ffd00946ac826583c1df3a1e655bad9e0780f06cb5acd72b3ad8d0b47b9945ae

Sharing

Copy URL

Twitter E-mail

General

Target

ffd00946ac826583c1df3a1e655bad9e0780f06cb5acd72b3ad8d0b47b9945ae
Size

666KB
MD5

c6adaa326a72ef771c194d22dd0394fe
SHA1

3ba981502e358028543c221992113fe5881ba436
SHA256

ffd00946ac826583c1df3a1e655bad9e0780f06cb5acd72b3ad8d0b47b9945ae
SHA512

3b37d695c4daf156acfbd6e5519140e4589d61ee839c802309eca67c1acd5b6c5c960d1e55ec6953a71add7dde687917bf4991b4d935f8fc960f4c654cf56b42
SSDEEP

12288:D1UaJQyAwT5l0lVvqaBnfxAlpH9eJX51qz9LqJPQhYsJHa5qmKLijiJ0:BGSTKq8npul9kp1e9WuWf5fJO0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffd00946ac826583c1df3a1e655bad9e0780f06cb5acd72b3ad8d0b47b9945ae

Files

ffd00946ac826583c1df3a1e655bad9e0780f06cb5acd72b3ad8d0b47b9945ae
.exe windows:5 windows x86 arch:x86

bf790d387cffe19730f479ec7af55c79

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetConsoleMode
GetConsoleCP
SetFilePointer
GetSystemTimeAsFileTime
QueryPerformanceCounter
DeleteCriticalSection
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
InterlockedDecrement
GetCurrentThreadId
SetLastError
GlobalLock
GetProcAddress
TlsGetValue
TlsAlloc
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameW
WriteFile
HeapCreate
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
EncodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DecodePointer
RaiseException
GetStartupInfoW
HeapSetInformation
GetCommandLineA
HeapAlloc
HeapFree
GetLastError
FindFirstFileA
GetStdHandle
MultiByteToWideChar
RtlUnwind
HeapSize
SetStdHandle
WriteConsoleW
LCMapStringW
GetStringTypeW
HeapReAlloc
FlushFileBuffers
CreateFileW
CloseHandle
lstrcpyA
CreateThread
LocalFree
GetCurrentProcessId
WaitForMultipleObjects
SetConsoleWindowInfo
LocalAlloc
LoadLibraryA
TlsFree
GetLocalTime
FreeLibrary
lstrcpynA
lstrlenA
lstrlenW
GetConsoleWindow
CreateEventA
LoadLibraryW
FormatMessageA
GetTickCount
GetModuleHandleW
TlsSetValue
SetConsoleScreenBufferSize
InterlockedIncrement
ExitProcess

user32

CheckRadioButton
DeferWindowPos
SystemParametersInfoA
BeginDeferWindowPos
GetSystemMetrics
SetWindowTextA
LoadImageA
MapWindowPoints
DestroyMenu
DestroyIcon
EndDeferWindowPos
EndPaint
ClientToScreen
IsWindow
GetMenuItemCount
IsDlgButtonChecked
ShowWindow
SetLayeredWindowAttributes
CheckDlgButton
SetWindowPos
GetDesktopWindow
DefWindowProcA
EndDialog
GetDlgItem
ReleaseDC
CreateWindowExA
SetDlgItemTextA
GetRawInputDeviceList
GetMessagePos
CreateWindowExW
GetWindowLongA
CreateAcceleratorTableA
SetWindowLongA
SetRect
GetAsyncKeyState
RegisterClipboardFormatA
GetWindowTextA
GetClassNameA
SetTimer
ScreenToClient
GetWindowRect
DdeCreateStringHandleA
PostQuitMessage
SendDlgItemMessageA
TrackPopupMenu
GetWindowDC
FillRect
SetCapture
DrawTextA
GetSubMenu
GetParent
LoadMenuA
WaitForInputIdle
IsWindowEnabled
GetClientRect
SetFocus
GetWindowTextLengthA
SendMessageA
BeginPaint
CreateIconIndirect
GetIconInfo
GetDC
InflateRect
GetForegroundWindow
GetMenu

gdi32

PatBlt
SetViewportOrgEx
LineTo
SetTextColor
DeleteDC
CreateFontA
CreateFontIndirectA
SetBkColor
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
Rectangle
SetDCPenColor
StretchDIBits
SetStretchBltMode
Polyline
CreatePen
SetROP2
SetTextAlign
GetObjectA
TextOutW
GetStockObject
CreateSolidBrush
MoveToEx

advapi32

RegQueryValueExA
OpenProcessToken

shell32

DragQueryFileA
SHBrowseForFolderA
SHGetFileInfoA
ord3
DragFinish
Shell_NotifyIconA

ole32

RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
CoInitialize
CoGetClassObject
CoUninitialize
StgCreateDocfile
ReleaseStgMedium
CoCreateInstance
CoInitializeEx

oleaut32

VariantClear
VariantChangeType
SystemTimeToVariantTime
UnRegisterTypeLi
VariantInit
VariantTimeToSystemTime

wininet

InternetOpenUrlW

avicap32

capGetDriverDescriptionA

winmm

waveOutOpen
mmioSeek
waveOutPrepareHeader

crypt32

CertEnumSystemStore

shlwapi

ord597
SHCreateStreamOnFileEx

comctl32

ImageList_DragEnter
ImageList_DragShowNolock
ImageList_Draw
ImageList_Destroy
ord17
FlatSB_SetScrollInfo
ImageList_BeginDrag
ImageList_ReplaceIcon
ImageList_Create

pdh

PdhCollectQueryData

wintrust

CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminEnumCatalogFromHash

gdiplus

GdipSaveImageToFile
GdipCreateBitmapFromHBITMAP
GdipDisposeImage

opengl32

glLoadIdentity
glMatrixMode
glViewport

uxtheme

OpenThemeData

wsnmp32

ord600
ord504

Sections

.text
Size: 506KB - Virtual size: 505KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bf790d387cffe19730f479ec7af55c79

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wininet

avicap32

winmm

crypt32

shlwapi

comctl32

pdh

wintrust

gdiplus

opengl32

uxtheme

wsnmp32

Sections

.text Size: 506KB - Virtual size: 505KB

.rdata Size: 38KB - Virtual size: 38KB

.data Size: 15KB - Virtual size: 22KB

.rsrc Size: 94KB - Virtual size: 93KB

.reloc Size: 11KB - Virtual size: 11KB

.text
Size: 506KB - Virtual size: 505KB

.rdata
Size: 38KB - Virtual size: 38KB

.data
Size: 15KB - Virtual size: 22KB

.rsrc
Size: 94KB - Virtual size: 93KB

.reloc
Size: 11KB - Virtual size: 11KB