d77152711eb5616bfeba61c5053b3f780208312a0bfdfa97a08f70c71b71d8ef

Sharing

Copy URL Twitter E-mail

General

Target

d77152711eb5616bfeba61c5053b3f780208312a0bfdfa97a08f70c71b71d8ef
Size

3.8MB
MD5

e41f0bf0e901a22da8d6ab13eaf9f7be
SHA1

a4fd212e108310421ddc55fa67e291941e4d33ee
SHA256

d77152711eb5616bfeba61c5053b3f780208312a0bfdfa97a08f70c71b71d8ef
SHA512

2390183f6b89d6dcb0ec9d42d4a967ca2c06d36f9f37e5215201239c0483808bd83f35a69f07873f35b5f19a15e0a2dac5301a2a425a9793e48ae63443f9930e
SSDEEP

98304:4Nqq+uILK7PczlUJbmnk7NrmzY/K92J3FoZe:s3+D0dJunrev

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d77152711eb5616bfeba61c5053b3f780208312a0bfdfa97a08f70c71b71d8ef

Files

d77152711eb5616bfeba61c5053b3f780208312a0bfdfa97a08f70c71b71d8ef
.exe windows:5 windows x86 arch:x86

ce9a26e8c9d36e6a521e508d00adf262

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\git\shurufa\src\ImeWB\Temp\Release\Install.pdb

Imports

kernel32

Sleep
WaitForSingleObject
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CreateThread
CloseHandle
IsBadReadPtr
LoadLibraryA
lstrlenW
GetNativeSystemInfo
HeapReAlloc
HeapSize
RaiseException
CreateEventW
InitializeCriticalSectionAndSpinCount
GetSystemDirectoryW
SetLastError
GetProcessHeap
HeapFree
HeapAlloc
VirtualProtect
VirtualFree
VirtualAlloc
GetProcAddress
LocalAlloc
LocalFree
OpenProcess
GetCurrentProcessId
GetLogicalDriveStringsW
GetModuleHandleW
QueryDosDeviceW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
WriteFile
lstrcpyW
LoadLibraryW
DeleteFileW
GetFileSize
ReadFile
GetModuleFileNameW
CreateFileW
GetLastError
DecodePointer
InterlockedIncrement
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
InterlockedDecrement
LoadResource
GetDiskFreeSpaceExW
lstrcmpW
WinExec
FreeResource
GetTempPathW
LockResource
MultiByteToWideChar
FindResourceW
LoadLibraryExW
lstrcmpiW
SizeofResource
WriteConsoleW
SetEndOfFile
FlushFileBuffers
ReadConsoleW
GetConsoleCP
GetTimeZoneInformation
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStringTypeW
SetConsoleMode
ReadConsoleInputA
GetConsoleMode
SetConsoleCtrlHandler
GetDriveTypeW
SetFilePointerEx
FreeLibraryAndExitThread
ExitThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
GetACP
GetTickCount
GetCurrentDirectoryW
GetVersionExW
ExitProcess
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
MulDiv
GetFileType
SetFilePointer
SetFileTime
DuplicateHandle
SystemTimeToFileTime
DosDateTimeToFileTime
CreateDirectoryW
WideCharToMultiByte
GetLocalTime
GetLongPathNameW
GetFileAttributesW
GetTempFileNameW
CopyFileW
GetExitCodeProcess
FindClose
RemoveDirectoryW
SetFileAttributesW
FindFirstFileW
FindNextFileW
MoveFileExW
ReadProcessMemory
CreateProcessW
FileTimeToSystemTime
GetFileAttributesExW
ReleaseMutex
CreateMutexW
GetVolumeInformationW
GetWindowsDirectoryW
AreFileApisANSI
DeviceIoControl
OutputDebugStringA
SetPriorityClass
VerSetConditionMask
SetErrorMode
SystemTimeToTzSpecificLocalTime
GetVersion
VirtualAllocEx
VirtualFreeEx
WriteProcessMemory
lstrcpynW
GetFileAttributesExA
SleepEx
GetModuleHandleA
GetSystemDirectoryA
QueryPerformanceFrequency
VerifyVersionInfoA
ExpandEnvironmentStringsA
WaitForMultipleObjects
GetStdHandle
PeekNamedPipe
FormatMessageA
GetSystemTime
FlushConsoleInputBuffer
GlobalMemoryStatus
RtlUnwind
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetFullPathNameW
FindFirstFileExW
GetPrivateProfileIntW

user32

SetCursor
InflateRect
OffsetRect
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
DestroyWindow
UpdateLayeredWindow
SetFocus
GetFocus
GetKeyState
SetCapture
ReleaseCapture
KillTimer
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
GetClientRect
GetCursorPos
ScreenToClient
MapWindowPoints
IsRectEmpty
PtInRect
GetParent
GetWindow
wsprintfW
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
MonitorFromWindow
GetMonitorInfoW
IsIconic
IsZoomed
SetWindowRgn
IntersectRect
ShowWindow
DrawTextW
FillRect
SetRect
SetWindowPos
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
GetSysColor
GetDoubleClickTime
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
CreateAcceleratorTableW
InvalidateRgn
GetDesktopWindow
GetWindowThreadProcessId
FindWindowExW
GetClassNameW
GetShellWindow
SystemParametersInfoW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
PostQuitMessage
PostMessageW
SendMessageW
GetWindowLongW
SetWindowLongW
InvalidateRect
LoadIconW
LoadStringW
IsWindow
SetForegroundWindow
FindWindowW
CharNextW
MoveWindow
GetForegroundWindow
GetWindowRect
CharPrevW
SetTimer
CreateCaret

advapi32

CryptSetHashParam
CryptSignHashA
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
RegCloseKey
RegCreateKeyExW
RevertToSelf
ImpersonateLoggedOnUser
OpenProcessToken
GetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupAccountSidW
DuplicateTokenEx
RegEnumKeyW
RegOpenKeyW
DeregisterEventSource
RegisterEventSourceA
ReportEventA
CryptAcquireContextA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegEnumValueA
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
CryptEnumProvidersA

shell32

SHAppBarMessage
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFolderPathW
ShellExecuteW
ord155
SHGetFolderLocation
SHGetDesktopFolder
SHGetDataFromIDListW
SHGetFileInfoW
SHGetSpecialFolderPathW

ole32

OleLockRunning
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
CoTaskMemRealloc
CoTaskMemAlloc
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemFree

oleaut32

SysFreeString
VariantClear
VarUI4FromStr
VariantInit
SysAllocString

gdiplus

GdipCreateFromHDC
GdiplusShutdown
GdipDrawImageRectI
GdipAlloc
GdipFree
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCloneBrush
GdipDeleteBrush
GdipCreateLineBrushI
GdipSetTextRenderingHint
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipDrawImageRectRectI
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdiplusStartup
GdipDeleteGraphics

shlwapi

StrCpyW
PathFileExistsW
PathAppendW
PathFindFileNameW

psapi

EnumProcessModules
GetModuleFileNameExW
GetProcessImageFileNameW

crypt32

CertFreeCertificateContext
CertFindCertificateInStore
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertGetNameStringW
CertGetCertificateContextProperty
CryptMsgClose
CertOpenStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext

msimg32

AlphaBlend

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wininet

InternetOpenW
InternetCloseHandle
InternetSetOptionW
InternetReadFile
HttpQueryInfoW
InternetOpenUrlW

comctl32

_TrackMouseEvent
ord17

ws2_32

bind
getservbyname
gethostbyname
htonl
shutdown
getaddrinfo
freeaddrinfo
WSACleanup
gethostname
ioctlsocket
accept
listen
WSAGetLastError
socket
__WSAFDIsSet
select
WSASetLastError
recv
send
closesocket
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSAIoctl
WSAStartup
sendto
recvfrom

wldap32

ord211
ord50
ord41
ord22
ord46
ord217
ord143
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord60

gdi32

BitBlt
CreateCompatibleDC
CreateFontIndirectW
CreatePen
DeleteDC
DeleteObject
GetStockObject
Rectangle
RestoreDC
SaveDC
SelectObject
GetTextMetricsW
CreateDIBSection
GetObjectW
SetWindowOrgEx
CreateRoundRectRgn
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
RoundRect
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
MoveToEx
TextOutW
GetDeviceCaps
GetObjectA
GetDIBits
CreateBitmap
CreateDCW
CreateCompatibleBitmap

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 508KB - Virtual size: 507KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40.6MB - Virtual size: 40.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ce9a26e8c9d36e6a521e508d00adf262

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

gdiplus

shlwapi

psapi

crypt32

msimg32

version

wininet

comctl32

ws2_32

wldap32

gdi32

imm32

iphlpapi

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 508KB - Virtual size: 507KB

.data Size: 50KB - Virtual size: 84KB

.gfids Size: 512B - Virtual size: 436B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 40.6MB - Virtual size: 40.6MB

.reloc Size: 98KB - Virtual size: 98KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 508KB - Virtual size: 507KB

.data
Size: 50KB - Virtual size: 84KB

.gfids
Size: 512B - Virtual size: 436B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 40.6MB - Virtual size: 40.6MB

.reloc
Size: 98KB - Virtual size: 98KB