ee0ac1ff4d18f46c8f4787d482d14556eebce62842a1c03a53d9622563d6eb23

Sharing

Copy URL Twitter E-mail

General

Target
ee0ac1ff4d18f46c8f4787d482d14556eebce62842a1c03a53d9622563d6eb23
Size 10.6MB
Sample260826-j283cscc95
SHA256 ee0ac1ff4d18f46c8f4787d482d14556eebce62842a1c03a53d9622563d6eb23
MD5 9489a247dcc1d7678c1e1434fb617c1b
SHA1 aca754c95d397205d13abcd611f5879b38898ec6
SHA512 422fe47786ccf12c734808321104fc5f6e1b9fe117494579ff8e2a49749b14ddd7deff1526d5a96f36413ff374c7d93aa928458edbad7eb5e1a603a8b20213a4
SSDEEP 196608:Cd7sqj8pZZv/raokBE31K0zUsdq1/lmVlpOOo1VIXnJpvoCk:NqwpzQBq10EogV7OX1Vk7k
TLSH
T1D8B60233B16180A0C659193565722F3D3DF44FA95EA1D8ABFBA4FCE43D324A1A737209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ee0ac1ff4d18f46c8f4787d482d14556eebce62842a1c03a53d9622563d6eb23

File Explorer

ee0ac1ff4d18f46c8f4787d482d14556eebce62842a1c03a53d9622563d6eb23

.exe 10.6MB

ee0ac1ff4d18f46c8f4787d482d14556eebce62842a1c03a53d9622563d6eb23

IMPHASH e1b2140935fa1b81f8058ee5302d2575
SHA256 ee0ac1ff4d18f46c8f4787d482d14556eebce62842a1c03a53d9622563d6eb23
MD5 9489a247dcc1d7678c1e1434fb617c1b
SHA1 aca754c95d397205d13abcd611f5879b38898ec6
SHA512 422fe47786ccf12c734808321104fc5f6e1b9fe117494579ff8e2a49749b14ddd7deff1526d5a96f36413ff374c7d93aa928458edbad7eb5e1a603a8b20213a4
SSDEEP 196608:Cd7sqj8pZZv/raokBE31K0zUsdq1/lmVlpOOo1VIXnJpvoCk:NqwpzQBq10EogV7OX1Vk7k
TLSH
T1D8B60233B16180A0C659193565722F3D3DF44FA95EA1D8ABFBA4FCE43D324A1A737209
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10013349

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalFlags GetCurrentThread GetFileTime GetFileSize TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc lstrcmpA GetVersion GlobalGetAtomNameA GlobalAddAtomA GlobalDeleteAtom lstrcmpiA SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer DuplicateHandle lstrcpynA SetLastError FileTimeToLocalFileTime FileTimeToSystemTime LocalFree InterlockedDecrement InterlockedIncrement SetErrorMode GetProcessVersion GetCPInfo GetOEMCP GetStartupInfoA RtlUnwind RaiseException GetTimeZoneInformation GetSystemTime GetLocalTime TerminateProcess HeapSize GetACP UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableA LCMapStringA LCMapStringW VirtualAlloc IsBadWritePtr GetStringTypeA GetStringTypeW SetUnhandledExceptionFilter CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr WideCharToMultiByte MultiByteToWideChar GetCurrentProcess GetWindowsDirectoryA GetSystemDirectoryA TerminateThread CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource ReadFile lstrlenW RemoveDirectoryA GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetUserDefaultLCID GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA GetPrivateProfileStringA CreateThread CreateEventA Sleep ExpandEnvironmentStringsA GlobalAlloc GlobalLock GlobalUnlock GetTempPathA FindFirstFileA FindClose SetFileAttributesA GetFileAttributesA DeleteFileA CopyFileA CreateDirectoryA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount CreateProcessA WaitForSingleObject CloseHandle SetStdHandle GlobalFindAtomA VirtualQuery GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW LoadLibraryA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep FreeLibrary GetTickCount GlobalFree GetProcAddress LocalAlloc LocalFree ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetCommandLineA RaiseException RtlUnwind HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapReAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount SetStdHandle LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

GetWindowTextA SetWindowTextA GetMenuItemCount GetMenuItemID GetMenuStringA GetMenuState GetTabbedTextExtentA DrawStateA GrayStringA TabbedTextOutA WindowFromDC EnumChildWindows GetWindowDC UnhookWindowsHookEx CallNextHookEx SetWindowsHookExA FrameRect GetPropA MoveWindow CallWindowProcA SetPropA DrawTextA GetCursor LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu UnregisterClassA GetForegroundWindow GetSysColorBrush ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA DefWindowProcA GetSystemMenu DeleteMenu GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos SetRect InflateRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild TrackPopupMenu DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBoxA GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA WaitForInputIdle EnableMenuItem GetWindowTextLengthA CharUpperA BeginPaint EndPaint GetDlgItem DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetLastActivePopup GetMessageTime RemovePropA GetClassLongA CreateWindowExA RegisterClassA GetScrollPos AdjustWindowRectEx MapWindowPoints SendDlgItemMessageA ScrollWindowEx IsDialogMessageA CheckMenuItem SetMenuItemBitmaps GetMenuCheckMarkDimensions GetClassNameA GetDesktopWindow LoadStringA GetUserObjectInformationW CharUpperBuffW MessageBoxW GetProcessWindowStation GetProcessWindowStation GetUserObjectInformationW

gdi32

RestoreDC SaveDC SetWindowOrgEx SetTextColor SetBkMode SetBkColor CreateRectRgnIndirect SetPixel SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateEllipticRgn CreateRoundRectRgn CreatePenIndirect GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBrushIndirect CreateBitmap CreatePen PatBlt CombineRgn CreateRectRgn FillRgn CreateSolidBrush CreateFontIndirectA GetStockObject GetObjectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt GetPixel CreateCompatibleDC SetPixelV Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps PtVisible RectVisible TextOutA ExtTextOutA Escape ExtSelectClipRgn GetViewportExtEx GetTextMetricsA GetTextColor SelectObject LineTo MoveToEx ExcludeClipRect GetClipBox ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode SetROP2 SetPolyFillMode

winmm

waveOutGetNumDevs waveOutPrepareHeader waveOutUnprepareHeader waveOutOpen midiOutUnprepareHeader midiStreamOpen waveOutClose midiOutPrepareHeader midiStreamOut midiStreamStop midiOutReset midiStreamClose midiStreamRestart waveOutReset waveOutPause midiStreamProperty waveOutWrite

msimg32

GradientFill

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

advapi32

RegQueryValueA RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegCloseKey RegQueryValueExA

shell32

SHGetSpecialFolderPathA Shell_NotifyIconA ShellExecuteA

ole32

CLSIDFromProgID OleRun CoCreateInstance CLSIDFromString OleUninitialize OleInitialize

oleaut32

LoadTypeLi LHashValOfNameSys RegisterTypeLi SysAllocString VariantClear VariantChangeType VariantCopyInd VariantInit UnRegisterTypeLi

comctl32

ImageList_Destroy ImageList_Create ImageList_Read ImageList_DrawIndirect ord17 ImageList_AddMasked _TrackMouseEvent ImageList_Draw ImageList_SetBkColor ImageList_GetImageCount ImageList_GetImageInfo ImageList_GetIcon ImageList_Duplicate

ws2_32

inet_ntoa WSACleanup closesocket WSAAsyncSelect recvfrom ioctlsocket recv getpeername accept

comdlg32

GetFileTitleA GetOpenFileNameA ChooseColorA GetSaveFileNameA

wtsapi32

WTSSendMessageW

i��ݮ��q��ߗ�� C�<z��?མ��P�Ba��F�9��z��%1��<��a<n��Y�HhõteH�g9ӝV~��uЩu~�K�/�T��MZGVvsP��}&u�>�-��N+��\!q�gܗ<�VQg��F)��g�� y�jQ^]:�>��t�pj�eg�hyʕ˴�X�Swz��i�Y�?��|��E~ Ϫ�w%��G�c�DoqK�J2v��!�Ղt�@��HAZN��tK#�UM��.��48��Q��]�禊�>J��I<�b�R�tI}��j�0��x�T�N{�y-%ٟ��k�k7]!��-2�ic �o� ��u�E'��W#��d�^�cG��=!u)��yL�v�Ze�.��>��15L�X,G�1�3qU�]>�S��@2��K4<�� S�6�z��+f?qL6_��Lqm�jAZK�+��3%��B�;�oKbcv��G��⤞��?tj�Rl�E+��>�3Q=d�L�ǁ6��»fUe�ʷxҎ��^T��M[��U�7��jйqX��c��k`�ҏ!� �TF�X��jKd��V��_��m\2�:��4�I��(��nPZ0��ޗ<*�>1ȸd�?%&�<��i�V{��V�q��@'ٞ:b�}"DRcȔ�U�j��z��@@�(>L��oXj�xᱮ�9_�Y݈[;�D��Ô��լG5+�s �1?�j5P�e��)�Y<e�V ��`n�kڐG%��N:��>��X�F-/x�Q6��O؄�<X4�I�]_u|��RN��~V��Hjf]1��n|@~_x��X�"B�NxjO�'��̢�CY�+��_��qJ7�O��~��^ޔ#��.�8(��%��^��/6�pì��]��@�c��[.?{�![1�sL��O�-�K��?�0z��\�,��c��؃�)�ʡ�o˨!��f��1�R��&��ߌ��U�!��g��B�A��Mr��~1)��9gB�X;��Y��V��d�`�^��=?") `ĺ�r��F�C��P�x��-��u1�U��E��|M>ܙ��v��ʜ0�3'r]�� R;��r�Ot�S�v�?��K�*tH�k_^��!��F�z=��d�ZuO��g?+��(�@�"��M�� AA�e�o��Z�ziT�c"(�ȸ�o��.?ga��o�̀lbP�_�`4��^bʀv��j��d�}A��K�I�8��hȼ��{J�c.0y�4v1�,-j�,��Ï�"��]],IMN#p^"G��M��2˨Ǆ��.�K,�ۼ�+z��K͈�P�"ӥ<"yo��;�䅄X��-4��tK��Hg��i�$=��x\*y�u��a1a%�+Ŋ��lO��V��c�ԭL�,Y�C��}="��T�\��L?<�_�xm3<P5�1. k�rbt�_�ַvD|l��H%�ρ)�D��N�<�u�ي��8�Cq��]V�ȴ��>ӄy�իUO�/�M[�9��>��[6({��d��L�!�i�X޳Q�D��mo�@["S}~��&�&�r��,�n��_#��H��Y""�s��c�%`zTj��bU�T�\��#��^�y��j��#�?B��t��7�b5�x�^`�J�2�+3vh-f�i��5�c�~_ٻ��O�=�=~r��*��q��o+��s�V��K^�zwd��ֳ,XnG��M��>*w(��H2$mZ��XD��.�0��}�UW/�H��y慣 I�K�cӐ��\Vj��Ą��Ȟ�b�^j�H�+�v��6�p9ϙ�ɥ$�5��^�"�c��§�)��qW�ުe��bB�->�uw�Ի��v_Gzu��,��W|ё��ET4��(/<;V�t�gw�;t�N��G��B�΃�w뾉�l��<e�A�cC��Ȣ��E4�ϫ8y肽��G,��4'�mߴXl��3� A��,��"/K�)��]ˬّ� )�L��6�=��[I��=�Cm��[49�68K�+��lq�Ϊ�[��^��i�{�ً��KoD�{�j:.��j��)�� uO��]�n��8ƿ��U�'�8)q�1�B�=rbпh��u��h��뢩��O�`��p2)�ָ��7�� ΅v��Vr)��3�].�� Y�4�Z.48ݴs��J�(eJ��ձ��0o3Yﰹ�� J�o�c΢5�k_�r�O�x��Nc�!�=�G;�6�b:��>�c$0��IW��D��팤�11��w�Ń؁7�Y<g�f�~l;o噚i��L��b�y=%x*�l8��%Q�A�)�*[�4�.x�G%��#;(��Ԣ��k<�QcZ *?P��, ��>�E~�JJަ��B��l�j$�'�O;p1&P|�� {�@Vq#G��3(&O��_�8��)��@�z��0SV��eLB8@�}�w� c��E�Xz��&��#H��K)*Gl3 �*T,�E��q�Z��컥!�Î��Pz�j݃/AV�W��'ƀ��I�S�[t4��|�t�ߙ�v� g�#D.��.�F�V��0d�RUyh��8�f71�U^szX^;!ZH��hߙ|�ԁg��X��h4��﷒�j϶��F[(�E�#/��ا��߽Ţ��iQ�\$ȼn�@b�� @�f�Gc^2��gUgnIYm�=��ў�>{3)�8�v��j'� d h rT��"8�J��6`��Y��Z!�:�mmS��8Ew�p�\aͯ��܃� S�P��̣��a�i��-h�7� P ��B갴�N$&.b>`*��ӭ�Ș��H��M��~%DF�=��~�7R=��;>C�� b/ָ��4�x>׌��)�_�e�֮�e�ד'<iY6��

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

300KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

84KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ZoqAzh0

Size

6.6MB

Virtual Size

6.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

ZoqAzh1

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

188KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ee0ac1ff4d18f46c8f4787d482d14556eebce62842a1c03a53d9622563d6eb23

kernel32

user32

gdi32

winmm

msimg32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

wtsapi32

generic