035a0117478e4d12a67e5d43512b78735c404f18d98a7ff774c2137cb1e500f3

Sharing

Copy URL Twitter E-mail

General

Target
035a0117478e4d12a67e5d43512b78735c404f18d98a7ff774c2137cb1e500f3
Size 10.8MB
Sample260730-pefeesxbma
SHA256 035a0117478e4d12a67e5d43512b78735c404f18d98a7ff774c2137cb1e500f3
MD5 370d863196de371858ff838b63fa3121
SHA1 83bf0e0168682519c27e9e7f6097350d3a16a8c1
SHA512 70983c9005cbcec80ad3b60c39483483ad99e56b7b5885198097a7fd008552695c889c008893d2416c137167bcca20a3250a8abcae46d4efe850573ce3904b6e
SSDEEP 196608:Yd7sqx8pZZv/raokBE31K0zUsdq1/lmVlpOOo1VIXnJpvoCp:PqmpzQBq10EogV7OX1Vk7p
TLSH
T1B8B60233B16180A0C659193565722F3D3DF44FA95EA1D8ABFBA4FCE43D324A1A737209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
035a0117478e4d12a67e5d43512b78735c404f18d98a7ff774c2137cb1e500f3

File Explorer

035a0117478e4d12a67e5d43512b78735c404f18d98a7ff774c2137cb1e500f3

.exe 10.8MB

035a0117478e4d12a67e5d43512b78735c404f18d98a7ff774c2137cb1e500f3

IMPHASH e1b2140935fa1b81f8058ee5302d2575
SHA256 035a0117478e4d12a67e5d43512b78735c404f18d98a7ff774c2137cb1e500f3
MD5 370d863196de371858ff838b63fa3121
SHA1 83bf0e0168682519c27e9e7f6097350d3a16a8c1
SHA512 70983c9005cbcec80ad3b60c39483483ad99e56b7b5885198097a7fd008552695c889c008893d2416c137167bcca20a3250a8abcae46d4efe850573ce3904b6e
SSDEEP 196608:Yd7sqx8pZZv/raokBE31K0zUsdq1/lmVlpOOo1VIXnJpvoCp:PqmpzQBq10EogV7OX1Vk7p
TLSH
T1B8B60233B16180A0C659193565722F3D3DF44FA95EA1D8ABFBA4FCE43D324A1A737209
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10013349

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalFlags GetCurrentThread GetFileTime GetFileSize TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc lstrcmpA GetVersion GlobalGetAtomNameA GlobalAddAtomA GlobalDeleteAtom lstrcmpiA SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer DuplicateHandle lstrcpynA SetLastError FileTimeToLocalFileTime FileTimeToSystemTime LocalFree InterlockedDecrement InterlockedIncrement SetErrorMode GetProcessVersion GetCPInfo GetOEMCP GetStartupInfoA RtlUnwind RaiseException GetTimeZoneInformation GetSystemTime GetLocalTime TerminateProcess HeapSize GetACP UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableA LCMapStringA LCMapStringW VirtualAlloc IsBadWritePtr GetStringTypeA GetStringTypeW SetUnhandledExceptionFilter CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr WideCharToMultiByte MultiByteToWideChar GetCurrentProcess GetWindowsDirectoryA GetSystemDirectoryA TerminateThread CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource ReadFile lstrlenW RemoveDirectoryA GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetUserDefaultLCID GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA GetPrivateProfileStringA CreateThread CreateEventA Sleep ExpandEnvironmentStringsA GlobalAlloc GlobalLock GlobalUnlock GetTempPathA FindFirstFileA FindClose SetFileAttributesA GetFileAttributesA DeleteFileA CopyFileA CreateDirectoryA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount CreateProcessA WaitForSingleObject CloseHandle SetStdHandle GlobalFindAtomA VirtualQuery GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW LoadLibraryA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep FreeLibrary GetTickCount GlobalFree GetProcAddress LocalAlloc LocalFree ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetCommandLineA RaiseException RtlUnwind HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapReAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount SetStdHandle LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

GetWindowTextA SetWindowTextA GetMenuItemCount GetMenuItemID GetMenuStringA GetMenuState GetTabbedTextExtentA DrawStateA GrayStringA TabbedTextOutA WindowFromDC EnumChildWindows GetWindowDC UnhookWindowsHookEx CallNextHookEx SetWindowsHookExA FrameRect GetPropA MoveWindow CallWindowProcA SetPropA DrawTextA GetCursor LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu UnregisterClassA GetForegroundWindow GetSysColorBrush ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA DefWindowProcA GetSystemMenu DeleteMenu GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos SetRect InflateRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild TrackPopupMenu DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBoxA GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA WaitForInputIdle EnableMenuItem GetWindowTextLengthA CharUpperA BeginPaint EndPaint GetDlgItem DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetLastActivePopup GetMessageTime RemovePropA GetClassLongA CreateWindowExA RegisterClassA GetScrollPos AdjustWindowRectEx MapWindowPoints SendDlgItemMessageA ScrollWindowEx IsDialogMessageA CheckMenuItem SetMenuItemBitmaps GetMenuCheckMarkDimensions GetClassNameA GetDesktopWindow LoadStringA GetUserObjectInformationW CharUpperBuffW MessageBoxW GetProcessWindowStation GetProcessWindowStation GetUserObjectInformationW

gdi32

RestoreDC SaveDC SetWindowOrgEx SetTextColor SetBkMode SetBkColor CreateRectRgnIndirect SetPixel SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateEllipticRgn CreateRoundRectRgn CreatePenIndirect GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBrushIndirect CreateBitmap CreatePen PatBlt CombineRgn CreateRectRgn FillRgn CreateSolidBrush CreateFontIndirectA GetStockObject GetObjectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt GetPixel CreateCompatibleDC SetPixelV Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps PtVisible RectVisible TextOutA ExtTextOutA Escape ExtSelectClipRgn GetViewportExtEx GetTextMetricsA GetTextColor SelectObject LineTo MoveToEx ExcludeClipRect GetClipBox ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode SetROP2 SetPolyFillMode

winmm

waveOutGetNumDevs waveOutPrepareHeader waveOutUnprepareHeader waveOutOpen midiOutUnprepareHeader midiStreamOpen waveOutClose midiOutPrepareHeader midiStreamOut midiStreamStop midiOutReset midiStreamClose midiStreamRestart waveOutReset waveOutPause midiStreamProperty waveOutWrite

msimg32

GradientFill

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

advapi32

RegQueryValueA RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegCloseKey RegQueryValueExA

shell32

SHGetSpecialFolderPathA Shell_NotifyIconA ShellExecuteA

ole32

CLSIDFromProgID OleRun CoCreateInstance CLSIDFromString OleUninitialize OleInitialize

oleaut32

LoadTypeLi LHashValOfNameSys RegisterTypeLi SysAllocString VariantClear VariantChangeType VariantCopyInd VariantInit UnRegisterTypeLi

comctl32

ImageList_Destroy ImageList_Create ImageList_Read ImageList_DrawIndirect ord17 ImageList_AddMasked _TrackMouseEvent ImageList_Draw ImageList_SetBkColor ImageList_GetImageCount ImageList_GetImageInfo ImageList_GetIcon ImageList_Duplicate

ws2_32

inet_ntoa WSACleanup closesocket WSAAsyncSelect recvfrom ioctlsocket recv getpeername accept

comdlg32

GetFileTitleA GetOpenFileNameA ChooseColorA GetSaveFileNameA

wtsapi32

WTSSendMessageW

i��ݮ��q��ߗ�� C�<z��?མ��P�Ba��F�9��z��%1��<��a<n��Y�HhõteH�g9ӝV~��uЩu~�K�/�T��MZGVvsP��}&u�>�-��N+��\!q�gܗ<�VQg��F)��g�� y�jQ^]:�>��t�pj�eg�hyʕ˴�X�Swz��i�Y�?��|��E~ Ϫ�w%��G�c�DoqK�J2v��!�Ղt�@��HAZN��tK#�UM��.��48��Q��]�禊�>J��I<�b�R�tI}��j�0��x�T�N{�y-%ٟ��k�k7]!��-2�ic �o� ��u�E'��W#��d�^�cG��=!u)��yL�v�Ze�.��>��15L�X,G�1�3qU�]>�S��@2��K4<�� S�6�z��+f?qL6_��Lqm�jAZK�+��3%��B�;�oKbcv��G��⤞��?tj�Rl�E+��>�3Q=d�L�ǁ6��»fUe�ʷxҎ��^T��M[��U�7��jйqX��c��k`�ҏ!� �TF�X��jKd��V��_��m\2�:��4�I��(��nPZ0��ޗ<*�>1ȸd�?%&�<��i�V{��V�q��@'ٞ:b�}"DRcȔ�U�j��z��@@�(>L��oXj�xᱮ�9_�Y݈[;�D��Ô��լG5+�s �1?�j5P�e��)�Y<e�V ��`n�kڐG%��N:��>��X�F-/x�Q6��O؄�<X4�I�]_u|��RN��~V��Hjf]1��n|@~_x��X�"B�NxjO�'��̢�CY�+��_��qJ7�O��~��^ޔ#��.�8(��%��^��/6�pì��]��@�c��[.?{�![1�sL��O�-�K��?�0z��\�,��c��؃�)�ʡ�o˨!��f��1�R��&��ߌ��U�!��g��B�A��Mr��~1)��9gB�X;��Y��V��d�`�^��=?") `ĺ�r��F�C��P�x��-��u1�U��E��|M>ܙ��v��ʜ0�3'r]�� R;��r�Ot�S�v�?��K�*tH�k_^��!��F�z=��d�ZuO��g?+��(�@�"��M�� AA�e�o��Z�ziT�c"(�ȸ�o��.?ga��o�̀lbP�_�`4��^bʀv��j��d�}A��K�I�8��hȼ��{J�c.0y�4v1�,-j�,��Ï�"��]],IMN#p^"G��M��2˨Ǆ��.�K,�ۼ�+z��K͈�P�"ӥ<"yo��;�䅄X��-4��tK��Hg��i�$=��x\*y�u��a1a%�+Ŋ��lO��V��c�ԭL�,Y�C��}="��T�\��L?<�_�xm3<P5�1. k�rbt�_�ַvD|l��H%�ρ)�D��N�<�u�ي��8�Cq��]V�ȴ��>ӄy�իUO�/�M[�9��>��[6({��d��L�!�i�X޳Q�D��mo�@["S}~��&�&�r��,�n��_#��H��Y""�s��c�%`zTj��bU�T�\��#��^�y��j��#�?B��t��7�b5�x�^`�J�2�+3vh-f�i��5�c�~_ٻ��O�=�=~r��*��q��o+��s�V��K^�zwd��ֳ,XnG��M��>*w(��H2$mZ��XD��.�0��}�UW/�H��y慣 I�K�cӐ��\Vj��Ą��Ȟ�b�^j�H�+�v��6�p9ϙ�ɥ$�5��^�"�c��§�)��qW�ުe��bB�->�uw�Ի��v_Gzu��,��W|ё��ET4��(/<;V�t�gw�;t�N��G��B�΃�w뾉�l��<e�A�cC��Ȣ��E4�ϫ8y肽��G,��4'�mߴXl��3� A��,��"/K�)��]ˬّ� )�L��6�=��[I��=�Cm��[49�68K�+��lq�Ϊ�[��^��i�{�ً��KoD�{�j:.��j��)�� uO��]�n��8ƿ��U�'�8)q�1�B�=rbпh��u��h��뢩��O�`��p2)�ָ��7�� ΅v��Vr)��3�].�� Y�4�Z.48ݴs��J�(eJ��ձ��0o3Yﰹ�� J�o�c΢5�k_�r�O�x��Nc�!�=�G;�6�b:��>�c$0��IW��D��팤�11��w�Ń؁7�Y<g�f�~l;o噚i��L��b�y=%x*�l8��%Q�A�)�*[�4�.x�G%��#;(��Ԣ��k<�QcZ *?P��, ��>�E~�JJަ��B��l�j$�'�O;p1&P|�� {�@Vq#G��3(&O��_�8��)��@�z��0SV��eLB8@�}�w� c��E�Xz��&��#H��K)*Gl3 �*T,�E��q�Z��컥!�Î��Pz�j݃/AV�W��'ƀ��I�S�[t4��|�t�ߙ�v� g�#D.��.�F�V��0d�RUyh��8�f71�U^szX^;!ZH��hߙ|�ԁg��X��h4��﷒�j϶��F[(�E�#/��ا��߽Ţ��iQ�\$ȼn�@b�� @�f�Gc^2��gUgnIYm�=��ў�>{3)�8�v��j'� d h rT��"8�J��6`��Y��Z!�:�mmS��8Ew�p�\aͯ��܃� S�P��̣��a�i��-h�7� P ��B갴�N$&.b>`*��ӭ�Ș��H��M��~%DF�=��~�7R=��;>C�� b/ָ��4�x>׌��)�_�e�֮�e�ד'<iY6��

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

296KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

278KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ZoqAzh0

Size

6.6MB

Virtual Size

6.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

ZoqAzh1

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

184KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

035a0117478e4d12a67e5d43512b78735c404f18d98a7ff774c2137cb1e500f3

kernel32

user32

gdi32

winmm

msimg32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

wtsapi32

generic