95084a8833322e017d3fbfefc0cb7b234c48a96f13dc124e3265a67b893df1da

Sharing

Copy URL Twitter E-mail

General

Target

95084a8833322e017d3fbfefc0cb7b234c48a96f13dc124e3265a67b893df1da
Size

3.8MB
MD5

3969accd7788f62223be1a001c2f166b
SHA1

dad99cccde70c49b784a10e17acef3fd6f07b9ad
SHA256

95084a8833322e017d3fbfefc0cb7b234c48a96f13dc124e3265a67b893df1da
SHA512

e65e5a2cb5c71cbcfbdf7f4b39719b56774da0dc495f30448d300275fcd019842fa9a22f504444a8f4b2f7e22264a762d64328909d6a5cea24370868429920b2
SSDEEP

12288:IyhsfiXGUTWIrS6dy9pGHNu4B2UbfzFXfy/gjuuwi:TsatLI4rlXm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
95084a8833322e017d3fbfefc0cb7b234c48a96f13dc124e3265a67b893df1da

Files

95084a8833322e017d3fbfefc0cb7b234c48a96f13dc124e3265a67b893df1da
.exe windows x86

94165a2400038b62be80b930c78e5137

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc100ud

ord14191
ord5926
ord2295
ord1460
ord1059
ord1028
ord4071
ord13623
ord4146
ord15658
ord3460
ord14159
ord3461
ord406
ord5483
ord2707
ord14394
ord351
ord5863
ord5625
ord15939
ord15281
ord1680
ord9702
ord14152
ord8852
ord292
ord9269
ord15459
ord15571
ord14766
ord4899
ord14862
ord14708
ord6487
ord6448
ord14564
ord8876
ord14867
ord296
ord8839
ord5232
ord8832
ord14670
ord6063
ord1462
ord15463
ord15064
ord13853
ord15058
ord14815
ord9310
ord14776
ord2555
ord8999
ord2204
ord9352
ord7725
ord12561
ord11961
ord5796
ord1340
ord16748
ord7551
ord862
ord9052
ord15229
ord9754
ord5666
ord7717
ord15081
ord14718
ord6161
ord3348
ord8566
ord6849
ord6139
ord6484
ord9681
ord14868
ord15367
ord15518
ord2043
ord9227
ord12597
ord6450
ord7595
ord1095
ord1094
ord3096
ord15981
ord14124
ord455
ord7004
ord4291
ord457
ord1463
ord2365
ord3204
ord291
ord6538
ord3189
ord270
ord2449
ord2451
ord1434
ord15667
ord2455
ord532
ord1148
ord1439
ord998
ord2698
ord4673
ord6758
ord10196
ord13168
ord2966
ord15000
ord8559
ord3471
ord1432
ord8166
ord267
ord16746
ord16750
ord16732
ord16659
ord16660
ord10077
ord13035
ord4037
ord12309
ord15963
ord9904
ord13122
ord4886
ord2744
ord7719
ord11924
ord10175
ord3440
ord15144
ord13223
ord13221
ord1759
ord1766
ord1772
ord1770
ord1777
ord5341
ord5378
ord5349
ord5361
ord5357
ord5353
ord5383
ord5374
ord5345
ord5387
ord5366
ord5332
ord5336
ord5369
ord4897
ord16667
ord4884
ord3241
ord15965
ord8692
ord15971
ord7563
ord12638
ord14929
ord6560
ord2873
ord13071
ord4142
ord3553
ord3552
ord3439
ord13117
ord6368
ord11153
ord10149
ord4555
ord2599
ord7232
ord417
ord269
ord1674
ord8218
ord1064
ord1029
ord1062
ord1084
ord1132
ord1003
ord1418
ord1400
ord1034
ord1030
ord1133
ord1401
ord8762
ord2250
ord1441
ord934
ord15191
ord4290
ord1451
ord1428
ord1449
ord9358
ord9264
ord13931
ord16444
ord5851
ord2561
ord13532
ord13533
ord15964
ord11351
ord3590
ord3589
ord8691
ord15970
ord10338
ord4347
ord4288
ord14016
ord8712
ord2080
ord16763
ord12908
ord15841
ord13525
ord8765
ord14093
ord9753
ord286
ord3896
ord958
ord509
ord369
ord444
ord359
ord957
ord978
ord302
ord508
ord2273
ord9300
ord4270
ord13078
ord9973
ord6881
ord11938
ord16157
ord16154
ord16159
ord16156
ord16158
ord16155
ord4053
ord6535
ord13198
ord13206
ord4993
ord9053
ord11324
ord13216
ord13167
ord13997
ord5692
ord6079
ord6340
ord10291
ord6049
ord6343
ord5695
ord5914
ord5672
ord8467
ord8468
ord8458
ord5912
ord9057
ord11148
ord3340
ord3339
ord6879
ord14996
ord3480
ord3477
ord9045
ord2965
ord16747
ord12863
ord16749
ord10148
ord4670
ord2695
ord14235
ord7542
ord991
ord11270
ord8374
ord4419
ord1442
ord2480
ord2300

msvcr100d

memcpy_s
_resetstkoflw
_snprintf_s
_errno
_CxxThrowException
_CrtDbgReport
strcpy
wcscpy
_vsnwprintf_s
__CxxFrameHandler3
_snwprintf_s
wcscpy_s
wcsncpy_s
strcpy_s
memcmp
_wcsicmp
memmove_s
_CrtDbgReportW
strcmp
memset
wcslen
labs
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_vsnprintf_s
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
_CRT_RTC_INITW
_initterm_e
_initterm
_CrtSetCheckCount
_wcmdln
exit
_cexit
_XcptFilter
_exit
__wgetmainargs
_amsg_exit
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
fputc
fwrite
vfprintf
_vscprintf
printf
__iob_func
fseek
fgetc
ferror
ftell
fread
fopen_s
fclose
_purecall
sscanf_s
strchr
isspace
isdigit
isalpha
strncmp
strlen
memcpy
_recalloc
calloc
free
malloc
_wassert

kernel32

MapViewOfFile
GetSystemInfo
UnmapViewOfFile
VirtualAlloc
OutputDebugStringA
OpenEventA
SetEvent
CloseHandle
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
MulDiv
CreateFileMappingA
InterlockedDecrement
lstrlenW
EncodePointer
Sleep
InterlockedCompareExchange
HeapSetInformation
DecodePointer
IsDebuggerPresent
RaiseException
lstrlenA
GetProcAddress
LoadLibraryW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentThread
GetStartupInfoW
OpenFileMappingA
InterlockedIncrement
LocalFree
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringW
MultiByteToWideChar
InterlockedExchange
FreeLibrary
VirtualQuery
GetModuleFileNameW
GetProcessHeap
HeapAlloc
HeapFree
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
WideCharToMultiByte

user32

SubtractRect
IntersectRect
OffsetRect
InflateRect
EqualRect
SetRectEmpty
SetRect
PtInRect
IsRectEmpty
CopyRect
GetSystemMetrics
LoadImageW
UnionRect

gdi32

SetDIBColorTable
CreateDIBSection
DeleteDC
GetObjectW
SelectObject
CreateCompatibleDC
DeleteObject

comctl32

InitCommonControlsEx

oleaut32

SysFreeString
GetErrorInfo
VariantClear
VariantChangeType
VariantInit
CreateErrorInfo
SysAllocString
SetErrorInfo

gdiplus

GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipAlloc
GdipCloneImage
GdipDisposeImage
GdipFree
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdiplusShutdown
GdiplusStartup

advapi32

SetThreadToken
RevertToSelf
OpenThreadToken

Sections

.textbss
Size: - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 291KB - Virtual size: 290KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

94165a2400038b62be80b930c78e5137

Headers

DLL Characteristics

File Characteristics

Imports

mfc100ud

msvcr100d

kernel32

user32

gdi32

comctl32

oleaut32

gdiplus

advapi32

Sections

.textbss Size: - Virtual size: 131KB

.text Size: 291KB - Virtual size: 290KB

.rdata Size: 41KB - Virtual size: 41KB

.data Size: 21KB - Virtual size: 44KB

.idata Size: 9KB - Virtual size: 8KB

.rsrc Size: 3.5MB - Virtual size: 3.5MB

.reloc Size: 33KB - Virtual size: 32KB

.textbss
Size: - Virtual size: 131KB

.text
Size: 291KB - Virtual size: 290KB

.rdata
Size: 41KB - Virtual size: 41KB

.data
Size: 21KB - Virtual size: 44KB

.idata
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 3.5MB - Virtual size: 3.5MB

.reloc
Size: 33KB - Virtual size: 32KB