockedDecrement
InterlockedIncrement
GetProfileStringA
CloseHandle
WaitForSingleObject
GetTickCount
GetCommandLineA
MulDiv
GetProcAddress
GetTimeZoneInformation
SetLastError
FileTimeToSystemTime
GetModuleHandleA
GetVolumeInformationA
SetCurrentDirectoryA
DeleteFileA
GetFileAttributesA
FindClose
FindFirstFileA
GetTempPathA
GlobalUnlock
GlobalLock
GlobalAlloc
Sleep
CreateEventA
CreateThread
WritePrivateProfileStringA
GetVersionExA
GetLastError
LoadLibraryA
FreeLibrary
GetFullPathNameA
HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree
GlobalReAlloc
FindNextFileA
lstrcpyA
WinExec
lstrlenA
lstrcatA
InitializeCriticalSection
DeleteCriticalSection
GlobalFree
GlobalSize
ExitProcess
GetCurrentThreadId
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameA
ReadFile
LockResource
LoadResource
FindResourceA
SetEvent
CreateFileA
WaitForMultipleObjects
WriteFile

ole32

CoInitialize
CoUninitialize
OleRun
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CLSIDFromString
OleUninitialize
OleInitialize

shell32

ShellExecuteA
SHGetFileInfoA
SHChangeNotify
SHFileOperationA
SHBrowseForFolderA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetSpecialFolderPathA
Shell_NotifyIconA
ShellExecuteA

shlwapi

PathFindExtensionA
PathIsDirectoryA
PathIsDirectoryEmptyA
PathIsSystemFolderA
PathRenameExtensionA
PathRemoveBlanksA
PathMakeSystemFolderA
PathUnmakeSystemFolderA
PathFileExistsA
PathFindFileNameA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

gdi32

ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
CreateBitmap
PtVisible
GetClipBox
ExtTextOutA
Escape
GetObjectA
CreateCompatibleBitmap
GetPixel
TextOutA
SetTextColor
SetBkMode
CreateFontIndirectA
GetTextExtentPointA
RectVisible
RestoreDC
CreateRectRgn
DeleteDC
DeleteObject
SelectObject
CreateDIBSection
CreateCompatibleDC
SaveDC
SetMapMode
GetDeviceCaps
SetBkColor
GetStockObject
CreateRoundRectRgn
GetTextMetricsA
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetViewportExtEx
ExtSelectClipRgn
LineTo
MoveToEx
ExcludeClipRect
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetTextColor
GetTextColor
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
CreateEllipticRgn
PathToRegion
EndPath
BeginPath
GetWindowOrgEx
GetViewportOrgEx
GetWindowExtEx
GetDIBits
RealizePalette
SelectPalette
StretchBlt
CreatePalette
GetSystemPaletteEntries
CreateDIBitmap
DeleteObject
SelectClipRgn
CreatePolygonRgn
GetClipRgn
SetStretchBltMode
CreateRectRgnIndirect
SetBkColor
GetBkMode
GetBkColor
GetROP2
GetStretchBltMode
GetPolyFillMode
CreateCompatibleBitmap
CreateDCA
CreateFontIndirectA
EndPage
EndDoc
DeleteDC
StartDocA
StartPage
BitBlt
CreateCompatibleDC
Ellipse
Rectangle
LPtoDP
DPtoLP
GetCurrentObject
RoundRect
GetTextExtentPoint32A
GetDeviceCaps
CreateBitmap
SelectObject
GetObjectA
CreatePen
PatBlt
CombineRgn
CreateRectRgn
FillRgn
CreateSolidBrush
SetROP2
GetStockObject

gdiplus

GdiplusStartup
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawPath
GdipResetClip
GdipDeletePen
GdipDeletePath
GdipSetClipHrgn
GdipDrawRectangle
GdipCreatePen1
GdipCreateFromHDC

wininet

InternetConnectA
InternetCloseHandle
InternetTimeToSystemTime
InternetTimeFromSystemTime
InternetSetCookieA
HttpQueryInfoA
InternetReadFile
HttpSendRequestA
HttpOpenRequestA
InternetOpenA
InternetCloseHandle

oleaut32

RegisterTypeLi
LHashValOfNameSys
LoadTypeLi
VarR8FromBool
VarR8FromCy
SafeArrayGetElemsize
SafeArrayUnaccessData
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
VariantTimeToSystemTime
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantInit
VariantChangeType
SystemTimeToVariantTime
SafeArrayGetDim
SysFreeString
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi

dbghelp

MakeSureDirectoryPathExists

advapi32

LookupPrivilegeValueA
RegCreateKeyA
RegCloseKey
RegDeleteKeyA
RegOpenKeyA
CryptGetHashParam
CryptDestroyHash
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegEnumValueA
RegFlushKey
OpenProcessToken
CryptReleaseContext
AdjustTokenPrivileges
LookupAccountSidA
GetUserNameA
CryptAcquireContextA
CryptCreateHash
CryptHashData
RegQueryValueA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegSetValueExA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
ChooseColorA
GetFileTitleA
GetFileTitleA

psapi

GetModuleFileNameExA

winhttp

WinHttpTimeFromSystemTime
WinHttpTimeToSystemTime

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA
DocumentPropertiesA
OpenPrinterA
ClosePrinter

comctl32

ord17
ord17
ImageList_Destroy

oledlg

ord8

rasapi32

RasHangUpA
RasGetConnectStatusA

winmm

midiStreamProperty
midiStreamClose
midiOutReset
midiStreamStop
midiStreamOut
midiOutPrepareHeader
midiStreamOpen
midiStreamRestart
midiOutUnprepareHeader
waveOutOpen
waveOutGetNumDevs
waveOutClose
waveOutReset
waveOutPause
waveOutWrite
waveOutPrepareHeader
waveOutUnprepareHeader

ws2_32

inet_ntoa
WSAStartup
WSACleanup
select
send
closesocket
WSAAsyncSelect
recvfrom
ioctlsocket
recv
getpeername
accept

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 176KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 420KB - Virtual size: 532KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 120KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e12efcd9237b315aa4bcfdfe09ef070c

Headers

File Characteristics

Imports

user32

kernel32

ole32

shell32

shlwapi

version

gdi32

gdiplus

wininet

oleaut32

dbghelp

advapi32

comdlg32

psapi

winhttp

winspool.drv

comctl32

oledlg

rasapi32

winmm

ws2_32

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 176KB - Virtual size: 173KB

.data Size: 420KB - Virtual size: 532KB

.rsrc Size: 24KB - Virtual size: 22KB

.data Size: 120KB - Virtual size: 117KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 176KB - Virtual size: 173KB

.data
Size: 420KB - Virtual size: 532KB

.rsrc
Size: 24KB - Virtual size: 22KB

.data
Size: 120KB - Virtual size: 117KB