bdddade51a1d7560ee90f5e4b57bc325ed4bf2abc56c48053b395b4d8baacd57

Sharing

Copy URL Twitter E-mail

General

Target

bdddade51a1d7560ee90f5e4b57bc325ed4bf2abc56c48053b395b4d8baacd57
Size

220KB
MD5

eb19d921e3488e432150c5e419fd4cc3
SHA1

051f2f8363dd0e0757e1c48a1fb39ac824ec261e
SHA256

bdddade51a1d7560ee90f5e4b57bc325ed4bf2abc56c48053b395b4d8baacd57
SHA512

18bd3ab822f65ccfb2b337e9256176cc1660eed48c61de0f9a5d3b6c41271e7ee9b088dd40449f5e675e8513f96d06ef9c769dfa379142ce31d14912a90676ca
SSDEEP

6144:N4C9QS6kCziOuAOuAOuAOuAOuAOuAOuAOuAOu4wwwwwwww:NKjwwwwwwww

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bdddade51a1d7560ee90f5e4b57bc325ed4bf2abc56c48053b395b4d8baacd57

Files

bdddade51a1d7560ee90f5e4b57bc325ed4bf2abc56c48053b395b4d8baacd57
.exe windows x86

809f23cbdc62c105f236b910219a874e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memmove
_EH_prolog
??3@YAXPAX@Z
wcsncpy
_CxxThrowException
wcscmp
_wcsnicmp
wcsncat
wcscat
iswspace
wcsrchr
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_controlfp
__dllonexit
_onexit
wcscpy
wcslen
_vsnwprintf
_purecall
_wcsicmp
??2@YAPAXI@Z
_wtol
_itow
_snwprintf
__CxxFrameHandler
malloc
free
realloc
swprintf
wcschr

advapi32

EnumDependentServicesW
InitializeSecurityDescriptor
GetSidSubAuthority
GetAclInformation
QueryServiceConfigW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegEnumValueW
RegQueryInfoKeyW
RegQueryValueExW
RegDeleteValueW
InitializeAcl
StartServiceW
ControlService
ChangeServiceConfigW
SetFileSecurityW
AddAccessAllowedAce
AddAccessDeniedAce
GetAce
AddAce
GetSidLengthRequired
InitializeSid
SetSecurityDescriptorDacl
GetLengthSid
CloseServiceHandle
OpenSCManagerW
OpenServiceW
QueryServiceStatus

kernel32

GetStartupInfoA
GetModuleHandleA
GetModuleFileNameW
GetCommandLineW
GetEnvironmentVariableW
lstrlenW
GetLastError
WideCharToMultiByte
GetTempPathW
CloseHandle
CreateFileW
WriteFile
SetFilePointer
GetLocalTime
GetFileAttributesW
Sleep
FreeLibrary
GetProcAddress
SetLastError
LoadLibraryW
SetCurrentDirectoryW
GetCurrentDirectoryW
MoveFileExW
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
GetShortPathNameW
RemoveDirectoryW
FindClose
FindNextFileW
DeleteFileW
lstrcmpW
FindFirstFileW
GetVersionExW
SetFileAttributesW
ReadFile
MultiByteToWideChar
lstrcmpiW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
LoadLibraryA
lstrcpynW
GetWindowsDirectoryW
GetSystemDirectoryW
lstrlenA
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetComputerNameW
InterlockedExchange
RaiseException
HeapFree
HeapReAlloc
GetProcessHeap
CreateDirectoryW
VirtualFree
LocalAlloc

setupapi

SetupGetTargetPathW
SetupFindFirstLineW
SetupGetLineCountW
SetupInstallFileExW
SetupOpenInfFileW
SetupGetSourceFileLocationW
SetupDefaultQueueCallbackW
SetupSetDirectoryIdW
SetupPromptForDiskW
SetupFindNextLine
SetupGetLineTextW
SetupInitDefaultQueueCallbackEx
SetupInstallFileW
SetupGetStringFieldW
SetupCloseInfFile

ole32

CoUninitialize
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
StringFromCLSID
CoCreateInstance
CoTaskMemRealloc

oleaut32

SysAllocString
SysFreeString
VarUI4FromStr

user32

wsprintfW
CharNextW
GetActiveWindow

shlwapi

PathAppendW
PathFileExistsW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

Sections

.text
Size: 76KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

xtonpgn
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

809f23cbdc62c105f236b910219a874e

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

setupapi

ole32

oleaut32

user32

shlwapi

version

Sections

.text Size: 76KB - Virtual size: 73KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 136KB - Virtual size: 136KB

xtonpgn Size: - Virtual size: 4KB

.text
Size: 76KB - Virtual size: 73KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 136KB - Virtual size: 136KB

xtonpgn
Size: - Virtual size: 4KB