orig_client[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

orig_client.exe
Size

1.3MB
MD5

80b25ad0e1fae174a6f9e064485e8884
SHA1

331c5242692b57b260805b95083f53d31a7b9a7d
SHA256

9d6ba36e78f96745b1f1c719529971c20c8002a2b2a21a6c2c0f316025f99297
SHA512

653de010231eee104063bb4515cca423380b38a0326c3a1d3838c24550333e14b6c484a97120ed444243597ce460b6df4f0e976da3de74dcc0afd6a2e2ecee02
SSDEEP

24576:YhzX12X6R767MpIJq5o68jTGJFJepfa8hrMOr/0rid/6v:XTaQpEOQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
orig_client.exe

Files

orig_client.exe
.exe windows x86

15045bbe7aa9305a694228debbd1aff7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
GetLastError
CreateMutexA
CreateProcessA
UnmapViewOfFile
MapViewOfFile
WideCharToMultiByte
FlushViewOfFile
GetCurrentProcessId
GetVersion
OpenFileMappingA
GetACP
IsDBCSLeadByte
GetCurrentProcess
GetCurrentThread
SetThreadPriority
SetFilePointer
LoadLibraryA
GetProcAddress
FreeLibrary
GetVersionExA
ReadFile
WriteFile
TerminateProcess
OpenMutexA
CloseHandle
GetProfileStringA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateFileA
CreateFileMappingA
GetTimeZoneInformation
HeapReAlloc
TlsGetValue
SetLastError
TlsAlloc
GetCurrentThreadId
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
ExitThread
TlsSetValue
ResumeThread
GetLocalTime
GetSystemTime
DeleteFileA
CreateDirectoryA
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
HeapAlloc
HeapFree
RtlUnwind
HeapSize
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
InterlockedIncrement
InterlockedExchange
Sleep
CreateThread
GetStringTypeA
GetTickCount
VirtualAlloc
IsBadWritePtr
GetFullPathNameA
GetCurrentDirectoryA
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetCPInfo
SetEnvironmentVariableA
GetStringTypeW
SetStdHandle
FlushFileBuffers
GetOEMCP
GetFileAttributesA
GetExitCodeProcess
WaitForSingleObject
ExitProcess
OutputDebugStringA
GlobalMemoryStatus
GetDiskFreeSpaceA
InterlockedDecrement
GetDriveTypeA
SetEndOfFile
CompareStringA
CompareStringW
GetLogicalDriveStringsA
GetSystemInfo

user32

GetKeyState
IsZoomed
ShowWindow
GetDesktopWindow
GetDC
SetFocus
SetCapture
AppendMenuA
GetCursorPos
ShowCursor
TrackPopupMenu
DestroyMenu
PeekMessageA
DefWindowProcA
GetKeyNameTextA
GetDoubleClickTime
GetAsyncKeyState
ScreenToClient
MessageBoxA
FindWindowA
RegisterClassA
UpdateWindow
GetMessageA
GetFocus
MapVirtualKeyA
ReleaseCapture
GetActiveWindow
DefWindowProcW
SetMenu
AdjustWindowRectEx
OpenClipboard
GetClipboardData
CloseClipboard
RegisterClassW
CreateWindowExW
GetWindowDC
SystemParametersInfoA
BeginPaint
EndPaint
GetWindowRect
SetWindowPos
SetCursor
ClientToScreen
PostQuitMessage
GetWindowLongA
SetWindowLongA
LoadIconA
GetSystemMetrics
TranslateMessage
TranslateAcceleratorA
DispatchMessageA
LoadAcceleratorsA
SetWindowTextA
InvalidateRect
GetMenu
CheckMenuItem
GetWindowPlacement
GetClientRect
SendMessageA
LoadMenuA
LoadCursorA
CreatePopupMenu
ReleaseDC
CreateWindowExA

gdi32

CreatePalette
CreateCompatibleDC
BitBlt
GetDeviceCaps
DeleteObject
DeleteDC
SelectObject
SelectPalette
RealizePalette
CreateDIBSection

advapi32

RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA

ole32

CoInitialize
CoCreateInstance
CoUninitialize

wsock32

select
__WSAFDIsSet
gethostname
WSAGetLastError
bind
sendto
recvfrom
htonl
setsockopt
connect
inet_ntoa
ntohs
WSAStartup
WSACleanup
ntohl
gethostbyname
socket
htons
send
recv
closesocket

comctl32

ord17

ddraw

DirectDrawCreate

dsound

ord1

winmm

mmioRead
timeSetEvent
timeKillEvent
mciSendCommandA
midiOutSetVolume
midiOutGetDevCapsA
midiOutGetVolume
mmioClose
mmioOpenA
mmioSetBuffer
mmioSeek

Sections

.text
Size: 960KB - Virtual size: 956KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 312KB - Virtual size: 8.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UVA_DATA
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

15045bbe7aa9305a694228debbd1aff7

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

wsock32

comctl32

ddraw

dsound

winmm

Sections

.text Size: 960KB - Virtual size: 956KB

.rdata Size: 80KB - Virtual size: 77KB

.data Size: 312KB - Virtual size: 8.3MB

UVA_DATA Size: 16KB - Virtual size: 15KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 960KB - Virtual size: 956KB

.rdata
Size: 80KB - Virtual size: 77KB

.data
Size: 312KB - Virtual size: 8.3MB

UVA_DATA
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 4KB - Virtual size: 3KB