089269592ac1f8fa6c4ba00fa48a8a6cd1929cdf197a3c2042a7e569fe180cca

Sharing

Copy URL Twitter E-mail

General

Target

089269592ac1f8fa6c4ba00fa48a8a6cd1929cdf197a3c2042a7e569fe180cca
Size

482KB
MD5

84e3a4a2860bd1436b0add723a226f6b
SHA1

2f3113a32c0efd57778eebcced5fd89441f588ea
SHA256

089269592ac1f8fa6c4ba00fa48a8a6cd1929cdf197a3c2042a7e569fe180cca
SHA512

e86aa22f7ab5676318202f2d313508d03690f457544c2015450c670a5cabd149c43a5ee4c88fae4bb0a466304bbf2449969ae3f7302de3fb0e1c4d4beb0c6a09
SSDEEP

12288:xp9ZQnoAFgdc2w6f0huj4gkiAiig1AqTs+d+tmfXDW:xcoAFgrChOVFWg1AqTdd+GXDW

Score

N/A

Malware Config

Signatures

Files

089269592ac1f8fa6c4ba00fa48a8a6cd1929cdf197a3c2042a7e569fe180cca
.exe windows x86

5d2d9b0ac43996f42050b705a2f8b049

Code Sign

9b:ae:73:15:6a:69:49:41:bb:a4:34:af:16:97:58:59:e9:08:a3:e4
Signer

Actual PE Digest

9b:ae:73:15:6a:69:49:41:bb:a4:34:af:16:97:58:59:e9:08:a3:e4

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

NO CERTIFICATE

01/01/0001, 00:00
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessW
SetEvent
GetModuleHandleW
Sleep
GetCommandLineW
CreateEventW
RemoveDirectoryW
WaitForMultipleObjects
LocalFileTimeToFileTime
GetFileTime
SetFileTime
CreateFileA
DosDateTimeToFileTime
CloseHandle
OpenFileMappingW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
LocalFree
DeleteFileW
CopyFileW
GetLastError
InterlockedDecrement
CompareStringA
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetModuleHandleA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeA
SetStdHandle
GetCurrentProcessId
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameW
LoadLibraryW
GetProcAddress
FreeLibrary
FindFirstFileW
FindClose
FindNextFileW
GetTempPathW
GetVersionExW
GetCurrentProcess
OpenEventW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateMutexW
WaitForSingleObject
ReleaseMutex
ExpandEnvironmentStringsW
GetExitCodeProcess
MoveFileW
WTSGetActiveConsoleSessionId
HeapAlloc
GetProcessHeap
HeapFree
lstrcmpiW
CreateFileW
ReadFile
WriteFile
SetFilePointer
InterlockedIncrement
InterlockedCompareExchange
InterlockedExchange
lstrlenA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetEnvironmentVariableW
GetCurrentDirectoryW
SetCurrentDirectoryW
ExitProcess
GetStartupInfoW
GetSystemTimeAsFileTime
GetFileType
CreateDirectoryW
GetCPInfo
RtlUnwind
RaiseException
LCMapStringA
LCMapStringW
GetStringTypeW
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapSize
SetHandleCount
GetStdHandle
GetStartupInfoA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetACP
GetOEMCP
IsValidCodePage
GetModuleFileNameA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
CreateDirectoryA

user32

GetSystemMetrics
LoadStringW

shell32

SHGetSpecialFolderPathW
SHFileOperationW
CommandLineToArgvW
ShellExecuteW
SHCreateDirectoryExW

ole32

CoCreateInstance
OleRun
StringFromCLSID
CoInitialize
CoInitializeSecurity
CoCreateGuid
StringFromGUID2
CoTaskMemFree
CLSIDFromString
CoUninitialize

oleaut32

SysAllocString
GetErrorInfo
SysFreeString
SysStringLen
VariantClear
SysStringByteLen
VariantChangeType
VariantInit
SysAllocStringByteLen

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wtsapi32

WTSQuerySessionInformationW

secur32

GetUserNameExW

advapi32

GetUserNameW
GetTokenInformation
RegOpenKeyExW
RegCloseKey
LookupAccountNameW
ConvertSidToStringSidW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
OpenProcessToken

Sections

.text
Size: 351KB - Virtual size: 350KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5d2d9b0ac43996f42050b705a2f8b049

Code Sign

9b:ae:73:15:6a:69:49:41:bb:a4:34:af:16:97:58:59:e9:08:a3:e4Signer

Signature Validations

Verification

01/01/0001, 00:00 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

ole32

oleaut32

version

wtsapi32

secur32

advapi32

Sections

.text Size: 351KB - Virtual size: 350KB

.rdata Size: 89KB - Virtual size: 88KB

.data Size: 8KB - Virtual size: 16KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 25KB - Virtual size: 24KB

9b:ae:73:15:6a:69:49:41:bb:a4:34:af:16:97:58:59:e9:08:a3:e4
Signer

01/01/0001, 00:00
Valid: false

.text
Size: 351KB - Virtual size: 350KB

.rdata
Size: 89KB - Virtual size: 88KB

.data
Size: 8KB - Virtual size: 16KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 25KB - Virtual size: 24KB