0cabb1bb497cb077e6f851503e472ec37d6b3b12843192b4dcdd09ba88363d69

Sharing

Copy URL Twitter E-mail

General

Target

0cabb1bb497cb077e6f851503e472ec37d6b3b12843192b4dcdd09ba88363d69
Size

6.2MB
MD5

4a6096fc6f59ffd93c71d2750eb0d400
SHA1

db6d159f85548ebafeeec2df0f1b0ceeda3549f7
SHA256

0cabb1bb497cb077e6f851503e472ec37d6b3b12843192b4dcdd09ba88363d69
SHA512

dadf4bd811648d5e331225fd6b6dcf728ecd6e745900cbbd3ecc3ede5a75604ed40ac81187e86718835b6f3047537af2ca7dd631fa3afce40ea8c2c99cf6a608
SSDEEP

98304:GMd2524Yl62ykOeMQVG+77/bOtCCK7RWkBN3bMFx/:GMkkLWQ0M7/bOI4gYFx/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0cabb1bb497cb077e6f851503e472ec37d6b3b12843192b4dcdd09ba88363d69

Files

0cabb1bb497cb077e6f851503e472ec37d6b3b12843192b4dcdd09ba88363d69
.exe windows:5 windows x86 arch:x86

86ecfccbb749c45af864e331a1ea3868

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsA
PathFileExistsW
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW

kernel32

SetFileTime
SetFilePointer
SetEndOfFile
IsBadCodePtr
GetModuleHandleA
LoadLibraryA
SetThreadExecutionState
FreeLibrary
lstrcmpW
GetFileTime
GetSystemTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
QueryPerformanceCounter
QueryPerformanceFrequency
SetLastError
FormatMessageW
MoveFileExW
WaitForMultipleObjects
GetFileType
GetStdHandle
PeekNamedPipe
GetEnvironmentVariableA
SleepEx
VerSetConditionMask
VerifyVersionInfoW
FindClose
GetPrivateProfileSectionW
GetTempPathW
GetEnvironmentVariableW
DeleteFileA
Module32FirstW
Process32FirstW
lstrcpyA
Process32NextW
CreateToolhelp32Snapshot
OpenProcess
TerminateProcess
SystemTimeToFileTime
GetCurrentProcessId
GetLocalTime
GetDriveTypeW
LeaveCriticalSection
LoadLibraryW
FileTimeToSystemTime
SetThreadPriority
FindNextFileA
GetProcessId
RemoveDirectoryW
GetPrivateProfileIntW
WriteFile
GetCurrentProcess
FindNextFileW
SetPriorityClass
FindFirstFileA
GetFileSizeEx
GetFileAttributesW
FindFirstFileW
ReadFile
CreateDirectoryW
CreateFileW
DeviceIoControl
GetComputerNameW
LocalFree
GetSystemDirectoryW
GetVolumeInformationW
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
LoadResource
FindResourceExW
RaiseException
HeapReAlloc
LockResource
GetLastError
HeapSize
InitializeCriticalSectionAndSpinCount
HeapFree
SizeofResource
SetUnhandledExceptionFilter
ExitProcess
InitializeCriticalSection
EnterCriticalSection
MulDiv
CreateThread
FreeResource
CreateMutexW
GetCommandLineW
SetFileAttributesA
GlobalAlloc
lstrcmpiW
lstrcpynW
InterlockedIncrement
InterlockedDecrement
WritePrivateProfileStringA
OutputDebugStringW
GetTempPathA
GetACP
lstrlenW
GlobalUnlock
GlobalLock
OutputDebugStringA
WritePrivateProfileStringW
GetExitCodeProcess
MoveFileW
GetTickCount
CreateDirectoryA
lstrcpyW
WideCharToMultiByte
CopyFileW
GetModuleHandleW
GetFileSize
GetProcAddress
SetCurrentDirectoryW
GetCurrentDirectoryW
GetSystemInfo
CloseHandle
DeleteFileW
lstrcatW
GetCurrentThread
CreateFileA
Sleep
GetPrivateProfileStringW
GetTimeZoneInformation
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetFullPathNameW
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
FlushFileBuffers
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
SystemTimeToTzSpecificLocalTime
GetFileAttributesExW
GetCurrentDirectoryA
SetCurrentDirectoryA
MultiByteToWideChar
SetFileAttributesW
GetModuleFileNameW
WaitForSingleObject
UnhandledExceptionFilter
IsProcessorFeaturePresent
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
GetStartupInfoW
GetCurrentThreadId
GetSystemTimeAsFileTime
SetEnvironmentVariableA
FreeLibraryAndExitThread
ExitThread
GetModuleHandleExW
LoadLibraryExW
RtlUnwind
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
EncodePointer
InitializeSListHead
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread

user32

GetDC
ReleaseCapture
ReleaseDC
EndPaint
SetCapture
GetKeyState
GetFocus
GetActiveWindow
SetFocus
CharNextW
IsZoomed
IsIconic
IsWindowVisible
DestroyWindow
GetCursorPos
SetCursorPos
FindWindowA
mouse_event
DestroyMenu
CreatePopupMenu
SendMessageW
SetWindowPos
GetWindowRect
PostQuitMessage
KillTimer
ExitWindowsEx
SetTimer
ShowWindow
MessageBoxW
PostMessageW
MoveWindow
GetSystemMetrics
wsprintfW
IsWindow
CreateWindowExW
DispatchMessageW
TranslateMessage
GetMessageW
GetUpdateRect
InvalidateRect
GetClientRect
ScreenToClient
MapWindowPoints
MapVirtualKeyExW
GetKeyNameTextW
GetKeyboardLayout
SetForegroundWindow
GetGUIThreadInfo
InvalidateRgn
CreateAcceleratorTableW
DrawTextA
wsprintfA
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
EqualRect
UpdateWindow
IsWindowEnabled
ClientToScreen
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
GetCaretBlinkTime
CreateCaret
TrackPopupMenu
AppendMenuW
EnableMenuItem
SetRect
FillRect
DrawTextW
CharPrevW
GetWindowRgn
UpdateLayeredWindow
SetWindowRgn
GetPropW
SetPropW
EnableWindow
GetClassInfoExW
RegisterClassExW
RegisterClassW
CallWindowProcW
DefWindowProcW
LoadCursorW
InflateRect
SetCursor
GetMonitorInfoW
MonitorFromWindow
LoadImageW
GetWindow
GetParent
SetWindowLongW
GetWindowLongW
PtInRect
IsRectEmpty
OffsetRect
UnionRect
IntersectRect
GetSysColor
BeginPaint

advapi32

RegFlushKey
CryptGetHashParam
ConvertSidToStringSidW
CryptHashData
CryptCreateHash
CryptAcquireContextW
GetTokenInformation
RegQueryValueExW
RegOpenKeyExW
OpenProcessToken
RegSetValueExW
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptGenRandom
CryptReleaseContext
RegOpenKeyW
RegQueryValueExA
RegEnumKeyExA
RegEnumKeyA
RegQueryInfoKeyW
RegDeleteKeyA
RegQueryInfoKeyA
RegOpenKeyExA
RegEnumValueA
RegDeleteValueW
RegDeleteValueA
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
RegCreateKeyExW
LookupAccountNameW

shell32

SHGetDesktopFolder
ShellExecuteExW
SHGetFolderPathA
SHGetFolderPathW
SHChangeNotify
DragQueryFileW
ShellExecuteW
SHGetSpecialFolderPathW
CommandLineToArgvW

ole32

CoCreateInstance
DoDragDrop
OleDuplicateData
CoUninitialize
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
OleLockRunning
CoTaskMemFree
ReleaseStgMedium
CoInitialize

oleaut32

VariantClear
SysAllocString
SysFreeString
VariantInit

comctl32

_TrackMouseEvent
InitCommonControlsEx
ord17

gdiplus

GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipSetPenMode
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipImageGetFrameCount
ord1
GdipAddPathLine
GdipDeletePath
GdipCreatePath
GdipFree
GdipAlloc
GdiplusShutdown
GdiplusStartup
GdipImageGetFrameDimensionsCount
GdipImageSelectActiveFrame
GdipImageGetFrameDimensionsList
GdipGetImageHeight
GdipGetImageWidth
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipDrawImageRectI
GdipTranslateWorldTransform
GdipCloneBrush
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipFillPath
GdipFillRectangleI
GdipDrawPath
GdipRotateWorldTransform
GdipDrawRectangleI

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow

ws2_32

ioctlsocket
getpeername
freeaddrinfo
gethostname
listen
htonl
getsockname
bind
getaddrinfo
sendto
htons
WSAEnumNetworkEvents
recvfrom
WSAWaitForMultipleEvents
ntohs
socket
WSAEventSelect
inet_addr
WSAStartup
WSACreateEvent
ntohl
WSACleanup
WSAGetLastError
setsockopt
recv
send
gethostbyname
getsockopt
WSACloseEvent
WSAResetEvent
closesocket
WSASetLastError
WSAIoctl
__WSAFDIsSet
select
accept
connect

iphlpapi

GetAdaptersAddresses
GetAdaptersInfo

crypt32

CertOpenStore
CertFreeCertificateContext
CertCloseStore
CertAddEncodedCertificateToStore

wininet

InternetCheckConnectionW
InternetCheckConnectionA

winmm

mixerGetLineInfoW
mixerClose
mixerSetControlDetails
mixerOpen
mixerGetLineControlsW

wldap32

ord41
ord117
ord26
ord27
ord127
ord167
ord142
ord79
ord133
ord147
ord301
ord145
ord216
ord14
ord46
ord219
ord208

wlanapi

WlanEnumInterfaces
WlanCloseHandle
WlanOpenHandle
WlanReasonCodeToString
WlanSetProfile

gdi32

SetBitmapBits
GetBitmapBits
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBitmap
CreateFontIndirectW
CreatePen
DeleteDC
DeleteObject
GetDeviceCaps
GetStockObject
AddFontMemResourceEx
RemoveFontMemResourceEx
Rectangle
RestoreDC
SaveDC
SelectObject
CloseEnhMetaFile
CreateEnhMetaFileW
GetEnhMetaFileHeader
PlayEnhMetaFile
GetTextMetricsW
GetObjectW
SetWindowOrgEx
CreateRoundRectRgn
CreateRectRgn
GdiFlush
CreateDIBSection
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
PtInRegion
GetTextExtentPointA
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
GetObjectA
MoveToEx
TextOutW
CreatePatternBrush

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 397KB - Virtual size: 396KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.nws0
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

86ecfccbb749c45af864e331a1ea3868

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

comctl32

gdiplus

imm32

ws2_32

iphlpapi

crypt32

wininet

winmm

wldap32

wlanapi

gdi32

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 397KB - Virtual size: 396KB

.data Size: 11KB - Virtual size: 18KB

.nws0 Size: 30KB - Virtual size: 29KB

.reloc Size: 65KB - Virtual size: 64KB

.rsrc Size: 4.4MB - Virtual size: 4.4MB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 397KB - Virtual size: 396KB

.data
Size: 11KB - Virtual size: 18KB

.nws0
Size: 30KB - Virtual size: 29KB

.reloc
Size: 65KB - Virtual size: 64KB

.rsrc
Size: 4.4MB - Virtual size: 4.4MB