1bde10255cad6216a1a16dc4bb61f57ae5936602c7df1d9d66034155f54bd5b5N

Sharing

Copy URL Twitter E-mail

General

Target

1bde10255cad6216a1a16dc4bb61f57ae5936602c7df1d9d66034155f54bd5b5N
Size

3.0MB
MD5

02f1860157fcba64485a12ec2f9983a0
SHA1

ae146c0d74710fbe9706c07219e20d5de2a71b1c
SHA256

1bde10255cad6216a1a16dc4bb61f57ae5936602c7df1d9d66034155f54bd5b5
SHA512

bf5d94e0362004f0f1cc1e2aa6b6fae67d2c2317028b98733167f87ee8d433fc10e8c25696adf7b164b6ee8c9635c4f66847718506284ceddd36c4c63dc15a26
SSDEEP

49152:hD9huwDetY3zT+1qMjTo1dG6N4saZuZN1GJ5Mu5CoWpNjonxnMD4/LEtTxGKh9+5:p9IwDetYu1LjMw6N4saZQXe35Wp9onxr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1bde10255cad6216a1a16dc4bb61f57ae5936602c7df1d9d66034155f54bd5b5N

Files

1bde10255cad6216a1a16dc4bb61f57ae5936602c7df1d9d66034155f54bd5b5N
.exe windows:4 windows x86 arch:x86

4e9f873120be694059330f02e88cd37b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\svn\APPS\temp\GMUnpacker\ReleaseGMUnpacker.pdb

Imports

kernel32

FindClose
FindFirstFileW
FindNextFileW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
FreeResource
FindResourceW
LoadResource
LockResource
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
SizeofResource
InterlockedDecrement
MulDiv
InterlockedIncrement
ResumeThread
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetStringTypeW
GetStringTypeA
FlushFileBuffers
GetCurrentThreadId
SetStdHandle
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
LoadLibraryA
VirtualAlloc
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
VirtualFree
HeapCreate
HeapDestroy
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
ExitProcess
HeapSize
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
GetModuleFileNameA
GetStdHandle
RtlUnwind
RaiseException
HeapReAlloc
CreateThread
ExitThread
GetStartupInfoA
GetProcessHeap
HeapAlloc
GetVersionExA
HeapFree
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
WaitForSingleObject
GetTickCount
DeleteFileW
GetFullPathNameW
GetWindowsDirectoryW
GetTempPathW
lstrlenW
CreateDirectoryW
RemoveDirectoryW
SetCurrentDirectoryW
GetLongPathNameW
SetFileAttributesW
GetTempFileNameW
GetFileAttributesW
GetCurrentDirectoryW
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
GetFileSize
ReadFile
WriteFile
SetEndOfFile
GetLastError
SetFileTime
SetFilePointer
GetEnvironmentVariableW
lstrcmpW
GetModuleHandleW
GetModuleFileNameW
WinExec
CreateEventW
ResetEvent
SetEvent
Sleep
CreateProcessW
FreeLibrary
LoadLibraryW
CloseHandle
CreateFileA
GetProcAddress

user32

HideCaret
CreateCaret
SetCaretPos
RedrawWindow
ClientToScreen
ShowCaret
OffsetRect
InvalidateRgn
MoveWindow
DestroyAcceleratorTable
SetWindowLongW
GetWindowLongW
CreateAcceleratorTableW
GetDesktopWindow
KillTimer
LoadIconW
MonitorFromWindow
PostQuitMessage
CharPrevW
DrawIconEx
FillRect
DrawTextW
TrackMouseEvent
GetAsyncKeyState
LoadBitmapW
GetMonitorInfoW
SetTimer
SendMessageW
GetClassNameW
ShowWindow
EnumThreadWindows
PostMessageW
LoadStringW
GetParent
SetWindowPos
DestroyWindow
InvalidateRect
GetFocus
ReleaseCapture
GetCursorPos
UpdateLayeredWindow
GetUpdateRect
SetWindowRgn
GetDC
IsChild
SetCapture
ScreenToClient
ReleaseDC
EndPaint
GetKeyState
BeginPaint
IntersectRect
PtInRect
IsRectEmpty
CharNextW
SetCursor
GetClassInfoExW
RegisterClassW
EnableWindow
SetPropW
DispatchMessageW
TranslateMessage
DestroyIcon
IsWindow
GetMessageW
LoadCursorW
CreateWindowExW
RegisterClassExW
GetPropW
SetFocus
IsIconic
LoadImageW
CallWindowProcW
DefWindowProcW
CharNextA
SetForegroundWindow
GetWindow
MapWindowPoints
GetWindowTextLengthW
SetWindowTextW
GetWindowTextW
IsZoomed
SystemParametersInfoW
GetWindowRect
GetClientRect
GetActiveWindow
GetSysColor

gdi32

CreateRectRgnIndirect
CreateRoundRectRgn
GetStockObject
CreateRectRgn
CreateCompatibleDC
GetObjectW
CreateFontIndirectW
CreateDIBSection
DeleteDC
CreatePen
SelectObject
BitBlt
StretchBlt
Rectangle
DeleteObject
GetTextMetricsW
CombineRgn
TextOutW
SetBitmapBits
SelectClipRgn
SetTextColor
GetBitmapBits
SetStretchBltMode
ExtSelectClipRgn
GetClipBox
RoundRect
GetCharABCWidthsW
SetBkMode
SetBkColor
GetTextExtentPoint32W
ExtTextOutW
CreateSolidBrush
GetDeviceCaps
CreateCompatibleBitmap

advapi32

RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey

shell32

SHGetPathFromIDListW
SHGetSpecialFolderPathW
ShellExecuteExW
SHGetFileInfoW
ShellExecuteW
SHBrowseForFolderW

ole32

OleLockRunning
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
OleInitialize
OleUninitialize

oleaut32

OleLoadPicture
SysAllocString
SysFreeString

wininet

HttpQueryInfoW
InternetReadFile
InternetOpenUrlW
InternetSetOptionW
InternetOpenW
InternetCloseHandle

riched20

ord4

comctl32

_TrackMouseEvent

msimg32

AlphaBlend

Sections

.text
Size: 520KB - Virtual size: 519KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 84KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4e9f873120be694059330f02e88cd37b

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wininet

riched20

comctl32

msimg32

Sections

.text Size: 520KB - Virtual size: 519KB

.rdata Size: 96KB - Virtual size: 95KB

.data Size: 12KB - Virtual size: 19KB

.rsrc Size: 84KB - Virtual size: 81KB

.text
Size: 520KB - Virtual size: 519KB

.rdata
Size: 96KB - Virtual size: 95KB

.data
Size: 12KB - Virtual size: 19KB

.rsrc
Size: 84KB - Virtual size: 81KB