3e0aa5e2641499e58bcf829751835f4b4951ba355ab7ffd977491a3bd01e216b

Sharing

Copy URL

Twitter E-mail

General

Target

3e0aa5e2641499e58bcf829751835f4b4951ba355ab7ffd977491a3bd01e216b
Size

4.8MB
MD5

d0ac0b08ed8960fc9a53c3531f64501d
SHA1

11d6c524295e0c6862dcbba141cc8f5aa6c92941
SHA256

3e0aa5e2641499e58bcf829751835f4b4951ba355ab7ffd977491a3bd01e216b
SHA512

316ef8c8dc3589b064dcbd804992c6fe5afc2865150d4cda4a201ab43dc2c78d38d29c6cfaea7ffaabb9c7cb430a6fd74ba4624af314d5c4bd91ca2b264fbfdb
SSDEEP

98304:2R1YCIohHnCB0JgOhPWjLLLBYdATI6CKLHXrocDIjUuJcT4f:ehFZhM3LSi7CIH7ocGff

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e0aa5e2641499e58bcf829751835f4b4951ba355ab7ffd977491a3bd01e216b

Files

3e0aa5e2641499e58bcf829751835f4b4951ba355ab7ffd977491a3bd01e216b
.exe windows:5 windows x86 arch:x86

1b1c18ef55126d67f665d425ffd64f6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\March\branches\stable1.0\Output\Release\March.pdb

Imports

shlwapi

PathAddBackslashW
PathAppendW
PathIsDirectoryW
PathRemoveFileSpecW
PathIsRelativeW
PathStripPathW
PathRemoveExtensionW
PathFileExistsW

comctl32

ord17
_TrackMouseEvent

gdiplus

GdipDeletePath
GdipFillRectangle
GdipDrawLineI
GdipDrawBezierI
GdipDrawRectangleI
GdipDrawPath
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipScaleMatrix
GdipMeasureString
GdipFillPath
GdipFillEllipseI
GdipDrawEllipseI
GdipDrawString
GdipDeleteFont
GdipTransformPath
GdipIsOutlineVisiblePathPointI
GdipCloneStringFormat
GdipStringFormatGetGenericTypographic
GdipIsVisiblePathPointI
GdipGetPathWorldBoundsI
GdipAddPathPolygonI
GdipAddPathPieI
GdipAddPathArcI
GdipAddPathEllipseI
GdipAddPathRectangleI
GdipAddPathCurveI
GdipAddPathBezierI
GdipAddPathLine2I
GdipAddPathLineI
GdipClosePathFigure
GdipDeleteStringFormat
GdipGetPathFillMode
GdipSetPathFillMode
GdipResetPath
GdipClonePath
GdipCreatePath
GdipCreateTexture
GdipCreateBitmapFromHBITMAP
GdipCreateSolidFill
GdipGetPenDashStyle
GdipSetPenDashStyle
GdipGetPenLineJoin
GdipSetPenLineJoin
GdipGetPenDashCap197819
GdipGetPenEndCap
GdipGetPenStartCap
GdipSetPenDashCap197819
GdipSetPenEndCap
GdipSetPenStartCap
GdipSetPenColor
GdipGetPenWidth
GdipSetPenWidth
GdipClonePen
GdipLoadImageFromFile
GdipImageRotateFlip
GdipDrawImageRect
GdipSetWorldTransform
GdipRotateMatrix
GdipTranslateMatrix
GdipCreatePen2
GdipSetLineBlend
GdipCloneBrush
GdipDeleteBrush
GdipCreateLineBrushFromRect
GdipDrawArc
GdipDeletePen
GdipCreatePen1
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdiplusStartup
GdipSetStringFormatTrimming
GdipDeleteMatrix
GdipCreateMatrix
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCreateHBITMAPFromBitmap
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipAlloc
GdipFree
GdipCreateBitmapFromFile
GdipSetStringFormatLineAlign
GdiplusShutdown
GdipStartPathFigure

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

winmm

timeSetEvent
timeGetTime
timeKillEvent

msimg32

AlphaBlend

crypt32

CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCreateCertificateChainEngine
CertGetNameStringW
CryptMsgGetParam
CertCloseStore
CryptQueryObject
CertFreeCertificateContext
CryptMsgClose
CertGetNameStringA
CertCreateCertificateContext
CertFreeCertificateChainEngine
CertGetCertificateContextProperty
CertFreeCertificateChain
CertDuplicateCertificateContext
CertGetCertificateChain
CertOpenStore

wldap32

ord26
ord22
ord41
ord50
ord32
ord60
ord211
ord46
ord217
ord143
ord27
ord33
ord35
ord45
ord79
ord30
ord200
ord301

ws2_32

WSAStartup
WSACleanup
WSAGetLastError
setsockopt
ioctlsocket
freeaddrinfo
htons
htonl
getsockopt
WSARecv
WSAAddressToStringW
connect
ntohs
getsockname
getpeername
getaddrinfo
WSASocketW
WSASetLastError
listen
shutdown
gethostname
sendto
recvfrom
recv
socket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSASend
WSACreateEvent
WSACloseEvent
send
__WSAFDIsSet
accept
bind
WSAIoctl
closesocket
ntohl
select

kernel32

GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
CreateTimerQueueTimer
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
GetExitCodeThread
GetCurrentThread
SwitchToThread
WaitForSingleObjectEx
DuplicateHandle
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
OutputDebugStringW
FreeLibraryAndExitThread
LoadLibraryExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
SetConsoleCtrlHandler
ExitThread
InitializeSListHead
SystemTimeToTzSpecificLocalTime
SetFilePointerEx
ExitProcess
GetACP
GetConsoleCP
HeapFree
HeapAlloc
CreateTimerQueue
SignalObjectAndWait
CreateThread
GetThreadPriority
GetThreadTimes
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
FlushFileBuffers
GetFileAttributesExW
SetStdHandle
GetLogicalProcessorInformation
SetEndOfFile
GetFullPathNameW
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
WriteConsoleW
HeapSize
SetUnhandledExceptionFilter
VerSetConditionMask
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
GlobalMemoryStatus
ConvertFiberToThread
DeleteFiber
GetModuleHandleExW
FindClose
GetSystemTimeAsFileTime
FileTimeToSystemTime
VirtualQuery
GetVersionExW
TryEnterCriticalSection
GetCurrentThreadId
SetThreadPriority
ResetEvent
GetEnvironmentVariableW
SystemTimeToFileTime
LoadLibraryW
GetFileAttributesW
MulDiv
GlobalSize
GlobalUnlock
GlobalLock
GlobalAlloc
DeleteFileW
WriteFile
CreateFileW
MultiByteToWideChar
CloseHandle
WideCharToMultiByte
GetTickCount
InterlockedExchange
EnterCriticalSection
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
CreateMutexW
PostQueuedCompletionStatus
GetLastError
TlsAlloc
InterlockedExchangeAdd
RaiseException
DecodePointer
LocalFree
DeleteCriticalSection
InterlockedIncrement
TlsFree
FormatMessageA
CreateDirectoryW
ReadFile
SetFilePointer
GetFileSize
SizeofResource
GetModuleFileNameW
WaitForSingleObject
FreeResource
CreateEventW
SetEvent
GetDiskFreeSpaceExW
LoadResource
FindResourceW
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
SetFileTime
LocalFileTimeToFileTime
CreateFileA
DosDateTimeToFileTime
GetFileTime
GetCurrentProcess
ExpandEnvironmentStringsW
GetTempPathW
GetWindowsDirectoryW
GetDriveTypeW
SetWaitableTimer
TlsSetValue
SetLastError
CreateWaitableTimerW
InterlockedCompareExchange
WaitForMultipleObjects
GetQueuedCompletionStatus
GetModuleHandleA
Sleep
TerminateThread
QueueUserAPC
SleepEx
TlsGetValue
CreateIoCompletionPort
QueryPerformanceCounter
InitializeCriticalSection
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
LoadLibraryA
FormatMessageW
MoveFileExA
GetEnvironmentVariableA
GetStdHandle
GetFileType
PeekNamedPipe
VerifyVersionInfoW
GetFileSizeEx
GlobalFree
GetCurrentDirectoryW

user32

WaitMessage
GetUserObjectInformationW
MessageBoxW
DispatchMessageW
PeekMessageW
MsgWaitForMultipleObjectsEx
CallMsgFilterW
GetQueueStatus
TranslateMessage
GetDesktopWindow
FindWindowW
GetParent
MapWindowPoints
SetClipboardData
EmptyClipboard
CloseClipboard
GetClipboardData
GetProcessWindowStation
PostMessageW
UnregisterClassW
EnableWindow
KillTimer
SetTimer
PostQuitMessage
SetWindowTextW
GetCursorPos
PtInRect
GetClientRect
ScreenToClient
DefWindowProcW
DestroyWindow
ReleaseDC
LoadCursorW
RegisterClassW
GetClassInfoExW
RegisterClassExW
SetWindowLongW
IsWindow
CreateWindowExW
GetWindowLongW
GetWindow
SetFocus
ShowWindow
GetWindowRect
GetMonitorInfoW
MonitorFromWindow
IsIconic
SetWindowPos
LoadImageW
GetSystemMetrics
SendMessageW
CallWindowProcW
SetPropW
GetPropW
GetDC
InvalidateRect
GetKeyState
GetFocus
SetCapture
ReleaseCapture
BeginPaint
EndPaint
MoveWindow
GetUpdateRect
IsRectEmpty
IntersectRect
UpdateLayeredWindow
OffsetRect
UnionRect
SetCursor
CharNextW
IsZoomed
MonitorFromPoint
SetWindowRgn
IsWindowVisible
SetForegroundWindow
ClientToScreen
GetSysColor
GetAsyncKeyState
OpenClipboard
IsClipboardFormatAvailable

gdi32

ExtSelectClipRgn
CreateRectRgnIndirect
GetObjectA
SetStretchBltMode
SetWindowOrgEx
GetWindowOrgEx
RestoreDC
SaveDC
DeleteDC
CreateCompatibleDC
StretchBlt
CreateDIBSection
GetDeviceCaps
CreateRoundRectRgn
BitBlt
SelectObject
DeleteObject
CreateFontIndirectW
GetObjectW
GetStockObject

advapi32

CryptHashData
CryptGetHashParam
CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDecrypt
CryptExportKey
CryptReleaseContext
CryptGetUserKey
CryptAcquireContextA
CryptGetProvParam
CryptSetHashParam
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptCreateHash

shell32

SHGetSpecialFolderPathW
ShellExecuteW
ShellExecuteA
ShellExecuteExW
SHCreateDirectoryExW

ole32

CreateStreamOnHGlobal
CoCreateInstance
CoUninitialize
CoInitialize

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 540KB - Virtual size: 539KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6.5MB - Virtual size: 6.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1b1c18ef55126d67f665d425ffd64f6d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

comctl32

gdiplus

imm32

winmm

msimg32

crypt32

wldap32

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

.rdata Size: 540KB - Virtual size: 539KB

.data Size: 60KB - Virtual size: 74KB

.rsrc Size: 6.5MB - Virtual size: 6.5MB

.reloc Size: 109KB - Virtual size: 108KB

.text
Size: 2.3MB - Virtual size: 2.3MB

.rdata
Size: 540KB - Virtual size: 539KB

.data
Size: 60KB - Virtual size: 74KB

.rsrc
Size: 6.5MB - Virtual size: 6.5MB

.reloc
Size: 109KB - Virtual size: 108KB