03845299[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

03845299.exe
Size

703KB
MD5

4053b796a978356360e483af6c947397
SHA1

6d4a08d8df346557daab211d66bcb11fa845b076
SHA256

cb8f9a59e14731cead73fbf904487f3c0ccbbd200dd79a7efe8e28e231d1985f
SHA512

90da8637e8878e6f5caf05f545c451cfc206b02cf94f812efffc19521d485176303adfe700ea422752d065ef1a85aee226e3ee5a05b15b7a6a2100fd2a732e6a
SSDEEP

12288:RsXaGVzC3XJ7usXfr6m2Q3RqhnTWP13Zt4naQXHf7QMSo:RsXaJ3XJ7Nj2Q3RMnSP13f4aQvU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
03845299.exe

Files

03845299.exe
.dll windows x86

edcf0bbebc075d87da8681a4733f99dd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt20

_itoa
__dllonexit
_adjust_fdiv
_initterm
_onexit
_except_handler3
strtoul
_ultoa
atol
qsort
_CIpow
_adj_fdivr_m32
floor
_adj_fdiv_m32i
_adj_fdivr_m64
_adj_fdiv_r
_adj_fdiv_m32
__p__environ
_adj_fdiv_m64
_wgetenv
_CIexp
__p__wenviron
_locking
_close
_adj_fpatan
_write
_read
_lseek
rename
_isatty
_sopen
_rmdir
_mkdir
remove
_findnext
_findclose
_findfirst
_commit
wcstod
__doserrno
wcspbrk
wcsncmp
strtod
_ecvt
_errno
_fcvt
toupper
strstr
strpbrk
strrchr
wcschr
wcscat
iswctype
atoi
wcscmp
_wcsicmp
_exit
_statusfp
wcsncpy
_strnicmp
wcscpy
_fpreset
__p___mb_cur_max
_isctype
malloc
_chmod
_ltoa
_getdcwd
_getcwd
memcpy
_access
free
wcslen
_chdrive
_purecall
_getdrive
strchr
memmove
getenv
_clearfp
memchr
_splitpath
modf
__p__pctype
_chdir
_ftol
strncpy
exit

kernel32

SetHandleCount
LocalAlloc
LocalFree
GetCurrentProcessId
GetSystemDirectoryA
SetErrorMode
LoadLibraryExA
SetFileAttributesA
Sleep
CreateFileMappingA
CloseHandle
GlobalDeleteAtom
ExitProcess
UnhandledExceptionFilter
GetStartupInfoA
GetVersionExA
SetLocalTime
WinExec
GetSystemTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileTime
SetFileTime
LoadLibraryW
LCMapStringA
LCMapStringW
CompareStringW
GetUserDefaultLangID
CreateProcessW
RtlUnwind
RaiseException
FormatMessageW
SystemTimeToFileTime
FlushInstructionCache
VirtualProtect
GetCurrentProcess
MultiByteToWideChar
GetVersion
lstrcmpiW
GetLocaleInfoA
CompareStringA
GetUserDefaultLCID
GetExitCodeProcess
CreateProcessA
WaitForSingleObject
VirtualAlloc
FreeResource
VirtualQuery
WideCharToMultiByte
VirtualFree
GlobalSize
GlobalAddAtomA
GetCurrentThreadId
GetModuleHandleA
GetFileAttributesA
GetProfileStringA
GlobalReAlloc
SetLastError
SearchPathA
GetFullPathNameA
GlobalHandle
CreateFileA
GetFileType
LoadResource
FindResourceA
_lread
SizeofResource
_lwrite
GetTempFileNameA
LockResource
GetTempPathA
_lclose
GetWindowsDirectoryA
GetLastError
IsBadReadPtr
_llseek
GetPrivateProfileStringA
GetTickCount
MulDiv
lstrcmpiA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetDriveTypeA
FindClose
GetVolumeInformationA
FindFirstFileA
IsDBCSLeadByte
GetShortPathNameA
lstrcatA
GlobalLock
GlobalAlloc
GlobalFree
lstrcmpA
lstrlenA
GlobalUnlock
LoadLibraryA
lstrcpyA
GetModuleFileNameA
GetLocalTime
GetProcAddress
FreeLibrary
GetCommandLineA

user32

CharToOemA
IsZoomed
DestroyIcon
GetParent
GetClassLongA
CharUpperA
CallWindowProcA
GetClassNameA
EnableWindow
InvalidateRect
UpdateWindow
GetWindowRect
IsWindow
PostMessageA
InflateRect
GetWindow
CharNextA
LoadBitmapA
DrawFocusRect
CharPrevA
OffsetRect
CharLowerA
CharLowerBuffA
DrawTextA
CopyRect
SetCaretPos
GetCaretPos
ReleaseDC
SetWindowPos
GetWindowDC
IsIconic
GetWindowTextLengthA
DestroyMenu
SetFocus
DrawMenuBar
SetActiveWindow
WinHelpA
DefMDIChildProcA
PeekMessageA
SetForegroundWindow
GetWindowThreadProcessId
GetDesktopWindow
DefWindowProcA
EndPaint
BeginPaint
SetWindowContextHelpId
CharUpperBuffA
CharUpperBuffW
LoadStringW
SetWindowsHookExW
GetForegroundWindow
VkKeyScanA
VkKeyScanW
GetKeyboardState
keybd_event
SetKeyboardState
WaitForInputIdle
GetWindowLongA
ShowWindow
DeferWindowPos
EndDeferWindowPos
MoveWindow
FindWindowA
CharLowerBuffW
GetSystemMenu
IsWindowVisible
SetWindowTextA
wsprintfA
SetWindowLongA
CloseClipboard
EmptyClipboard
OpenClipboard
GetClipboardData
SetClipboardData
IsClipboardFormatAvailable
GetKeyState
IsChild
GetCapture
GetFocus
SendMessageA
MapWindowPoints
FindWindowW
BeginDeferWindowPos
AttachThreadInput
GetClientRect
TrackPopupMenu
FillRect
GetWindowTextA
FrameRect
SetScrollRange
ScreenToClient
GetScrollPos
SetTimer
SetScrollPos
SetCapture
ReleaseCapture
SetParent
PtInRect
GetUpdateRgn
WindowFromPoint
DdeCreateDataHandle
DdeGetLastError
DdeDisconnect
DdeClientTransaction
DdePostAdvise
DdeGetData
DdeSetUserHandle
DdeConnect
DdeAbandonTransaction
DdeFreeDataHandle
DdeCreateStringHandleA
DdeFreeStringHandle
DdeQueryStringA
DdeQueryConvInfo
DdeNameService
DdeInitializeA
SetCursor
DdeUninitialize
SetCursorPos
SetRect
LoadCursorA
LoadStringA
UnregisterClassA
CreateWindowExA
CharToOemBuffA
DestroyWindow
SetWindowWord
SetPropA
GetPropA
GetAsyncKeyState
GetTabbedTextExtentA
CreateIcon
RemovePropA
EnumClipboardFormats
DestroyCursor
CreateCursor
LoadIconA
IsDialogMessageA
GetCursor
CreateDialogParamA
GetLastActivePopup
IsRectEmpty
EnableMenuItem
GetDC
GetActiveWindow
GetSystemMetrics
GetSysColor
PostQuitMessage
MessageBeep
DialogBoxParamA
MessageBoxA
DrawIcon
EndDialog
SetDlgItemTextA
SendDlgItemMessageA
GetMessagePos
GetMessageTime
BringWindowToTop
LoadAcceleratorsA
TranslateMDISysAccel
RegisterClipboardFormatA
GetClipboardFormatNameA
GetMenuState
OemToCharA
ShowCursor
PostThreadMessageA
WaitMessage
CallNextHookEx
SetWindowsHookExA
RegisterWindowMessageA
UnhookWindowsHookEx
DispatchMessageA
SetMenuDefaultItem
GetCursorPos
CreatePopupMenu
InsertMenuA
GetSubMenu
GetMenu
SetMenu
CheckMenuItem
ModifyMenuA
IntersectRect
GetMenuItemID
GetDlgItem
GetMenuStringA
AppendMenuA
GetMenuItemCount
DeleteMenu
RegisterClassA
DefFrameProcA
TabbedTextOutA
KillTimer
IsWindowEnabled
TranslateMessage
RemoveMenu
ClientToScreen
GetClassInfoA
GetDoubleClickTime
ValidateRect
CreateMenu

gdi32

OffsetWindowOrgEx
IntersectClipRect
SaveDC
ExtTextOutA
UnrealizeObject
CreateSolidBrush
CreateHatchBrush
CreatePen
SetBkColor
SetTextColor
SetBrushOrgEx
SelectObject
StretchBlt
DeleteObject
SetBkMode
PatBlt
GetBkColor
SelectPalette
GetStockObject
GetViewportExtEx
GetClipBox
RealizePalette
GetObjectA
GetTextMetricsA
GetDeviceCaps
LineTo
MoveToEx
SetROP2
Escape
RestoreDC
GetROP2
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
RoundRect
Ellipse
CreateDCA
CombineRgn
SetRectRgn
Rectangle
ExcludeClipRect
SetWindowOrgEx
CreateRectRgn
GetWindowExtEx
TextOutA
SetAbortProc
BitBlt
EnumFontsA
CreateBrushIndirect
Arc
CreatePenIndirect
SetStretchBltMode
GetPixel
Pie
StretchDIBits
CreateBitmap
GetBitmapBits
CopyEnhMetaFileA
CreatePalette
CopyMetaFileA
CreateDIBitmap
GetPaletteEntries
GetNearestColor
ScaleViewportExtEx
SetViewportExtEx
GetDIBits
SetWindowExtEx
SetMapMode
SetViewportOrgEx
CloseMetaFile
CreateMetaFileA
DeleteMetaFile
SelectClipRgn
CreateRectRgnIndirect
PlayMetaFile
CreateICA
EndDoc
StartPage
EndPage
AbortDoc
ResetDCA
CreatePatternBrush
StartDocA
GetTextExtentPointA

advapi32

RegQueryValueW
RegDeleteValueW
RegQueryInfoKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyW
RegQueryValueExA
RegQueryValueExW
RegCloseKey
RegEnumValueA
RegEnumValueW
RegEnumKeyW
RegDeleteValueA
RegOpenKeyA
RegDeleteKeyW
RegOpenKeyW
RegSetValueExA
RegSetValueExW
RegSetValueW
RegDeleteKeyA
RegEnumKeyA
RegCreateKeyA
RegSetValueA
RegQueryValueA

ole32

CLSIDFromProgID
OleUninitialize
CoGetMalloc
OleInitialize
OleQueryCreateFromData
RegisterDragDrop
RevokeDragDrop
CoLockObjectExternal
OleDuplicateData
CreateILockBytesOnHGlobal
OleSave
MkParseDisplayName
OleQueryLinkFromData
OleDoAutoConvert
OleLoad
ReadClassStm
CoIsOle1Class
OleBuildVersion
BindMoniker
OleSaveToStream
StgCreateDocfile
StgIsStorageILockBytes
StgCreateDocfileOnILockBytes
OleCreateFromData
OleCreateLinkFromData
OleGetIconOfClass
OleGetClipboard
OleSetClipboard
OleCreateLink
OleCreateLinkToFile
GetClassFile
ReleaseStgMedium
OleGetAutoConvert
OleCreateFromFile
CoCreateInstance
OleSetMenuDescriptor
OleConvertIStorageToOLESTREAM
OleConvertOLESTREAMToIStorage
ReadClassStg
WriteClassStg
OleRun
CreateBindCtx
OleLockRunning
OleIsCurrentClipboard
OleFlushClipboard
StgOpenStorageOnILockBytes
OleIsRunning
IsAccelerator
CoRegisterMessageFilter
CoRegisterClassObject
CoRevokeClassObject
CLSIDFromString
ProgIDFromCLSID
StringFromCLSID
StringFromGUID2
CoFreeUnusedLibraries
CoGetClassObject
IsValidInterface
CoDisconnectObject
CreateStreamOnHGlobal

oleaut32

VariantCopy
SysAllocStringLen
SysStringLen
SysFreeString
VariantClear
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
VariantChangeType
VariantInit
SysAllocStringByteLen
SafeArrayDestroy
SysAllocString
GetActiveObject
VarBstrFromDate
SysStringByteLen
SetErrorInfo
SafeArrayLock
SafeArrayUnlock
VarBstrFromI4
VariantCopyInd
SafeArrayDestroyDescriptor
SafeArrayAllocData
GetErrorInfo
RegisterTypeLi
SafeArrayAllocDescriptor
SafeArrayCopy
SafeArrayDestroyData
RevokeActiveObject
VarDateFromStr
VarR8FromStr
VarCyFromStr
VarBstrFromCy
VarUI1FromI2
VarCyFromR8
SysReAllocStringLen
SafeArrayPutElement
VariantChangeTypeEx
SafeArrayGetElement
SafeArrayGetDim
SafeArrayRedim
VarCyFromI4
VarBstrFromI2
DispGetIDsOfNames
VarBstrFromR8
VarI2FromStr
VarI4FromStr
VarI4FromR8
VarR4FromStr
VarI2FromI4
VarR4FromR8
SysReAllocString
LoadRegTypeLi
CreateErrorInfo
SafeArrayGetUBound
SafeArrayGetLBound
LoadTypeLi
CreateDispTypeInfo
DispInvoke
OaBuildVersion
VarBstrFromR4

olepro32

ord252
ord251
ord248
ord253
ord254
ord250

Exports

Exports

AssignRecord
CopyRecord
CreateIExprSrvObj
DestructRecord
DllFunctionCall
EbGetHandleOfExecutingProject
EbGetObjConnectionCounts
EbGetVBAObject
EbResetProject
EbResetProjectNormal
GetMem1
GetMem2
GetMem4
GetMem8
GetMemNewObj
GetMemObj
GetMemStr
GetMemVar
IID_IVbaHost
IntlInitializeTable
MethCallEngine
ProcCallEngine
PutMem1
PutMem2
PutMem4
PutMem8
PutMemNewObj
PutMemObj
PutMemStr
PutMemVar
SetMemNewObj
SetMemObj
SetMemVar
ThunRTMain
TipCreateInstanceProject
TipGetAddressOfPredeclaredInstance
TipInvokeMethod
TipUnloadProject
UserDllMain
VBDllCanUnloadNow
VBDllGetClassObject
VBDllRegisterServer
VBDllUnRegisterServer
VarPtr
rtBoolFromErrVar
rtBstrFromErrVar
rtCyFromErrVar
rtI2FromErrVar
rtI4FromErrVar
rtR4FromErrVar
rtR8FromErrVar
rtUI1FromErrVar
rtcAbsVar
rtcAnsiValueBstr
rtcAppActivate
rtcAppleScript
rtcArray
rtcAtn
rtcBeep
rtcBstrFromAnsi
rtcBstrFromByte
rtcBstrFromChar
rtcBstrFromError
rtcBstrFromFormatVar
rtcByteValueBstr
rtcCVErrFromVar
rtcChangeDir
rtcChangeDrive
rtcCharValueBstr
rtcChoose
rtcCommandBstr
rtcCommandVar
rtcCompareBstr
rtcCos
rtcCreateObject
rtcCurrentDir
rtcCurrentDirBstr
rtcDDB
rtcDateAdd
rtcDateDiff
rtcDateFromVar
rtcDatePart
rtcDeleteSetting
rtcDir
rtcDoEvents
rtcEndOfFile
rtcEnvironBstr
rtcEnvironVar
rtcErrObj
rtcExp
rtcFV
rtcFileAttributes
rtcFileCopy
rtcFileDateTime
rtcFileLen
rtcFileLength
rtcFileLocation
rtcFileReset
rtcFileSeek
rtcFileWidth
rtcFixVar
rtcFreeFile
rtcGetAllSettings
rtcGetDateBstr
rtcGetDateValue
rtcGetDateVar
rtcGetDayOfMonth
rtcGetDayOfWeek
rtcGetErl
rtcGetFileAttr
rtcGetHourOfDay
rtcGetMinuteOfHour
rtcGetMonthOfYear
rtcGetObject
rtcGetPresentDate
rtcGetProjectLCID
rtcGetSecondOfMinute
rtcGetSetting
rtcGetTimeBstr
rtcGetTimeValue
rtcGetTimeVar
rtcGetTimer
rtcGetYear
rtcHexBstrFromVar
rtcHexVarFromVar
rtcIMEStatus
rtcIPMT
rtcIRR
rtcImmediateIf
rtcInStr
rtcInStrChar
rtcInputBox
rtcInputCharCount
rtcInputCharCountVar
rtcInputCount
rtcInputCountVar
rtcIntVar
rtcIsArray
rtcIsDate
rtcIsEmpty
rtcIsError
rtcIsMissing
rtcIsNull
rtcIsNumeric
rtcIsObject
rtcKillFiles
rtcLeftBstr
rtcLeftCharBstr
rtcLeftCharVar
rtcLeftTrimBstr
rtcLeftTrimVar
rtcLeftVar
rtcLenCharVar
rtcLenVar
rtcLog
rtcLowerCaseBstr
rtcLowerCaseVar
rtcMIRR
rtcMacId
rtcMakeDir
rtcMidBstr
rtcMidCharBstr
rtcMidCharVar
rtcMidVar
rtcMsgBox
rtcNPV
rtcNPer
rtcOctBstrFromVar
rtcOctVarFromVar
rtcPMT
rtcPPMT
rtcPV
rtcPackDate
rtcPackTime
rtcPartition
rtcQBColor
rtcR8ValFromBstr
rtcRandomNext
rtcRandomize
rtcRate
rtcRemoveDir
rtcRgb
rtcRightBstr
rtcRightCharBstr
rtcRightCharVar
rtcRightTrimBstr
rtcRightTrimVar
rtcRightVar
rtcSLN
rtcSYD
rtcSaveSetting
rtcSendKeys
rtcSetDateBstr
rtcSetDateVar
rtcSetFileAttr
rtcSetTimeBstr
rtcSetTimeVar
rtcSgnVar
rtcShell
rtcSin
rtcSpaceBstr
rtcSpaceVar
rtcSqr
rtcStrConvVar
rtcStrFromVar
rtcStringBstr
rtcStringVar
rtcSwitch
rtcTan
rtcTrimBstr
rtcTrimVar
rtcTypeName
rtcUpperCaseBstr
rtcUpperCaseVar
rtcVarBstrFromAnsi
rtcVarBstrFromByte
rtcVarBstrFromChar
rtcVarDateFromVar
rtcVarFromError
rtcVarFromFormatVar
rtcVarFromVar
rtcVarStrFromVar
rtcVarType

Sections

.text
Size: 514KB - Virtual size: 514KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

ENGINE
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

edcf0bbebc075d87da8681a4733f99dd

Headers

File Characteristics

Imports

msvcrt20

kernel32

user32

gdi32

advapi32

ole32

oleaut32

olepro32

Exports

Exports

Sections

.text Size: 514KB - Virtual size: 514KB

ENGINE Size: 45KB - Virtual size: 44KB

.bss Size: - Virtual size: 7KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 35KB - Virtual size: 34KB

.idata Size: 15KB - Virtual size: 14KB

.edata Size: 12KB - Virtual size: 11KB

.rsrc Size: 35KB - Virtual size: 34KB

.reloc Size: 35KB - Virtual size: 35KB

.text
Size: 514KB - Virtual size: 514KB

ENGINE
Size: 45KB - Virtual size: 44KB

.bss
Size: - Virtual size: 7KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 35KB - Virtual size: 34KB

.idata
Size: 15KB - Virtual size: 14KB

.edata
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 35KB - Virtual size: 34KB

.reloc
Size: 35KB - Virtual size: 35KB