871dcdfc62e05144ff881260320d8c3dadc8950da36807f4174cc2244eee3522

Sharing

Copy URL

Twitter E-mail

General

Target

871dcdfc62e05144ff881260320d8c3dadc8950da36807f4174cc2244eee3522
Size

11.0MB
MD5

5bde59e4dd1679dddb67481e845d1ee5
SHA1

64590bd97a5599735d5d3a33b7924e2a1d2ed0cb
SHA256

871dcdfc62e05144ff881260320d8c3dadc8950da36807f4174cc2244eee3522
SHA512

8fee4fdd841e8da9b87c84a9f89af8f4ce4c8e9db219ca04b9c539bf5bfbb5b685f76862529480a8e4944ddae6e05fab580684e1b086d55a169fe58bf8b67b14
SSDEEP

196608:VQKJGtsO5X1UzEKEH+SATVe4clBMjjjAI3nOAWWvYXdqlLcFW5mOYKD75B0BeISx:ada21zI8eIl15IFGXp5oA256b4JyiDuk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
871dcdfc62e05144ff881260320d8c3dadc8950da36807f4174cc2244eee3522

Files

871dcdfc62e05144ff881260320d8c3dadc8950da36807f4174cc2244eee3522
.exe windows:4 windows x86 arch:x86

a8b64556a83cf27f5313af773060ac7d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

autonester-t

ord2
ord1

mpr

WNetOpenEnumA
WNetEnumResourceA
WNetCloseEnum

richpeaceam

GetSSOptEnvironment
CheckShapeShifter
ShapeShifterOpt
DeleteSSOptEnvironment
ShapeShifterAM

ws2_32

WSACleanup
inet_ntoa
WSAStartup
gethostname
gethostbyname

gdiplus

GdipDrawLinesI
GdipDrawEllipseI
GdipDrawPolygonI
GdipDrawCurveI
GdipFillPolygonI
GdipDrawRectangleI
GdipDeleteBrush
GdipCloneBrush
GdipCreatePen1
GdipDeletePen
GdipSetPenWidth
GdipSetPenDashArray
GdipDisposeImageAttributes
GdipSetImageAttributesRemapTable
GdipCreateFromHDC
GdipDeleteGraphics
GdipReleaseDC
GdipSetPageUnit
GdipDrawImagePointsRectI
GdipGetImageWidth
GdipGetImageHeight
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipFree
GdipDisposeImage
GdipCloneImage
GdipAlloc
GdipCreateHBITMAPFromBitmap
GdiplusStartup
GdiplusShutdown
GdipLoadImageFromFile
GdipLoadImageFromFileICM
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipGetImageGraphicsContext
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdipDrawImageRectI
GdipSaveImageToFile
GdipCreateBitmapFromScan0
GdipDrawImageRectRectI
GdipGetImagePixelFormat
GdipSetSmoothingMode
GdipCloneBitmapAreaI
GdipCreateSolidFill
GdipCreateImageAttributes
GdipSetPixelOffsetMode
GdipSetCompositingQuality

setupapi

SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailA

hid

HidD_GetAttributes
HidD_FlushQueue
HidD_GetHidGuid

kernel32

GetOverlappedResult
FindResourceA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
lstrcmpiA
GlobalGetAtomNameA
DuplicateHandle
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
MoveFileA
lstrcpynA
GetFullPathNameA
GetStringTypeExA
GetThreadLocale
GetShortPathNameA
VirtualProtect
WaitForMultipleObjects
lstrlenW
FileTimeToLocalFileTime
ResumeThread
SuspendThread
GetTempFileNameA
SetFileTime
GetDiskFreeSpaceA
GlobalFlags
GetCurrentThread
LocalFileTimeToFileTime
GlobalHandle
LocalReAlloc
GetProcessVersion
GetCPInfo
GetOEMCP
FindResourceExA
lstrcpyW
RtlUnwind
RaiseException
GetTimeZoneInformation
GetACP
GetSystemTimeAsFileTime
lstrcatA
ReleaseSemaphore
GetStartupInfoA
GetCommandLineA
ExitThread
SetStdHandle
GetFileType
HeapSize
FatalAppExitA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetUnhandledExceptionFilter
LCMapStringW
CompareStringA
CompareStringW
GetStringTypeA
GetStringTypeW
SetHandleCount
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
IsBadCodePtr
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
CreateFileW
SetConsoleCtrlHandler
GetLocaleInfoW
SetEnvironmentVariableA
SetCurrentDirectoryA
InterlockedExchange
GetSystemDirectoryA
MoveFileExA
LocalLock
LocalUnlock
GetModuleHandleW
OpenMutexA
IsBadReadPtr
ExitProcess
IsBadWritePtr
CopyFileA
GetLocalTime
lstrlenA
OpenSemaphoreA
CreateSemaphoreA
SearchPathA
HeapReAlloc
InterlockedIncrement
FindNextFileA
FindFirstFileA
SetErrorMode
GetVersion
FindClose
GetFileSize
ReadFile
HeapFree
GetProcessHeap
HeapAlloc
TlsFree
GetCurrentProcessId
GetSystemTime
SystemTimeToFileTime
TlsAlloc
TlsGetValue
TlsSetValue
GetEnvironmentVariableA
GetVolumeInformationA
InterlockedCompareExchange
QueryDosDeviceA
GetVersionExA
CreateThread
DeviceIoControl
SizeofResource
LoadResource
LockResource
GetComputerNameA
DeleteCriticalSection
LocalAlloc
InterlockedDecrement
lstrcmpA
GetDriveTypeA
GetFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SetEvent
ResetEvent
GetPrivateProfileIntA
GlobalReAlloc
TerminateThread
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
SetProcessWorkingSetSize
CreateMutexA
InitializeCriticalSection
ReleaseMutex
EnterCriticalSection
LeaveCriticalSection
lstrcpyA
GetModuleHandleA
WritePrivateProfileStringA
GlobalAlloc
CreateFileA
WriteFile
GetLastError
FormatMessageA
LocalFree
WinExec
GetPrivateProfileStringA
GetProfileIntA
GetSystemDefaultLangID
GetThreadPriority
SetThreadPriority
CreateEventA
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
GetWindowsDirectoryA
GetTickCount
GetCurrentThreadId
MulDiv
GlobalSize
GlobalLock
GlobalUnlock
GetCurrentDirectoryA
CreateDirectoryA
GlobalFree
WaitForSingleObject
GetFileAttributesA
SetFileAttributesA
DeleteFileA
GetModuleFileNameA
Sleep
LoadLibraryA
GetProcAddress
FreeLibrary
SetLastError
TerminateProcess

user32

BeginPaint
LoadStringA
OemToCharA
CharToOemA
wvsprintfA
GetMenuCheckMarkDimensions
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
SendDlgItemMessageA
AdjustWindowRectEx
DeferWindowPos
BeginDeferWindowPos
EndDeferWindowPos
ScrollWindow
GetScrollInfo
SetScrollInfo
GetScrollRange
GetTopWindow
IsChild
WinHelpA
RegisterClassA
GetMenuItemCount
GetMenuItemID
TrackPopupMenu
SetWindowPlacement
GetWindowTextLengthA
GetWindowTextA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
GetLastActivePopup
SetWindowPos
IsIconic
GetWindowPlacement
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamA
PostThreadMessageA
CreateWindowExA
RegisterClassExA
DestroyWindow
UnregisterClassA
GetUpdateRect
CopyIcon
SetScrollRange
LoadImageA
IsWindowEnabled
EndPaint
SetParent
GetDlgItem
SetWindowTextA
EnumDisplaySettingsA
MessageBoxA
IsRectEmpty
GetScrollPos
GetDlgCtrlID
ShowWindow
WindowFromDC
MapDialogRect
GetIconInfo
CreateIconIndirect
DestroyIcon
GetPropA
GetActiveWindow
wsprintfA
IsZoomed
CloseWindow
SetPropA
DeleteMenu
RemovePropA
SetScrollPos
ReuseDDElParam
FindWindowA
SetForegroundWindow
SetActiveWindow
SetFocus
BringWindowToTop
GetMessageA
TranslateMessage
DispatchMessageA
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
PeekMessageA
PostQuitMessage
GetAsyncKeyState
DrawEdge
ClipCursor
InvertRect
IsWindow
GrayStringA
DrawTextA
TabbedTextOutA
GetClassInfoA
DefWindowProcA
SystemParametersInfoA
GetWindowDC
CallWindowProcA
GetDesktopWindow
IsWindowVisible
MapWindowPoints
UnpackDDElParam
AppendMenuA
GetClassNameA
ShowOwnedPopups
SetWindowContextHelpId
InSendMessage
LockWindowUpdate
CharUpperA
GetDialogBaseUnits
GetSysColorBrush
GetDCEx
CreateMenu
GetCursorPos
RedrawWindow
MessageBeep
MoveWindow
EnableMenuItem
CheckMenuItem
UnionRect
SetRectEmpty
SetCursorPos
DrawFocusRect
SetWindowLongA
GetWindow
ShowScrollBar
GetSystemMetrics
DrawMenuBar
GetMenu
LoadMenuA
RemoveMenu
MsgWaitForMultipleObjects
DestroyMenu
WindowFromPoint
ValidateRect
CharNextA
RegisterClipboardFormatA
IsClipboardFormatAvailable
DestroyCursor
WaitMessage
LoadAcceleratorsA
SetMenu
TranslateAcceleratorA
InsertMenuA
GetSubMenu
GetMenuStringA
SetCapture
GetCapture
LoadBitmapA
CopyRect
PtInRect
GetWindowLongA
ReleaseCapture
SetCursor
LoadCursorA
UpdateWindow
ReleaseDC
GetDC
EqualRect
IntersectRect
SetRect
OffsetRect
GetSysColor
KillTimer
GetFocus
GetWindowRect
SetTimer
PostMessageA
GetParent
FillRect
LoadIconA
ScreenToClient
ClientToScreen
GetClientRect
GetKeyState
InflateRect
SendMessageA
InvalidateRect
EnableWindow
RegisterWindowMessageA
GetTabbedTextExtentA
GetNextDlgGroupItem
GetSystemMenu
CopyAcceleratorTableA
ScrollWindowEx

gdi32

GetDIBits
RealizePalette
SelectPalette
DeleteDC
CreateDCA
SetBkMode
SetBkColor
SetTextColor
DeleteObject
CreatePatternBrush
CreateBitmap
GetClipBox
GetSystemPaletteEntries
CreatePalette
CreateBrushIndirect
GetRgnBox
CreatePenIndirect
GetPixel
CombineRgn
CreateHatchBrush
Ellipse
CreateRectRgnIndirect
PatBlt
CreateDIBitmap
SetDIBitsToDevice
SetStretchBltMode
ExtSelectClipRgn
StretchDIBits
PlayEnhMetaFile
GetEnhMetaFilePaletteEntries
DeleteEnhMetaFile
SetWinMetaFileBits
GetEnhMetaFileHeader
SetEnhMetaFileBits
GetDCOrgEx
SaveDC
RestoreDC
SetPolyFillMode
SetROP2
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
GetStockObject
ScaleWindowExtEx
SelectClipRgn
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
MoveToEx
LineTo
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
GetCurrentPositionEx
ArcTo
SetArcDirection
PolyDraw
PolylineTo
SetColorAdjustment
PolyBezierTo
GetClipRgn
SelectClipPath
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
GetViewportExtEx
GetWindowExtEx
ExtCreatePen
CreateDIBPatternBrushPt
GetMapMode
SetRectRgn
DPtoLP
LPtoDP
GetCharWidthA
SetAbortProc
GetWindowOrgEx
GetViewportOrgEx
CopyMetaFileA
GetNearestColor
GetStretchBltMode
GetPolyFillMode
GetTextAlign
GetBkMode
GetROP2
GetTextFaceA
DeleteMetaFile
CloseMetaFile
CreateMetaFileA
GetCurrentObject
EndDoc
AbortDoc
EndPage
StartPage
StartDocA
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetTextCharacterExtra
GetGlyphOutlineA
GetBkColor
EnumFontFamiliesExA
Polygon
SelectObject
CreateFontA
Arc
PtInRegion
CreateFontIndirectA
OffsetRgn
Rectangle
GetTextMetricsA
SetPixel
GetTextColor
GetTextExtentPoint32A
GetDeviceCaps
RectInRegion
CreatePen
BitBlt
CreateCompatibleBitmap
UnrealizeObject
StretchBlt
CreateSolidBrush
CreateCompatibleDC
GetObjectA
CreateDIBSection
FillRgn
CreatePolygonRgn
SetWindowExtEx
CreateRectRgn

comdlg32

PrintDlgA
PageSetupDlgA
GetOpenFileNameA
GetFileTitleA
CommDlgExtendedError
ChooseColorA
ChooseFontA
GetSaveFileNameA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegCloseKey
RegCreateKeyA
RegSetValueA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
GetUserNameA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegOpenKeyA
SetFileSecurityA
GetFileSecurityA
RegDeleteValueA
RegDeleteKeyA
RegQueryValueA
RegEnumKeyA

shell32

DragFinish
SHGetFileInfoA
DragAcceptFiles
DragQueryFileA
SHChangeNotify
SHGetSpecialFolderPathA
ShellExecuteA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
ExtractIconA

comctl32

ImageList_DragLeave
ImageList_GetImageInfo
ImageList_AddMasked
ImageList_Draw
ImageList_GetImageCount
ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_Add
ImageList_Create
ImageList_SetBkColor
ord17
PropertySheetA
DestroyPropertySheetPage
CreatePropertySheetPageA
ord13
ord14
ImageList_Destroy
ImageList_LoadImageA
ImageList_Merge
ImageList_Read
ImageList_Write
ImageList_EndDrag

odbc32

ord9
ord51
ord45
ord10
ord5
ord50
ord23
ord1
ord2
ord41
ord43
ord68
ord15
ord46
ord19
ord44
ord8
ord59
ord17
ord20
ord49
ord48
ord4
ord72
ord31
ord24
ord75
ord12
ord14
ord3
ord11
ord18
ord13
ord61
ord16
ord55

oledlg

ord8

ole32

OleRegEnumVerbs
CreateOleAdviseHolder
OleRegGetMiscStatus
CreateDataAdviseHolder
OleTranslateAccelerator
IsAccelerator
GetRunningObjectTable
OleCreateMenuDescriptor
CoGetMalloc
OleIsRunning
OleQueryLinkFromData
OleSetMenuDescriptor
CoRevokeClassObject
CoRegisterClassObject
CoRegisterMessageFilter
CoGetClassObject
CoTreatAsClass
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CreateBindCtx
OleDuplicateData
CoTaskMemAlloc
CoDisconnectObject
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
CreateGenericComposite
CreateItemMoniker
CreateStreamOnHGlobal
OleSaveToStream
WriteClassStm
OleGetIconOfClass
GetHGlobalFromILockBytes
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
OleSave
OleLoad
OleCreate
OleCreateLinkToFile
OleCreateFromFile
OleCreateStaticFromData
OleCreateLinkFromData
OleCreateFromData
OleSetContainedObject
StringFromCLSID
OleLockRunning
StgIsStorageFile
StgOpenStorage
StgCreateDocfile
CreateFileMoniker
DoDragDrop
OleGetClipboard
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
CoTaskMemFree
ReleaseStgMedium
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
OleRun
CoUninitialize
CoInitialize
OleDestroyMenuDescriptor
OleQueryCreateFromData

olepro32

ord253

oleaut32

SysAllocStringByteLen
SysStringByteLen
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
CreateErrorInfo
SafeArrayRedim
VarCyFromStr
VarBstrFromCy
VarDateFromStr
VarBstrFromDate
SafeArrayCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayGetElement
SafeArrayPtrOfIndex
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SysAllocStringLen
SysReAllocStringLen
SysStringLen
LoadTypeLi
SysAllocString
VariantCopy
SysFreeString
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreate
SafeArrayPutElement
GetErrorInfo
SetErrorInfo
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantClear
VariantInit
VariantChangeType

shlwapi

PathFileExistsA

winscard

SCardConnectA
SCardListReadersA
SCardReleaseContext
SCardReconnect
g_rgSCardT1Pci
SCardTransmit
SCardEstablishContext
SCardDisconnect

wininet

HttpQueryInfoA
InternetCloseHandle
InternetGetConnectedState
InternetOpenA
InternetOpenUrlA
InternetReadFile

Sections

.text
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 620KB - Virtual size: 619KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 508KB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a8b64556a83cf27f5313af773060ac7d

Headers

File Characteristics

Imports

autonester-t

mpr

richpeaceam

ws2_32

gdiplus

setupapi

hid

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

odbc32

oledlg

ole32

olepro32

oleaut32

shlwapi

winscard

wininet

Sections

.text Size: 5.9MB - Virtual size: 5.9MB

.rdata Size: 620KB - Virtual size: 619KB

.data Size: 508KB - Virtual size: 1.8MB

.rsrc Size: 3.9MB - Virtual size: 3.9MB

.text
Size: 5.9MB - Virtual size: 5.9MB

.rdata
Size: 620KB - Virtual size: 619KB

.data
Size: 508KB - Virtual size: 1.8MB

.rsrc
Size: 3.9MB - Virtual size: 3.9MB