b0b8d1a1c8016b9dc5bf360916660498b243b9b23fb92b7d2d99189f130b205b

Sharing

Copy URL Twitter E-mail

General

Target

b0b8d1a1c8016b9dc5bf360916660498b243b9b23fb92b7d2d99189f130b205b
Size

14.7MB
MD5

3a18537898ffe6b678f63dfe73799195
SHA1

74745c9ab64b6f02f87d6aa03822f54a42d5f29f
SHA256

b0b8d1a1c8016b9dc5bf360916660498b243b9b23fb92b7d2d99189f130b205b
SHA512

00bcfcbf81b5fa86c59ceae308d52b6bacf6425ea03122b971f04d31d03de6a5441b9b185b3d9f566b2c853f1d55ccdc507171e338005ce69d6789c462b70502
SSDEEP

393216:MgtERDrQX1qrl57N/GGWuRMgl6ateVK/XRa9xac7QicA:KDcMrlr/TWwMgl6ieV4XyamIA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b0b8d1a1c8016b9dc5bf360916660498b243b9b23fb92b7d2d99189f130b205b

Files

b0b8d1a1c8016b9dc5bf360916660498b243b9b23fb92b7d2d99189f130b205b
.exe windows:6 windows x86 arch:x86

4db42a69f88f758095401645f544e606

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Program Files (x86)\Jenkins\workspace\LagoFast_New\Installer\Release\Installer.pdb

Imports

advapi32

RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA

ws2_32

htonl
ioctlsocket
listen
accept
sendto
recvfrom
freeaddrinfo
getaddrinfo
WSAStartup
WSAIoctl
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
ntohl
WSACleanup
WSAGetLastError
__WSAFDIsSet
select
gethostbyname
WSASetLastError
recv
send
bind
gethostname

crypt32

CertFreeCertificateContext

wldap32

ord46
ord211
ord60
ord45
ord50
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord143

kernel32

DisconnectNamedPipe
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
Sleep
GetCurrentProcessId
TerminateProcess
OpenProcess
DecodePointer
lstrcpyW
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
DeleteFileW
EnterCriticalSection
LeaveCriticalSection
GetShortPathNameW
FreeResource
GetModuleFileNameW
LoadResource
LockResource
SizeofResource
FindResourceW
GetPrivateProfileStringW
GetUserDefaultUILanguage
CreateFileW
GetDriveTypeW
GetFileAttributesW
GetLogicalDriveStringsW
RemoveDirectoryW
SetFileAttributesW
WriteFile
GetTempPathW
SetHandleInformation
CreatePipe
WaitNamedPipeW
GetCurrentThreadId
CreateProcessW
WritePrivateProfileStringW
LocalFileTimeToFileTime
SetFilePointer
SetFileTime
SystemTimeToFileTime
FreeLibrary
GetProcAddress
LoadLibraryW
MoveFileExW
GetFileSize
SetEndOfFile
GetStdHandle
GetFileInformationByHandle
FindClose
FindFirstFileW
FindNextFileW
SetLastError
GetTickCount
GetModuleHandleW
GetModuleHandleA
VirtualAlloc
VirtualFree
FormatMessageA
GetTickCount64
SleepEx
VerSetConditionMask
GetSystemDirectoryA
LoadLibraryA
VerifyVersionInfoA
WaitForSingleObjectEx
GetFileType
PeekNamedPipe
WaitForMultipleObjects
OutputDebugStringW
OutputDebugStringA
ReadFile
CreateDirectoryW
GetLastError
RaiseException
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
GetCurrentDirectoryW
CloseHandle
lstrcmpiW
IsValidLocale
GetFileSizeEx
FlushFileBuffers
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetEnvironmentVariableW
GetFullPathNameW
GetModuleHandleExW
ResumeThread
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualProtect
LoadLibraryExW
FreeLibraryAndExitThread
DuplicateHandle
GetCurrentProcess
SwitchToThread
GetCurrentThread
GetExitCodeThread
TryEnterCriticalSection
FormatMessageW
GetStringTypeW
FindFirstFileExW
GetFileAttributesExW
SetFilePointerEx
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetCPInfo
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetACP
GlobalUnlock
GlobalLock
lstrlenW
ExitProcess
MulDiv
LocalFree
GetVersionExW
GlobalAlloc
GetLocalTime
lstrcpynW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes

user32

OffsetRect
GetWindowRect
SetWindowPos
SetWindowLongW
GetWindowLongW
KillTimer
SetCursor
InflateRect
UnionRect
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
CreateWindowExW
IsWindow
DestroyWindow
IsIconic
IsZoomed
CharNextW
SetFocus
GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetClientRect
GetCursorPos
GetParent
MapWindowPoints
GetSysColor
IntersectRect
IsRectEmpty
PtInRect
GetWindow
LoadImageW
MonitorFromRect
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
SetWindowRgn
MessageBoxW
EqualRect
UpdateLayeredWindow
MoveWindow
IsWindowEnabled
GetWindowRgn
CharPrevW
DrawTextW
FillRect
SetRect
CreatePopupMenu
DestroyMenu
EnableMenuItem
AppendMenuW
TrackPopupMenu
CreateCaret
GetCaretBlinkTime
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
UpdateWindow
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
wsprintfA
DrawTextA
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
SetForegroundWindow
GetKeyboardLayout
GetKeyNameTextW
MapVirtualKeyExW
SetTimer
IsWindowVisible
PostQuitMessage
ShowWindow
PostMessageW
wsprintfW
MonitorFromWindow
GetMonitorInfoW
CharUpperW
DefWindowProcW
ScreenToClient

gdi32

SetTextColor
SetStretchBltMode
TextOutW
StretchBlt
GetObjectA
SetBkColor
SetBitmapBits
GdiFlush
CreatePatternBrush
SetBkMode
GetTextExtentPointA
MoveToEx
CreateCompatibleBitmap
BitBlt
ExtSelectClipRgn
SelectClipRgn
LineTo
GetTextExtentPoint32W
GetClipBox
GetCharABCWidthsW
CreateSolidBrush
CreateRectRgnIndirect
CreatePenIndirect
CombineRgn
CreateDIBSection
PtInRegion
CreateRectRgn
CreateRoundRectRgn
SetWindowOrgEx
GetObjectW
GetTextMetricsW
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateEnhMetaFileW
CloseEnhMetaFile
SelectObject
SaveDC
RestoreDC
Rectangle
SetLayout
GetLayout
SetViewportOrgEx
GetBitmapBits
RemoveFontMemResourceEx
AddFontMemResourceEx
GetStockObject
GetDeviceCaps
CreateCompatibleDC
CreateDIBitmap
CreateFontIndirectW
CreatePen
DeleteDC
DeleteObject

shell32

DragQueryFileW
SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW
SHGetFolderPathW
SHGetSpecialFolderPathW
CommandLineToArgvW
SHGetSpecialFolderLocation

ole32

CLSIDFromString
CLSIDFromProgID
CreateStreamOnHGlobal
ReleaseStgMedium
OleDuplicateData
DoDragDrop
OleLockRunning
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

VariantInit
VariantClear
SysAllocStringByteLen
SysStringByteLen
SysStringLen
SysFreeString
SysAllocStringLen
SysAllocString

shlwapi

PathRemoveFileSpecW
PathRemoveBackslashW
PathIsRootW
PathFileExistsW

comctl32

_TrackMouseEvent
ord17
InitCommonControlsEx

gdiplus

GdipCreateFontFromDC
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipDrawImageRectI
GdiplusStartup
GdiplusShutdown
GdipAlloc
GdipGetPropertyItem
GdipCreatePath
GdipDeletePath
GdipAddPathLine
GdipAddPathArc
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipCloneImage
GdipDisposeImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipDrawRectangleI
GdipDrawPath
GdipFillRectangleI
GdipFillPath
GdipFree
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize

imm32

ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 279KB - Virtual size: 279KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78.3MB - Virtual size: 78.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4db42a69f88f758095401645f544e606

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

ws2_32

crypt32

wldap32

kernel32

user32

gdi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

imm32

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 279KB - Virtual size: 279KB

.data Size: 17KB - Virtual size: 26KB

.rsrc Size: 78.3MB - Virtual size: 78.3MB

.reloc Size: 63KB - Virtual size: 62KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 279KB - Virtual size: 279KB

.data
Size: 17KB - Virtual size: 26KB

.rsrc
Size: 78.3MB - Virtual size: 78.3MB

.reloc
Size: 63KB - Virtual size: 62KB