606d6499f288102c86454b782e94a0e5e84a75e2dfe486b716c80b3e6a2c040b

Sharing

Copy URL Twitter E-mail

General

Target

606d6499f288102c86454b782e94a0e5e84a75e2dfe486b716c80b3e6a2c040b
Size

2.7MB
MD5

d6dabee257766290f403e997ded3d955
SHA1

7aa0113a8cc001e7b8c41e4fdc666d5ba6b2234c
SHA256

606d6499f288102c86454b782e94a0e5e84a75e2dfe486b716c80b3e6a2c040b
SHA512

92781b872f24f6726627d02bb17cb30761109af19ca16f675b38d3e4c3ac65f8abaae27733087cc1b1d9d24014ec01854e1c144192662d63720956bd69ead510
SSDEEP

49152:EnLjIH9daVyLUKOmHq2cYTIznBdAkeeUOd4QXvC59tGa6dbqG7DM:gPAdUKOmHq2Ngn38i/c90lA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
606d6499f288102c86454b782e94a0e5e84a75e2dfe486b716c80b3e6a2c040b

Files

606d6499f288102c86454b782e94a0e5e84a75e2dfe486b716c80b3e6a2c040b
.exe windows x86

a3f5238a097e667a7b50d2c71b0ffb12

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
CloseHandle
DeleteFileW
LocalFree
SetFileAttributesW
lstrcpyW
CreateMutexW
FindFirstFileW
MapViewOfFile
UnmapViewOfFile
FreeLibrary
Sleep
ReadFile
WritePrivateProfileStringW
FindClose
CreateFileMappingW
FindNextFileW
ReleaseMutex
SetUnhandledExceptionFilter
GetCurrentProcessId
GetDriveTypeW
GetPrivateProfileStringW
LeaveCriticalSection
FlushInstructionCache
SetLastError
lstrcmpiA
EnterCriticalSection
DeviceIoControl
GlobalReAlloc
CreateThread
DeleteCriticalSection
FlushFileBuffers
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
LoadLibraryExW
InitializeCriticalSectionEx
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetModuleFileNameA
GetFileType
GetStdHandle
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
WideCharToMultiByte
lstrcatW
GetSystemInfo
DecodePointer
GlobalFree
HeapSize
GetProcAddress
GetLastError
VerifyVersionInfoW
RaiseException
GlobalUnlock
lstrlenW
MultiByteToWideChar
lstrcmpW
HeapReAlloc
CreateFileW
GetModuleFileNameW
MulDiv
LoadLibraryW
GlobalAlloc
WriteFile
GetProcessHeap
GetModuleHandleW
GlobalLock
CreateDirectoryW
HeapFree
GetCurrentProcess
MoveFileExW
VerSetConditionMask
HeapAlloc
GetModuleHandleExW
ExitProcess
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
RtlUnwind
GetCommandLineA
GetSystemTimeAsFileTime
EncodePointer
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
OutputDebugStringW
IsDebuggerPresent
SetNamedPipeHandleState
WaitNamedPipeW
PeekNamedPipe
LCMapStringW

user32

SetDlgItemTextW
SendMessageW
MessageBoxW
CreateWindowExW
GetDesktopWindow
ReleaseDC
GetDC
wsprintfW
DialogBoxIndirectParamW
GetDlgItem
SetWindowLongW
EndDialog
SendDlgItemMessageW
ShowWindow
IsDlgButtonChecked
GetActiveWindow
CheckRadioButton
GetDlgItemTextW
LoadImageW
EnableWindow
GetDlgCtrlID
ExitWindowsEx
MapDialogRect
UnregisterClassW

gdi32

SetBkColor
DeleteObject
CreateSolidBrush
EnumFontFamiliesW
CreateFontIndirectW
GetDeviceCaps
GetObjectW
SetTextColor

advapi32

RegCreateKeyExW
AdjustTokenPrivileges
ControlService
RegDeleteTreeW
QueryServiceStatus
StartServiceW
LookupPrivilegeValueW
OpenServiceW
OpenSCManagerW
DeleteService
OpenProcessToken
CloseServiceHandle
CreateServiceW
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteKeyW
RegQueryValueExW

shell32

SHFileOperationW
ord75
SHGetSpecialFolderPathW
SHChangeNotify
SHBrowseForFolderW
SHGetPathFromIDListW

ole32

CoCreateInstance
CoUninitialize
CoInitialize
CoInitializeEx
CoTaskMemFree
CLSIDFromString

shlwapi

StrStrW
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
PathFindFileNameW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

comctl32

ord17

Sections

.text
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a3f5238a097e667a7b50d2c71b0ffb12

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

version

comctl32

Sections

.text Size: 99KB - Virtual size: 98KB

.rdata Size: 37KB - Virtual size: 37KB

.data Size: 5KB - Virtual size: 13KB

.rsrc Size: 21KB - Virtual size: 21KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 99KB - Virtual size: 98KB

.rdata
Size: 37KB - Virtual size: 37KB

.data
Size: 5KB - Virtual size: 13KB

.rsrc
Size: 21KB - Virtual size: 21KB

.reloc
Size: 7KB - Virtual size: 7KB