d15ee79e525442836c44c20f6b564aa4992c27dd5332537e472bdfd8d3a513ce

Sharing

Copy URL

Twitter E-mail

General

Target

d15ee79e525442836c44c20f6b564aa4992c27dd5332537e472bdfd8d3a513ce
Size

4.9MB
MD5

f9f5d032e48633fe3e14dff3d7a8ea56
SHA1

7dc7bacc624a2075606ae8b7195f4af6d2b33488
SHA256

d15ee79e525442836c44c20f6b564aa4992c27dd5332537e472bdfd8d3a513ce
SHA512

e9d7e2b67b30fec9becd0608213d4ee5f4cd87dcf9e0ba8b32dd62a8f90c6a0cdad0738ef5446bb3154f151cec225c5676a5713fa71ea284802a83692be23d3b
SSDEEP

49152:M8808Nj/P3CRggLTjlzjn2Q6ZeCCF4+ITov6g7apCW9kf6LuoCrhyVCvPXZLWgnf:6bNj/vC2Qhj4JT+cI9y5kXZLTW8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d15ee79e525442836c44c20f6b564aa4992c27dd5332537e472bdfd8d3a513ce

Files

d15ee79e525442836c44c20f6b564aa4992c27dd5332537e472bdfd8d3a513ce
.exe windows:5 windows x86 arch:x86

68325d4a08b5e62f8184409464e5d11d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LeaveCriticalSection
EnterCriticalSection
lstrlenA
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
GetFileSizeEx
GetFileInformationByHandle
InterlockedCompareExchange
WTSGetActiveConsoleSessionId
CreateFileA
GetDriveTypeW
GetEnvironmentVariableW
GetLongPathNameW
CreateDirectoryW
GetFileAttributesExW
GetFileAttributesW
SetFileAttributesW
FileTimeToSystemTime
WriteFile
GetVersionExW
GetVolumeInformationW
GetTickCount
GetSystemInfo
MultiByteToWideChar
CreateFileW
ReadFile
GetFileSize
HeapSize
HeapReAlloc
HeapDestroy
DeviceIoControl
CreateProcessW
GetLogicalDriveStringsW
lstrcpyW
WaitForSingleObject
GetCurrentThreadId
GetExitCodeProcess
GetCurrentProcess
GetProcessHeap
HeapFree
HeapAlloc
VirtualFree
VirtualAlloc
LocalAlloc
GlobalFree
GlobalAlloc
WritePrivateProfileStringW
GetPrivateProfileIntW
WideCharToMultiByte
SetCurrentDirectoryW
OutputDebugStringA
GetModuleHandleW
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
InterlockedDecrement
InterlockedIncrement
GetCurrentProcessId
CopyFileW
FormatMessageW
GetLastError
QueryDosDeviceW
SetPriorityClass
LocalFree
GetPrivateProfileStringW
TerminateProcess
lstrlenW
GetTempPathW
CreateThread
MoveFileExW
FindNextFileW
FindFirstFileW
RemoveDirectoryW
FindClose
GetSystemDirectoryW
LoadLibraryW
GetProcAddress
FreeLibrary
Process32NextW
SetEndOfFile
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
SetStdHandle
GetCurrentDirectoryW
FlushFileBuffers
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
WriteConsoleW
GetConsoleCP
GetACP
SetConsoleCtrlHandler
ExitProcess
SetFilePointerEx
SystemTimeToTzSpecificLocalTime
ExitThread
RtlUnwind
FindNextFileA
FindFirstFileA
Process32FirstW
CreateToolhelp32Snapshot
DeleteFileW
CloseHandle
Sleep
OpenProcess
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
IsBadReadPtr
GetVersionExA
GetLocalTime
FindResourceW
SizeofResource
LockResource
LoadResource
FreeResource
GetFullPathNameW
FlushInstructionCache
HeapCreate
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
SetEvent
OutputDebugStringW
GlobalUnlock
GlobalLock
MulDiv
SystemTimeToFileTime
GetSystemTime
ReadConsoleW
WaitForSingleObjectEx
SwitchToThread
GetCurrentThread
EncodePointer
SetLastError
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
QueryPerformanceCounter
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
FormatMessageA
InitializeCriticalSection
SleepEx
WaitForMultipleObjects
GetFileType
GetStdHandle
PeekNamedPipe
ExpandEnvironmentStringsA
VerSetConditionMask
LoadLibraryA
GetModuleHandleA
GetSystemDirectoryA
VerifyVersionInfoA
GetModuleHandleExW
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetConsoleMode
SetConsoleMode
ReadConsoleA

user32

SetForegroundWindow
SetWindowLongW
GetKeyState
wsprintfW
GetClassNameW
PeekMessageW
SystemParametersInfoW
DispatchMessageW
TranslateMessage
LoadStringW
UnregisterClassW
SendMessageW
MonitorFromRect
GetWindowRect
SetWindowTextW
ReleaseDC
GetDC
SetWindowPos
ShowWindow
FindWindowW
GetDesktopWindow
SetActiveWindow
EnableWindow
SetMenuContextHelpId
GetMenuItemInfoW
SetMenuInfo
GetMenuInfo
TrackPopupMenu
DeleteMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
CheckMenuItem
DestroyMenu
PostMessageW
GetWindowLongW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
InflateRect
OffsetRect
DrawIconEx
GetIconInfo
LoadCursorW
DestroyCursor
IsWindow
DestroyWindow
SetTimer
KillTimer
SetCursor
CopyRect
IntersectRect
UnionRect
IsRectEmpty
EqualRect
PtInRect
CharNextW
DestroyIcon
SetFocus
GetFocus
DefWindowProcW
CallWindowProcW
RegisterClassExW
CreateWindowExW
GetDlgItem
GetActiveWindow
GetClientRect
MapWindowPoints
GetParent
GetWindow
MonitorFromWindow
GetMonitorInfoW
TrackMouseEvent
PostQuitMessage
AnimateWindow
SetLayeredWindowAttributes
IsIconic
IsZoomed
GetCapture
SetCapture
ReleaseCapture
UpdateWindow
BeginPaint
EndPaint
InvalidateRect
GetCursorPos
ScreenToClient
LoadBitmapW
CreateIconFromResource
LoadImageW
GetMessageW
ClientToScreen
SetRect
EnableMenuItem
GetSysColor
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetSystemMetrics
LoadIconW
GetWindowPlacement
IsWindowVisible
DrawTextW
SystemParametersInfoA
CharLowerBuffW
MapVirtualKeyA
UpdateLayeredWindow
IsMenu
IsWindowEnabled
CreatePopupMenu

gdi32

GetStockObject
GetClipBox
CreateSolidBrush
CreatePen
Rectangle
CreateBitmap
EnumFontsW
BitBlt
SetViewportOrgEx
SetBkMode
SetTextColor
GetDCOrgEx
StretchBlt
CreateCompatibleBitmap
GetCurrentObject
GetViewportOrgEx
CreateFontIndirectW
GetObjectW
CreateDIBSection
SetWorldTransform
SetGraphicsMode
SelectObject
SelectClipRgn
IntersectClipRect
ExtCreateRegion
GetFontUnicodeRanges
GetDeviceCaps
DeleteObject
GetGlyphIndicesW
DeleteDC
CreateCompatibleDC
GetTextExtentPointI
AddFontMemResourceEx
RemoveFontMemResourceEx
SetTextAlign
GetTextMetricsW
EnumFontFamiliesExW
GetCharABCWidthsW
GetFontData
GetGlyphOutlineW
GdiFlush
GetTextFaceW
ExtTextOutW
GetOutlineTextMetricsW

advapi32

CryptGenRandom
RegQueryValueExA
RegFlushKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptReleaseContext
OpenProcessToken
CreateProcessAsUserW
RegDeleteTreeW
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
CloseServiceHandle
ControlService
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
StartServiceW
RegCreateKeyExW
RegDeleteKeyW
RegQueryValueExW
RegCreateKeyExA
RegDeleteKeyExW
RegEnumKeyW
GetTokenInformation
SetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupAccountSidW
DuplicateTokenEx
RevertToSelf
CryptAcquireContextW
ImpersonateLoggedOnUser
RegOpenKeyW

shell32

SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
ShellExecuteW
SHGetFolderPathW
SHGetSpecialFolderPathA
SHChangeNotify

ole32

CoCreateGuid
CLSIDFromProgID
CLSIDFromString
OleLockRunning
IIDFromString
CreateStreamOnHGlobal
OleInitialize
CoCreateInstance
OleUninitialize
CreateBindCtx
CoInitialize
CoUninitialize
CoTaskMemFree

crypt32

CertGetNameStringW
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CryptMsgClose
CryptQueryObject

psapi

EnumProcessModules
GetModuleFileNameExW
GetProcessImageFileNameW

shlwapi

StrToIntExW
SHDeleteKeyW
PathFileExistsW
SHDeleteValueW
PathAddBackslashW
SHGetValueW
SHSetValueW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wtsapi32

WTSQueryUserToken

gdiplus

GdipSaveImageToFile
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipGetImageWidth
GdipAlloc
GdipGetImageGraphicsContext
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectI
GdipGraphicsClear
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipFree
GdipGetImageHeight

imm32

ImmDestroyContext
ImmCreateContext
ImmGetContext
ImmAssociateContext
ImmReleaseContext

wldap32

ord30
ord200
ord301
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord60
ord211
ord46
ord143
ord79

ws2_32

WSAIoctl
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
recv
WSASetLastError
gethostname
select
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup
recvfrom
freeaddrinfo
ioctlsocket
listen
accept
sendto
getaddrinfo

oleaut32

SysFreeString
SysAllocString

usp10

ScriptFreeCache
ScriptItemize
ScriptShape

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 943KB - Virtual size: 943KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 75KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 154KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 254KB - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

68325d4a08b5e62f8184409464e5d11d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

crypt32

psapi

shlwapi

userenv

version

wtsapi32

gdiplus

imm32

wldap32

ws2_32

oleaut32

usp10

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.rdata Size: 943KB - Virtual size: 943KB

.data Size: 75KB - Virtual size: 185KB

.rsrc Size: 154KB - Virtual size: 154KB

.reloc Size: 254KB - Virtual size: 256KB

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 943KB - Virtual size: 943KB

.data
Size: 75KB - Virtual size: 185KB

.rsrc
Size: 154KB - Virtual size: 154KB

.reloc
Size: 254KB - Virtual size: 256KB