9b0d85e018e0137dde21a6b386d91b4ecbd7676c7269c5ef7b4388c846265ceb

Sharing

Copy URL Twitter E-mail

General

Target

9b0d85e018e0137dde21a6b386d91b4ecbd7676c7269c5ef7b4388c846265ceb
Size

77KB
MD5

f3eda53f68f5a52ecb661ddac3dea78b
SHA1

6f67dd52e7b7aaf31e3b22552258f6e5b3883a17
SHA256

9b0d85e018e0137dde21a6b386d91b4ecbd7676c7269c5ef7b4388c846265ceb
SHA512

864081aa2dd9fa22964ddb209778b3c87aac293912ccf9236fa7b893f5f182f40be3de45b773b382943df81d44efc5c5acda4f0f2e34e0dc49153ecaed87993e
SSDEEP

1536:xuDxhMWZghCOVDO3yu0DbFZtguohk8EyxcwEZ2pRIV/6DXOJ0PLV1QhOPru:xa9gh7qCuObjM8yxbXOKxKy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9b0d85e018e0137dde21a6b386d91b4ecbd7676c7269c5ef7b4388c846265ceb

Files

9b0d85e018e0137dde21a6b386d91b4ecbd7676c7269c5ef7b4388c846265ceb
.exe windows:4 windows x86 arch:x86

12ca87fdcdee9471002061e10efc10c8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

OpenBackupEventLogA
RegQueryMultipleValuesW
LookupPrivilegeDisplayNameW
DeregisterEventSource
RevertToSelf
GetSecurityInfo
SetFileSecurityA
SetThreadToken
RegisterServiceCtrlHandlerA
IsValidSecurityDescriptor
BuildTrusteeWithSidA
StartServiceCtrlDispatcherA
GetEffectiveRightsFromAclA
CreatePrivateObjectSecurity
ObjectDeleteAuditAlarmW
CryptSetProviderExA
CryptDuplicateKey
GetServiceDisplayNameA
GetSecurityDescriptorSacl
DeleteService
CryptCreateHash
ChangeServiceConfigA
RegEnumKeyExA
SetEntriesInAuditListW
SetEntriesInAclW
ObjectCloseAuditAlarmW
RegSetValueA
CryptGenKey
AreAnyAccessesGranted
BuildImpersonateExplicitAccessWithNameA
RegLoadKeyA
GetCurrentHwProfileW
CryptGenRandom
CryptEncrypt
LookupSecurityDescriptorPartsW
RegEnumKeyA
TrusteeAccessToObjectW
IsValidAcl
AdjustTokenGroups
AreAllAccessesGranted
PrivilegedServiceAuditAlarmA
RegDeleteValueA
ConvertSecurityDescriptorToAccessA
GetMultipleTrusteeOperationA
ConvertSecurityDescriptorToAccessNamedW
PrivilegedServiceAuditAlarmW
RegDeleteKeyA
ImpersonateNamedPipeClient
OpenThreadToken
RegGetKeySecurity
ConvertSecurityDescriptorToAccessNamedA
QueryServiceLockStatusW
CryptSetHashParam
LookupAccountSidA
RegQueryInfoKeyW
GetAclInformation
GetSidIdentifierAuthority
CancelOverlappedAccess
BuildImpersonateTrusteeA
SetEntriesInAclA
GetCurrentHwProfileA
NotifyChangeEventLog
GetTrusteeTypeA
BuildExplicitAccessWithNameA
RegQueryValueExW
LookupAccountNameW
OpenBackupEventLogW
RegFlushKey
UnlockServiceDatabase
CryptSignHashW
GetOldestEventLogRecord
OpenServiceA

kernel32

WritePrivateProfileStructA
LockResource
FreeEnvironmentStringsW
OpenMutexA
GetDiskFreeSpaceA
LockFile
EnumSystemLocalesA
InitAtomTable
CallNamedPipeW
VirtualAlloc
WideCharToMultiByte
GetEnvironmentStringsW
SearchPathA
CreateEventW
RaiseException
VirtualFreeEx
GetEnvironmentStrings
SetThreadPriority
GlobalMemoryStatus
EnumResourceTypesW
GetHandleInformation
GetSystemDirectoryA
LocalFree
FindFirstChangeNotificationW
CopyFileExW
RtlFillMemory
DisconnectNamedPipe
SetConsoleCursorPosition
CopyFileA
GetTempPathW
WriteProfileSectionW
GetConsoleScreenBufferInfo
GetSystemDirectoryW
CopyFileExA
EnumSystemCodePagesW
VirtualFree
CreateDirectoryExW
EnumCalendarInfoExA
FillConsoleOutputCharacterW
WaitNamedPipeA
GetSystemDefaultLangID
CancelIo
VirtualProtect
GetCommandLineA
GetPrivateProfileStructA
SetupComm
SetErrorMode
CreateThread
WriteProfileStringA
FreeLibraryAndExitThread
GetThreadTimes
GetThreadContext
ReleaseSemaphore
GlobalReAlloc
FindFirstFileExA
GetCalendarInfoA
SetProcessAffinityMask
VirtualAllocEx
GetCalendarInfoW
SetCurrentDirectoryW
GetBinaryTypeA
GetExitCodeProcess
CreateMailslotW
GetLargestConsoleWindowSize
GetDateFormatW
LoadLibraryExA
GetEnvironmentVariableW
GetProcessVersion
FindResourceA
IsBadReadPtr
FatalAppExitA
SetEnvironmentVariableW
CreatePipe

user32

WINNLSGetIMEHotkey
BroadcastSystemMessage
DlgDirSelectComboBoxExW
KillTimer
GetLastActivePopup
VkKeyScanExW
GetScrollRange
SendMessageCallbackW
IsCharUpperA
SetWindowsHookExA
LoadAcceleratorsW
RegisterClipboardFormatW
CreateDesktopW
DdeEnableCallback
DdeCmpStringHandles
LoadMenuIndirectA
DialogBoxIndirectParamA
DefFrameProcW
CharNextW
ChangeMenuW
GetClassInfoW
DdeQueryNextServer
EnableWindow
CreateCaret
MapVirtualKeyExW
GetClipboardFormatNameW
GetMenuItemInfoA
SendMessageTimeoutA
OpenInputDesktop
EnumDisplaySettingsExW
IsDialogMessage
GetInputState
GrayStringA
CreateMDIWindowA
GetDlgItemInt
GetCaretPos
DdeClientTransaction
GetScrollBarInfo
PeekMessageW
AttachThreadInput
DdeCreateStringHandleW
BlockInput
DdeUninitialize
RegisterClassW
CheckMenuRadioItem
PeekMessageA
GetThreadDesktop
WINNLSEnableIME
DragObject
BeginPaint
DrawTextW
MenuItemFromPoint
EndDialog
GetUserObjectInformationW
TranslateMessage
SetCaretBlinkTime
DrawFrame
SetRectEmpty
CharUpperBuffW
ShowOwnedPopups
ChangeMenuA
IsCharAlphaW
FindWindowExW
GetClassInfoExW
SwapMouseButton
DdeReconnect
LoadBitmapW
RedrawWindow
InvertRect
SetDlgItemInt
EnumDisplaySettingsExA
IsWindow
DestroyAcceleratorTable
DestroyIcon
OffsetRect
IsCharLowerA
SetClipboardViewer
EnumClipboardFormats
GetSysColor
DdeSetUserHandle
GetWindowModuleFileNameA
GetTitleBarInfo
SetUserObjectInformationW
GetDC
WaitMessage
CharToOemBuffW
OemKeyScan
EnumPropsExA
CreateMenu

ole32

OleQueryLinkFromData
PropVariantClear
CoGetMarshalSizeMax
CoMarshalHresult
OleCreateLink
OleUninitialize
CoRegisterSurrogate
ReadClassStg
CreateBindCtx
CoRegisterClassObject
CoGetTreatAsClass
CreateItemMoniker
ReadOleStg
CoGetPSClsid
CoGetClassObject
OleRegGetUserType
OleGetIconOfClass
OleDuplicateData
CoRevokeClassObject
StgOpenStorageEx
CoFreeUnusedLibraries
CoCreateGuid
CoFreeAllLibraries
StgGetIFillLockBytesOnILockBytes
OleCreateStaticFromData
OleRegEnumVerbs
ReadFmtUserTypeStg
OleCreateMenuDescriptor
CreatePointerMoniker
UtGetDvtd16Info
OleSaveToStream
CoFileTimeNow
OleConvertIStorageToOLESTREAM
MonikerCommonPrefixWith
CoGetCallerTID
StringFromGUID2
WriteClassStm
StgOpenStorageOnILockBytes
OleGetIconOfFile
CoReleaseServerProcess
CoCopyProxy
OleCreate
StgIsStorageFile
CoRevertToSelf
SetDocumentBitStg
OleSetAutoConvert
CoRevokeMallocSpy
StgGetIFillLockBytesOnFile
CoInitializeEx
ProgIDFromCLSID
CoMarshalInterface
OleLoad
StringFromCLSID
CoUnmarshalInterface
CoGetObject
StgSetTimes
CoUnmarshalHresult
CoDosDateTimeToFileTime
CoSetProxyBlanket
OleCreateFromDataEx
OleMetafilePictFromIconAndLabel
OleIsRunning
StgCreateStorageEx
MonikerRelativePathTo
CreateClassMoniker
CoCreateInstanceEx
StringFromIID
GetHookInterface
CoReleaseMarshalData
OleGetAutoConvert
OleCreateLinkFromDataEx
OleQueryCreateFromData
GetHGlobalFromILockBytes
OleCreateLinkFromData
OpenOrCreateStream
CoTaskMemRealloc
UtConvertDvtd32toDvtd16
ReadStringStream

shlwapi

PathFindExtensionW
PathIsRelativeW
PathCombineW
PathIsLFNFileSpecA
StrCSpnA
PathIsContentTypeW
SHGetInverseCMAP
PathRenameExtensionW
UrlIsOpaqueA
StrPBrkW
UrlHashA
SHSetValueA
ChrCmpIA
PathStripPathW
UrlCreateFromPathA
SHQueryInfoKeyA
AssocQueryKeyA
PathRelativePathToW
UrlApplySchemeW
PathFileExistsW
PathSearchAndQualifyA
SHOpenRegStreamW
SHCopyKeyW
UrlCombineW
SHCopyKeyA
StrCmpNIA
StrToIntW
PathSetDlgItemPathW
IntlStrEqWorkerW
SHCreateStreamOnFileA
PathStripToRootA
PathFileExistsA
SHGetValueA
SHRegOpenUSKeyW
StrFromTimeIntervalW
SHQueryValueExW
UrlIsA
StrRetToBufW
PathIsLFNFileSpecW
PathFindSuffixArrayA
SHGetThreadRef
StrCmpNA
SHOpenRegStream2W
GetMenuPosFromID
StrDupA
PathMatchSpecA
PathMakeSystemFolderW
SHRegDeleteUSValueA
PathIsNetworkPathA
PathIsUNCServerShareA
PathAddExtensionA
SHRegEnumUSKeyA
SHRegGetUSValueA
AssocQueryStringW
wvnsprintfA
PathUnquoteSpacesA
PathMakePrettyW
SHStrDupW
UrlCompareW
PathCompactPathA
StrChrA
SHEnumKeyExA
StrFormatByteSizeW
AssocQueryStringByKeyW
UrlCanonicalizeW
UrlIsNoHistoryW
SHRegOpenUSKeyA
StrFormatKBSizeA
StrTrimA
wnsprintfA
PathSkipRootW
PathIsUNCServerShareW
UrlCanonicalizeA
SHOpenRegStreamA
SHCreateStreamOnFileW
SHRegWriteUSValueW
StrStrIA
StrStrA
SHDeleteKeyA
AssocQueryStringByKeyA
SHRegWriteUSValueA
UrlUnescapeW
PathGetCharTypeA
StrCatBuffA
PathMatchSpecW
PathCommonPrefixA
StrCmpNIW

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

12ca87fdcdee9471002061e10efc10c8

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

ole32

shlwapi

Sections

.text Size: 64KB - Virtual size: 63KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 512B - Virtual size: 8KB

.text
Size: 64KB - Virtual size: 63KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 512B - Virtual size: 8KB