SecuriteInfo[.]com[.]Adware[.]Presenoker[.]17900[.]25308[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

SecuriteInfo.com.Adware.Presenoker.17900.25308.exe
Size

886KB
MD5

0a8340d1052e9e1d43f3cb12c7481346
SHA1

e81c662a4fef2292f78a09569313d1cbc1a5d1e9
SHA256

81aa84d5c59168fd965e669a98c589296397b90f55b67d957a32de6f70f98293
SHA512

dee63bfc4db1957334caa8f38eb04e0d61f0e04bac25f56c661477986e2cc4e38b6e06e2484a21a7af61e1c84eeedf716c6c2346362e05ff995d3891975eebcf
SSDEEP

12288:d19EmgDPVn6IQYx7FD8nD4j4KJlDCCGAQD:x9MHx7FDrjhPGA2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecuriteInfo.com.Adware.Presenoker.17900.25308.exe

Files

SecuriteInfo.com.Adware.Presenoker.17900.25308.exe
.exe windows x86

b413e4ede87d6d9f214641082bcb0673

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetSetStatusCallback
InternetCloseHandle
HttpQueryInfoA
HttpSendRequestA
InternetErrorDlg
HttpOpenRequestA
InternetConnectA
InternetReadFile
InternetOpenA
InternetOpenUrlA
InternetCanonicalizeUrlA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

mfc42

ord815
ord415
ord567
ord324
ord825
ord715
ord5641
ord2370
ord2302
ord4234
ord800
ord823
ord537
ord2915
ord6199
ord941
ord1168
ord5953
ord939
ord2818
ord858
ord926
ord3097
ord540
ord6241
ord4710
ord4615
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord656
ord641
ord860
ord541
ord561
ord700
ord5861
ord4160
ord3811
ord2393
ord1200
ord6380
ord6215
ord6197
ord4610
ord6402
ord3521
ord6117
ord986
ord520
ord2725
ord1825
ord4238
ord4696
ord3058
ord3065
ord6336
ord2510
ord2542
ord5243
ord5740
ord1746
ord5577
ord3172
ord5653
ord4420
ord4953
ord4858
ord2399
ord4387
ord3454
ord3198
ord6080
ord6175
ord4623
ord4426
ord338
ord652
ord4823
ord801
ord396
ord414
ord713
ord535
ord4425
ord3597
ord2614
ord922
ord4203
ord940
ord6663
ord4204
ord5572
ord6876
ord6779
ord2764
ord6877
ord538
ord6307
ord4187
ord4202
ord521
ord3663
ord6883
ord911
ord5859
ord6403
ord3522
ord936
ord832
ord6401
ord3520
ord3584
ord543
ord803
ord6597
ord6800
ord6658
ord6650
ord6591
ord6807
ord6857
ord6823
ord6855
ord6832
ord6859
ord6867
ord6847
ord6839
ord6846
ord6858
ord6845
ord6856
ord6835
ord4589
ord4588
ord4899
ord4370
ord4892
ord5076
ord4340
ord4889
ord4531
ord4545
ord4543
ord4526
ord4529
ord4524
ord4963
ord4960
ord4108
ord6054
ord5240
ord3748
ord1725
ord6614
ord4432
ord6514
ord6478
ord5260
ord1233
ord6803
ord4720
ord6822
ord6814
ord4129
ord5575
ord434
ord6699
ord6808
ord5683
ord5710
ord6661
ord1175
ord6813
ord2864
ord5651
ord3130
ord698
ord924
ord350
ord4347
ord2379
ord5281
ord6854
ord6812
ord6815
ord6816
ord665
ord6648
ord3079
ord5442
ord3318
ord5186
ord354
ord2411
ord2023
ord4218
ord2578
ord4398
ord3582
ord616
ord3797
ord4275
ord6930
ord6928
ord3874
ord3317
ord6283
ord6282
ord6817
ord6691
ord539
ord3619
ord3721
ord795
ord3626
ord2414
ord755
ord5789
ord6172
ord5873
ord470
ord1146
ord1641
ord2860
ord1842
ord4242
ord2723
ord2390
ord3059
ord5100
ord5103
ord4303
ord3350
ord5012
ord975
ord5472
ord3403
ord2879
ord2878
ord4151
ord4077
ord5237
ord2649
ord1665
ord4436
ord4427
ord807
ord674
ord6491
ord554
ord366
ord620
ord2863
ord2012
ord2921
ord4413
ord4853
ord6565
ord6619
ord4163
ord6625
ord2820
ord4457
ord5252
ord6195
ord4284
ord3870
ord5282
ord4467
ord1105
ord1228
ord1567
ord268
ord686
ord2452
ord2453
ord2096
ord384
ord3092
ord2301
ord4278
ord3437
ord6143
ord2652
ord6334
ord1669
ord5681
ord3692
ord3571
ord3742
ord818
ord2152
ord6379
ord613
ord5791
ord289
ord640
ord5785
ord1640
ord323
ord4189
ord5594
ord3439
ord913
ord923
ord398
ord5645
ord3127
ord3616
ord5583
ord547
ord548
ord603
ord1969
ord273
ord6383
ord1871
ord6571
ord5440
ord2740
ord2801
ord2917
ord2803
ord958
ord6312
ord4177
ord6010
ord2601
ord3180
ord3183
ord3176
ord3507
ord3614
ord353
ord5773
ord6232
ord6230
ord6148
ord2568
ord6268
ord6271
ord3225
ord3257
ord3912
ord2544
ord2543
ord2511
ord978
ord1731
ord5851
ord2398
ord2418
ord6224
ord6226
ord2429
ord2250
ord4732
ord4541
ord5477
ord2259
ord4836
ord4440
ord3720
ord527
ord794
ord4264
ord4763
ord4789
ord4985
ord2884
ord3495
ord1622
ord3613
ord5450
ord6394
ord4033
ord4376
ord5265
ord3610
ord4424
ord3402
ord5290
ord1776
ord6055
ord4627
ord4080
ord3830
ord3825
ord3831
ord2985
ord2976
ord3081
ord4465
ord3262
ord3136
ord2982
ord3259
ord3147
ord2446
ord5277
ord2124
ord5065
ord5261
ord1727
ord2055
ord3749
ord6376
ord4837
ord2648
ord4441
ord4353
ord3798
ord5280
ord2385
ord6374
ord5163
ord1775
ord5241
ord4407
ord2514
ord4078
ord6052
ord6385
ord4998
ord1979
ord3676
ord1656
ord6209
ord1576

msvcrt

atoi
calloc
??1exception@@UAE@XZ
??0exception@@QAE@XZ
?what@exception@@UBEPBDXZ
_CxxThrowException
_onexit
__dllonexit
strstr
fwrite
isdigit
atol
isspace
malloc
_purecall
_mbscmp
strncpy
isalnum
_wcsnicmp
wcscmp
wcscpy
wcsrchr
wcsstr
wcscat
wcslen
wcschr
wcsncpy
_strdup
time
srand
??1type_info@@UAE@XZ
_except_handler3
exit
_exit
_XcptFilter
_initterm
_acmdln
__getmainargs
__p__commode
__setusermatherr
_adjust_fdiv
free
fgetc
fopen
sprintf
_setmbcp
__set_app_type
_controlfp
__CxxFrameHandler
__p__fmode
_ftol
fclose
fgetpos
rand

kernel32

LocalFree
FileTimeToSystemTime
InitializeCriticalSection
InterlockedIncrement
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
GetLastError
SizeofResource
lstrlenA
LoadResource
FindResourceA
LockResource
GetComputerNameA
CreateThread
GetModuleHandleA
WaitForSingleObject
TerminateThread
CloseHandle
Sleep
ResumeThread
GetExitCodeThread
FreeLibrary
LoadLibraryA
GetTickCount
RemoveDirectoryA
FindClose
FindFirstFileA
DeleteFileA
FindNextFileA
GetTempPathA
GetTempFileNameA
CreateDirectoryA
CreateFileA
GetTimeZoneInformation
GetFileTime
GetStartupInfoA
GetModuleFileNameA
HeapDestroy

user32

LoadMenuA
GetFocus
GetWindow
DeleteMenu
GetWindowTextA
GetClassNameA
ReleaseDC
GetMenuItemID
GetAsyncKeyState
GetKeyState
PostMessageA
LoadIconA
TrackPopupMenu
LoadCursorA
RegisterHotKey
GetMenuItemCount
GetSubMenu
RemoveMenu
GetDC
ScreenToClient
UnregisterHotKey
RedrawWindow
GetParent
keybd_event
SetTimer
KillTimer
MessageBoxA
GetCursorPos
SetMenu
GetMenu
FindWindowExA
GetSysColor
IsWindow
UpdateWindow
GetWindowRect
GetSystemMetrics
SendMessageA
GetClientRect
PtInRect
ReleaseCapture
GetCapture
SetCapture
EnableWindow
ClientToScreen
WindowFromPoint
SetCursor

gdi32

BitBlt
CreateFontIndirectA
CreateCompatibleBitmap
CreatePalette
RealizePalette
GetStockObject
GetDeviceCaps
GetObjectA
CreateDIBitmap
DeleteDC
StretchDIBits
SelectObject
CreateCompatibleDC

advapi32

RegCloseKey
RegQueryValueExA
RegDeleteKeyA
RegDeleteValueA
RegSetValueExA
RegOpenKeyExA

shell32

SHGetMalloc
ShellExecuteA
SHGetPathFromIDListA
SHGetDesktopFolder

comctl32

ImageList_AddMasked

ole32

CoUninitialize
CoInitialize

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocString

urlmon

ReleaseBindInfo
CoInternetGetSession

msvcp60

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

Sections

.text
Size: 128KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 560KB - Virtual size: 556KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b413e4ede87d6d9f214641082bcb0673

Headers

File Characteristics

Imports

wininet

version

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

oleaut32

urlmon

msvcp60

Sections

.text Size: 128KB - Virtual size: 124KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 16KB - Virtual size: 14KB

.rsrc Size: 560KB - Virtual size: 556KB

.text
Size: 128KB - Virtual size: 124KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 16KB - Virtual size: 14KB

.rsrc
Size: 560KB - Virtual size: 556KB