1f10dad472cd57d097ff41dbbaf792bcb53d47fb57942d7172623481310ddc1d

Sharing

Copy URL Twitter E-mail

General

Target
1f10dad472cd57d097ff41dbbaf792bcb53d47fb57942d7172623481310ddc1d
Size 12.3MB
Sample261017-e7ey9asw5p
SHA256 1f10dad472cd57d097ff41dbbaf792bcb53d47fb57942d7172623481310ddc1d
MD5 a7d4b48a45e47acb995ff2da7181d05e
SHA1 6687119f917cac812f305762119743c676006133
SHA512 f5ed53927efdccc81adf2866bcd12ed0b13ef5cb3a1aa4b1205c3ef123bbb126bbfe5fc0072566b61c75cc2af4666179f844b316f89f56f4e974d69aa0e6245d
SSDEEP 393216:n2HcEHJlZj7lHxVum6M+qZNeZGfA5fzFj:n2Jpl99x37c+QBj
TLSH
T10CD633F0E6150A41FC1B0BE7ADB4361EFAC9740154C1B9BA8098572991FF1EA1FF26B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Aitiy.exe
unpack001/AitiyOcr.dll

File Explorer

1f10dad472cd57d097ff41dbbaf792bcb53d47fb57942d7172623481310ddc1d

.zip 12.3MB
Aitiy.exe

.exe 7.0MB
AitiyOcr.dll

.dll 15.6MB

1f10dad472cd57d097ff41dbbaf792bcb53d47fb57942d7172623481310ddc1d

SHA256 1f10dad472cd57d097ff41dbbaf792bcb53d47fb57942d7172623481310ddc1d
MD5 a7d4b48a45e47acb995ff2da7181d05e
SHA1 6687119f917cac812f305762119743c676006133
SHA512 f5ed53927efdccc81adf2866bcd12ed0b13ef5cb3a1aa4b1205c3ef123bbb126bbfe5fc0072566b61c75cc2af4666179f844b316f89f56f4e974d69aa0e6245d
SSDEEP 393216:n2HcEHJlZj7lHxVum6M+qZNeZGfA5fzFj:n2Jpl99x37c+QBj
TLSH
T10CD633F0E6150A41FC1B0BE7ADB4361EFAC9740154C1B9BA8098572991FF1EA1FF26B4
MD5 SHA1 SHA512 SSDEEP TLSH

Aitiy.exe

IMPHASH 159754bfe841f1e1dd6af9b45ce364db
SHA256 cbfe32f9fb7f862fc54462c64404d02badfa17117264dd5564d84960b9a6730c
MD5 05212186fb5a803f496e98c860cd3fee
SHA1 8ce20fa25a748b35eaaab34cdb0e3c894797b8fd
SHA512 6dd4a99bb40d4fc415edabde45a26982b7081402cf7c84afdc4b203d558eedc1b134bfb63ba7851951d4e74db0fbb5e770d5d7651d75342d745a8fc01004c055
SSDEEP 49152:HOxXRsEUxNYZArHu1VR3B2XzjWX9G7O4yzZE2XlNW1azCRx9MvBUgNCmENFF/XEi:4sqxM+pj+eDeRqScQx9c2
TLSH
T1E676AF5AB16801ECC0ABC1F4CE6B9917E77278CA0330A2DF13E196571F676B09E7E611
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4972800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdiplus

GdipBitmapUnlockBits GdipCreateBitmapFromStream GdipAlloc GdipCloneImage GdipDisposeImage GdipSetInterpolationMode GdipFree GdipGetImageHeight GdipCreateBitmapFromFile GdiplusStartup GdipDrawImageRectI GdiplusShutdown GdipBitmapLockBits GdipGetImageGraphicsContext GdipDeleteGraphics GdipGetImageWidth GdipCreateBitmapFromScan0

oleacc

AccessibleObjectFromPoint

iphlpapi

GetAdaptersAddresses GetBestInterface

bcrypt

BCryptOpenAlgorithmProvider BCryptGenRandom BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptCreateHash BCryptHashData BCryptGetProperty

winhttp

WinHttpReadData WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpCrackUrl WinHttpConnect WinHttpSetTimeouts

kernel32

TlsFree FormatMessageA MoveFileExW ReplaceFileW GetCurrentProcessId MultiByteToWideChar WideCharToMultiByte GetModuleFileNameW GetProcAddress FreeLibrary LoadLibraryExW GlobalSize GlobalAlloc GlobalFree GlobalLock GlobalUnlock TlsSetValue EnterCriticalSection WaitForMultipleObjects InitializeCriticalSectionAndSpinCount LeaveCriticalSection WaitForSingleObject CreateEventW Sleep SetEvent TerminateThread CloseHandle ResetEvent QueueUserAPC DeleteCriticalSection SleepEx TlsGetValue GetModuleFileNameA SetWaitableTimer CreateSemaphoreExW HeapFree SetLastError GetCurrentProcess CreateWaitableTimerW ReleaseSemaphore GetModuleHandleExW GetUserDefaultLocaleName GetQueuedCompletionStatus InitializeCriticalSectionEx GetCurrentThreadId ReleaseMutex OpenProcess PostQueuedCompletionStatus FormatMessageW WaitForSingleObjectEx OpenSemaphoreW LoadLibraryW HeapAlloc GetLocalTime DecodePointer CreateMutexExW GetProcessHeap GetModuleHandleW QueryFullProcessImageNameW DebugBreak GetFileAttributesExW IsDebuggerPresent LCMapStringEx GetTickCount64 TlsAlloc ExpandEnvironmentStringsW CreateFileW SetUnhandledExceptionFilter SetThreadExecutionState GetFileAttributesW ReadFile GetFileInformationByHandleEx GetFileInformationByHandle SetFilePointerEx GetFileType GetComputerNameW HeapSetInformation SetProcessWorkingSetSize GetTickCount SizeofResource GetTempPathW CreateMutexW RaiseException LoadResource FindResourceW ExitProcess lstrcmpiW GetSystemTimeAsFileTime GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle WriteConsoleA WriteFile OutputDebugStringA GetConsoleMode GetEnvironmentVariableW CreateWaitableTimerExW CompareStringOrdinal GetLocaleInfoEx GetCPInfo OutputDebugStringW GetLastError CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW GetFinalPathNameByHandleW GetFullPathNameW SetFileInformationByHandle GetStartupInfoW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache VirtualAlloc VirtualFree LoadLibraryExA RtlUnwindEx VirtualQuery RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent LCIDToLocaleName CreateFile2 AreFileApisANSI CompareStringEx LocalFree FindNextFileW CancelIoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime RtlPcToFileHeader SwitchToThread GetExitCodeThread GetLogicalProcessorInformationEx SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable GetStringTypeW InitOnceBeginInitialize InitOnceComplete EncodePointer CreateIoCompletionPort

user32

CreateWindowExW SetWindowLongPtrW DefWindowProcW GetDpiForSystem KillTimer RegisterClassW SetTimer UpdateLayeredWindow SetProcessDpiAwarenessContext EndPaint BeginPaint SetCursor SetLayeredWindowAttributes MapWindowPoints GetCursor FillRect AdjustWindowRectExForDpi GetDpiForWindow CallWindowProcW GetSystemMetricsForDpi SetFocus IsWindowEnabled TrackMouseEvent SetWindowPlacement GetCapture GetWindowPlacement SetCapture CreateIconIndirect SetParent RedrawWindow CopyIcon EnumDisplaySettingsW RegisterClassExW GetAsyncKeyState GetCursorInfo GetDoubleClickTime IsZoomed RealChildWindowFromPoint GetWindow FindWindowExW CopyImage ScreenToClient GetClassInfoExW ChildWindowFromPointEx PostQuitMessage DispatchMessageW PeekMessageW MsgWaitForMultipleObjectsEx UnhookWindowsHookEx TranslateMessage LoadCursorW SetWindowsHookExW IsChild PostThreadMessageW GetClassLongPtrW DestroyIcon ChangeWindowMessageFilterEx RegisterWindowMessageW LoadImageW GetClientRect GetMessageW DestroyWindow MessageBoxW CharNextW FindWindowW SetProcessDPIAware SetSystemCursor PtInRect SetForegroundWindow UnregisterHotKey RegisterHotKey WindowFromPoint InternalGetWindowText GetWindowTextLengthW AdjustWindowRectEx GetKeyState PostMessageW MapVirtualKeyW MonitorFromPoint SendMessageTimeoutW SetWindowPos GetDesktopWindow EqualRect keybd_event MonitorFromWindow UnregisterClassW GetMonitorInfoW GetWindowLongW GetForegroundWindow EnumClipboardFormats GetClipboardData SystemParametersInfoW GetParent GetCursorPos SendInput GetWindowTextW GetWindowThreadProcessId RegisterClipboardFormatW GetWindowRect IsWindowVisible GetPropW GetSystemMetrics ReleaseCapture GetKeyboardState ClientToScreen ToUnicode GetGUIThreadInfo GetLastInputInfo GetKeyNameTextW EnumDisplayMonitors GetClipboardSequenceNumber GetClipCursor SetThreadDesktop GetThreadDesktop CloseDesktop OpenInputDesktop GetUserObjectInformationW GetIconInfo DrawIconEx GetClipboardFormatNameW IsClipboardFormatAvailable GetRawInputData GetRegisteredRawInputDevices RegisterRawInputDevices SendMessageW LoadIconW MonitorFromRect ShowWindow GetMessageTime CallNextHookEx GetWindowLongPtrW IsWindow ReleaseDC SetPropW SetCursorPos DestroyCursor GetDC IsIconic GetAncestor SetClipboardData GetClassNameW IntersectRect OpenClipboard CloseClipboard EnumWindows EmptyClipboard

gdi32

RestoreDC SetDeviceGammaRamp BitBlt CreateCompatibleBitmap GetStockObject ExcludeClipRect CreateCompatibleDC DeleteDC SetDIBits DeleteObject SaveDC CreateDIBSection CreateBitmap SelectObject StretchDIBits

shell32

SHCreateItemFromParsingName SHOpenFolderAndSelectItems ord155 SHGetKnownFolderPath ShellExecuteExW ord190 CommandLineToArgvW Shell_NotifyIconW DragQueryFileW ShellExecuteW

shlwapi

ord176 PathFindFileNameW

advapi32

RegCreateKeyExW RegGetValueW RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyExW RegDeleteValueW GetSidSubAuthorityCount GetSidSubAuthority RegCloseKey RegSetValueExW OpenProcessToken RegOpenKeyExW RegQueryValueExW GetTokenInformation

ole32

GetHGlobalFromStream CLSIDFromString CoInitialize RevokeDragDrop RegisterDragDrop DoDragDrop CoWaitForMultipleHandles ReleaseStgMedium CoTaskMemRealloc OleInitialize CoTaskMemAlloc OleUninitialize OleSetClipboard CoInitializeSecurity CoTaskMemFree CoInitializeEx CreateStreamOnHGlobal CoCreateInstance CoUninitialize CoSetProxyBlanket

oleaut32

SysStringByteLen VariantInit VariantClear SysAllocString SysAllocStringByteLen SysFreeString SafeArrayGetDim SafeArrayGetElement SafeArrayGetVartype SafeArrayPutElement SysAllocStringLen SafeArrayCreateVector VarUI4FromStr SafeArrayDestroy SafeArrayGetUBound SafeArrayGetLBound SafeArrayUnaccessData SafeArrayAccessData SysStringLen

uiautomationcore

UiaRaiseStructureChangedEvent UiaRaiseAutomationEvent UiaRaiseAutomationPropertyChangedEvent UiaHostProviderFromHwnd UiaReturnRawElementProvider UiaGetReservedNotSupportedValue UiaGetReservedMixedAttributeValue

dwrite

DWriteCreateFactory

d2d1

ord1

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute DwmFlush DwmGetWindowAttribute DwmDefWindowProc

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

dcomp

DCompositionCreateDevice

imm32

ImmGetContext ImmGetDefaultIMEWnd ImmNotifyIME ImmSetCandidateWindow ImmGetCompositionStringW ImmSetCompositionWindow ImmReleaseContext

ws2_32

ioctlsocket WSARecv WSASend closesocket htons htonl getsockopt getpeername ntohl WSARecvFrom setsockopt connect ntohs getsockname WSASocketW WSASendTo WSAStringToAddressW WSASetLastError listen shutdown select WSAIoctl bind accept __WSAFDIsSet WSAStartup WSAGetLastError WSACleanup WSAAddressToStringW

mswsock

GetAcceptExSockaddrs AcceptEx

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress

msvcrt

_wcsicmp tolower ceilf toupper strtol isspace isdigit calloc strcspn frexp labs _wcsnicmp _localtime64_s _mktime64 _time64 realloc towlower iswspace strtoul _gmtime64_s isalpha _Strftime _Gettnames expf wcscmp atan2f _hypotf cosf sinf strftime strcmp malloc wcsncpy_s wcsncpy sqrtf powf acosf ceil _localtime64 fmodf isxdigit isalnum fopen fseek ftell ferror _beginthreadex isupper strncmp floor cos pow feof freopen getc strerror strspn islower ispunct isgraph iscntrl strpbrk strcpy ldexp acos asin exp fmod log log10 sin tan abort strcoll tanf _mkgmtime64 _stricmp iswalnum _fileno _isatty atoi strncat strtok_s strncpy floorf _strnicmp ___lc_codepage_func _wfsopen __pctype_func _wcsdup rand_s ___mb_cur_max_func ___lc_collate_cp_func __strncnt wcsnlen _Getdays _Getmonths _initterm _initterm_e _set_fmode strcpy_s _iob _strtoi64 _lock _unlock strnlen wcstol _mbtowc_l wctomb_s _strtoui64 ?terminate@@YAXXZ _hypot _abs64 ___lc_handle_func __wgetmainargs _msize _XcptFilter __set_app_type _wcmdln ?_set_new_mode@@YAHH@Z _commode _clearfp __CxxFrameHandler3 _aligned_free abs sqrt atan2 fabs wcslen _fseeki64 fread fsetpos ungetc free setvbuf fgetpos _errno strlen fgetc fclose strtod fflush _setjmp wcsrchr _local_unwind _aligned_malloc __DestructExceptionObject _amsg_exit strrchr longjmp __RTDynamicCast memchr _CxxThrowException strstr __RTtypeid strchr wcsstr wcschr __C_specific_handler memcmp memset memcpy memmove

generic

count=1, id=259, version=27412,

count=7, id=261, version=27412,

count=27, id=260, version=27412,

count=13, id=199, version=41118,

count=2, id=257, version=35219,

count=39, id=261, version=35219,

count=1, id=261, version=35207,

count=2, id=259, version=35207,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=253, version=35721,

count=10, id=260, version=35721,

count=6, id=259, version=35721,

count=88, id=261, version=35721,

count=1, id=261, version=33145,

count=10, id=260, version=33145,

count=47, id=257, version=33145,

count=683, id=1, productName=Unmarked objects,

count=1, id=261, version=36256,

count=1, id=260, version=36260,

count=99, id=261, version=36260,

count=103, id=260, version=36256,

count=278, id=265, version=36260,

count=1, productName=Unmarked objects (old),

count=1, id=255, version=36260,

count=1, id=151,

count=1, id=258, version=36260,

AitiyOcr.dll

IMPHASH d41353e07835124edf9bff8e76449258
SHA256 5db5f31fad944e5f14f972793db6d794347d0994e9dbdf8cc01114dbdc2d2993
MD5 a83adddcd4e8a091f37d54a74872fdf6
SHA1 fcd8ec5a3c15aa52a366530ecde4a33ee9c7f8e3
SHA512 0a627270b6b0d67681a8c7362ecbf87363c58ead5edcc9e20d30abfbc1954a29ddb294d665b6bfb96cf462ed897c8c9ee15ec6b8b75cc0e0e6f7430762bff8ef
SSDEEP 393216:qSBWIsmhg22g2WlqBnmcfamymD4NG6qJIA4a3p619Ua:bBWGDefg1NG6qka3p
TLSH
T15DF6D026B6A801ACC0BBC0B8CF575903FBB2705943316AEB11A545651F1BBF4AA7FF11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3458848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

WideCharToMultiByte Sleep RtlCaptureStackBackTrace InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable SleepConditionVariableSRW GetProcAddress CloseHandle WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetLogicalProcessorInformationEx LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW FindFirstFileExW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW CreateFile2 AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx InitOnceBeginInitialize InitOnceComplete QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime WakeAllConditionVariable GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime HeapQueryInformation RtlLookupFunctionEntry RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetCurrentProcess TerminateProcess FindNextFileW SetEnvironmentVariableW CreateFileW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetConsoleMode ReadConsoleW WriteFile GetConsoleOutputCP ExitProcess FreeLibrary GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleFileNameW GetFileSizeEx SetFilePointerEx GetCurrentThread GetStdHandle FlushFileBuffers HeapFree HeapAlloc VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation SetStdHandle SetEndOfFile IsValidCodePage GetACP GetOEMCP HeapReAlloc GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap WriteConsoleW HeapSize OutputDebugStringW GetEnvironmentVariableA CreateDirectoryA DeleteFileW GetFileAttributesA RemoveDirectoryW DebugBreak WaitForSingleObject GetSystemInfo CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameA GetModuleHandleA SetThreadGroupAffinity FormatMessageW GetCurrentProcessorNumber LoadLibraryA ReleaseSemaphore ReleaseMutex OpenSemaphoreW CreateMutexExW CreateSemaphoreExW InitOnceExecuteOnce GetMaximumProcessorGroupCount GetMaximumProcessorCount GetLogicalProcessorInformation OutputDebugStringA VirtualAlloc VirtualFree RtlUnwind SetLastError FindFirstFileW FindClose GetCurrentDirectoryW MultiByteToWideChar GetLastError VerifyVersionInfoW IsProcessorFeaturePresent VerSetConditionMask

dbghelp

ImageDirectoryEntryToData SymFromAddr

setupapi

SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupDiOpenDevRegKey SetupDiGetClassDevsA

dxgi

CreateDXGIFactory2

advapi32

EventRegister EventSetInformation EventWriteTransfer RegCloseKey RegQueryValueExW EventUnregister

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec PathCchRemoveBackslash

Name

.text

Size

7.2MB

Virtual Size

7.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7.8MB

Virtual Size

7.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

286KB

Virtual Size

409KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

246KB

Virtual Size

246KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ