442bac62161eb0fcd2d7138a0a65e7c2
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2018-Dec-12 23:42:48 |
| Detected languages |
English - United Kingdom
|
Plugin Output
| Info | Matching compiler(s): | Microsoft Visual C++ 6.0 - 8.0 |
| Suspicious | PEiD Signature: | AsCrypt v0.1 -> SToRM - needs to be added |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Is an AutoIT compiled script:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to SHA1 |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | The PE is possibly a dropper. |
Resource EXE1 detected as a PE Executable.
Resource EXE2 detected as a PE Executable. Resource SCRIPT is possibly compressed or encrypted. Resources amount for 88.8326% of the executable. |
| Malicious | VirusTotal score: 42/69 (Scanned on 2018-12-17 13:12:00) |
MicroWorld-eScan:
Trojan.GenericKD.31412730
McAfee: Artemis!442BAC62161E Malwarebytes: Spyware.PasswordStealer K7GW: Trojan ( 005438f41 ) K7AntiVirus: Trojan ( 005438f41 ) Arcabit: Trojan.Generic.D1DF51FA Invincea: heuristic NANO-Antivirus: Trojan.Win32.Coins.fldfxr Symantec: Trojan.Gen.MBT TrendMicro-HouseCall: TROJ_GEN.R002C0OLF18 Avast: Win32:TrojanX-gen [Trj] Kaspersky: Trojan-PSW.Win32.Coins.ofe BitDefender: Trojan.GenericKD.31412730 Paloalto: generic.ml Ad-Aware: Trojan.GenericKD.31412730 Emsisoft: Trojan.GenericKD.31412730 (B) Comodo: Malware@#3gr3p70mvc625 F-Secure: Trojan.GenericKD.31412730 DrWeb: Trojan.PWS.Papras.3647 TrendMicro: TROJ_GEN.R002C0OLF18 McAfee-GW-Edition: BehavesLike.Win64.PWSZbot.rc Fortinet: W32/Kryptik.GNTF!tr Trapmine: suspicious.low.ml.score Sophos: Mal/Kryptik-CQ Cyren: W32/GenBl.442BAC62!Olympus Avira: TR/AD.InstaBot.wujvp MAX: malware (ai score=89) Endgame: malicious (moderate confidence) Microsoft: Trojan:Win32/Occamy.C ViRobot: Trojan.Win32.Z.Spyeye.8500736 ZoneAlarm: Trojan-PSW.Win32.Coins.ofe AhnLab-V3: PUP/RL.Generic.R248601 ALYac: Trojan.GenericKD.31412730 Cylance: Unsafe ESET-NOD32: a variant of Win32/Kryptik.GNTF Ikarus: Trojan.Win32.Spyeye GData: Trojan.GenericKD.31412730 AVG: Win32:TrojanX-gen [Trj] Cybereason: malicious.66edd1 Panda: Trj/CI.A CrowdStrike: malicious_confidence_90% (W) Qihoo-360: Win32/Trojan.4b0 |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x110 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2018-Dec-12 23:42:48 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 12.0 |
| SizeOfCode | 0xa8400 |
| SizeOfInitializedData | 0x772e00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000002FB2C (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.2 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x824000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x13fb16 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x400000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x400000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.pdata
.rsrc
.reloc
Imports
| WSOCK32.dll |
#116
#23 #12 #21 #15 #17 #10 #9 #115 #151 #18 #1 #13 #2 #3 #111 #16 #20 #19 #11 #52 #57 #4 |
|---|---|
| VERSION.dll |
GetFileVersionInfoW
GetFileVersionInfoSizeW VerQueryValueW |
| WINMM.dll |
timeGetTime
waveOutSetVolume mciSendStringW |
| COMCTL32.dll |
ImageList_ReplaceIcon
ImageList_Destroy ImageList_Remove ImageList_SetDragCursorImage ImageList_BeginDrag ImageList_DragEnter ImageList_DragLeave ImageList_EndDrag ImageList_DragMove InitCommonControlsEx ImageList_Create |
| MPR.dll |
WNetUseConnectionW
WNetCancelConnection2W WNetGetConnectionW WNetAddConnection2W |
| WININET.dll |
InternetQueryDataAvailable
InternetCloseHandle InternetOpenW InternetSetOptionW InternetCrackUrlW HttpQueryInfoW InternetQueryOptionW HttpOpenRequestW HttpSendRequestW FtpOpenFileW FtpGetFileSize InternetOpenUrlW InternetReadFile InternetConnectW |
| PSAPI.DLL |
GetProcessMemoryInfo
|
| IPHLPAPI.DLL |
IcmpCreateFile
IcmpCloseHandle IcmpSendEcho |
| USERENV.dll |
DestroyEnvironmentBlock
UnloadUserProfile CreateEnvironmentBlock LoadUserProfileW |
| UxTheme.dll |
IsThemeActive
|
| KERNEL32.dll |
WaitForSingleObject
HeapAlloc GetProcessHeap HeapFree Sleep GetCurrentThreadId MultiByteToWideChar MulDiv GetVersionExW IsWow64Process GetSystemInfo FreeLibrary LoadLibraryA GetProcAddress SetErrorMode GetModuleFileNameW WideCharToMultiByte lstrcpyW lstrlenW GetModuleHandleW QueryPerformanceCounter VirtualFreeEx OpenProcess VirtualAllocEx WriteProcessMemory ReadProcessMemory CreateFileW SetFilePointerEx SetEndOfFile ReadFile WriteFile FlushFileBuffers TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFileTime GetFileAttributesW FindFirstFileW FindClose GetLongPathNameW GetShortPathNameW CloseHandle FindNextFileW CopyFileExW MoveFileW CreateDirectoryW RemoveDirectoryW SetSystemPowerState QueryPerformanceFrequency FindResourceW LoadResource LockResource SizeofResource EnumResourceNamesW OutputDebugStringW GetTempPathW GetTempFileNameW DeviceIoControl GetLocalTime CompareStringW CreateThread LeaveCriticalSection GetStdHandle CreatePipe TerminateThread LoadLibraryExW FindResourceExW CopyFileW VirtualFree FormatMessageW GetExitCodeProcess GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileSectionNamesW FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToFileTime LocalFileTimeToFileTime GetDriveTypeW GetDiskFreeSpaceExW GetDiskFreeSpaceW GetVolumeInformationW SetVolumeLabelW CreateHardLinkW SetFileAttributesW CreateEventW SetEvent GetEnvironmentVariableW SetEnvironmentVariableW GlobalLock GlobalUnlock GlobalAlloc GetFileSize GlobalFree GlobalMemoryStatusEx Beep GetSystemDirectoryW HeapReAlloc HeapSize GetComputerNameW GetWindowsDirectoryW GetCurrentProcessId GetProcessIoCounters CreateProcessW GetProcessId SetPriorityClass LoadLibraryW VirtualAlloc GetFullPathNameW SetCurrentDirectoryW IsDebuggerPresent GetCurrentDirectoryW lstrcmpiW DecodePointer GetLastError RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection EncodePointer DuplicateHandle GetCurrentProcess EnterCriticalSection GetCurrentThread ExitProcess GetModuleHandleExW ExitThread GetSystemTimeAsFileTime ResumeThread GetCommandLineW IsProcessorFeaturePresent RtlPcToFileHeader RtlUnwindEx IsValidCodePage GetACP GetOEMCP GetCPInfo SetLastError RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetStringTypeW SetStdHandle GetFileType GetConsoleCP GetConsoleMode ReadConsoleW GetTimeZoneInformation GetDateFormatW GetTimeFormatW LCMapStringW GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW DeleteFileW SetEnvironmentVariableA |
| USER32.dll |
RegisterHotKey
ClientToScreen GetKeyboardLayoutNameW IsCharAlphaW IsCharAlphaNumericW IsCharLowerW IsCharUpperW GetMenuStringW GetSubMenu GetCaretPos IsZoomed GetWindowLongW MonitorFromPoint GetMonitorInfoW SetWindowLongW SetLayeredWindowAttributes FlashWindow GetClassLongPtrW TranslateAcceleratorW IsDialogMessageW GetSysColor InflateRect DrawFocusRect DrawTextW FrameRect DrawFrameControl FillRect PtInRect DestroyAcceleratorTable CreateAcceleratorTableW SetCursor GetWindowDC GetSystemMetrics SetWindowLongPtrW GetActiveWindow CharNextW wsprintfW RedrawWindow DrawMenuBar DestroyMenu SetMenu GetWindowTextLengthW CreateMenu IsDlgButtonChecked DefDlgProcW CallWindowProcW ReleaseCapture SetCapture UnregisterHotKey CharLowerBuffW MonitorFromRect LoadImageW CreateIconFromResourceEx mouse_event ExitWindowsEx SetActiveWindow FindWindowExW EnumThreadWindows SetMenuDefaultItem InsertMenuItemW IsMenu GetCursorInfo GetCursorPos DeleteMenu CheckMenuRadioItem GetMenuItemID GetMenuItemCount SetMenuItemInfoW GetMenuItemInfoW SetForegroundWindow IsIconic TranslateMessage SystemParametersInfoW keybd_event SendInput GetAsyncKeyState SetKeyboardState GetKeyboardState GetKeyState VkKeyScanW LoadStringW DialogBoxParamW MessageBeep EndDialog SendDlgItemMessageW GetDlgItem SetWindowTextW CopyRect ReleaseDC GetDC EndPaint BeginPaint GetClientRect GetMenu DestroyWindow EnumWindows GetDesktopWindow IsWindow IsWindowEnabled IsWindowVisible EnableWindow InvalidateRect GetWindowLongPtrW GetWindowThreadProcessId AttachThreadInput GetFocus GetWindowTextW SendMessageTimeoutW EnumChildWindows CharUpperBuffW GetClassNameW GetParent GetDlgCtrlID SendMessageW MapVirtualKeyW PostMessageW GetWindowRect SetUserObjectSecurity CloseDesktop CloseWindowStation OpenDesktopW SetProcessWindowStation GetProcessWindowStation SetWindowPos CopyImage AdjustWindowRectEx SetRect SetClipboardData EmptyClipboard CountClipboardFormats CloseClipboard GetClipboardData IsClipboardFormatAvailable OpenClipboard BlockInput GetMessageW LockWindowUpdate TrackPopupMenuEx DispatchMessageW OpenWindowStationW GetUserObjectSecurity MessageBoxW DefWindowProcW MoveWindow SetFocus PostQuitMessage KillTimer CreatePopupMenu RegisterWindowMessageW SetTimer ShowWindow CreateWindowExW RegisterClassExW LoadIconW LoadCursorW GetSysColorBrush GetForegroundWindow MessageBoxA DestroyIcon FindWindowW PeekMessageW ScreenToClient |
| GDI32.dll |
StrokePath
DeleteObject GetTextExtentPoint32W ExtCreatePen GetDeviceCaps EndPath SetPixel CloseFigure LineTo AngleArc MoveToEx CreateCompatibleBitmap CreateCompatibleDC Ellipse PolyDraw BeginPath Rectangle SetViewportOrgEx SelectObject StretchBlt GetDIBits DeleteDC GetPixel CreateDCW GetObjectW SetBkMode RoundRect SetBkColor CreatePen CreateSolidBrush SetTextColor CreateFontW GetTextFaceW GetStockObject StrokeAndFillPath |
| COMDLG32.dll |
GetOpenFileNameW
GetSaveFileNameW |
| ADVAPI32.dll |
GetAce
RegEnumValueW RegDeleteValueW RegDeleteKeyW RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegCloseKey RegQueryValueExW RegConnectRegistryW InitializeSecurityDescriptor InitializeAcl AdjustTokenPrivileges OpenThreadToken OpenProcessToken LookupPrivilegeValueW DuplicateTokenEx CreateProcessAsUserW CreateProcessWithLogonW GetLengthSid CopySid LogonUserW AllocateAndInitializeSid CheckTokenMembership RegCreateKeyExW FreeSid GetTokenInformation GetSecurityDescriptorDacl GetAclInformation AddAce SetSecurityDescriptorDacl GetUserNameW InitiateSystemShutdownExW |
| SHELL32.dll |
DragQueryPoint
ShellExecuteExW DragQueryFileW SHEmptyRecycleBinW SHGetPathFromIDListW SHBrowseForFolderW SHCreateShellItem SHGetDesktopFolder SHGetSpecialFolderLocation SHGetFolderPathW SHFileOperationW ExtractIconExW Shell_NotifyIconW ShellExecuteW DragFinish |
| ole32.dll |
CoTaskMemAlloc
CoTaskMemFree CLSIDFromString ProgIDFromCLSID CLSIDFromProgID OleSetMenuDescriptor MkParseDisplayName OleSetContainedObject CoCreateInstance IIDFromString StringFromGUID2 CreateStreamOnHGlobal OleInitialize OleUninitialize CoInitialize CoUninitialize GetRunningObjectTable CoGetInstanceFromFile CoGetObject CoInitializeSecurity CoCreateInstanceEx CoSetProxyBlanket |
| OLEAUT32.dll |
#186
#443 #442 #163 #183 #11 #3 #6 #38 #39 #24 #31 #37 #41 #411 #2 #185 #220 #77 #418 #164 #10 #9 #32 #146 #12 #7 #23 #8 |
Delayed Imports
1
2
3
4
5
6
7
166
7 (#2)
8
9
10
11
12
313
EXE1
EXE2
SCRIPT
99
162
164
169
1 (#2)
1 (#3)
String Table contents
| (Paused) |
| AutoIt Error |
| AutoIt has detected the stack has become corrupt. |
| Stack corruption typically occurs when either the wrong calling convention is used or when the function is called with the wrong number of arguments. |
| AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention. |
| "EndWith" missing "With". |
| Badly formatted "Func" statement. |
| "With" missing "EndWith". |
| Missing right bracket ')' in expression. |
| Missing operator in expression. |
| Unbalanced brackets in expression. |
| Error in expression. |
| Error parsing function call. |
| Incorrect number of parameters in function call. |
| "ReDim" used without an array variable. |
| Illegal text at the end of statement (one statement per line). |
| "If" statement has no matching "EndIf" statement. |
| "Else" statement with no matching "If" statement. |
| "EndIf" statement with no matching "If" statement. |
| Too many "Else" statements for matching "If" statement. |
| "While" statement has no matching "Wend" statement. |
| "Wend" statement with no matching "While" statement. |
| Variable used without being declared. |
| Array variable has incorrect number of subscripts or subscript dimension range exceeded. |
| Variable subscript badly formatted. |
| Subscript used on non-accessible variable. |
| Too many subscripts used for an array. |
| Missing subscript dimensions in "Dim" statement. |
| No variable given for "Dim", "Local", "Global", "Struct" or "Const" statement. |
| Expected a "=" operator in assignment statement. |
| Invalid keyword at the start of this line. |
| Array maximum size exceeded. |
| "Func" statement has no matching "EndFunc". |
| Duplicate function name. |
| Unknown function name. |
| Unknown macro. |
| Unable to get a list of running processes. |
| Invalid element in a DllStruct. |
| Unknown option or bad parameter specified. |
| Unable to load the internet libraries. |
| "Struct" statement has no matching "EndStruct". |
| Unable to open file, the maximum number of open files has been exceeded. |
| "ContinueLoop" statement with no matching "While", "Do" or "For" statement. |
| Invalid file filter given. |
| Expected a variable in user function call. |
| "Do" statement has no matching "Until" statement. |
| "Until" statement with no matching "Do" statement. |
| "For" statement is badly formatted. |
| "Next" statement with no matching "For" statement. |
| "ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop. |
| "For" statement has no matching "Next" statement. |
| "Case" statement with no matching "Select"or "Switch" statement. |
| "EndSelect" statement with no matching "Select" statement. |
| Recursion level has been exceeded - AutoIt will quit to prevent stack overflow. |
| Cannot make existing variables static. |
| Cannot make static variables into regular variables. |
| Badly formated Enum statement |
| This keyword cannot be used after a "Then" keyword. |
| "Select" statement is missing "EndSelect" or "Case" statement. |
| "If" statements must have a "Then" keyword. |
| Badly formated Struct statement. |
| Cannot assign values to constants. |
| Cannot make existing variables into constants. |
| Only Object-type variables allowed in a "With" statement. |
| "long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead. |
| Object referenced outside a "With" statement. |
| Nested "With" statements are not allowed. |
| Variable must be of type "Object". |
| The requested action with this object has failed. |
| Variable appears more than once in function declaration. |
| ReDim array can not be initialized in this manner. |
| An array variable can not be used in this manner. |
| Can not redeclare a constant. |
| Can not redeclare a parameter inside a user function. |
| Can pass constants by reference only to parameters with "Const" keyword. |
| Can not initialize a variable with itself. |
| Incorrect way to use this parameter. |
| "EndSwitch" statement with no matching "Switch" statement. |
| "Switch" statement is missing "EndSwitch" or "Case" statement. |
| "ContinueCase" statement with no matching "Select"or "Switch" statement. |
| Assert Failed! |
| Obsolete function/parameter. |
| Invalid Exitcode (reserved for AutoIt internal use). |
| Variable cannot be accessed in this manner. |
| Func reassign not allowed. |
| Func reassign on global level not allowed. |
| Unable to parse line. |
| Unable to open the script file. |
| String missing closing quote. |
| Badly formated variable or macro. |
| Missing separator character after keyword. |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 0.0.0.0 |
| ProductVersion | 0.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United Kingdom |
| Resource LangID | English - United Kingdom |
|---|
IMAGE_DEBUG_TYPE_RESERVED
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2018-Mar-15 13:15:00 |
| Version | 0.0 |
| SizeofData | 4 |
| AddressOfRawData | 0xccc38 |
| PointerToRawData | 0xcb438 |
TLS Callbacks
Load Configuration
| Size | 0x70 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1400dd1a0 |
RICH Header
| XOR Key | 0x3a0cc232 |
|---|---|
| Unmarked objects | 0 |
| 199 (41118) | 1 |
| C objects (20806) | 178 |
| ASM objects (20806) | 25 |
| C++ objects (20806) | 55 |
| C objects (VS2008 SP1 build 30729) | 8 |
| 135 (VS2008 SP1 build 30729) | 1 |
| Imports (VS2008 SP1 build 30729) | 37 |
| Total imports | 547 |
| 234 (VS2013 UPD5 build 40629) | 80 |
| ASM objects (VS2013 UPD5 build 40629) | 1 |
| Resource objects (VS2013 build 21005) | 1 |
| 151 | 1 |
| Linker (VS2013 UPD5 build 40629) | 1 |