d7f9a412c6c9aa0be47a13af550bb57dd5113917f209fb9bbb02cf8432037575

Sharing

Copy URL Twitter E-mail

General

Target

d7f9a412c6c9aa0be47a13af550bb57dd5113917f209fb9bbb02cf8432037575
Size

6.9MB
MD5

8d45d7dbc2cc7bfcef0c3fe705b3d187
SHA1

287532e76e67afa57384f590e36c73b52d7a3ae8
SHA256

d7f9a412c6c9aa0be47a13af550bb57dd5113917f209fb9bbb02cf8432037575
SHA512

28369235af63106d0faa98a1772498b84a3d5ba5511dcda878eec47dfefacfeae53a707d84f16509ccd919b40aeee1300a19e864dc787599fdc89ae840de08a0
SSDEEP

98304:/JYyw766Vq2aUBtSuz3PCoKGx8UAOEIHd0Sk5zF6VPUdRTyoeJ0Ft29xh:xYFHaUBtSuzKOEI+SkWUzyoEW2nh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d7f9a412c6c9aa0be47a13af550bb57dd5113917f209fb9bbb02cf8432037575

Files

d7f9a412c6c9aa0be47a13af550bb57dd5113917f209fb9bbb02cf8432037575
.exe windows:6 windows x86 arch:x86

3cd2c6372db53488c8e2dedd8eb1eb4b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetEvent
WaitForMultipleObjects
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
GetCurrentProcessId
CreateProcessW
SetWaitableTimer
CreateWaitableTimerW
RaiseException
GetCurrentThreadId
GetModuleHandleW
IsDebuggerPresent
CreateEventW
CreateSemaphoreW
FindClose
FindFirstFileW
GetModuleFileNameW
GetTempPathW
GetTimeZoneInformation
MultiByteToWideChar
WideCharToMultiByte
GetFileSizeEx
SetFilePointerEx
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetStdHandle
EnumSystemLocalesW
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
DuplicateHandle
GetConsoleOutputCP
TzSpecificLocalTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
ReadConsoleW
GetCommandLineA
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryExA
CreateFileW
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
GetCPInfo
GetStringTypeW
LCMapStringEx
EncodePointer
SleepConditionVariableSRW
WakeAllConditionVariable
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SetFileTime
SetFileAttributesW
CreateDirectoryExW
CreateFileMappingA
DeviceIoControl
SetFileValidData
AreFileApisANSI
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
GetFullPathNameA
SetEndOfFile
UnlockFileEx
CreateMutexW
UnmapViewOfFile
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
DeleteFileA
HeapCompact
UnlockFile
LockFileEx
GetFileSize
LoadLibraryExW
lstrcmpiW
VerifyVersionInfoW
VerSetConditionMask
GetSystemTimeAsFileTime
GetLocalTime
FileTimeToSystemTime
ResetEvent
CreateThread
GetExitCodeProcess
GenerateConsoleCtrlEvent
VirtualQuery
GetCurrentDirectoryW
GetSystemInfo
GlobalFlags
GetFileAttributesExW
GetFileAttributesW
PeekNamedPipe
CreatePipe
RemoveDirectoryW
GetCurrentProcess
FindNextFileW
GetCommandLineW
SetLastError
CreateDirectoryW
SetFilePointer
LockFile
ReadFile
FreeLibrary
GetProcAddress
LoadLibraryW
GetUserDefaultLCID
GetTickCount
ExitProcess
FindResourceW
LoadResource
LockResource
FreeResource
SizeofResource
GlobalReAlloc
MulDiv
GlobalUnlock
WriteFile
ReleaseSemaphore
WaitForSingleObject
CloseHandle
Sleep
DeleteFileW
LeaveCriticalSection
TryEnterCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
SystemTimeToFileTime
GetSystemTime
CreateFileMappingW
MapViewOfFile
FlushFileBuffers
LocalFree
MoveFileExW
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
WriteConsoleW
GetConsoleMode
GetVersionExA
SetConsoleCtrlHandler
FormatMessageA
CreateFileA
VerifyVersionInfoA
FormatMessageW
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
HeapFree
MoveFileExA
LoadLibraryA
GetModuleHandleA
GetSystemDirectoryA
QueryPerformanceFrequency
SleepEx
InitializeCriticalSectionEx
QueryPerformanceCounter
GlobalFree
GlobalLock
GlobalAlloc
HeapAlloc
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionAndSpinCount
VirtualFree

user32

TranslateMessage
GetMessageW
PeekMessageW
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
ShowWindow
EnableWindow
GetWindowRect
GetParent
ScreenToClient
GetFocus
SetFocus
GetKeyState
SetCursor
GetWindow
AdjustWindowRectEx
MsgWaitForMultipleObjects
ReleaseDC
GetClientRect
GetWindowDC
GetSystemMetrics
GetDC
LoadImageW
GetDesktopWindow
LoadCursorW
LoadIconW
SetPropW
RegisterClassW
SetTimer
GetClassInfoW
GetActiveWindow
LoadStringW
RemovePropW
GetSysColor
DrawFocusRect
FrameRect
DrawStateW
CreateWindowExW
GetPropW
PostMessageW
DefWindowProcW
EnumDisplaySettingsW
EnumWindows
MoveWindow
GetMonitorInfoW
WaitForInputIdle
SetActiveWindow
MonitorFromWindow
GetWindowThreadProcessId
ClientToScreen
CopyRect
IsWindow
DestroyWindow
InvalidateRect
SetWindowLongW
SetWindowPos
SendMessageW
GetWindowLongW
MessageBoxW
IsDialogMessageW
UnregisterClassW
DispatchMessageW
OffsetRect
WindowFromPoint
FillRect
InflateRect
CallWindowProcW
CharNextW
GetClassInfoExW
PostQuitMessage
RegisterClassExW
TranslateAcceleratorW
DestroyMenu
DestroyAcceleratorTable
DeleteMenu
RedrawWindow
FindWindowExW
EndPaint
BeginPaint
IsIconic
wsprintfW
GetNextDlgTabItem
GetDlgItem
DestroyIcon
GetTopWindow
IsZoomed
SetRect
KillTimer
GetCapture
SetCapture
UpdateWindow
ReleaseCapture
MessageBeep
SetParent
PtInRect
GetLastActivePopup
GetSystemMenu
IsWindowVisible
SetWindowRgn
DrawIcon
GetClassNameW
GetDlgCtrlID
IsChild
IsWindowEnabled
SetMenu
WinHelpW
IsRectEmpty
IntersectRect
DrawTextW

gdi32

MoveToEx
CreateFontIndirectW
SetPixel
ExtCreateRegion
CreateRectRgn
CombineRgn
PatBlt
GetTextMetricsW
ExcludeClipRect
GetClipBox
CreateRoundRectRgn
CreateEllipticRgn
GetPixel
SetTextColor
SetBkMode
LineTo
CreatePen
DeleteObject
SetBkColor
CreateSolidBrush
CreateBitmap
RoundRect
ExtTextOutW
BitBlt
CreateCompatibleBitmap
SelectObject
CreateDIBSection
SetDIBColorTable
CreateCompatibleDC
GdiAlphaBlend
StretchBlt
GetStockObject
GetDeviceCaps
DeleteDC
GetObjectW
SetStretchBltMode

advapi32

CryptCreateHash
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
LookupPrivilegeValueA
CryptGenRandom
RegQueryInfoKeyW
RegDeleteKeyW
RegEnumKeyExW
RegDeleteValueW
AdjustTokenPrivileges
RegCloseKey
RegQueryValueW
RegCreateKeyExW
RegSetValueExW
OpenProcessToken
RegOpenKeyExW
GetTokenInformation
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptEncrypt

shell32

ShellExecuteW
DragFinish
DragQueryFileW
SHGetMalloc
SHGetPathFromIDListW
SHBrowseForFolderW
Shell_NotifyIconW
SHGetSpecialFolderPathW

ole32

CoTaskMemFree
CoTaskMemAlloc
CLSIDFromString
OleRun
CLSIDFromProgID
CoTaskMemRealloc
CreateStreamOnHGlobal
CoUninitialize
CoCreateInstance
CoInitialize
CoInitializeEx

oleaut32

VariantInit
SafeArrayGetDim
LHashValOfNameSys
VariantTimeToSystemTime
SystemTimeToVariantTime
VarUI4FromStr
SafeArrayGetElemsize
LoadTypeLi
SafeArrayGetLBound
VariantCopyInd
RegisterTypeLi
SysAllocString
SafeArrayGetUBound
SysStringLen
SysAllocStringLen
VariantCopy
SafeArrayUnaccessData
SafeArrayCreate
VarCmp
SafeArrayAccessData
VariantChangeType
VariantClear
SysFreeString

comctl32

ImageList_Destroy
ImageList_Create
ImageList_AddMasked
_TrackMouseEvent
InitCommonControlsEx

bcrypt

BCryptGenerateSymmetricKey
BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptExportKey
BCryptImportKey
BCryptImportKeyPair
BCryptEncrypt
BCryptFinalizeKeyPair
BCryptDestroySecret
BCryptSignHash
BCryptVerifySignature
BCryptSecretAgreement
BCryptDeriveKey
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptDecrypt
BCryptDestroyKey
BCryptGenerateKeyPair

wldap32

ord45
ord50
ord41
ord22
ord211
ord143
ord32
ord33
ord35
ord79
ord60
ord26
ord30
ord200
ord46
ord27
ord301

ws2_32

closesocket
recv
accept
WSAEventSelect
WSAStartup
WSACleanup
WSAGetLastError
inet_pton
__WSAFDIsSet
select
WSASetLastError
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
send
socket
htonl
listen
ioctlsocket
ntohl
getaddrinfo
freeaddrinfo
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
recvfrom
sendto
gethostname
WSAIoctl
shutdown
WSASend
getnameinfo
inet_addr
inet_ntoa
getservbyname
getservbyport
gethostbyname
gethostbyaddr

uxtheme

SetWindowTheme

dsound

ord11

gdiplus

GdipCreateBitmapFromFile
GdipGetImageWidth
GdipSetCompositingMode
GdipGetImagePalette
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipBitmapLockBits
GdipFree
GdipGetImagePixelFormat
GdipDisposeImage
GdipDrawImageRectI
GdipAlloc
GdipCreateBitmapFromStream
GdipBitmapUnlockBits
GdipCloneImage
GdipGetImagePaletteSize
GdipGetImageHeight
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromScan0

winmm

PlaySoundW

secur32

DecryptMessage
FreeContextBuffer
QueryContextAttributesA
ApplyControlToken
DeleteSecurityContext
AcceptSecurityContext
InitializeSecurityContextA
FreeCredentialsHandle
AcquireCredentialsHandleW
EncryptMessage

iphlpapi

GetAdaptersAddresses

crypt32

CryptDecodeObjectEx
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
PFXIsPFXBlob
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain

Sections

.text
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 717KB - Virtual size: 716KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 118KB - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3cd2c6372db53488c8e2dedd8eb1eb4b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

bcrypt

wldap32

ws2_32

uxtheme

dsound

gdiplus

winmm

secur32

iphlpapi

crypt32

Sections

.text Size: 4.5MB - Virtual size: 4.5MB

.rdata Size: 717KB - Virtual size: 716KB

.data Size: 118KB - Virtual size: 195KB

.rsrc Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 171KB - Virtual size: 170KB

.text
Size: 4.5MB - Virtual size: 4.5MB

.rdata
Size: 717KB - Virtual size: 716KB

.data
Size: 118KB - Virtual size: 195KB

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 171KB - Virtual size: 170KB