15f1b887e9de41162912c725e82a2eb86c3fdf844b862479e72f13b61feccdaeN

Sharing

Copy URL Twitter E-mail

General

Target

15f1b887e9de41162912c725e82a2eb86c3fdf844b862479e72f13b61feccdaeN
Size

777KB
MD5

2ddf63b976a4f7bf343cbe351016cd00
SHA1

ba50dad998054c4e532dfbfaba1f1752bd410172
SHA256

15f1b887e9de41162912c725e82a2eb86c3fdf844b862479e72f13b61feccdae
SHA512

f87c88c574a85ebe1c329806cf7b43096408a102651d261c24bd1182cd310b76adf55cda6bdee35b45150d87d1988ff67087d8c9a33a28f61e9c80451336e803
SSDEEP

12288:d8oHZId8/YzkTC25RpKnnKUxE/EgnL3ZX9fnKiW9xCI:dii/Yzk+7vxE/NXnlW9xCI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
15f1b887e9de41162912c725e82a2eb86c3fdf844b862479e72f13b61feccdaeN

Files

15f1b887e9de41162912c725e82a2eb86c3fdf844b862479e72f13b61feccdaeN
.exe windows:5 windows x86 arch:x86

0686b803c1c4f0a884a06153cbf2902d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

HelpCtr.pdb

Imports

msvcrt

wcscpy
wcscat
wcscmp
iswspace
memmove
_ftol
_beginthreadex
_CxxThrowException
_wcsicmp
_wfindfirst
_findclose
_purecall
wcslen
__CxxFrameHandler
realloc
free
malloc
_snwprintf
_wtol
wcschr
wcsstr
_strdup
sprintf
strncpy
_controlfp
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
wcsncpy
swprintf
_wcsnicmp
wcsncat
wcsrchr
swscanf
_wtoi
_wcsdup
wcsncmp
_vsnwprintf

advapi32

RegEnumKeyExW
AddAuditAccessObjectAce
AddAccessDeniedObjectAce
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDeriveKey
AddAccessAllowedObjectAce
AddAuditAccessAceEx
CryptEncrypt
CryptDecrypt
CryptDestroyHash
DeregisterEventSource
RegOpenKeyExA
RegQueryValueExA
CryptGenRandom
QueryServiceStatus
StartServiceW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
CryptDestroyKey
CryptReleaseContext
ConvertSidToStringSidW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
InitializeAcl
InitializeSecurityDescriptor
RegQueryValueExW
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
GetAce
GetLengthSid
GetAclInformation
IsValidAcl
EqualSid
RegConnectRegistryW
RegEnumKeyW
OpenProcessToken
AddAce
SetThreadToken
CopySid
GetTokenInformation
OpenThreadToken
AddAccessAllowedAceEx
AddAccessDeniedAceEx

kernel32

InitializeCriticalSection
DeleteCriticalSection
lstrcmpiW
LoadLibraryW
lstrcpynW
HeapDestroy
lstrcatW
GetModuleFileNameW
FreeLibrary
InterlockedIncrement
lstrlenA
SizeofResource
LoadResource
FindResourceW
GetLastError
LoadLibraryExW
GetShortPathNameW
InterlockedDecrement
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
GetSystemDirectoryW
GetSystemWindowsDirectoryW
GetLocaleInfoW
GetUserDefaultUILanguage
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InterlockedExchange
Sleep
WaitForMultipleObjects
SetEvent
CloseHandle
CreateEventW
WaitForSingleObject
GetCurrentThread
SetEnvironmentVariableW
GetTempPathW
GetEnvironmentVariableW
GetSystemTime
GetLocalTime
QueryPerformanceFrequency
GlobalMemoryStatusEx
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
GetCommandLineW
GetFileAttributesExW
LeaveCriticalSection
GetTimeZoneInformation
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempFileNameW
WideCharToMultiByte
LocalFree
DuplicateHandle
ReadFile
WriteFile
SetFilePointer
GetFileInformationByHandle
CreateFileW
CopyFileW
SetFileAttributesW
DeleteFileW
MoveFileExW
RemoveDirectoryW
GlobalFree
GetModuleHandleA
GetStartupInfoW
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
VirtualFree
VirtualAlloc
EnterCriticalSection
lstrcpyW
lstrlenW
MultiByteToWideChar
lstrcmpiA
SetLastError
GetVersionExW
GetModuleHandleW
GetSystemDefaultLCID
FindNextChangeNotification
lstrcmpW
LocalAlloc
RaiseException
ReleaseMutex
FlushViewOfFile
UnmapViewOfFile
OpenMutexW
CreateMutexW
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
ResetEvent
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
HeapReAlloc
FindFirstChangeNotificationW
FindCloseChangeNotification
TlsSetValue
TlsFree
TlsAlloc
ExitProcess
GlobalReAlloc
GetUserDefaultLCID
SetThreadPriority
FlushFileBuffers
GetProcAddress
TlsGetValue

gdi32

CreateDIBSection
CreateSolidBrush
CreateCompatibleBitmap
SelectObject
BitBlt
GetStockObject
GetObjectW
CreateCompatibleDC
DeleteObject
CreateRectRgnIndirect
CreateDCW
GetDeviceCaps
LPtoDP
SaveDC
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
DeleteDC
RestoreDC
SetLayout

user32

EqualRect
OffsetRect
SetWindowRgn
SetWindowPos
UnionRect
PtInRect
GetParent
RegisterClassExW
wsprintfW
LoadCursorW
GetClassInfoExW
CreateWindowExW
MessageBoxW
IntersectRect
GetKeyboardState
EndPaint
GetClientRect
BeginPaint
GetClassNameW
SendMessageTimeoutW
RegisterWindowMessageW
EnumChildWindows
GetWindowRect
SendMessageW
MoveWindow
CharUpperW
IsWindowVisible
DestroyMenu
TrackPopupMenu
MapWindowPoints
DestroyWindow
SetKeyboardState
DefWindowProcW
GetWindowLongW
CallWindowProcW
ShowWindow
IsWindow
AppendMenuW
CreatePopupMenu
InsertMenuItemW
LoadStringW
GetSystemMetrics
MsgWaitForMultipleObjects
DispatchMessageW
GetKeyState
DestroyAcceleratorTable
InvalidateRect
SetFocus
IsChild
GetFocus
GetDC
ReleaseDC
CharNextW
GetMenuItemCount
GetSystemMenu
SystemParametersInfoW
EnumDisplaySettingsW
SystemParametersInfoA
CharUpperBuffW
CharLowerW
SetWindowTextW
LoadIconW
LoadImageW
SetForegroundWindow
IsIconic
PostMessageW
GetSysColor
GetProcessDefaultLayout
GetCursorPos
GetWindow
GetWindowTextW
GetWindowTextLengthW
ReleaseCapture
SetCapture
InvalidateRgn
GetDesktopWindow
GetDlgItem
FillRect
RedrawWindow
CreateAcceleratorTableW
TranslateMessage
SetWindowLongW
CopyImage
PeekMessageW

comctl32

ImageList_Create
ImageList_DrawIndirect
InitCommonControlsEx
ImageList_LoadImageW
ImageList_Destroy
ImageList_GetImageCount
ImageList_AddMasked

uxtheme

IsThemeActive
GetThemeDocumentationProperty
GetCurrentThemeName

urlmon

URLOpenBlockingStreamW
RegisterBindStatusCallback
CreateURLMoniker
ReleaseBindInfo
CopyBindInfo
CoInternetQueryInfo
CoInternetGetSession

wininet

InternetCloseHandle
InternetCanonicalizeUrlW
InternetSetOptionW
InternetQueryOptionW
InternetSetOptionA
HttpQueryInfoW
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetOpenW
InternetGetConnectedState
InternetSetStatusCallbackW
CommitUrlCacheEntryW
DeleteUrlCacheEntryW
CreateUrlCacheEntryW
InternetCombineUrlW
InternetCrackUrlW
InternetAutodial
InternetAutodialHangup

ole32

CLSIDFromProgID
OleLockRunning
OleUninitialize
OleInitialize
StringFromCLSID
CLSIDFromString
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemFree
StgOpenStorageEx
StgCreateStorageEx
GetRunningObjectTable
CreateClassMoniker
CoTaskMemAlloc
CoTaskMemRealloc
OleRegEnumVerbs
OleRegGetUserType
CreateOleAdviseHolder
OleRegGetMiscStatus
OleLoadFromStream
WriteClassStm
OleSaveToStream
CoUninitialize
CoInitializeSecurity
CoInitialize
CoCreateInstance
CoInitializeEx
CreateStreamOnHGlobal
CoGetCallContext
GetHGlobalFromStream
CoGetClassObject
CreateBindCtx

oleaut32

OleCreateFontIndirect
DispCallFunc
VariantInit
VariantTimeToSystemTime
VariantChangeTypeEx
SafeArrayCreateVector
SysAllocStringLen
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SystemTimeToVariantTime
VariantCopy
OleCreatePropertyFrame
SysStringLen
LoadRegTypeLi
SysStringByteLen
SysAllocStringByteLen
VariantChangeType
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
VariantClear
SysAllocString
SysFreeString

shlwapi

UrlGetPartW
UrlCombineW
StrStrIW
PathIsRelativeW

shell32

SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteW
ShellExecuteExW

msimg32

GradientFill

Sections

.text
Size: 565KB - Virtual size: 565KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 177KB - Virtual size: 179KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0686b803c1c4f0a884a06153cbf2902d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

gdi32

user32

comctl32

uxtheme

urlmon

wininet

ole32

oleaut32

shlwapi

shell32

msimg32

Sections

.text Size: 565KB - Virtual size: 565KB

.data Size: 33KB - Virtual size: 34KB

.rsrc Size: 177KB - Virtual size: 179KB

.text
Size: 565KB - Virtual size: 565KB

.data
Size: 33KB - Virtual size: 34KB

.rsrc
Size: 177KB - Virtual size: 179KB