fca0238d8c4c5eb0c9805bebb9c03bebe099abe64d0b9fdc8c875d246f4268dfN

Sharing

Copy URL Twitter E-mail

General

Target

fca0238d8c4c5eb0c9805bebb9c03bebe099abe64d0b9fdc8c875d246f4268dfN
Size

1.7MB
MD5

ac6c78acb7f689ee020609a0ac472100
SHA1

666c121239d9c670a898d2c9ba18788b349198f2
SHA256

fca0238d8c4c5eb0c9805bebb9c03bebe099abe64d0b9fdc8c875d246f4268df
SHA512

82d1cef2e27ce6afe2a569741b201da1e8c72f707b9ec6c6016271bfc268da7823ef7f68b3cce92916fe11c9be5aa0f0e2bded5e3580e9c370ea685173b3e31c
SSDEEP

49152:PACtFMyVoTkf8bGWYpeSHbtHNMGSbtGT+y2Jvp6Bm:CimgtHNeX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fca0238d8c4c5eb0c9805bebb9c03bebe099abe64d0b9fdc8c875d246f4268dfN

Files

fca0238d8c4c5eb0c9805bebb9c03bebe099abe64d0b9fdc8c875d246f4268dfN
.exe windows:5 windows x86 arch:x86

0173252058a0bf4a8ff253533a894b3c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MapViewOfFile
UnmapViewOfFile
GetDriveTypeW
FindFirstFileW
FindClose
CreateDirectoryW
GetFileAttributesW
SetFileAttributesW
RemoveDirectoryW
FindNextFileW
DeleteFileW
CopyFileW
FileTimeToSystemTime
MoveFileW
MoveFileExW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
TerminateProcess
CreateProcessW
WaitForSingleObject
GetModuleHandleExW
FormatMessageW
LocalFree
VirtualAlloc
GetCurrentProcessId
CreateMutexW
ExpandEnvironmentStringsW
SystemTimeToFileTime
SetLocalTime
GetVersionExW
GetVersionExA
GetSystemInfo
DeviceIoControl
SetPriorityClass
InitializeCriticalSection
TryEnterCriticalSection
ReleaseMutex
GlobalFree
CreateThread
TerminateThread
GetCommandLineW
OutputDebugStringW
CreateEventW
SetEvent
CloseHandle
WideCharToMultiByte
WTSGetActiveConsoleSessionId
CreateFileA
Sleep
GetVolumeInformationW
AreFileApisANSI
GetSystemTime
GetTempPathA
GetFileAttributesExW
GetDiskFreeSpaceA
LoadLibraryExW
LoadLibraryA
GetDiskFreeSpaceW
LockFileEx
HeapValidate
GetFileAttributesA
FormatMessageA
UnlockFileEx
WaitForSingleObjectEx
LockFile
FlushViewOfFile
UnlockFile
HeapCompact
GetFullPathNameA
GetFullPathNameW
CreateFileMappingW
FindCloseChangeNotification
FindFirstChangeNotificationW
lstrlenA
SetEnvironmentVariableA
CompareStringW
SetEndOfFile
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTimeZoneInformation
FlushFileBuffers
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
IsValidCodePage
GetOEMCP
GetACP
ExitProcess
HeapSize
HeapDestroy
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCPInfo
LCMapStringW
GetStdHandle
GetFileType
WriteConsoleW
HeapReAlloc
GetSystemTimeAsFileTime
MoveFileA
ReadFile
GetFileSize
WriteFile
SetFilePointer
CreateFileW
GetTickCount
LoadLibraryW
ExpandEnvironmentStringsA
GetTempPathW
GetSystemDirectoryW
OutputDebugStringA
GetLocalTime
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
FreeLibrary
GlobalAlloc
GlobalLock
GlobalUnlock
GetModuleFileNameW
MulDiv
lstrcmpW
SetLastError
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
GetModuleHandleW
GetProcAddress
lstrlenW
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
LeaveCriticalSection
GetStartupInfoW
HeapSetInformation
ExitThread
RtlUnwind
DecodePointer
EncodePointer
InterlockedExchange
GetStringTypeW
InterlockedPopEntrySList
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
GetComputerNameW
DeleteFileA
EnterCriticalSection
CreateFileMappingA
RaiseException

user32

GetWindowLongW
ScreenToClient
GetDC
ReleaseDC
InvalidateRect
InvalidateRgn
RedrawWindow
SetCapture
IsChild
GetParent
GetDlgItem
GetClassNameW
ReleaseCapture
FillRect
CallWindowProcW
EndPaint
CreateDialogParamW
GetDesktopWindow
DestroyAcceleratorTable
GetWindow
GetFocus
SetFocus
SendMessageW
IsWindow
GetClassInfoExW
LoadCursorW
RegisterClassExW
CreateWindowExW
SetWindowLongW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
RegisterWindowMessageW
IsDialogMessageW
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetWindowRect
LoadImageW
EnableWindow
DialogBoxParamW
GetActiveWindow
PostQuitMessage
GetSystemMetrics
EndDialog
wsprintfW
LoadStringW
MessageBoxA
SetCursor
PostMessageW
UpdateLayeredWindow
IsWindowVisible
SetForegroundWindow
GetSysColor
ClientToScreen
GetClientRect
MoveWindow
CreateAcceleratorTableW
SetWindowPos
BeginPaint
DestroyWindow
CharNextW
DefWindowProcW
PeekMessageW
GetMessageW
UnregisterClassA
TranslateMessage
DispatchMessageW
ShowWindow

gdi32

GetObjectW
CreatePolygonRgn
GetTextMetricsW
CreateFontW
GetTextExtentExPointW
GetObjectA
GetStockObject
DeleteObject
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
SelectObject

advapi32

AllocateAndInitializeSid
LookupAccountNameW
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetLengthSid
SetTokenInformation
DuplicateTokenEx
LookupAccountSidW
GetTokenInformation
OpenProcessToken
FreeSid
CheckTokenMembership
ConvertSidToStringSidW
CreateProcessAsUserW
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
QueryServiceStatus
CloseServiceHandle

shell32

ord155
SHGetFolderLocation
SHFileOperationW
ShellExecuteExW
SHGetSpecialFolderPathW
ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
StringFromGUID2
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoUninitialize
CoSetProxyBlanket
CoInitializeSecurity
CoInitialize

oleaut32

LoadTypeLi
SysStringLen
SysFreeString
SysAllocStringLen
SysAllocString
VarUI4FromStr
VariantInit
VariantClear
OleCreateFontIndirect
LoadRegTypeLi

shlwapi

PathFileExistsA
PathFindFileNameW
PathRemoveFileSpecW
PathFileExistsW

comctl32

InitCommonControlsEx
_TrackMouseEvent

psapi

GetModuleFileNameExW

wtsapi32

WTSQueryUserToken

iphlpapi

GetAdaptersInfo

winhttp

WinHttpSendRequest
WinHttpCloseHandle
WinHttpOpen
WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpConnect
WinHttpOpenRequest
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpWriteData
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData

gdiplus

GdipDrawImageI
GdiplusStartup
GdiplusShutdown
GdipDrawImageRectI
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipDrawImagePointRectI
GdipDrawRectangleI
GdipDrawLineI
GdipSetSmoothingMode
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipDeletePen
GdipCreatePen1
GdipCloneBrush
GdipCreateFontFromLogfontA
GdipDrawLine
GdipDrawImageRectRectI
GdipSetSolidFillColor
GdipReleaseDC
GdipCreateFromHDC
GdipCreateSolidFill
GdipDeleteFont
GdipDeleteGraphics
GdipDeleteBrush
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipDisposeImage
GdipAlloc
GdipFree
GdipSetClipHrgn
GdipFillRectangle
GdipFillRectangleI
GdipMeasureString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipCreateCachedBitmap
GdipDeleteCachedBitmap
GdipDeleteMatrix
GdipCreatePath
GdipDeletePath
GdipCreateBitmapFromGraphics
GdipCreateMatrix
GdipCreateMatrix2
GdipRotateMatrix
GdipTranslateMatrix
GdipGetFontHeight
GdipSetWorldTransform
GdipSetInterpolationMode
GdipDrawString
GdipDrawRectangle
GdipSetTextRenderingHint
GdipTransformPath
GdipCreateFontFromDC
GdipAddPathRectangleI
GdipSetStringFormatAlign

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0173252058a0bf4a8ff253533a894b3c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

psapi

wtsapi32

iphlpapi

winhttp

gdiplus

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 236KB - Virtual size: 236KB

.data Size: 22KB - Virtual size: 36KB

.rsrc Size: 12KB - Virtual size: 11KB

.reloc Size: 78KB - Virtual size: 77KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 236KB - Virtual size: 236KB

.data
Size: 22KB - Virtual size: 36KB

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 78KB - Virtual size: 77KB