212610323b36d50ed65519fd54fa5f6b8964f6cd5557b02bdc825b15c7e65835

Sharing

Copy URL Twitter E-mail

General

Target

212610323b36d50ed65519fd54fa5f6b8964f6cd5557b02bdc825b15c7e65835
Size

5.6MB
MD5

6783a16291bb983ffdc7b22675d5f2b9
SHA1

7adf3ef62e01026c0840872135d86fc054f29d75
SHA256

212610323b36d50ed65519fd54fa5f6b8964f6cd5557b02bdc825b15c7e65835
SHA512

f1834b64c07e6b8ea115221db33ccd12f5803c89f99103f1c8a69c7e6eefd92b05a8d6a003f19f49cdaa2fb8c0a2726fdacca12d6044a031633ada734f24b3fd
SSDEEP

98304:5Ys/Ezu3hXDsEjYsShT2SYoIQFLOAkGkzdnEVomFHKnP:Ss/E4DET2S3FLOyomFHKnP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
212610323b36d50ed65519fd54fa5f6b8964f6cd5557b02bdc825b15c7e65835

Files

212610323b36d50ed65519fd54fa5f6b8964f6cd5557b02bdc825b15c7e65835
.exe windows:6 windows x64 arch:x64

aa69924b8264130888921420ada2dcd5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

H:\source code\ui_4WinKey_pe_win_mfc\src\x64\Release\4WinKey.pdb

Imports

lib_unlockvolume_sdk

unLockVolumeToPw
offBitlokcer
unLockVolumeToNPw
getNPw
getVolumeIDs
getProStatus
InitUnlockVolumeLog
addVolumeLetter

lib_changepw_sdk

restoreFiles
getFullName
getUserInfo
openSAMFile
InitChangePwLog
changePassword
disposableByPass
writeSAMFile
closeSAMFile

ntpasswd

remove_password
liveID2local
GetHash
GetUserInfo

resetuser

?CreateResetUserObj@@YAPEAVIResetUser@@XZ
?FreeResetUserObj@@YAXPEAVIResetUser@@@Z

kernel32

SetErrorMode
GetProfileIntW
SearchPathW
GetWindowsDirectoryW
GetTempFileNameW
GetUserDefaultLCID
FindResourceExW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetFileSizeEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
PeekNamedPipe
GetFileInformationByHandle
WriteConsoleW
GetFileType
GetStdHandle
RtlPcToFileHeader
RtlUnwindEx
GetCPInfo
LCMapStringW
GetStringTypeW
GetFileTime
GetFileAttributesExW
VirtualProtect
IsProcessorFeaturePresent
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GetCurrentDirectoryW
GlobalGetAtomNameW
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SystemTimeToTzSpecificLocalTime
FileTimeToLocalFileTime
GetThreadLocale
lstrcmpiW
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
GetFileSize
FlushFileBuffers
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
VerifyVersionInfoW
VerSetConditionMask
GetSystemDirectoryW
EncodePointer
GetPrivateProfileStringW
GetPrivateProfileIntW
InitializeCriticalSectionAndSpinCount
lstrcpyW
FreeResource
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
lstrcmpW
lstrcmpA
GlobalDeleteAtom
LoadLibraryW
LoadLibraryExW
GetModuleHandleExW
FreeLibrary
GetVersionExW
OutputDebugStringA
SetLastError
FormatMessageW
MulDiv
LocalFree
GlobalUnlock
GlobalLock
GlobalSize
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
HeapFree
ResetEvent
ReadFile
GetStartupInfoW
CreatePipe
GetDiskFreeSpaceExW
RemoveDirectoryW
FindClose
DeleteFileW
FindNextFileW
FindFirstFileW
DeviceIoControl
CreateFileW
WritePrivateProfileStringW
SetEvent
OutputDebugStringW
CreateThread
GlobalAlloc
GlobalFree
CreateEventW
OpenThread
VirtualQuery
FlushInstructionCache
GetCurrentProcessId
GetProcAddress
GetThreadContext
VirtualProtectEx
GetSystemInfo
GetThreadPriority
ResumeThread
SuspendThread
InitializeCriticalSection
LeaveCriticalSection
SetThreadPriority
VirtualAlloc
GetCurrentProcess
VirtualFree
EnterCriticalSection
GetCurrentThreadId
GetModuleHandleW
GetCurrentThread
TerminateProcess
OpenProcess
MultiByteToWideChar
GetTickCount
FileTimeToSystemTime
lstrlenW
GetSystemPowerStatus
WaitForSingleObject
WideCharToMultiByte
CopyFileW
CreateDirectoryW
GetFileAttributesW
GetDriveTypeW
GetLogicalDriveStringsW
GetTempPathW
CloseHandle
GetLastError
CreateMutexW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
FindResourceW
LoadResource
LockResource
SizeofResource
GetModuleFileNameW
CreateProcessW
Sleep
GetCommandLineA
GetCommandLineW
ExitThread
FreeLibraryAndExitThread
SetStdHandle
HeapQueryInformation
QueryPerformanceFrequency
ExitProcess
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetFilePointerEx
ReadConsoleW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WaitForSingleObjectEx

user32

GetTopWindow
GetClassLongPtrW
EqualRect
AdjustWindowRectEx
GetWindowTextLengthW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
SetForegroundWindow
GetForegroundWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
SetFocus
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
IsChild
IsMenu
CreateWindowExW
GetClassInfoExW
RegisterClassW
GetMessageTime
GetMessagePos
EndPaint
BeginPaint
GetWindowDC
GetLastActivePopup
GetWindowThreadProcessId
MessageBoxW
ShowOwnedPopups
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
EnumDisplayMonitors
GetMonitorInfoW
SystemParametersInfoW
GetClassInfoW
DefWindowProcW
GetDesktopWindow
SetActiveWindow
IsWindowEnabled
GetNextDlgTabItem
GetDlgItem
EndDialog
CreateDialogIndirectParamW
DestroyWindow
GetCursorPos
ValidateRect
GetKeyState
GetActiveWindow
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
DrawIconEx
DrawFocusRect
GetSysColorBrush
GetSysColor
GetScrollInfo
DrawStateW
DrawFrameControl
DrawEdge
RegisterWindowMessageW
MapDialogRect
GetWindow
SetWindowContextHelpId
PostQuitMessage
RemoveMenu
InsertMenuW
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringW
UnregisterClassW
IsWindowVisible
LoadCursorW
SetCursor
FillRect
GetMenuItemCount
UnhookWindowsHookEx
SetWindowsHookExW
CallWindowProcW
CallNextHookEx
SetWindowLongPtrW
WinHelpW
MonitorFromWindow
SendDlgItemMessageA
CharUpperW
ShowWindow
SetWindowRgn
ScreenToClient
ReleaseDC
GetDC
InflateRect
GetWindowTextW
OffsetRect
GrayStringW
DrawTextExW
TabbedTextOutW
DrawTextW
CopyRect
GetFocus
CloseWindow
GetAsyncKeyState
LoadImageW
GetParent
PtInRect
IsRectEmpty
SetLayeredWindowAttributes
GetWindowLongPtrW
CheckDlgButton
SetWindowTextW
IsDialogMessageW
IntersectRect
DestroyMenu
GetMenuItemInfoW
LoadMenuW
GetKeyNameTextW
MapVirtualKeyW
SetWindowLongW
SetRect
SetRectEmpty
WaitMessage
SetCapture
ReleaseCapture
WindowFromPoint
CopyImage
DeleteMenu
RealChildWindowFromPoint
CharNextW
CopyAcceleratorTableW
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
SetParent
MonitorFromPoint
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DestroyIcon
GetWindowRgn
DestroyCursor
InvertRect
HideCaret
CreateMenu
GetComboBoxInfo
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
MapVirtualKeyExW
IsCharLowerW
PostThreadMessageW
FrameRect
UpdateLayeredWindow
CharUpperBuffW
SubtractRect
RegisterClipboardFormatW
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
TranslateAcceleratorW
CreateAcceleratorTableW
LoadAcceleratorsW
GetKeyboardState
GetKeyboardLayout
MoveWindow
SetWindowPos
GetClassNameW
GetWindowLongW
GetSystemMetrics
FindWindowW
SwitchToThisWindow
wsprintfW
LoadIconW
SendMessageW
PostMessageW
GetClientRect
ToUnicodeEx
SetTimer
IsIconic
DrawIcon
CreatePopupMenu
IsClipboardFormatAvailable
GetUpdateRect
SetClassLongPtrW
DestroyAcceleratorTable
ModifyMenuW
SetMenuDefaultItem
GetMenuDefaultItem
CopyIcon
GetIconInfo
GetDoubleClickTime
EnableScrollBar
LockWindowUpdate
BringWindowToTop
UnionRect
SetCursorPos
NotifyWinEvent
GetSystemMenu
IsZoomed
AppendMenuW
GetWindowRect
ClientToScreen
RedrawWindow
KillTimer
IsWindow
UpdateWindow
InvalidateRect
EnableWindow
SetScrollInfo
MapWindowPoints
TrackMouseEvent

gdi32

GetTextColor
PatBlt
CreatePolygonRgn
Polygon
Polyline
GetTextMetricsW
CreateDIBitmap
CreatePatternBrush
EnumFontFamiliesW
GetTextCharsetInfo
CreateBitmap
GetClipBox
GetObjectType
GetPixel
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetBkColor
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextColor
SetTextAlign
CreateRectRgn
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
GetBkColor
GetMapMode
SetRectRgn
DPtoLP
GetRgnBox
RealizePalette
SetPixel
StretchBlt
SetDIBColorTable
OffsetRgn
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
EnumFontFamiliesExW
LPtoDP
ExtFloodFill
SetPaletteEntries
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
GetViewportOrgEx
GetWindowOrgEx
SetPixelV
GetTextFaceW
CreateHatchBrush
CreateEllipticRgn
CombineRgn
GetDeviceCaps
CreateDCW
CopyMetaFileW
DeleteDC
ExcludeClipRect
CreateRoundRectRgn
GetStockObject
CreateDIBSection
SelectObject
GetTextExtentPoint32W
RoundRect
DeleteObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
BitBlt
Ellipse
ScaleWindowExtEx
CreateRectRgnIndirect
CreateCompatibleBitmap
CreateCompatibleDC
Rectangle
CreateSolidBrush
GetCurrentObject
GetObjectW
RemoveFontResourceW
MoveToEx
CreatePen
CreateFontIndirectW

msimg32

TransparentBlt
AlphaBlend

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

RegEnumKeyW
RegUnLoadKeyW
RegOpenKeyExW
RegLoadKeyW
RegCloseKey
RegQueryValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegFlushKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW

shell32

ShellExecuteExW
ShellExecuteW
SHGetMalloc
DragFinish
DragQueryFileW
SHAppBarMessage
SHGetFileInfoW
SHGetDesktopFolder
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetPathFromIDListW

comctl32

InitCommonControlsEx
_TrackMouseEvent

shlwapi

PathFileExistsW
PathFindExtensionW
PathFindFileNameW
PathIsUNCW
PathStripToRootW
PathRemoveFileSpecW
StrFormatKBSizeW

uxtheme

GetThemeSysColor
IsAppThemed
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
DrawThemeParentBackground
DrawThemeText
GetWindowTheme
GetThemePartSize
IsThemeBackgroundPartiallyTransparent

ole32

CoInitialize
CreateStreamOnHGlobal
CoRegisterMessageFilter
CoRevokeClassObject
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
StringFromGUID2
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoDisconnectObject
CoInitializeEx
CLSIDFromProgID
CLSIDFromString
CoCreateGuid
ReleaseStgMedium
OleDuplicateData
OleLockRunning
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize
CoCreateInstance

oleaut32

SysAllocStringLen
VariantCopy
SysStringLen
SysAllocStringByteLen
VariantInit
VarBstrFromDate
SysAllocString
OleCreateFontIndirect
VariantClear
VariantChangeType
LoadTypeLi
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
SysFreeString

oledlg

OleUIBusyW

gdiplus

GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipImageGetFrameDimensionsList
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipImageGetFrameCount
GdipGetImagePixelFormat
GdipGetPropertyItem
GdipGetImagePalette
GdipImageSelectActiveFrame
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipGetPropertyItemSize
GdipImageGetFrameDimensionsCount
GdiplusStartup
GdiplusShutdown
GdipLoadImageFromFile
GdipFree
GdipAlloc
GdipCloneImage
GdipDisposeImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawImageRect
GdipDrawImageRectRect
GdipStringFormatGetGenericTypographic
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDeleteFont
GdipSetTextRenderingHint
GdipMeasureString
GdipDrawString
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageRectI
GdipGetImageThumbnail
GdipImageRotateFlip
GdipFillRectangleI
GdipSetInterpolationMode

softwarelog

CreateExportObj
DestroyExportObj

bugsplat64

??0MiniDmpSender@@QEAA@PEB_W000K@Z
?setCallback@MiniDmpSender@@QEAAXP6A_NIPEAX0@Z@Z
??1MiniDmpSender@@UEAA@XZ
?getMinidumpPath@MiniDmpSender@@QEAAXPEA_W_K@Z

cfgmgr32

CM_Get_Device_ID_Size
CM_Get_Device_IDW
CM_Enumerate_Classes

setupapi

SetupDiDestroyDriverInfoList
SetupGetInfDriverStoreLocationW
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiEnumDriverInfoW
SetupDiGetDeviceRegistryPropertyW
SetupDiBuildDriverInfoList
SetupDiGetDriverInfoDetailW

libqrencode

QRcode_encodeString
QRcode_free

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

register

?GetRegisterObj@@YAPEAVIRegisterManager@@XZ

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 897KB - Virtual size: 897KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 203KB - Virtual size: 235KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aa69924b8264130888921420ada2dcd5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

lib_unlockvolume_sdk

lib_changepw_sdk

ntpasswd

resetuser

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

softwarelog

bugsplat64

cfgmgr32

setupapi

libqrencode

version

register

oleacc

imm32

winmm

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 897KB - Virtual size: 897KB

.data Size: 203KB - Virtual size: 235KB

.pdata Size: 107KB - Virtual size: 107KB

.rsrc Size: 1.8MB - Virtual size: 1.8MB

.reloc Size: 70KB - Virtual size: 70KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 897KB - Virtual size: 897KB

.data
Size: 203KB - Virtual size: 235KB

.pdata
Size: 107KB - Virtual size: 107KB

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

.reloc
Size: 70KB - Virtual size: 70KB