15f786d3977f8c1f983f2c8c0c61adff585d099caec6fd39f96503fcf28ea8fa

Sharing

Copy URL Twitter E-mail

General

Target

15f786d3977f8c1f983f2c8c0c61adff585d099caec6fd39f96503fcf28ea8fa
Size

1.7MB
MD5

12f6e3c497404947b97b0b6a4852bf7a
SHA1

87f23f77348f781854f76189d4376e47f3c9adbf
SHA256

15f786d3977f8c1f983f2c8c0c61adff585d099caec6fd39f96503fcf28ea8fa
SHA512

d0e8da2b7e2e90cc2c575f62c6acab0e945b6ee2538839e2794be2645d73e92d5163a54e80f7a26ac5109a8eb8d603b38c717049735a6e7d82914231c0231cd6
SSDEEP

24576:gG+lbdjJ244ImmT2fZllwAluV5ssXKF2numWumnivFCieqzG5Hdu:At2QMZwAlkCFAumWumi8ieCMHdu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
15f786d3977f8c1f983f2c8c0c61adff585d099caec6fd39f96503fcf28ea8fa

Files

15f786d3977f8c1f983f2c8c0c61adff585d099caec6fd39f96503fcf28ea8fa
.exe windows:5 windows x86 arch:x86

df69131668df73fa41e91b2a1a3ac663

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Work\YwProjects\Bin\bsView.pdb

Imports

kernel32

LCMapStringEx
LocalFree
SetUnhandledExceptionFilter
GetCommandLineW
InitializeCriticalSectionEx
LockResource
SizeofResource
LoadResource
FindResourceW
GetTempPathW
lstrcpyW
FreeResource
GetTickCount
TerminateThread
Sleep
WaitForSingleObject
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetDriveTypeW
lstrcmpW
GlobalUnlock
SystemTimeToTzSpecificLocalTime
WideCharToMultiByte
GetModuleHandleW
DeleteCriticalSection
MoveFileExW
GlobalLock
GetProcAddress
DecodePointer
CreateThread
LoadLibraryW
RaiseException
CloseHandle
DeleteFileW
GlobalAlloc
lstrcatW
FileTimeToSystemTime
GetLastError
GetPrivateProfileStringW
MultiByteToWideChar
CreateFileW
FindClose
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
TerminateProcess
InterlockedDecrement
GetPrivateProfileIntW
GetModuleHandleExW
lstrcpynW
WriteFile
lstrlenW
GetCurrentProcess
FindNextFileW
WritePrivateProfileStringW
FindFirstFileW
WriteConsoleW
GetFullPathNameW
SetEndOfFile
FlushFileBuffers
GetConsoleCP
SetStdHandle
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
HeapReAlloc
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapAlloc
GetStringTypeW
HeapFree
GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
SetFilePointerEx
FreeLibraryAndExitThread
ExitThread
GetFileAttributesExW
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
RtlUnwind
GetLocalTime
GetFileAttributesW
CreateDirectoryW
LocalFileTimeToFileTime
SystemTimeToFileTime
SetFileTime
SetFilePointer
lstrcmpiW
GetACP
ExitProcess
GetCurrentDirectoryW
GetFileSize
MulDiv
InterlockedIncrement
GetFileSizeEx
VerifyVersionInfoW
VerSetConditionMask
FormatMessageW
SetLastError
PeekNamedPipe
ReadFile
GetStdHandle
GetFileType
WaitForMultipleObjects
GetEnvironmentVariableA
QueryPerformanceFrequency
IsDebuggerPresent
OutputDebugStringW
UnhandledExceptionFilter
IsProcessorFeaturePresent
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SleepEx
FreeLibrary
GetSystemDirectoryW

user32

SetWindowLongW
SetWindowPos
wsprintfA
DefWindowProcW
GetWindowRect
MessageBoxW
LoadImageW
SendMessageW
IsZoomed
SystemParametersInfoW
IsWindowVisible
GetForegroundWindow
GetWindowLongW
ShowWindow
IsWindow
PtInRect
ClientToScreen
GetWindowTextLengthW
CreateWindowExW
GetSystemMetrics
WindowFromPoint
SetTimer
RegisterClassW
LoadCursorW
wsprintfW
KillTimer
DrawIconEx
PostQuitMessage
GetParent
GetWindowTextW
SetWindowTextW
EqualRect
GetCaretPos
MapVirtualKeyExW
GetKeyNameTextW
GetKeyboardLayout
GetFocus
DestroyWindow
MoveWindow
SetCapture
ReleaseCapture
CreateAcceleratorTableW
GetDC
ReleaseDC
BeginPaint
EndPaint
InvalidateRect
InvalidateRgn
GetClientRect
GetCaretBlinkTime
ScreenToClient
FillRect
GetGUIThreadInfo
CharNextW
SetCursor
IntersectRect
IsRectEmpty
GetMessageW
TranslateMessage
DispatchMessageW
PostMessageW
IsIconic
SetFocus
GetActiveWindow
GetKeyState
GetUpdateRect
GetCursorPos
MapWindowPoints
GetSysColor
UnionRect
OffsetRect
GetWindow
MonitorFromWindow
GetMonitorInfoW
SetWindowRgn
InflateRect
CallWindowProcW
RegisterClassExW
GetClassInfoExW
EnableWindow
SetPropW
GetPropW
UpdateWindow
IsWindowEnabled
CharPrevW
DrawTextW
SetRect
SetForegroundWindow
UpdateLayeredWindow
GetWindowRgn
CreatePopupMenu
DestroyMenu
EnableMenuItem
AppendMenuW
TrackPopupMenu
CreateCaret
HideCaret
ShowCaret
SetCaretPos
DrawTextA

gdi32

SetWindowOrgEx
GetTextMetricsW
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateEnhMetaFileW
CloseEnhMetaFile
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
CreateSolidBrush
DeleteDC
GetTextExtentPoint32W
GetObjectW
DeleteObject
GetTextExtentPointA
GetBitmapBits
SetBitmapBits
SaveDC
RestoreDC
Rectangle
RemoveFontMemResourceEx
AddFontMemResourceEx
GetStockObject
CreatePen
CreateFontIndirectW
GetCharABCWidthsW
GetClipBox
LineTo
SelectClipRgn
CreateRoundRectRgn
CreatePatternBrush
PtInRegion
CreateRectRgn
GdiFlush
TextOutW
MoveToEx
GetDeviceCaps
GetObjectA
CreateDIBSection
SetTextColor
SetStretchBltMode
StretchBlt
SetBkMode
SetBkColor
CreateDIBitmap
ExtSelectClipRgn

advapi32

CryptEncrypt
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegQueryValueExW
RegOpenKeyExW
CryptImportKey
RegSetValueExW
RegCreateKeyExW
RegCloseKey

shell32

CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW
DragQueryFileW

ole32

DoDragDrop
OleLockRunning
CLSIDFromProgID
CLSIDFromString
OleDuplicateData
CoCreateInstance
CoTaskMemFree
CreateStreamOnHGlobal
CoInitialize
OleUninitialize
CoUninitialize
ReleaseStgMedium
OleInitialize

oleaut32

VariantInit
VariantClear
SysFreeString
SysAllocString

shlwapi

PathRemoveFileSpecW

gdiplus

GdipGetImageGraphicsContext
GdipSaveImageToFile
GdipCreateBitmapFromScan0
GdipDeleteGraphics
GdipGetImageWidth
GdiplusStartup
GdiplusShutdown
GdipCreatePath
GdipDeletePath
GdipAddPathLine
ord1
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipSetPenMode
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipCreateFromHDC
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipDrawRectangleI
GdipDrawPath
GdipFillRectangleI
GdipFillPath
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdipFree
GdipGetImageHeight
GdipGetImageEncoders
GdipCloneImage
GdipAlloc
GdipDrawImageRectI
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipGetImageEncodersSize
GdipGetImagePixelFormat
GdipSetInterpolationMode
GdipDeletePen

sqlite3

sqlite3_errmsg
sqlite3_step
sqlite3_open
sqlite3_column_text
sqlite3_free
sqlite3_changes
sqlite3_finalize
sqlite3_column_count
sqlite3_column_type
sqlite3_busy_timeout
sqlite3_prepare_v2
sqlite3_close
sqlite3_exec
sqlite3_mprintf
sqlite3_vmprintf
sqlite3_column_int

ws2_32

__WSAFDIsSet
ioctlsocket
listen
htonl
gethostbyname
accept
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
ntohl
connect
bind
WSAGetLastError
send
recv
closesocket
select
freeaddrinfo
WSACloseEvent
getaddrinfo
gethostname
sendto
recvfrom
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent

wldap32

ord127
ord301
ord27
ord26
ord117
ord41
ord208
ord73
ord145
ord219
ord46
ord167
ord147
ord133
ord79
ord142
ord216
ord14

crypt32

CertFindExtension
CryptQueryObject
CertCreateCertificateChainEngine
CryptDecodeObjectEx
CertGetCertificateChain
CertFreeCertificateChain
PFXImportCertStore
CryptStringToBinaryW
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertOpenStore
CertCloseStore
CertFreeCertificateChainEngine
CertAddCertificateContextToStore

comctl32

_TrackMouseEvent
InitCommonControlsEx
ord17

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

Sections

.text
Size: 900KB - Virtual size: 899KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 207KB - Virtual size: 206KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 9KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 463KB - Virtual size: 462KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 115KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

df69131668df73fa41e91b2a1a3ac663

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

sqlite3

ws2_32

wldap32

crypt32

comctl32

imm32

Sections

.text Size: 900KB - Virtual size: 899KB

.rdata Size: 207KB - Virtual size: 206KB

.data Size: 9KB - Virtual size: 14KB

.rsrc Size: 463KB - Virtual size: 462KB

.reloc Size: 115KB - Virtual size: 116KB

.text
Size: 900KB - Virtual size: 899KB

.rdata
Size: 207KB - Virtual size: 206KB

.data
Size: 9KB - Virtual size: 14KB

.rsrc
Size: 463KB - Virtual size: 462KB

.reloc
Size: 115KB - Virtual size: 116KB