d7c910921b8da331222dbdcb55bc9769c40a04326563a07decbc64e764710471N

Sharing

Copy URL Twitter E-mail

General

Target

d7c910921b8da331222dbdcb55bc9769c40a04326563a07decbc64e764710471N
Size

414KB
MD5

c39f1f7b4dec442ac85b4a11c2087db0
SHA1

7b0022d300495b691eb76d0899d6286b5717c5c6
SHA256

d7c910921b8da331222dbdcb55bc9769c40a04326563a07decbc64e764710471
SHA512

8d69c36d80c48d441f66e911d1b8aed30f4ee64744c2d537cbbef7379c3cd641e66d7359018b839df7966176450f7a50fbd1d44314ad314123803589b804d16e
SSDEEP

6144:4978k8lRRaExvv0iwZgLkxBr43T+cbJ5JIJAbW0we3/Fzt15DNs:4lAHd0rZg4f4CIJ5MZ0wsFzt15DN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d7c910921b8da331222dbdcb55bc9769c40a04326563a07decbc64e764710471N

Files

d7c910921b8da331222dbdcb55bc9769c40a04326563a07decbc64e764710471N
.exe windows:6 windows x86 arch:x86

aa5795f627534a10c671ed5e2d715a46

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

SnippingTool.pdb

Imports

advapi32

TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceEvent
RegisterTraceGuidsW
UnregisterTraceGuids
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW

kernel32

GetTickCount
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
OutputDebugStringA
SetLastError
lstrlenA
MultiByteToWideChar
CreateMutexW
ReleaseMutex
GetVersionExW
Sleep
GetSystemDefaultUILanguage
CreateFileW
WriteFile
CloseHandle
EnterCriticalSection
LeaveCriticalSection
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
lstrlenW
HeapSetInformation
RegisterApplicationRestart
DeleteFileW
GetProcAddress
WideCharToMultiByte
FreeLibrary
ExpandEnvironmentStringsW
LoadLibraryW
GetTempPathW
GlobalDeleteAtom
GlobalAddAtomW
RaiseException
GetLastError
QueryPerformanceCounter

gdi32

CreateSolidBrush
CreatePen
CreateCompatibleBitmap
Rectangle
SelectObject
GetStockObject
CombineRgn
CreateRectRgn
CreateRectRgnIndirect
GetDeviceCaps
DeleteObject
SetBkMode
SetTextColor
SelectClipRgn
GetClipRgn
GetLayout
FillRgn
OffsetRgn
CreatePolygonRgn
GetObjectW
DeleteDC
CreateCompatibleDC
PatBlt
BitBlt
SetLayout
CreateDIBSection

user32

MapWindowPoints
UnregisterClassA
SetFocus
LoadMenuW
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
GetWindowRect
RegisterHotKey
CreateWindowExW
LoadStringW
GetForegroundWindow
SetWindowTextW
AdjustWindowRect
GetWindowTextW
GetWindowRgnBox
OffsetRect
SetClassLongW
LoadCursorW
UnionRect
IntersectRect
SetRect
LogicalToPhysicalPoint
GetWindowLongW
GetSystemMetrics
SetPropW
EnumDisplayMonitors
SetScrollInfo
PtInRect
IsIconic
IsWindowVisible
InvalidateRect
SetCapture
ReleaseCapture
DefWindowProcW
EndPaint
BeginPaint
GetWindow
ShowWindow
RegisterClassW
CloseClipboard
OpenClipboard
EmptyClipboard
SetClipboardData
GetClassNameW
GetParent
PostQuitMessage
UnregisterHotKey
IsZoomed
CallWindowProcW
SetCursor
GetIconInfo
DrawIconEx
CheckMenuRadioItem
LoadIconW
LoadImageW
AdjustWindowRectEx
SystemParametersInfoW
SetWindowLongW
DestroyMenu
TranslateAcceleratorW
DestroyWindow
DialogBoxParamW
GetClientRect
EndDialog
CheckDlgButton
FillRect
GetSubMenu
GetMonitorInfoW
MonitorFromWindow
CopyRect
TrackPopupMenuEx
GetProcessDefaultLayout
GetPropW
GetScrollInfo
GetWindowDC
GetDesktopWindow
SetWindowPos
ReleaseDC
PostMessageW
InflateRect
DrawTextW
DrawFocusRect
IsDlgButtonChecked
GetDlgItem
SendMessageW
LoadAcceleratorsW
GetMessageW
TranslateMessage
DispatchMessageW
GetDC
FindWindowW
OpenIcon
SetForegroundWindow
MessageBoxW
GetSysColor

msvcrt

memcpy
??3@YAXPAX@Z
??_V@YAXPAX@Z
__CxxFrameHandler3
free
_vsnwprintf
memset
??_U@YAPAXI@Z
_CxxThrowException
??2@YAPAXI@Z
_ftol2_sse
memcpy_s
malloc
_controlfp
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
??1type_info@@UAE@XZ
_errno
realloc
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
strstr
vswprintf_s
_vscwprintf
_resetstkoflw
memmove_s
wcscspn
wcsspn
_wcsicmp

ntdll

WinSqmIncrementDWORD
WinSqmIsOptedIn
EtwTraceMessage

gdiplus

GdipSaveImageToStream
GdipCreateFontFromLogfontW
GdipCreateFontFromDC
GdipMeasureString
GdipDrawString
GdipFillRectangle
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipCreateLineBrushFromRect
GdipDeleteFont
GdipDeleteStringFormat
GdipCreateStringFormat
GdipCloneImage
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipSaveImageToFile
GdipDisposeImage
GdipFillEllipseI
GdipSetSmoothingMode
GdiplusShutdown
GdiplusStartup
GdipCloneBrush
GdipFillRectangleI
GdipCreateFromHDC
GdipCreateSolidFill
GdipDeleteGraphics
GdipDeleteBrush
GdipAlloc
GdipFree
GdipGetImageEncoders

comctl32

InitCommonControlsEx
ImageList_Add
ImageList_Create
ImageList_Destroy
ord380
ord345

shlwapi

PathFindExtensionW
UrlCreateFromPathW
StrStrA
PathIsURLW
ord487
StrChrW
PathFindFileNameW
SHRegGetUSValueW
ord158
PathRemoveExtensionW

shell32

SHCreateItemInKnownFolder
ord75
ShellAboutW

ole32

CoCreateGuid
CoTaskMemFree
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
CoCreateInstance
StringFromCLSID

oleaut32

SysAllocStringLen
VarBstrCat
SysStringLen
SafeArrayGetUBound
SafeArrayGetElement
SysAllocString
VariantClear
VariantInit
SysFreeString
SafeArrayPutElement

uxtheme

GetThemeSysColor
GetThemeSysFont

oleacc

AccessibleObjectFromWindow

slc

SLGetWindowsInformationDWORD

msdrm

DRMIsWindowProtected

Sections

.text
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 246KB - Virtual size: 246KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

aa5795f627534a10c671ed5e2d715a46

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

gdiplus

comctl32

shlwapi

shell32

ole32

oleaut32

uxtheme

oleacc

slc

msdrm

Sections

.text Size: 130KB - Virtual size: 129KB

.data Size: 3KB - Virtual size: 9KB

.rsrc Size: 246KB - Virtual size: 246KB

.reloc Size: 33KB - Virtual size: 34KB

.text
Size: 130KB - Virtual size: 129KB

.data
Size: 3KB - Virtual size: 9KB

.rsrc
Size: 246KB - Virtual size: 246KB

.reloc
Size: 33KB - Virtual size: 34KB