c994b8a766d2ec348998408fbd184b8ffbe3c8703a0317fb62f75d22e00fe863

Sharing

Copy URL

Twitter E-mail

General

Target

c994b8a766d2ec348998408fbd184b8ffbe3c8703a0317fb62f75d22e00fe863
Size

1.8MB
MD5

1bc73cbe4ce7208b3b832498eda8afe4
SHA1

760ad12d2e04ccd42d6aae92d8a7f75e3f26054a
SHA256

c994b8a766d2ec348998408fbd184b8ffbe3c8703a0317fb62f75d22e00fe863
SHA512

f5bcef697df834d5cbc8947d6704c5661056ec22b41a82719b9a147dd038a6b3066190754b13c1432cbfaa1b7c6b8fcb6c2f440a10d8b6febda5e59139ac4357
SSDEEP

49152:n3fkubRGhRgSxbap1XyLVYLLjZe2N1FDkCrM/jNfTvDBcccccccccccccc+vcccn:3fku2CSdap1XIV0j9N1FDkCrM/jNfTI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c994b8a766d2ec348998408fbd184b8ffbe3c8703a0317fb62f75d22e00fe863

Files

c994b8a766d2ec348998408fbd184b8ffbe3c8703a0317fb62f75d22e00fe863
.exe windows:4 windows x86 arch:x86

6ab86a759cd60e832df081ea777042fb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

AdjustTokenPrivileges
CloseEncryptedFileRaw
InitializeAcl
LookupAccountSidW
LookupPrivilegeValueA
LookupPrivilegeValueW
OpenEncryptedFileRawW
OpenProcessToken
OpenSCManagerA
OpenSCManagerW
OpenServiceA
OpenServiceW
ReadEncryptedFileRaw
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegFlushKey
RegLoadKeyW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegUnLoadKeyW
RegisterServiceCtrlHandlerW
SetSecurityInfo
SetServiceStatus
StartServiceCtrlDispatcherW
StartServiceW
SystemFunction036
WriteEncryptedFileRaw

comctl32

InitCommonControlsEx
SetWindowSubclass

gdi32

BeginPath
BitBlt
CombineRgn
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
CreateDIBSection
CreateFontIndirectW
CreatePen
CreateRectRgn
CreateSolidBrush
DeleteDC
DeleteObject
Ellipse
EndPath
GetDeviceCaps
GetObjectW
GetPixel
GetStockObject
GetTextExtentPoint32A
LineTo
MoveToEx
Rectangle
RoundRect
SelectObject
SetBkColor
SetBkMode
SetPixel
SetTextColor
StrokePath
TextOutW

gdiplus

GdipAddPathArc
GdipAddPathLine
GdipAddPathString
GdipBitmapGetPixel
GdipBitmapSetPixel
GdipClosePathFigure
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromStream
GdipCreateFontFamilyFromName
GdipCreateFromHDC
GdipCreateHBITMAPFromBitmap
GdipCreateHICONFromBitmap
GdipCreateLineBrush
GdipCreatePath
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipDeleteCustomLineCap
GdipDeleteFontFamily
GdipDeleteGraphics
GdipDeletePath
GdipDeletePen
GdipDisposeImage
GdipDrawArc
GdipDrawEllipse
GdipDrawImageRect
GdipDrawPath
GdipDrawRectangle
GdipFillEllipse
GdipFillPath
GdipFillPie
GdipFillRectangle
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipGetImageHeight
GdipGetImageWidth
GdipGetMatrixElements
GdipGetPathGradientPointCount
GdipGetPenFillType
GdipSaveImageToFile
GdipSetImageAttributesRemapTable
GdipSetSmoothingMode
GdipWindingModeOutline
GdiplusShutdown
GdiplusStartup

kernel32

AddVectoredExceptionHandler
CloseHandle
CompareStringW
CopyFileExW
CreateDirectoryW
CreateEventA
CreateEventW
CreateFileA
CreateFileMappingW
CreateFileW
CreatePipe
CreateProcessAsUserW
CreateProcessW
CreateSemaphoreA
CreateToolhelp32Snapshot
CreateWaitableTimerW
DefineDosDeviceW
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
FindClose
FindFirstFileA
FindFirstFileW
FindFirstVolumeW
FindNextFileA
FindNextFileW
FindNextVolumeW
FindResourceW
FindVolumeClose
FlushFileBuffers
FormatMessageA
FormatMessageW
FreeLibrary
FreeResource
GetCommandLineW
GetConsoleCP
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetDriveTypeA
GetDriveTypeW
GetExitCodeProcess
GetFileAttributesW
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetFileType
GetFirmwareEnvironmentVariableW
GetFullPathNameW
GetHandleInformation
GetLargestConsoleWindowSize
GetLastError
GetLocaleInfoA
GetLogicalDriveStringsA
GetLogicalDrives
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetNativeSystemInfo
GetPrivateProfileStringW
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetProcessId
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetSystemDirectoryW
GetSystemFirmwareTable
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetThreadContext
GetThreadPriority
GetTickCount
GetVersionExA
GetVersionExW
GetVolumeInformationW
GetWindowsDirectoryA
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalLock
GlobalMemoryStatusEx
GlobalUnlock
HeapAlloc
HeapFree
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
IsWow64Process
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LoadResource
LocalFree
LockFile
LockResource
MapViewOfFile
MoveFileExW
MoveFileW
MulDiv
MultiByteToWideChar
OpenFileMappingW
OpenProcess
OutputDebugStringA
PeekConsoleInputA
Process32First
Process32FirstW
Process32Next
Process32NextW
QueryDosDeviceA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleInputA
ReadFile
ReleaseSemaphore
RemoveDirectoryW
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
SetComputerNameW
SetConsoleCtrlHandler
SetConsoleMode
SetConsoleWindowInfo
SetEndOfFile
SetEvent
SetFileAttributesW
SetFilePointer
SetFilePointerEx
SetFirmwareEnvironmentVariableW
SetLastError
SetLocalTime
SetPriorityClass
SetProcessAffinityMask
SetProcessPriorityBoost
SetThreadAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
SizeofResource
Sleep
SuspendThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnlockFile
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
Wow64DisableWow64FsRedirection
WriteConsoleInputA
WriteFile
WritePrivateProfileStringW

msvcrt

__doserrno
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__p__acmdln
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_assert
_beginthreadex
_cexit
_close
_controlfp
_endthreadex
_errno
_exit
_fdopen
_filelengthi64
_fileno
_fmode
_fpreset
_fstat64
_get_osfhandle
_getcwd
_gmtime64
_i64toa
_i64tow
_initterm
_iob
_itoa
_itow
_lock
_lseeki64
_mkdir
_onexit
_open_osfhandle
_setjmp3
_snprintf
_snwprintf
_stat
_strdup
_strdup
_stricmp
_strnicmp
_telli64
_read
_ui64toa
_ui64tow
_ultoa
_ultow
_unlock
_vsnprintf
_waccess
_wcsicmp
_wfopen
_wgetenv
_wmkdir
_wopen
_write
_wstat64
_wtempnam
_wstat
_wunlink
abort
atoi
calloc
cos
exit
fclose
feof
ferror
fflush
fgetpos
fgets
fgetwc
fopen
fprintf
fputc
fputs
fputwc
fputws
fwprintf
fread
free
freopen
fsetpos
fwrite
getc
getenv
islower
isspace
isupper
localtime
iswctype
localeconv
log10
longjmp
malloc
mbstowcs
memset
memchr
memcmp
memcpy
memmove
pow
printf
putc
qsort
rand
realloc
remove
setlocale
setvbuf
signal
sin
sprintf
srand
sscanf
strcat
strchr
strcmp
strcpy
strerror
strlen
strncmp
strncpy
strtoul
time
tolower
toupper
towlower
towupper
ungetc
ungetwc
vfprintf
wcschr
wcscmp
wcscpy
wcscspn
wcsftime
wcslen
wcsncmp
wcspbrk
wcsrchr
wcsstr
wcstod
wcstol
wcstombs
wcstoul

ntdll

NtClose
NtCreateFile
NtFsControlFile
NtOpenFile
NtOpenSymbolicLinkObject
NtQueryDirectoryFile
NtQueryEaFile
NtQueryInformationFile
NtQuerySecurityObject
NtQueryVolumeInformationFile
NtReadFile
NtSetEaFile
NtSetInformationFile
NtSetSecurityObject
NtWaitForSingleObject
NtWriteFile
RtlDosPathNameToNtPathName_U
RtlInitUnicodeString
RtlNtStatusToDosError

ole32

CoCreateGuid
CreateStreamOnHGlobal
StringFromGUID2

oleaut32

SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen

psapi

GetModuleFileNameExW

shell32

CommandLineToArgvW
SHFileOperationW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
ShellExecuteExW
Shell_NotifyIconW

shlwapi

PathRemoveBackslashW

user32

AdjustWindowRectEx
AppendMenuW
BeginDeferWindowPos
BeginPaint
CallWindowProcW
CopyAcceleratorTableW
CreateAcceleratorTableW
CreateDesktopW
CreateIconIndirect
CreatePopupMenu
CreateWindowExW
DefWindowProcW
DeferWindowPos
DestroyAcceleratorTable
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageW
DrawIconEx
DrawTextW
EnableWindow
EndDeferWindowPos
EndPaint
EnumThreadWindows
ExitWindowsEx
FillRect
FindWindowW
FlashWindowEx
GetActiveWindow
GetAncestor
GetClassLongW
GetClassNameA
GetClassNameW
GetClientRect
GetCursorPos
GetDC
GetDesktopWindow
GetDlgCtrlID
GetDlgItem
GetIconInfo
GetMenu
GetMessageW
GetParent
GetPropW
GetScrollInfo
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMetrics
GetWindow
GetWindowDC
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowThreadProcessId
InvalidateRect
IsDialogMessageW
IsIconic
IsWindow
IsWindowEnabled
IsWindowVisible
IsZoomed
KillTimer
LoadCursorW
LoadImageA
LoadImageW
MapVirtualKeyA
MapWindowPoints
MessageBoxW
ModifyMenuW
OpenIcon
PeekMessageW
PostMessageW
PostQuitMessage
RegisterClassExW
RegisterWindowMessageA
ReleaseCapture
ReleaseDC
RemovePropW
ScreenToClient
SendMessageA
SendMessageW
SetClassLongW
SetCursor
SetFocus
SetForegroundWindow
SetLayeredWindowAttributes
SetMenuItemBitmaps
SetMenuItemInfoW
SetParent
SetPropW
SetRect
SetScrollInfo
SetTimer
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowRgn
ShowWindow
SystemParametersInfoW
TrackMouseEvent
TrackPopupMenu
TranslateAcceleratorW
TranslateMDISysAccel
TranslateMessage
UnregisterClassW
UpdateWindow
VkKeyScanA
wsprintfW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wsock32

WSACleanup
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
getpeername
getsockname
htonl
htons
inet_addr
listen
recv
recvfrom
select
send
sendto
setsockopt
socket

Exports

Exports

SHA256CREATE@4
SHA256CREATEFILE@4
wimlib_add_empty_image
wimlib_add_image
wimlib_add_image_multisource
wimlib_add_tree
wimlib_compress
wimlib_create_compressor
wimlib_create_decompressor
wimlib_create_new_wim
wimlib_decompress
wimlib_delete_image
wimlib_delete_path
wimlib_extract_image
wimlib_extract_image_from_pipe
wimlib_extract_image_from_pipe_with_progress
wimlib_extract_pathlist
wimlib_extract_paths
wimlib_extract_xml_data
wimlib_free
wimlib_free_compressor
wimlib_free_decompressor
wimlib_get_compression_type_string
wimlib_get_compressor_needed_memory
wimlib_get_error_string
wimlib_get_image_description
wimlib_get_image_name
wimlib_get_image_property
wimlib_get_version
wimlib_get_version_string
wimlib_get_wim_info
wimlib_get_xml_data
wimlib_global_cleanup
wimlib_global_init
wimlib_image_name_in_use
wimlib_iterate_lookup_table
wimlib_open_wim
wimlib_open_wim_with_progress
wimlib_overwrite
wimlib_print_available_images
wimlib_print_header
wimlib_register_progress_function
wimlib_rename_path
wimlib_resolve_image
wimlib_set_default_compression_level
wimlib_set_error_file
wimlib_set_error_file_by_name
wimlib_set_image_descripton
wimlib_set_image_flags
wimlib_set_image_name
wimlib_set_image_property
wimlib_set_memory_allocator
wimlib_set_output_chunk_size
wimlib_set_output_compression_type
wimlib_set_output_pack_chunk_size
wimlib_set_output_pack_compression_type
wimlib_set_print_errors
wimlib_set_wim_info
wimlib_update_image
wimlib_write
wimlib_write_to_fd

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3.6MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 420KB - Virtual size: 420KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6ab86a759cd60e832df081ea777042fb

Headers

File Characteristics

Imports

advapi32

comctl32

gdi32

gdiplus

kernel32

msvcrt

ntdll

ole32

oleaut32

psapi

shell32

shlwapi

user32

version

wsock32

Exports

Exports

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.data Size: 10KB - Virtual size: 9KB

.rdata Size: 144KB - Virtual size: 144KB

.bss Size: - Virtual size: 3.6MB

.edata Size: 2KB - Virtual size: 2KB

.idata Size: 17KB - Virtual size: 17KB

.CRT Size: 512B - Virtual size: 56B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 420KB - Virtual size: 420KB

.reloc Size: 27KB - Virtual size: 27KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 10KB - Virtual size: 9KB

.rdata
Size: 144KB - Virtual size: 144KB

.bss
Size: - Virtual size: 3.6MB

.edata
Size: 2KB - Virtual size: 2KB

.idata
Size: 17KB - Virtual size: 17KB

.CRT
Size: 512B - Virtual size: 56B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 420KB - Virtual size: 420KB

.reloc
Size: 27KB - Virtual size: 27KB