05880799[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

05880799.exe
Size

328KB
MD5

8ed9a60127aee45336102bf12059a850
SHA1

b649b9bc9436d373fd09a89ed71840aa7ac5ec54
SHA256

eefa052da01c3faa1d1f516ddfefa8ceb8a5185bb9b5368142ffdf839aea4506
SHA512

95a0d62f02b29a48b1988cba6610b6410327f52ef918fd83fe2565d3767ab202d2a9aef6bcf47234c7c7200c49b71b80cd0430a7b6e55885f7a4b54a69e0dc2e
SSDEEP

6144:wDeUVJuo0tl4VJLofrFD68Y7LE8DO11bEVUNNa:IuFl4VJ4D68YUQO1tEV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
05880799.exe

Files

05880799.exe
.exe windows x86

4f7e80b12e14587fc3c198bdef27ceee

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoRevokeClassObject
CoRegisterClassObject
CoTaskMemAlloc
CoTaskMemRealloc
StringFromGUID2
CoDisconnectObject
CoUninitialize
CoRevertToSelf
CoInitializeSecurity
CoCreateGuid
CLSIDFromString
CoGetClassObject
CoGetCallContext
StringFromIID
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
CoImpersonateClient
CoQueryProxyBlanket
StringFromCLSID
CoTaskMemFree

oleaut32

SysFreeString
SysAllocStringLen
SysAllocString
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
VarBstrCat
VariantClear
VariantInit
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysStringByteLen
SysAllocStringByteLen
SafeArrayCreate

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

rpcrt4

RpcStringFreeA
RpcBindingFromStringBindingA
RpcStringBindingComposeA
NdrClientCall
RpcBindingSetAuthInfoA

shlwapi

PathFindExtensionA

advapi32

RegOpenKeyExW
QueryServiceStatus
LookupAccountSidA
PrivilegeCheck
IsValidSecurityDescriptor
DuplicateTokenEx
AddAce
GetSecurityDescriptorLength
GetUserNameA
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorSacl
MakeAbsoluteSD
SetSecurityDescriptorDacl
MakeSelfRelativeSD
InitializeAcl
AddAccessAllowedAce
AddAccessDeniedAce
AllocateAndInitializeSid
FreeSid
RegConnectRegistryA
RegSetKeySecurity
LookupAccountNameA
GetAclInformation
GetAce
DuplicateToken
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
AccessCheck
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
EqualSid
GetSecurityDescriptorControl
GetLengthSid
CopySid
IsValidSid
LookupAccountSidW
RegCreateKeyA
RegEnumValueA
RegQueryValueExA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
ControlService
DeleteService
SetThreadToken
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
RegEnumKeyA
SetServiceStatus
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA
GetTokenInformation
OpenThreadToken
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
DeregisterEventSource
ReportEventA
RegisterEventSourceA
CloseServiceHandle
ChangeServiceConfigA
OpenServiceA
CreateServiceA
OpenSCManagerA
RegQueryValueExW

kernel32

HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlUnwind
IsBadWritePtr
HeapSize
GetOEMCP
GetCPInfo
HeapReAlloc
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
FlushFileBuffers
SetEndOfFile
GetProcessHeap
GetSystemTimeAsFileTime
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryW
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
RaiseException
InitializeCriticalSection
DeleteCriticalSection
GetVersion
lstrcmpiA
lstrlenW
lstrlenA
CloseHandle
OpenProcess
CompareStringA
CompareStringW
HeapAlloc
InterlockedIncrement
InterlockedDecrement
LoadLibraryA
GetModuleHandleA
WaitForSingleObject
CreateEventA
SetEvent
TerminateThread
CreateThread
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetComputerNameA
LocalFree
GetCurrentProcess
GetCurrentThread
lstrcpynA
lstrcpyA
GetModuleFileNameA
lstrcatA
IsDBCSLeadByte
FormatMessageA
GetFileAttributesA
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
SetUnhandledExceptionFilter
GetCommandLineA
GetCurrentProcessId
SetErrorMode
GetProcessTimes
GetPrivateProfileStringA
TerminateProcess
GetPrivateProfileSectionA
GetPrivateProfileIntA
CreateFileA
GetProfileStringA
CreateDirectoryA
WritePrivateProfileStringA
WriteProfileStringA
GetPrivateProfileSectionNamesA
GetTickCount
LocalAlloc
LockResource
CreateProcessA
InterlockedCompareExchange
SetEnvironmentVariableA
GetSystemDirectoryA
Sleep
GetModuleHandleW
LocalSize
ReadFile
SetFilePointer
SetLastError
ReadProcessMemory
FindClose
FindFirstFileA
FindResourceExA
UnmapViewOfFile
DuplicateHandle
GetModuleFileNameW
MapViewOfFile
CreateFileMappingA
CreateMutexA
ReleaseMutex
GetExitCodeProcess
CreateProcessW
GetStartupInfoA
ExitProcess
QueryPerformanceCounter

user32

wsprintfA
wsprintfW
EnumWindows
GetWindowThreadProcessId
IsWindowVisible
GetWindowTextA
DispatchMessageA
MessageBoxA
LoadStringA
CharNextA
PeekMessageA
SetTimer
GetMessageA
KillTimer
PostThreadMessageA
CharUpperA

Sections

.text
Size: 300KB - Virtual size: 297KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4f7e80b12e14587fc3c198bdef27ceee

Headers

File Characteristics

Imports

ole32

oleaut32

version

rpcrt4

shlwapi

advapi32

kernel32

user32

Sections

.text Size: 300KB - Virtual size: 297KB

.data Size: 12KB - Virtual size: 10KB

.rsrc Size: 12KB - Virtual size: 10KB

.text
Size: 300KB - Virtual size: 297KB

.data
Size: 12KB - Virtual size: 10KB

.rsrc
Size: 12KB - Virtual size: 10KB