gmail-account-creator-x64[.]7z

Sharing

Copy URL Twitter E-mail

General

Target
gmail-account-creator-x64.7z
Size 67.7MB
Sample260710-sd5vgabv9l
SHA256 7983e7da395a9196685d4b03e5786beef7d4707efb664b3d35b2e129f8b0c2e2
MD5 6f3a6fb336562cc598495d7e7b36e3bb
SHA1 535e7dee425f17d65c6a74cb24a09f800357a3bb
SHA512 c0b4cf6b2b0f0f636436dbea9a0b1f8db43cf4bfbe86986775219bbd607fabdb524dbd8feaec8327045ae757024238ad34178478498273d170fd98496fe9c9a9
SSDEEP 1572864:aGCW5bLYCHTdQXiUiaphn/QSZfSJNhDQSMm+IEWAgAQClQ4E:aGd5YCz1UV/QS8hcG+plI
TLSH
T183F733CE71E4C20797BFF3A269AA6551BDC333E3867F41A1617BE2AA041EF441645F80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/gmail-account-creator-x64.exe

File Explorer

gmail-account-creator-x64.7z

.7z 67.7MB
gmail-account-creator-x64.exe

.exe 78.2MB

gmail-account-creator-x64.7z

SHA256 7983e7da395a9196685d4b03e5786beef7d4707efb664b3d35b2e129f8b0c2e2
MD5 6f3a6fb336562cc598495d7e7b36e3bb
SHA1 535e7dee425f17d65c6a74cb24a09f800357a3bb
SHA512 c0b4cf6b2b0f0f636436dbea9a0b1f8db43cf4bfbe86986775219bbd607fabdb524dbd8feaec8327045ae757024238ad34178478498273d170fd98496fe9c9a9
SSDEEP 1572864:aGCW5bLYCHTdQXiUiaphn/QSZfSJNhDQSMm+IEWAgAQClQ4E:aGd5YCz1UV/QS8hcG+plI
TLSH
T183F733CE71E4C20797BFF3A269AA6551BDC333E3867F41A1617BE2AA041EF441645F80
MD5 SHA1 SHA512 SSDEEP TLSH

gmail-account-creator-x64.exe

IMPHASH 093a6cd038fd14a54e7d359b46cb8dab
SHA256 ba5be09836c1061bb64f558f8614c1bb463276a026252937c9bdf2d06a530dc5
MD5 e96a33a7911b25568621e8b7201eadab
SHA1 dc32f39c9ca7626691daefcd37fa1eb51a7fd881
SHA512 9a08362c58cbce8b457b178a96c74572df0628fb2584d6d25e05b6c44f648467b327f0a2d79b581617807460bffb4b5727c503634ef7dbec8df43e60e121c928
SSDEEP 1572864:bx+HrqxhpssMkv/yXGKX6EyIUeSLAsRF3aRqq+aXelVsQO:bw+xh+sMkntKVyIY3RF3m+j
TLSH
T1B2082205BB6AA564E08EC47093570A834F2170DB223BA4FF91D551283F9A7F49B3E35E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6120512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Updater.pdb

kernel32

SetFileTime GetModuleHandleW VirtualProtect LoadLibraryExA FormatMessageW GetDiskFreeSpaceExW GetLastError GetTickCount64 GetConsoleWindow LoadLibraryA HeapAlloc HeapFree GetProcessHeap FreeConsole GetConsoleMode GetConsoleOutputCP Sleep DeleteFileW SetLastError WriteConsoleW GetModuleFileNameW LoadLibraryExW GetProcAddress CreateDirectoryW GetFullPathNameW FindFirstFileExW CreateFileW HeapReAlloc GetSystemTimePreciseAsFileTime GetTempPathW FindClose GlobalLock SetHandleInformation SetFileInformationByHandle GetFileInformationByHandleEx GetPhysicallyInstalledSystemMemory SetFileCompletionNotificationModes GlobalUnlock GetFileInformationByHandle GetModuleHandleA WriteFileEx ReadFileEx CreateFileMappingW MapViewOfFile CancelIo GetSystemInfo GetOverlappedResult GetStdHandle ReadFile GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW SetFilePointerEx CreateIoCompletionPort FindNextFileW PostQueuedCompletionStatus GlobalSize GlobalAlloc GlobalFree GetSystemTimeAsFileTime FreeLibrary GetQueuedCompletionStatusEx DuplicateHandle SetThreadErrorMode CloseHandle GetFinalPathNameByHandleW UnmapViewOfFile SetUnhandledExceptionFilter InitializeSListHead AddVectoredExceptionHandler GetCurrentProcess SetWaitableTimer CreateWaitableTimerExW Process32Next Process32First CreateToolhelp32Snapshot SwitchToThread GetCurrentThreadId GetCurrentThread WideCharToMultiByte GetUserPreferredUILanguages RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW WaitForSingleObjectEx lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex WaitForSingleObject MultiByteToWideChar GetEnvironmentVariableW GetCommandLineW QueryPerformanceFrequency CreateThread SleepEx QueryPerformanceCounter ExitProcess CreateEventW CompareStringOrdinal CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW WaitForMultipleObjects GetExitCodeProcess CreateEventA RemoveVectoredExceptionHandler SetThreadStackGuarantee

advapi32

ImpersonateAnonymousToken RevertToSelf GetTokenInformation RegCloseKey RegEnumKeyExW RegQueryValueExW SystemFunction036 RegOpenKeyExW OpenProcessToken

oleaut32

SysStringLen SysFreeString GetErrorInfo

ntdll

NtCreateNamedPipeFile RtlNtStatusToDosError NtReadFile NtCancelIoFileEx NtDeviceIoControlFile NtWriteFile NtCreateFile NtOpenFile

ws2_32

WSAIoctl WSASocketW ioctlsocket connect getsockopt getsockname WSAGetLastError shutdown bind closesocket getpeername WSAStartup WSACleanup getaddrinfo freeaddrinfo send setsockopt recv WSASend

bcrypt

BCryptGenRandom

crypt32

CertDuplicateCertificateChain CertAddCertificateContextToStore CertVerifyCertificateChainPolicy CertFreeCertificateContext CertCloseStore CertDuplicateCertificateContext CertFreeCertificateChain CertGetCertificateChain CertEnumCertificatesInStore CertOpenStore CertDuplicateStore

secur32

FreeCredentialsHandle DeleteSecurityContext QueryContextAttributesW AcquireCredentialsHandleA DecryptMessage EncryptMessage FreeContextBuffer AcceptSecurityContext InitializeSecurityContextW ApplyControlToken

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

user32

OpenClipboard GetClipboardData DefWindowProcA RegisterClassExA CreateWindowExA ReleaseDC GetDC DestroyIcon CreateIcon MapVirtualKeyW SetWindowLongW GetCursorPos SendInput CloseClipboard GetWindowLongPtrW DispatchMessageW TranslateMessage MsgWaitForMultipleObjectsEx PeekMessageW RegisterRawInputDevices SetWindowLongPtrW ShowWindow MessageBoxW GetSystemMetrics RedrawWindow FlashWindowEx GetClientRect CreateWindowExW RegisterClassExW DestroyWindow MonitorFromPoint ValidateRect SetWindowTextW TrackPopupMenu SetMenuDefaultItem EnableMenuItem PostMessageW GetForegroundWindow GetActiveWindow EmptyClipboard SetWindowPos GetSystemMenu ClientToScreen IsWindowVisible SetClipboardData LoadCursorW SetCursor ReleaseCapture ChangeDisplaySettingsExW GetWindowPlacement SetWindowPlacement GetMonitorInfoW MonitorFromWindow DefWindowProcW GetRawInputData GetWindowLongW GetMenu AdjustWindowRectEx MapVirtualKeyExW GetKeyboardState GetKeyboardLayout ToUnicodeEx TrackMouseEvent ScreenToClient GetTouchInputInfo MonitorFromRect CloseTouchInputHandle GetWindowRect SetCapture SystemParametersInfoA GetClipCursor ClipCursor ShowCursor GetKeyState IsIconic SetForegroundWindow SetWindowDisplayAffinity RegisterTouchWindow GetAsyncKeyState IsProcessDPIAware DestroyCursor RegisterWindowMessageA InvalidateRgn SendMessageW VkKeyScanW

shell32

ShellExecuteW DragQueryFileW DragFinish

gdi32

SelectObject CreateDIBSection SetPixelFormat DeleteDC GetDeviceCaps CreateRectRgn DescribePixelFormat BitBlt GetPixelFormat ChoosePixelFormat SwapBuffers DeleteObject CreateCompatibleDC

opengl32

wglDeleteContext wglMakeCurrent wglGetCurrentContext wglGetProcAddress wglCreateContext

d3dcompiler_47

D3DCompile

ole32

CoUninitialize CoInitializeEx RevokeDragDrop OleInitialize RegisterDragDrop CoCreateInstance

imm32

ImmGetContext ImmGetCompositionStringW ImmReleaseContext ImmAssociateContextEx

uxtheme

SetWindowTheme

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

vcruntime140

memset memcmp __CxxFrameHandler3 _CxxThrowException __C_specific_handler memcpy __current_exception __current_exception_context memmove

api-ms-win-crt-math-l1-1-0

fmod pow ceil tan round sin cos exp2f exp2 truncf ceilf roundf _hypotf powf tanf fmax fminf acos floor acosf fmaxf fmodf sinf floorf trunc __setusermatherr cosf fmaf atan2

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_c_exit _cexit strerror _set_app_type _register_thread_local_exe_atexit_callback _crt_atexit __p___argv __p___argc _configure_narrow_argv _exit terminate exit _initterm_e _initterm _initialize_narrow_environment _get_initial_narrow_environment _register_onexit_function _seh_filter_exe _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode