22755fa5ea0a15d1e819f4fd0dfdc66848720acc068ddc1447874e5267be12bfN

Sharing

Copy URL Twitter E-mail

General

Target

22755fa5ea0a15d1e819f4fd0dfdc66848720acc068ddc1447874e5267be12bfN
Size

1.7MB
MD5

ff5c183a4061ca73ff057e3c83eb7710
SHA1

9ae8c9060eb6f7f9726c55d40c7aa030b6aa58a4
SHA256

22755fa5ea0a15d1e819f4fd0dfdc66848720acc068ddc1447874e5267be12bf
SHA512

0bc0104840aa8808306d7e83c2d6bb10af41f4d92ada405912c446ccc636d44d0ccd5c955828ef8785668e80bf720d2da3c63286cef925e7a47a43ff8c305f84
SSDEEP

49152:GjIc/DocXCtNXwR2fhDRKGYMWkWRTxRgyUsTn:yUAwYMWkd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
22755fa5ea0a15d1e819f4fd0dfdc66848720acc068ddc1447874e5267be12bfN

Files

22755fa5ea0a15d1e819f4fd0dfdc66848720acc068ddc1447874e5267be12bfN
.exe windows:5 windows x86 arch:x86

0173252058a0bf4a8ff253533a894b3c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MapViewOfFile
UnmapViewOfFile
GetDriveTypeW
FindFirstFileW
FindClose
CreateDirectoryW
GetFileAttributesW
SetFileAttributesW
RemoveDirectoryW
FindNextFileW
DeleteFileW
CopyFileW
FileTimeToSystemTime
MoveFileW
MoveFileExW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
TerminateProcess
CreateProcessW
WaitForSingleObject
GetModuleHandleExW
FormatMessageW
LocalFree
VirtualAlloc
GetCurrentProcessId
CreateMutexW
ExpandEnvironmentStringsW
SystemTimeToFileTime
SetLocalTime
GetVersionExW
GetVersionExA
GetSystemInfo
DeviceIoControl
SetPriorityClass
InitializeCriticalSection
TryEnterCriticalSection
ReleaseMutex
GlobalFree
CreateThread
TerminateThread
GetCommandLineW
OutputDebugStringW
CreateEventW
SetEvent
CloseHandle
WideCharToMultiByte
WTSGetActiveConsoleSessionId
CreateFileA
Sleep
GetVolumeInformationW
AreFileApisANSI
GetSystemTime
GetTempPathA
GetFileAttributesExW
GetDiskFreeSpaceA
LoadLibraryExW
LoadLibraryA
GetDiskFreeSpaceW
LockFileEx
HeapValidate
GetFileAttributesA
FormatMessageA
UnlockFileEx
WaitForSingleObjectEx
LockFile
FlushViewOfFile
UnlockFile
HeapCompact
GetFullPathNameA
GetFullPathNameW
CreateFileMappingW
FindCloseChangeNotification
FindFirstChangeNotificationW
lstrlenA
SetEnvironmentVariableA
CompareStringW
SetEndOfFile
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTimeZoneInformation
FlushFileBuffers
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
IsValidCodePage
GetOEMCP
GetACP
ExitProcess
HeapSize
HeapDestroy
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCPInfo
LCMapStringW
GetStdHandle
GetFileType
WriteConsoleW
HeapReAlloc
GetSystemTimeAsFileTime
MoveFileA
ReadFile
GetFileSize
WriteFile
SetFilePointer
CreateFileW
GetTickCount
LoadLibraryW
ExpandEnvironmentStringsA
GetTempPathW
GetSystemDirectoryW
OutputDebugStringA
GetLocalTime
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
FreeLibrary
GlobalAlloc
GlobalLock
GlobalUnlock
GetModuleFileNameW
MulDiv
lstrcmpW
SetLastError
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
GetModuleHandleW
GetProcAddress
lstrlenW
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
LeaveCriticalSection
GetStartupInfoW
HeapSetInformation
ExitThread
RtlUnwind
DecodePointer
EncodePointer
InterlockedExchange
GetStringTypeW
InterlockedPopEntrySList
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
GetComputerNameW
DeleteFileA
EnterCriticalSection
CreateFileMappingA
RaiseException

user32

GetWindowLongW
ScreenToClient
GetDC
ReleaseDC
InvalidateRect
InvalidateRgn
RedrawWindow
SetCapture
IsChild
GetParent
GetDlgItem
GetClassNameW
ReleaseCapture
FillRect
CallWindowProcW
EndPaint
CreateDialogParamW
GetDesktopWindow
DestroyAcceleratorTable
GetWindow
GetFocus
SetFocus
SendMessageW
IsWindow
GetClassInfoExW
LoadCursorW
RegisterClassExW
CreateWindowExW
SetWindowLongW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
RegisterWindowMessageW
IsDialogMessageW
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetWindowRect
LoadImageW
EnableWindow
DialogBoxParamW
GetActiveWindow
PostQuitMessage
GetSystemMetrics
EndDialog
wsprintfW
LoadStringW
MessageBoxA
SetCursor
PostMessageW
UpdateLayeredWindow
IsWindowVisible
SetForegroundWindow
GetSysColor
ClientToScreen
GetClientRect
MoveWindow
CreateAcceleratorTableW
SetWindowPos
BeginPaint
DestroyWindow
CharNextW
DefWindowProcW
PeekMessageW
GetMessageW
UnregisterClassA
TranslateMessage
DispatchMessageW
ShowWindow

gdi32

GetObjectW
CreatePolygonRgn
GetTextMetricsW
CreateFontW
GetTextExtentExPointW
GetObjectA
GetStockObject
DeleteObject
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
SelectObject

advapi32

AllocateAndInitializeSid
LookupAccountNameW
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetLengthSid
SetTokenInformation
DuplicateTokenEx
LookupAccountSidW
GetTokenInformation
OpenProcessToken
FreeSid
CheckTokenMembership
ConvertSidToStringSidW
CreateProcessAsUserW
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
QueryServiceStatus
CloseServiceHandle

shell32

ord155
SHGetFolderLocation
SHFileOperationW
ShellExecuteExW
SHGetSpecialFolderPathW
ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
StringFromGUID2
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoUninitialize
CoSetProxyBlanket
CoInitializeSecurity
CoInitialize

oleaut32

LoadTypeLi
SysStringLen
SysFreeString
SysAllocStringLen
SysAllocString
VarUI4FromStr
VariantInit
VariantClear
OleCreateFontIndirect
LoadRegTypeLi

shlwapi

PathFileExistsA
PathFindFileNameW
PathRemoveFileSpecW
PathFileExistsW

comctl32

InitCommonControlsEx
_TrackMouseEvent

psapi

GetModuleFileNameExW

wtsapi32

WTSQueryUserToken

iphlpapi

GetAdaptersInfo

winhttp

WinHttpSendRequest
WinHttpCloseHandle
WinHttpOpen
WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpConnect
WinHttpOpenRequest
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpWriteData
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData

gdiplus

GdipDrawImageI
GdiplusStartup
GdiplusShutdown
GdipDrawImageRectI
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipDrawImagePointRectI
GdipDrawRectangleI
GdipDrawLineI
GdipSetSmoothingMode
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipDeletePen
GdipCreatePen1
GdipCloneBrush
GdipCreateFontFromLogfontA
GdipDrawLine
GdipDrawImageRectRectI
GdipSetSolidFillColor
GdipReleaseDC
GdipCreateFromHDC
GdipCreateSolidFill
GdipDeleteFont
GdipDeleteGraphics
GdipDeleteBrush
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipDisposeImage
GdipAlloc
GdipFree
GdipSetClipHrgn
GdipFillRectangle
GdipFillRectangleI
GdipMeasureString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipCreateCachedBitmap
GdipDeleteCachedBitmap
GdipDeleteMatrix
GdipCreatePath
GdipDeletePath
GdipCreateBitmapFromGraphics
GdipCreateMatrix
GdipCreateMatrix2
GdipRotateMatrix
GdipTranslateMatrix
GdipGetFontHeight
GdipSetWorldTransform
GdipSetInterpolationMode
GdipDrawString
GdipDrawRectangle
GdipSetTextRenderingHint
GdipTransformPath
GdipCreateFontFromDC
GdipAddPathRectangleI
GdipSetStringFormatAlign

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0173252058a0bf4a8ff253533a894b3c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

psapi

wtsapi32

iphlpapi

winhttp

gdiplus

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 236KB - Virtual size: 236KB

.data Size: 22KB - Virtual size: 36KB

.rsrc Size: 12KB - Virtual size: 11KB

.reloc Size: 78KB - Virtual size: 77KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 236KB - Virtual size: 236KB

.data
Size: 22KB - Virtual size: 36KB

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 78KB - Virtual size: 77KB