2f931801cb5da1bfd8e880fa0d5eb87229db522469b0bd8ed81bb17a7d943e5a

Sharing

Copy URL Twitter E-mail

General

Target

2f931801cb5da1bfd8e880fa0d5eb87229db522469b0bd8ed81bb17a7d943e5a
Size

444KB
MD5

b4b8273407937f5dde73f915d4c97bf1
SHA1

0345f7d9aeea5a9e22bb21641a83bb6cd4d4654a
SHA256

2f931801cb5da1bfd8e880fa0d5eb87229db522469b0bd8ed81bb17a7d943e5a
SHA512

0768f59690a7835a11160ab1f64487b2132875f916fd432d1c1e08219febe426055ca9cef51138245dd2d8b610d672f19ffec8db35253c0bb606bc0414ef5deb
SSDEEP

3072:rvo3VT8Q5Mu3V5VQ7HuyxngV0tJOw9tnhawMYeWtVXmiSc+yy2yy0GALJe5dn3VQ:rRQiu3V5VQ7FxnLTtawMumfJ0QND

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f931801cb5da1bfd8e880fa0d5eb87229db522469b0bd8ed81bb17a7d943e5a

Files

2f931801cb5da1bfd8e880fa0d5eb87229db522469b0bd8ed81bb17a7d943e5a
.exe windows x86

c1843bc5875d63c620cee8ef52db7692

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlUnwind
HeapAlloc
HeapFree
HeapReAlloc
VirtualAlloc
GetCommandLineA
GetProcessHeap
GetStartupInfoA
RaiseException
HeapSize
ExitProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
VirtualFree
HeapDestroy
HeapCreate
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
SetFilePointer
WriteFile
GetOEMCP
GetCPInfo
GetLocaleInfoA
GlobalFlags
GetCurrentThreadId
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
GetThreadLocale
lstrcmpA
GlobalGetAtomNameA
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetCurrentProcessId
InterlockedIncrement
SetErrorMode
InterlockedDecrement
GetModuleFileNameW
GetModuleHandleA
SetLastError
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
CompareStringA
GetVersion
MultiByteToWideChar
InterlockedExchange
ReleaseMutex
GetUserDefaultLangID
GetSystemDefaultLangID
CreateThread
CreateProcessA
OpenProcess
WaitForSingleObject
GlobalAlloc
CreateFileA
GetPrivateProfileStringA
lstrcpynA
GetModuleFileNameA
Sleep
CreateMutexA
GetLastError
CloseHandle
GlobalFree
lstrlenA
lstrcpyA
lstrcatA
GetPrivateProfileIntA
FindResourceExA
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
GetVersionExA
LoadLibraryA
GetProcAddress
GetCurrentProcess
IsValidCodePage
FreeLibrary

user32

DestroyMenu
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
SetWindowTextA
ValidateRect
RegisterWindowMessageA
WinHelpA
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
IsWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
GetKeyState
GetClientRect
GetMenu
PostMessageA
GetClassInfoExA
AdjustWindowRectEx
CopyRect
PtInRect
GetDlgCtrlID
CallWindowProcA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
GetClassInfoA
SetForegroundWindow
SystemParametersInfoA
AttachThreadInput
GetWindowThreadProcessId
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetWindowTextA
UnregisterClassA
GetParent
GetLastActivePopup
IsWindowEnabled
EnableWindow
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
GetForegroundWindow
ShowWindow
SetWindowPos
SetWindowLongA
GetWindowLongA
EnumWindows
SendMessageA
FindWindowA
WaitForInputIdle
DefWindowProcA
PostQuitMessage
MessageBoxA
DispatchMessageA
TranslateMessage
GetMessageA
CreateWindowExA
RegisterClassA
LoadCursorA
UnhookWindowsHookEx
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
LoadIconA

gdi32

DeleteDC
CreateBitmap
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
GetStockObject
DeleteObject
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
GetDeviceCaps
PtVisible

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl
AllocateAndInitializeSid
FreeSid
OpenProcessToken
GetTokenInformation
EqualSid

shlwapi

PathFindFileNameA
PathFindExtensionA

oleaut32

VariantClear
VariantChangeType
VariantInit

Sections

.text
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 292KB - Virtual size: 291KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

qlugfo
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 88KB - Virtual size: 87KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c1843bc5875d63c620cee8ef52db7692

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

shlwapi

oleaut32

Sections

.text Size: 112KB - Virtual size: 111KB

.rdata Size: 28KB - Virtual size: 26KB

.data Size: 8KB - Virtual size: 21KB

.rsrc Size: 292KB - Virtual size: 291KB

qlugfo Size: 8KB - Virtual size: 4KB

Size: 88KB - Virtual size: 87KB

.text
Size: 112KB - Virtual size: 111KB

.rdata
Size: 28KB - Virtual size: 26KB

.data
Size: 8KB - Virtual size: 21KB

.rsrc
Size: 292KB - Virtual size: 291KB

qlugfo
Size: 8KB - Virtual size: 4KB