9f993bfa852ee68818e602196b2f348a8af0ae28baa21e3365a5d3c27d3b24bb

Sharing

Copy URL

Twitter E-mail

General

Target

9f993bfa852ee68818e602196b2f348a8af0ae28baa21e3365a5d3c27d3b24bb
Size

946KB
MD5

a32feb31e60f5f468943a94eb5eeadd2
SHA1

78de02e7d70bdfb55d523bbde1b889adeee13784
SHA256

9f993bfa852ee68818e602196b2f348a8af0ae28baa21e3365a5d3c27d3b24bb
SHA512

ef7031bfe8d41bdec6a4f7a2dcd903746291619364f9e905748c48b4814af02aeafe7b26874e1ce55aebb839d9e55524c852337a368047f846619ecf8829012c
SSDEEP

12288:CP72apyiwiaE51qviizQBODAFZCYylk25ZERX7s5Zx5Z25ZOR:CTDpKm5kRzAFncToc5Yw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9f993bfa852ee68818e602196b2f348a8af0ae28baa21e3365a5d3c27d3b24bb

Files

9f993bfa852ee68818e602196b2f348a8af0ae28baa21e3365a5d3c27d3b24bb
.exe windows:6 windows x86 arch:x86

ebcd9ab2dcb5c560eb2451ccd9cf584b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

mblctr.pdb

Imports

advapi32

TraceMessage
RegCloseKey
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
TraceEvent
RegEnumKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegGetValueW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
EventRegister
EventUnregister
EventWrite

kernel32

LocalAlloc
GetSystemPowerStatus
FormatMessageW
SetEvent
DeleteCriticalSection
CreateEventW
InitializeCriticalSection
LocalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FindResourceW
LoadResource
LockResource
SizeofResource
GetLastError
WaitForSingleObject
GetSystemDirectoryW
CreateProcessW
ExpandEnvironmentStringsW
FlushInstructionCache
GetVersionExA
InterlockedExchange
MulDiv
CreateThread
OutputDebugStringA
LoadLibraryW
EnterCriticalSection
GetCurrentProcess
HeapSetInformation
GetCurrentThreadId
SetLastError
CloseHandle
RegisterApplicationRestart
ReleaseMutex
CreateMutexW
lstrcmpW
GetCommandLineW
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
LeaveCriticalSection
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
HeapFree
GetProcessHeap
HeapAlloc
GetProcAddress
LoadLibraryA
VirtualFree
VirtualAlloc
Sleep
RaiseException

gdi32

GetObjectW
Polygon
GetBkColor
SetBkColor
GetTextExtentPoint32W
CreateRectRgn
SelectClipRgn
GetLayout
SetLayout
SetViewportOrgEx
SetBrushOrgEx
BitBlt
GdiGradientFill
SetDCPenColor
MoveToEx
LineTo
CreateDIBSection
DeleteDC
GetTextMetricsW
SelectObject
CreateCompatibleDC
CreateFontIndirectW
DeleteObject
CreateSolidBrush
GetDeviceCaps
GetStockObject
SetBkMode
SetTextColor
GdiAlphaBlend

user32

QueryDisplayConfig
GetDisplayConfigBufferSizes
ValidateRect
EndPaint
BeginPaint
PtInRect
SetRect
DrawEdge
UnregisterClassA
GetDC
ReleaseDC
SetClassLongW
NotifyWinEvent
GetKeyState
GetFocus
GetDlgCtrlID
CallNextHookEx
IsWindowEnabled
DrawTextW
SetWindowPos
GetWindowInfo
MonitorFromRect
GetMonitorInfoW
SetScrollInfo
GetScrollInfo
SendDlgItemMessageW
SetTimer
InvalidateRect
UpdateWindow
GetActiveWindow
GetNextDlgTabItem
GetWindowPlacement
GetWindowRect
UnhookWindowsHookEx
MoveWindow
FillRect
DrawFocusRect
CopyRect
InflateRect
DrawIconEx
DefWindowProcW
GetWindowLongW
GetParent
CreateWindowExW
GetClientRect
MapWindowPoints
OffsetRect
DestroyWindow
FindWindowW
SetForegroundWindow
GetForegroundWindow
IsIconic
ShowWindow
GetClassInfoW
RegisterClassW
LoadIconW
KillTimer
EnableWindow
SetDlgItemTextW
GetWindowTextW
SetWindowTextW
CallWindowProcW
SetWindowsHookExW
UnregisterPowerSettingNotification
RegisterPowerSettingNotification
UnregisterDeviceNotification
RegisterDeviceNotificationW
GetClassLongW
ScrollWindow
FrameRect
GetMessageW
IsDialogMessageW
TranslateMessage
DispatchMessageW
UnregisterClassW
CreateDialogParamW
EnumDisplayDevicesW
PostQuitMessage
GetIconInfo
AllowSetForegroundWindow
LoadImageW
DestroyIcon
SendMessageW
GetDlgItem
PostMessageW
LoadStringW
EnumDisplaySettingsExW
ChangeDisplaySettingsExW
LoadCursorW
GetSysColor
GetSystemMetrics
SystemParametersInfoW
GetSysColorBrush
SetWindowLongW
EnumChildWindows

msvcrt

_unlock
_except_handler4_common
__dllonexit
realloc
??1type_info@@UAE@XZ
__set_app_type
__p__commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_ftol2
_purecall
__RTDynamicCast
memcpy
wcstok
wcstol
wcscspn
_wcsicmp
free
memmove_s
??_U@YAPAXI@Z
__CxxFrameHandler3
ceil
_ftol2_sse
??2@YAPAXI@Z
_lock
_onexit
?terminate@@YAXXZ
_controlfp
_vsnwprintf
memset
??_V@YAXPAX@Z
??3@YAXPAX@Z
_errno
__p__fmode

oleaut32

SysAllocString
VariantInit
VariantClear
SafeArrayGetElement
SysFreeString

powrprof

PowerSetActiveScheme
PowerReadDCValue
PowerSettingAccessCheck
GetPwrCapabilities
PowerGetActiveScheme
PowerDeterminePlatformRole
PowerReadFriendlyName

batmeter

GetBatteryStatusText
BatMeterOnDeviceChange
CreateBatteryData
SubscribeBatteryUpdateNotification
CleanupBatteryData
UnsubscribeBatteryUpdateNotification
QueryBatteryData
SetBatteryLevel
UpdateBatteryDataAsync

winmm

waveOutGetNumDevs
PlaySoundW

shell32

ord100
ord155
ShellExecuteExW
SHGetKnownFolderIDList
DuplicateIcon
ShellExecuteW

shlwapi

StrTrimW
PathRemoveBlanksW
PathGetArgsW
ord618
ord219
PathFileExistsW
ord437

ole32

CoCreateInstance
CoUninitialize
CoInitialize
CoSetProxyBlanket
CoInitializeSecurity
CreateStreamOnHGlobal
CLSIDFromString

slc

SLGetWindowsInformationDWORD

rpcrt4

UuidFromStringW

gdiplus

GdipCloneImage
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipImageRotateFlip
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipFree
GdipAlloc
GdiplusStartup
GdiplusShutdown
GdipDeletePen
GdipCreatePen1
GdipCreateLineBrush
GdipCloneBrush
GdipFillPath
GdipFillRectangle
GdipDrawLine
GdipSetSmoothingMode
GdipDeleteGraphics
GdipDeleteBrush
GdipCreateSolidFill
GdipDeletePath
GdipAddPathLine
GdipCreateFromHDC
GdipCreatePath

uxtheme

CloseThemeData
GetThemeColor
OpenThemeData
BufferedPaintUnInit
BufferedPaintInit
EndBufferedPaint
BufferedPaintSetAlpha
BeginBufferedPaint
DrawThemeTextEx
DrawThemeText
GetThemeTextExtent
GetThemeBackgroundContentRect
GetThemePartSize
DrawThemeBackground

wlanapi

WlanCloseHandle
WlanRegisterNotification
WlanGetInterfaceCapability
WlanQueryInterface
WlanOpenHandle
WlanEnumInterfaces
WlanSetInterface
WlanFreeMemory

wmi

WmiQueryAllDataW
WmiCloseBlock
WmiExecuteMethodW
WmiOpenBlock
WmiQuerySingleInstanceW
WmiNotificationRegistrationW

comctl32

ImageList_Destroy
ImageList_Create
ImageList_ReplaceIcon
ImageList_DrawIndirect
ord344
ord345

dwmapi

DwmExtendFrameIntoClientArea
DwmIsCompositionEnabled

wtsapi32

WTSUnRegisterSessionNotification
WTSRegisterSessionNotification

ntdll

EtwTraceMessage

Sections

.text
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 781KB - Virtual size: 780KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ebcd9ab2dcb5c560eb2451ccd9cf584b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

oleaut32

powrprof

batmeter

winmm

shell32

shlwapi

ole32

slc

rpcrt4

gdiplus

uxtheme

wlanapi

wmi

comctl32

dwmapi

wtsapi32

ntdll

Sections

.text Size: 125KB - Virtual size: 125KB

.data Size: 2KB - Virtual size: 4KB

.rsrc Size: 781KB - Virtual size: 780KB

.reloc Size: 36KB - Virtual size: 38KB

.text
Size: 125KB - Virtual size: 125KB

.data
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 781KB - Virtual size: 780KB

.reloc
Size: 36KB - Virtual size: 38KB