70633dcce6c44267c5073c800013b96fec4b3cd6f4dce2c86e41b2c70e4761f3N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

70633dcce6c44267c5073c800013b96fec4b3cd6f4dce2c86e41b2c70e4761f3N.exe
Size

1.5MB
MD5

f509e7803c1deb94adf7fb9a42764350
SHA1

6367ab6d80c70eeb233f90bf79cb29f2f339e14f
SHA256

70633dcce6c44267c5073c800013b96fec4b3cd6f4dce2c86e41b2c70e4761f3
SHA512

2d54141bd052acb48a1437a8d239d0c89e33157468f8d0a015567b93f57477f586811b65bf111cff5a98a99957fabccf95b121d6497e6a770a21da603f97363e
SSDEEP

24576:j3DYvW2MI3POgNLadFbj2QSmzlgRQY8x:6F//SMmWRQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
70633dcce6c44267c5073c800013b96fec4b3cd6f4dce2c86e41b2c70e4761f3N.exe

Files

70633dcce6c44267c5073c800013b96fec4b3cd6f4dce2c86e41b2c70e4761f3N.exe
.dll regsvr32 windows:5 windows x86 arch:x86

a4c8540f74798d93a5f3f27aed12a9f6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Users\hojin\Desktop\새 폴더\SourceCode\SourceCode\W2PDesigner\W2PDesigner\Release\W2PDesigner.pdb

Imports

gdiplus

GdipDisposeImageAttributes
GdipDeleteBrush
GdipCreatePen1
GdipDeletePen
GdipCreateStringFormat
GdipDeleteStringFormat
GdipCreatePath
GdipDeletePath
GdipSetPathGradientPresetBlend
GdipSetPathGradientFocusScales
GdipDeleteGraphics
GdipGetHemfFromMetafile
GdiplusShutdown
GdipDrawImageI
GdipCreateLineBrushFromRect
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetFamilyName
GdipCloneImage
GdipCloneFont
GdipCloneBrush
GdipCreateImageAttributes
GdipGetFontSize
GdipGetFontStyle
GdipGetFamily
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipCreateRegionRect
GdipCreateRegion
GdipRecordMetafile
GdipCreateMetafileFromStream
GdipCreateMetafileFromEmf
GdipComment
GdipIsVisibleRect
GdipGetVisibleClipBounds
GdipGetClip
GdipResetClip
GdipSetClipRegion
GdipSetClipRect
GdipEnumerateMetafileDestPointI
GdipEnumerateMetafileDestPoint
GdipDrawImageRectRect
GdipDrawImageRectI
GdipDrawImageRect
GdipAlloc
GdiplusStartup
GdipGetFontUnit
GdipDrawImage
GdipMeasureCharacterRanges
GdipMeasureString
GdipDrawString
GdipFillRegion
GdipFillPath
GdipFillRectangle
GdipGraphicsClear
GdipDrawRectangle
GdipTranslateWorldTransform
GdipSetSmoothingMode
GdipGetSmoothingMode
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipGetImageGraphicsContext
GdipCreateFromHDC
GdipCreatePathGradientFromPath
ord1
GdipClosePathFigure
GdipSetStringFormatMeasurableCharacterRanges
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipGetStringFormatAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipSetPenDashArray
GdipCreateSolidFill
GdipSetImageAttributesColorMatrix
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromScan0
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageHeight
GdipGetImageWidth
GdipSaveImageToStream
GdipDisposeImage
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipIsEmptyRegion
GdipGetRegionHRgn
GdipGetRegionBounds
GdipCombineRegionRect
GdipSetEmpty
GdipSetInfinite
GdipDeleteRegion
GdipFree

imm32

ImmGetCompositionWindow
ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext

kernel32

VirtualFree
IsProcessorFeaturePresent
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapDestroy
GetCommandLineA
HeapCreate
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
Sleep
ExitProcess
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
ExpandEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsValidCodePage
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
RaiseException
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
LoadLibraryW
GetLastError
SetLastError
GetModuleFileNameW
OutputDebugStringA
LoadLibraryA
InitializeCriticalSection
InterlockedIncrement
InterlockedDecrement
lstrlenW
SetThreadLocale
GetThreadLocale
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
MultiByteToWideChar
lstrcpynW
GetFullPathNameW
MulDiv
GetLocaleInfoW
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetTickCount
GlobalFree
GetCurrentThreadId
FreeLibrary
HeapFree
HeapAlloc
GetProcessHeap
FlushInstructionCache
GetCurrentProcess
GetVersionExW
CloseHandle
CreateThread
CreateProcessW
GetShortPathNameW
GetDateFormatW
GetTimeFormatW
DeleteFileW
GetTempFileNameW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
IsDebuggerPresent

user32

GetDlgItem
FillRect
GetScrollInfo
SetScrollInfo
IsMenu
DeleteMenu
GetMenuItemCount
GetMenuItemInfoW
SetMenuItemInfoW
DestroyMenu
SystemParametersInfoW
UnregisterClassA
DrawFocusRect
CreateDialogParamW
DialogBoxParamW
ChangeClipboardChain
DestroyAcceleratorTable
DestroyCursor
SetCursor
MapWindowPoints
GetCursorPos
TranslateAcceleratorW
CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
GetKeyState
GetFocus
LoadMenuW
SetWindowPos
GetWindow
CallWindowProcW
DefWindowProcW
GetSubMenu
BeginPaint
EndPaint
GetWindowDC
LoadImageW
GetClipboardFormatNameW
GetMonitorInfoW
MonitorFromWindow
EndDialog
GetSysColor
MoveWindow
SetRect
IsDlgButtonChecked
MessageBeep
SetClipboardViewer
GetParent
SetCapture
ReleaseCapture
GetCapture
GetDlgCtrlID
EnumChildWindows
DestroyIcon
LoadIconW
GetMessagePos
CheckDlgButton
InsertMenuItemW
IntersectRect
SetClipboardData
EmptyClipboard
SendMessageW
GetActiveWindow
GetDesktopWindow
CreateWindowExW
DestroyWindow
SetFocus
ShowWindow
GetClientRect
SetWindowLongW
RegisterClipboardFormatW
RegisterWindowMessageA
GetSystemMetrics
GetKeyboardState
GetKeyboardLayout
ToUnicodeEx
SetTimer
GetDC
KillTimer
UnionRect
OffsetRect
InflateRect
RedrawWindow
PtInRect
IsRectEmpty
CopyRect
DrawFrameControl
IsWindow
GetClassInfoExW
RegisterClassExW
LoadCursorW
CharNextW
SetScrollPos
ScrollWindowEx
IsWindowEnabled
IsWindowVisible
InvalidateRect
UpdateWindow
ReleaseDC
GetWindowRect
GetWindowTextW
SetWindowTextW
LoadAcceleratorsW
GetWindowLongW
EnableWindow

gdi32

CreateCompatibleDC
GetObjectType
StartPage
GetEnhMetaFileDescriptionW
GetEnhMetaFileBits
DeleteEnhMetaFile
CopyEnhMetaFileW
CopyMetaFileW
DeleteObject
CreateDCW
EnumFontFamiliesExW
SetBkColor
CreateFontIndirectW
CreateSolidBrush
SetTextColor
SetBkMode
SetViewportOrgEx
GetObjectW
CreateFontW
TextOutW
GetTextMetricsW
GetTextExtentPoint32W
RestoreDC
SaveDC
GetDeviceCaps
StartDocW
EndDoc
EndPage
SelectClipRgn
DeleteDC
GetObjectA
SelectObject
GetStockObject

advapi32

RegDeleteKeyW
RegCreateKeyW
RegSetValueExW
RegOpenKeyW
RegQueryValueExW
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey

shell32

ord190
SHGetMalloc
SHGetPathFromIDListW
SHGetDesktopFolder
ShellExecuteW
ord155

ole32

DoDragDrop
RegisterDragDrop
RevokeDragDrop
StringFromCLSID
OleInitialize
OleUninitialize
CoTaskMemFree
CLSIDFromString
ReleaseStgMedium
OleDuplicateData
CoTaskMemAlloc
CreateStreamOnHGlobal
CoCreateInstance

oleaut32

VariantClear
SysStringLen
SysFreeString
UnRegisterTypeLi
RegisterTypeLi
SysAllocString

atl90

ord31
ord23
ord44
ord43
ord32
ord30
ord64
ord15
ord49
ord56
ord61
ord68

shlwapi

PathFindExtensionW
PathFindFileNameW
StrToIntW
StrCmpIW
PathFileExistsW
StrNCatW
PathRemoveFileSpecW
PathAddBackslashW
StrCpyNW
StrCpyW
PathIsURLW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 242KB - Virtual size: 241KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a4c8540f74798d93a5f3f27aed12a9f6

Headers

File Characteristics

PDB Paths

Imports

gdiplus

imm32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

atl90

shlwapi

version

Exports

Exports

Sections

.text Size: 242KB - Virtual size: 241KB

.rdata Size: 44KB - Virtual size: 43KB

.data Size: 10KB - Virtual size: 17KB

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.reloc Size: 21KB - Virtual size: 21KB

.rmnet Size: 56KB - Virtual size: 60KB

.text
Size: 242KB - Virtual size: 241KB

.rdata
Size: 44KB - Virtual size: 43KB

.data
Size: 10KB - Virtual size: 17KB

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

.reloc
Size: 21KB - Virtual size: 21KB

.rmnet
Size: 56KB - Virtual size: 60KB