2cd006af0034c94a19e4fdcc6e443b9113c63e46a47843ba187bfee98d987777

Sharing

Copy URL

Twitter E-mail

General

Target

2cd006af0034c94a19e4fdcc6e443b9113c63e46a47843ba187bfee98d987777
Size

2.7MB
MD5

f8c0b8f2ed911a9eeebf2dace1e5df05
SHA1

40b6c82d9058aaa8f9e93c04707963aaac837992
SHA256

2cd006af0034c94a19e4fdcc6e443b9113c63e46a47843ba187bfee98d987777
SHA512

e719a99ca0f66a9e2b3795ae49bc5aaf89b8a13b341b1ea81a3963a665ea4fe696eacd3ab33f03b05e23d7bbbe8f16bd1422b612c1b2622d39be4d5761b0ff03
SSDEEP

49152:n+3GXB6qFrciGI4wLwTC8CtXa2w8uiHvGWbm3mjab28rzPvfmMrF9s2:n8oRrVLw7CtXawn83mW24r3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2cd006af0034c94a19e4fdcc6e443b9113c63e46a47843ba187bfee98d987777

Files

2cd006af0034c94a19e4fdcc6e443b9113c63e46a47843ba187bfee98d987777
.exe windows:6 windows x86 arch:x86

a5acfcd44e93b90714415ad179f8e864

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

dbghelp

MakeSureDirectoryPathExists

kernel32

EnterCriticalSection
GetShortPathNameW
QueryDepthSList
ReleaseSemaphore
VirtualProtect
GetThreadTimes
UnregisterWait
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SignalObjectAndWait
CreateTimerQueue
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeZoneInformation
GetConsoleMode
GetConsoleOutputCP
GetFileType
FreeLibraryAndExitThread
ExitThread
InterlockedFlushSList
RtlUnwind
lstrcmpA
DeviceIoControl
GetSystemWindowsDirectoryW
UnregisterWaitEx
RegisterWaitForSingleObject
HeapFree
K32EnumProcessModules
GetTempFileNameW
lstrcpyW
GetCurrentProcessId
K32EnumProcesses
SetFileAttributesW
OpenProcess
GetFileAttributesW
CreateFileW
FindClose
SetFilePointer
K32GetModuleFileNameExW
RemoveDirectoryW
TerminateProcess
OutputDebugStringA
GetModuleHandleExW
GetModuleHandleExA
GetModuleHandleA
SetFilePointerEx
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
SetThreadPriority
CreateThread
InterlockedCompareExchange
InterlockedExchange
SizeofResource
GetVersion
ResetEvent
GlobalFree
GlobalAlloc
GlobalUnlock
GlobalLock
IsBadReadPtr
WriteFile
lstrlenW
FindNextFileW
GetFullPathNameW
FindFirstFileW
GetStartupInfoW
GetACP
ExitProcess
FreeResource
MulDiv
FlushFileBuffers
GetFileSizeEx
OpenFileMappingW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
DosDateTimeToFileTime
LocalFileTimeToFileTime
LocalFree
GetLocalTime
GetCurrentProcess
CreateProcessW
lstrcpynW
SetLastError
GetVersionExW
GetTickCount
VerifyVersionInfoW
VerSetConditionMask
LoadLibraryExW
lstrcmpiW
GetCurrentThreadId
SetErrorMode
lstrcmpW
WideCharToMultiByte
GetTickCount64
CreateMutexW
GetCommandLineW
GetPrivateProfileStringW
GetModuleFileNameW
WritePrivateProfileStringW
MoveFileW
CopyFileW
FreeLibrary
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
MoveFileExW
GetProcAddress
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
LoadResource
FindResourceExW
LoadLibraryW
RaiseException
CloseHandle
HeapReAlloc
DeleteFileW
LockResource
SetEvent
ReleaseMutex
GetStdHandle
SetEndOfFile
ReadFile
GetLastError
MultiByteToWideChar
CreateEventW
HeapSize
WaitForSingleObject
InitializeCriticalSectionEx
GetFileSize
InitializeCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
CreateDirectoryW
GetTempPathW
SetFileTime
GetCPInfo
GetLocaleInfoW
LCMapStringW
ResumeThread
IsProcessorFeaturePresent
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetNativeSystemInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
EncodePointer
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
LoadLibraryExA
FormatMessageW
GetStringTypeW
TryEnterCriticalSection
QueryPerformanceFrequency
DuplicateHandle
WaitForSingleObjectEx
Sleep
SwitchToThread
GetCurrentThread

user32

UpdateWindow
PtInRect
MsgWaitForMultipleObjectsEx
GetQueueStatus
CallMsgFilterW
ReleaseCapture
SetForegroundWindow
WaitMessage
PeekMessageW
EqualRect
IsWindowEnabled
CreateAcceleratorTableW
InvalidateRgn
GetWindowTextW
GetDlgCtrlID
GetMessagePos
FillRect
DrawFocusRect
RemovePropW
GetWindowDC
SetWindowTextW
GetWindowTextLengthW
CallWindowProcW
LoadImageW
DestroyIcon
UnregisterClassW
PostMessageW
MessageBoxW
CharNextW
DestroyWindow
DefWindowProcW
EndPaint
BeginPaint
GetCursorPos
ReleaseDC
CharPrevW
MoveWindow
GetIconInfo
LoadStringW
GetMessageW
DispatchMessageW
TranslateMessage
InvalidateRect
RegisterClassExW
LoadCursorW
GetClassInfoExW
CreateDialogParamW
FindWindowW
GetSystemMetrics
GetWindowLongW
GetWindow
GetWindowRect
GetDC
IsWindowVisible
SetWindowPos
MonitorFromWindow
CreateWindowExW
ScreenToClient
SendMessageW
ShowWindow
IsWindow
GetAsyncKeyState
SetTimer
GetMonitorInfoW
SwitchToThisWindow
MapWindowPoints
SetFocus
LoadIconW
SetCapture
SetWindowLongW
GetClientRect
IsZoomed
UpdateLayeredWindow
KillTimer
PostQuitMessage
GetDesktopWindow
SystemParametersInfoW
GetParent
RegisterWindowMessageW
wsprintfW
EnableWindow
RegisterClassW
SetPropW
GetPropW
AdjustWindowRectEx
GetMenu
GetKeyState
GetUpdateRect
IsRectEmpty
UnionRect
IntersectRect
GetFocus
GetClassNameW
IsChild
CreateCaret
SetCaretPos
GetCaretBlinkTime
CopyRect
SetCursor
IsIconic
SetWindowRgn
OffsetRect
InflateRect
wvsprintfW
FindWindowExW
ShowCaret
HideCaret
ClientToScreen
GetSysColor
DrawIconEx
DrawTextW
SetRect

gdi32

StretchBlt
SetDIBColorTable
SetBkMode
SetBkColor
CombineRgn
ExtSelectClipRgn
GetTextMetricsW
SetTextColor
OffsetViewportOrgEx
GetCharABCWidthsW
TextOutW
CreateSolidBrush
GetClipBox
GetTextColor
SetDIBitsToDevice
CreateDCW
SetViewportOrgEx
RectVisible
SetStretchBltMode
GetDeviceCaps
GetTextExtentPoint32W
CreateRoundRectRgn
GetStockObject
CreateFontIndirectW
CreatePen
Rectangle
SetWindowOrgEx
ExtTextOutW
GetDIBits
BitBlt
CreateCompatibleBitmap
SaveDC
SelectObject
CreateDIBSection
CreateCompatibleDC
CreateRectRgnIndirect
DeleteDC
SelectClipRgn
GetObjectW
RestoreDC
DeleteObject

advapi32

SetSecurityDescriptorDacl
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegCloseKey
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
RegCreateKeyW
InitializeSecurityDescriptor
RegQueryValueExW

shell32

ShellExecuteW
SHCreateDirectoryExW
Shell_NotifyIconW
SHFileOperationW
ShellExecuteExW
SHGetSpecialFolderPathW
ord165
SHChangeNotify

ole32

CoTaskMemAlloc
CoUninitialize
CoTaskMemFree
CoTaskMemRealloc
CoInitialize
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
OleLockRunning
CoCreateGuid
CreateStreamOnHGlobal

oleaut32

SysAllocStringLen
VarUI4FromStr
SysFreeString
SysStringLen
VariantInit
VariantClear
SysAllocString

shlwapi

StrTrimA
SHAutoComplete
StrCmpIW
StrCmpNIW
PathRemoveFileSpecW
PathFileExistsW
SHDeleteKeyW
StrStrIW
StrStrIA
PathIsDirectoryW
PathAppendW
PathCombineW
StrCpyW
PathIsDirectoryA
AssocQueryStringW
PathFileExistsA
PathFindFileNameW
SHSetValueW
SHGetValueW

comctl32

ImageList_DrawEx
ord17
_TrackMouseEvent
InitCommonControlsEx
ImageList_GetIconSize

msimg32

GradientFill
AlphaBlend

gdiplus

GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipAddPathArc
GdipGetImagePixelFormat
GdipLoadImageFromFile
GdipDrawEllipseI
GdipClosePathFigure
GdipSaveImageToFile
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCloneBitmapAreaI
GdipBitmapUnlockBits
GdipDrawImagePointsI
GdipCreateHBITMAPFromBitmap
GdipDrawImageRectRectI
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipFillPath
GdipCreateTexture
GdipSetInterpolationMode
GdipGetImageGraphicsContext
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipImageSelectActiveFrame
GdipDrawImageRectI
GdipGraphicsClear
GdipGetImageHeight
GdipGetImageWidth
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipLoadImageFromStreamICM
GdipDisposeImage
GdipCloneImage
GdipFillEllipseI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipSetSmoothingMode
GdipDrawPath
GdipAddPathArcI
GdipSetStringFormatTrimming
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDrawString
GdipCreateFont
GdipDeleteFontFamily
GdipDeletePath
GdipCreatePath
GdipDrawRectangleI
GdipSetPenMode
GdipDrawLineI
GdipSetPenDashStyle
GdipDeletePen
GdipCreatePen1
GdipDeleteGraphics
GdipCreateFromHDC
GdipFree
GdipAlloc
GdiplusStartup
GdiplusShutdown
GdipCreateFontFamilyFromName
GdipDrawImageRectRect
GdipFillRectangleI
GdipSetTextRenderingHint
GdipAddPathLineI

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

crypt32

CertGetNameStringW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

urlmon

URLDownloadToFileW
URLDownloadToCacheFileW

winmm

timeBeginPeriod
timeGetTime
timeEndPeriod

wininet

InternetSetCookieW
InternetCrackUrlW
InternetGetCookieExW
InternetGetConnectedState

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 344KB - Virtual size: 344KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 400KB - Virtual size: 400KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a5acfcd44e93b90714415ad179f8e864

Headers

DLL Characteristics

File Characteristics

Imports

dbghelp

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

version

crypt32

wintrust

urlmon

winmm

wininet

iphlpapi

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 344KB - Virtual size: 344KB

.data Size: 34KB - Virtual size: 75KB

.rsrc Size: 400KB - Virtual size: 400KB

.reloc Size: 105KB - Virtual size: 105KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 344KB - Virtual size: 344KB

.data
Size: 34KB - Virtual size: 75KB

.rsrc
Size: 400KB - Virtual size: 400KB

.reloc
Size: 105KB - Virtual size: 105KB