d4735112f50489f869e528f893380683c96561eb2b70d4788509502264093201

Sharing

Copy URL Twitter E-mail

General

Target
d4735112f50489f869e528f893380683c96561eb2b70d4788509502264093201
Size 10.8MB
Sample260730-pec93axblf
SHA256 d4735112f50489f869e528f893380683c96561eb2b70d4788509502264093201
MD5 24b0a40435a099ea20b9b63d02f62dfb
SHA1 fad933bae85a81bc9b59ce5986194ada979932b8
SHA512 27ccc046e139076e0b3992d5f8e3a2786b53c5982746c2786e4b22181e71435c2cf775aa750e8151788c320a61601e150c66844c9b0a95707ba924de0ae8564b
SSDEEP 196608:Yd7sqR8pZZv/raokBE31K0zUsdq1/lmVlpOOo1VIXnJpvoCp:PqGpzQBq10EogV7OX1Vk7p
TLSH
T193B60233B16180A0C659193565722F3D3DF44FA95EA1D8ABFBA4FCE43D324A1A737209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d4735112f50489f869e528f893380683c96561eb2b70d4788509502264093201

File Explorer

d4735112f50489f869e528f893380683c96561eb2b70d4788509502264093201

.exe 10.8MB

d4735112f50489f869e528f893380683c96561eb2b70d4788509502264093201

IMPHASH e1b2140935fa1b81f8058ee5302d2575
SHA256 d4735112f50489f869e528f893380683c96561eb2b70d4788509502264093201
MD5 24b0a40435a099ea20b9b63d02f62dfb
SHA1 fad933bae85a81bc9b59ce5986194ada979932b8
SHA512 27ccc046e139076e0b3992d5f8e3a2786b53c5982746c2786e4b22181e71435c2cf775aa750e8151788c320a61601e150c66844c9b0a95707ba924de0ae8564b
SSDEEP 196608:Yd7sqR8pZZv/raokBE31K0zUsdq1/lmVlpOOo1VIXnJpvoCp:PqGpzQBq10EogV7OX1Vk7p
TLSH
T193B60233B16180A0C659193565722F3D3DF44FA95EA1D8ABFBA4FCE43D324A1A737209
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10013349

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalFlags GetCurrentThread GetFileTime GetFileSize TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc lstrcmpA GetVersion GlobalGetAtomNameA GlobalAddAtomA GlobalDeleteAtom lstrcmpiA SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer DuplicateHandle lstrcpynA SetLastError FileTimeToLocalFileTime FileTimeToSystemTime LocalFree InterlockedDecrement InterlockedIncrement SetErrorMode GetProcessVersion GetCPInfo GetOEMCP GetStartupInfoA RtlUnwind RaiseException GetTimeZoneInformation GetSystemTime GetLocalTime TerminateProcess HeapSize GetACP UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableA LCMapStringA LCMapStringW VirtualAlloc IsBadWritePtr GetStringTypeA GetStringTypeW SetUnhandledExceptionFilter CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr WideCharToMultiByte MultiByteToWideChar GetCurrentProcess GetWindowsDirectoryA GetSystemDirectoryA TerminateThread CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource ReadFile lstrlenW RemoveDirectoryA GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetUserDefaultLCID GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA GetPrivateProfileStringA CreateThread CreateEventA Sleep ExpandEnvironmentStringsA GlobalAlloc GlobalLock GlobalUnlock GetTempPathA FindFirstFileA FindClose SetFileAttributesA GetFileAttributesA DeleteFileA CopyFileA CreateDirectoryA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount CreateProcessA WaitForSingleObject CloseHandle SetStdHandle GlobalFindAtomA VirtualQuery GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW LoadLibraryA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep FreeLibrary GetTickCount GlobalFree GetProcAddress LocalAlloc LocalFree ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetCommandLineA RaiseException RtlUnwind HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapReAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount SetStdHandle LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

GetWindowTextA SetWindowTextA GetMenuItemCount GetMenuItemID GetMenuStringA GetMenuState GetTabbedTextExtentA DrawStateA GrayStringA TabbedTextOutA WindowFromDC EnumChildWindows GetWindowDC UnhookWindowsHookEx CallNextHookEx SetWindowsHookExA FrameRect GetPropA MoveWindow CallWindowProcA SetPropA DrawTextA GetCursor LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu UnregisterClassA GetForegroundWindow GetSysColorBrush ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA DefWindowProcA GetSystemMenu DeleteMenu GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos SetRect InflateRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild TrackPopupMenu DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBoxA GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA WaitForInputIdle EnableMenuItem GetWindowTextLengthA CharUpperA BeginPaint EndPaint GetDlgItem DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetLastActivePopup GetMessageTime RemovePropA GetClassLongA CreateWindowExA RegisterClassA GetScrollPos AdjustWindowRectEx MapWindowPoints SendDlgItemMessageA ScrollWindowEx IsDialogMessageA CheckMenuItem SetMenuItemBitmaps GetMenuCheckMarkDimensions GetClassNameA GetDesktopWindow LoadStringA GetUserObjectInformationW CharUpperBuffW MessageBoxW GetProcessWindowStation GetProcessWindowStation GetUserObjectInformationW

gdi32

RestoreDC SaveDC SetWindowOrgEx SetTextColor SetBkMode SetBkColor CreateRectRgnIndirect SetPixel SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateEllipticRgn CreateRoundRectRgn CreatePenIndirect GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBrushIndirect CreateBitmap CreatePen PatBlt CombineRgn CreateRectRgn FillRgn CreateSolidBrush CreateFontIndirectA GetStockObject GetObjectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt GetPixel CreateCompatibleDC SetPixelV Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps PtVisible RectVisible TextOutA ExtTextOutA Escape ExtSelectClipRgn GetViewportExtEx GetTextMetricsA GetTextColor SelectObject LineTo MoveToEx ExcludeClipRect GetClipBox ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode SetROP2 SetPolyFillMode

winmm

waveOutGetNumDevs waveOutPrepareHeader waveOutUnprepareHeader waveOutOpen midiOutUnprepareHeader midiStreamOpen waveOutClose midiOutPrepareHeader midiStreamOut midiStreamStop midiOutReset midiStreamClose midiStreamRestart waveOutReset waveOutPause midiStreamProperty waveOutWrite

msimg32

GradientFill

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

advapi32

RegQueryValueA RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegCloseKey RegQueryValueExA

shell32

SHGetSpecialFolderPathA Shell_NotifyIconA ShellExecuteA

ole32

CLSIDFromProgID OleRun CoCreateInstance CLSIDFromString OleUninitialize OleInitialize

oleaut32

LoadTypeLi LHashValOfNameSys RegisterTypeLi SysAllocString VariantClear VariantChangeType VariantCopyInd VariantInit UnRegisterTypeLi

comctl32

ImageList_Destroy ImageList_Create ImageList_Read ImageList_DrawIndirect ord17 ImageList_AddMasked _TrackMouseEvent ImageList_Draw ImageList_SetBkColor ImageList_GetImageCount ImageList_GetImageInfo ImageList_GetIcon ImageList_Duplicate

ws2_32

inet_ntoa WSACleanup closesocket WSAAsyncSelect recvfrom ioctlsocket recv getpeername accept

comdlg32

GetFileTitleA GetOpenFileNameA ChooseColorA GetSaveFileNameA

wtsapi32

WTSSendMessageW

i��ݮ��q��ߗ�� C�<z��?མ��P�Ba��F�9��z��%1��<��a<n��Y�HhõteH�g9ӝV~��uЩu~�K�/�T��MZGVvsP��}&u�>�-��N+��\!q�gܗ<�VQg��F)��g�� y�jQ^]:�>��t�pj�eg�hyʕ˴�X�Swz��i�Y�?��|��E~ Ϫ�w%��G�c�DoqK�J2v��!�Ղt�@��HAZN��tK#�UM��.��48��Q��]�禊�>J��I<�b�R�tI}��j�0��x�T�N{�y-%ٟ��k�k7]!��-2�ic �o� ��u�E'��W#��d�^�cG��=!u)��yL�v�Ze�.��>��15L�X,G�1�3qU�]>�S��@2��K4<�� S�6�z��+f?qL6_��Lqm�jAZK�+��3%��B�;�oKbcv��G��⤞��?tj�Rl�E+��>�3Q=d�L�ǁ6��»fUe�ʷxҎ��^T��M[��U�7��jйqX��c��k`�ҏ!� �TF�X��jKd��V��_��m\2�:��4�I��(��nPZ0��ޗ<*�>1ȸd�?%&�<��i�V{��V�q��@'ٞ:b�}"DRcȔ�U�j��z��@@�(>L��oXj�xᱮ�9_�Y݈[;�D��Ô��լG5+�s �1?�j5P�e��)�Y<e�V ��`n�kڐG%��N:��>��X�F-/x�Q6��O؄�<X4�I�]_u|��RN��~V��Hjf]1��n|@~_x��X�"B�NxjO�'��̢�CY�+��_��qJ7�O��~��^ޔ#��.�8(��%��^��/6�pì��]��@�c��[.?{�![1�sL��O�-�K��?�0z��\�,��c��؃�)�ʡ�o˨!��f��1�R��&��ߌ��U�!��g��B�A��Mr��~1)��9gB�X;��Y��V��d�`�^��=?") `ĺ�r��F�C��P�x��-��u1�U��E��|M>ܙ��v��ʜ0�3'r]�� R;��r�Ot�S�v�?��K�*tH�k_^��!��F�z=��d�ZuO��g?+��(�@�"��M�� AA�e�o��Z�ziT�c"(�ȸ�o��.?ga��o�̀lbP�_�`4��^bʀv��j��d�}A��K�I�8��hȼ��{J�c.0y�4v1�,-j�,��Ï�"��]],IMN#p^"G��M��2˨Ǆ��.�K,�ۼ�+z��K͈�P�"ӥ<"yo��;�䅄X��-4��tK��Hg��i�$=��x\*y�u��a1a%�+Ŋ��lO��V��c�ԭL�,Y�C��}="��T�\��L?<�_�xm3<P5�1. k�rbt�_�ַvD|l��H%�ρ)�D��N�<�u�ي��8�Cq��]V�ȴ��>ӄy�իUO�/�M[�9��>��[6({��d��L�!�i�X޳Q�D��mo�@["S}~��&�&�r��,�n��_#��H��Y""�s��c�%`zTj��bU�T�\��#��^�y��j��#�?B��t��7�b5�x�^`�J�2�+3vh-f�i��5�c�~_ٻ��O�=�=~r��*��q��o+��s�V��K^�zwd��ֳ,XnG��M��>*w(��H2$mZ��XD��.�0��}�UW/�H��y慣 I�K�cӐ��\Vj��Ą��Ȟ�b�^j�H�+�v��6�p9ϙ�ɥ$�5��^�"�c��§�)��qW�ުe��bB�->�uw�Ի��v_Gzu��,��W|ё��ET4��(/<;V�t�gw�;t�N��G��B�΃�w뾉�l��<e�A�cC��Ȣ��E4�ϫ8y肽��G,��4'�mߴXl��3� A��,��"/K�)��]ˬّ� )�L��6�=��[I��=�Cm��[49�68K�+��lq�Ϊ�[��^��i�{�ً��KoD�{�j:.��j��)�� uO��]�n��8ƿ��U�'�8)q�1�B�=rbпh��u��h��뢩��O�`��p2)�ָ��7�� ΅v��Vr)��3�].�� Y�4�Z.48ݴs��J�(eJ��ձ��0o3Yﰹ�� J�o�c΢5�k_�r�O�x��Nc�!�=�G;�6�b:��>�c$0��IW��D��팤�11��w�Ń؁7�Y<g�f�~l;o噚i��L��b�y=%x*�l8��%Q�A�)�*[�4�.x�G%��#;(��Ԣ��k<�QcZ *?P��, ��>�E~�JJަ��B��l�j$�'�O;p1&P|�� {�@Vq#G��3(&O��_�8��)��@�z��0SV��eLB8@�}�w� c��E�Xz��&��#H��K)*Gl3 �*T,�E��q�Z��컥!�Î��Pz�j݃/AV�W��'ƀ��I�S�[t4��|�t�ߙ�v� g�#D.��.�F�V��0d�RUyh��8�f71�U^szX^;!ZH��hߙ|�ԁg��X��h4��﷒�j϶��F[(�E�#/��ا��߽Ţ��iQ�\$ȼn�@b�� @�f�Gc^2��gUgnIYm�=��ў�>{3)�8�v��j'� d h rT��"8�J��6`��Y��Z!�:�mmS��8Ew�p�\aͯ��܃� S�P��̣��a�i��-h�7� P ��B갴�N$&.b>`*��ӭ�Ș��H��M��~%DF�=��~�7R=��;>C�� b/ָ��4�x>׌��)�_�e�֮�e�ד'<iY6��

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

296KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

278KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ZoqAzh0

Size

6.6MB

Virtual Size

6.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

ZoqAzh1

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

184KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d4735112f50489f869e528f893380683c96561eb2b70d4788509502264093201

kernel32

user32

gdi32

winmm

msimg32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

wtsapi32

generic