328e3e585e04ac876661e8e657b135a9b4aae0558737e1757e8f7dbaed92d32c

Sharing

Copy URL Twitter E-mail

General

Target

328e3e585e04ac876661e8e657b135a9b4aae0558737e1757e8f7dbaed92d32c
Size

1.6MB
MD5

264b2cadc519785e47864a2dd89b2e7f
SHA1

075d959e15e2103150db8e5cd56f0a6ebc8a6c95
SHA256

328e3e585e04ac876661e8e657b135a9b4aae0558737e1757e8f7dbaed92d32c
SHA512

50c7c5777b02c626313d23a84bc162007937e30d5f195bd3b0d55be91617ce1f1b24daefefcdced64651f4c2297aefa513c461b916bd759b3c0d7312a380119a
SSDEEP

24576:BygJlJhyLfxES9xfvrzRIVzuT0uNU6LzjeDqT4sv:EgdhwCwfDzRIxuNBLz5Msv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
328e3e585e04ac876661e8e657b135a9b4aae0558737e1757e8f7dbaed92d32c

Files

328e3e585e04ac876661e8e657b135a9b4aae0558737e1757e8f7dbaed92d32c
.exe windows x86

cb3b6e12b95e232d5be162290d4df803

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32FirstW
CreateToolhelp32Snapshot
LocalFree
LocalAlloc
GetSystemDirectoryW
TerminateProcess
FindAtomW
AddAtomW
DeleteAtom
CopyFileW
CreateThread
K32GetModuleFileNameExW
GetLocalTime
OpenProcess
CreateFileW
GetStartupInfoW
Module32NextW
CreateProcessW
WideCharToMultiByte
CreateEventW
WaitForSingleObjectEx
SetEvent
MoveFileExW
SetFileAttributesW
GetFullPathNameW
FindNextFileW
FindFirstFileW
FindClose
GetShortPathNameW
IsBadReadPtr
lstrlenW
lstrcpynW
LoadLibraryExW
VirtualProtect
GetVersionExW
GetProcessId
GetCurrentThreadId
GetCurrentThread
CreateMutexW
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetLastError
SetUnhandledExceptionFilter
RaiseException
CloseHandle
DecodePointer
OutputDebugStringW
DeleteFileW
GetCommandLineW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
GlobalFindAtomW
GlobalAddAtomW
Module32FirstW
GetModuleFileNameW
GetTickCount
GetCurrentProcessId
GetCurrentProcess
Sleep
GetLastError
ExpandEnvironmentStringsW
MultiByteToWideChar
lstrcmpiW
LoadLibraryW
FindResourceW
SizeofResource
LockResource
LoadResource
GetProcAddress
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetStdHandle
ExitProcess
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileType
GetModuleHandleExW
ExitThread
GetFileAttributesExW
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
ReleaseSemaphore
GetModuleHandleA
FreeLibrary
FindResourceExW
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
FlushFileBuffers
UnhandledExceptionFilter
GetModuleHandleW
Process32NextW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
WriteFile
IsDebuggerPresent
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
GetStringTypeW
FormatMessageW
DuplicateHandle
SwitchToThread
GetExitCodeThread
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
QueryPerformanceCounter
QueryPerformanceFrequency
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
ReleaseMutex
DeviceIoControl
lstrcmpA
lstrcmpiA
CreateFileA
InterlockedCompareExchange
FreeResource
GetSystemWindowsDirectoryW
InterlockedIncrement
InterlockedDecrement
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetFileSizeEx
ReadFile
SetFilePointer
GetACP
GetFileSize
SetEndOfFile

user32

SendMessageW
IsWindow
ShowWindow
GetWindowTextW
GetMessageW
TranslateMessage
DispatchMessageW
GetWindowThreadProcessId
SetWinEventHook
wsprintfW
SetWindowTextW
UnhookWinEvent
PeekMessageW
SendMessageTimeoutW
CharNextW
SetWindowLongW
FindWindowExW
DefWindowProcW
GetWindowLongW
UnregisterClassW
RegisterClassExW
LoadCursorW
SystemParametersInfoW
EnumDisplaySettingsW
ChangeDisplaySettingsW
WaitForInputIdle
GetAncestor
GetWindowInfo
MonitorFromPoint
GetWindow
GetDesktopWindow
WindowFromPoint
GetWindowRect
GetForegroundWindow
GetShellWindow
FindWindowW
IsWindowVisible
PostQuitMessage
RegisterWindowMessageW
GetMonitorInfoW
GetClassInfoExW
KillTimer
SetTimer
DestroyWindow
CallWindowProcW
PostMessageW
CreateWindowExW

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegGetValueW
StartServiceW
QueryServiceConfigW
ChangeServiceConfigW
SetTokenInformation
GetLengthSid
CreateWellKnownSid
LookupPrivilegeValueW
DuplicateTokenEx
AdjustTokenPrivileges
RegFlushKey
QueryServiceStatus
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
GetTokenInformation
FreeSid
EqualSid
AllocateAndInitializeSid
OpenThreadToken
OpenProcessToken
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW

shell32

SHCreateDirectoryExW
ShellExecuteW
SHLoadInProc
ord165
SHGetFolderPathW
ord680
ShellExecuteExW
SHChangeNotify
SHGetSpecialFolderPathW

ole32

CreateStreamOnHGlobal
StringFromGUID2
CoInitializeEx
CoCreateInstance
CoUninitialize
CoInitialize
CoCreateGuid
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear
VariantChangeType
VarUI4FromStr

shlwapi

SHGetValueA
PathIsRelativeW
StrCpyW
wnsprintfA
PathFindFileNameW
StrCmpIW
PathQuoteSpacesW
StrToInt64ExW
SHGetValueW
SHSetValueW
ord176
wnsprintfW
PathRemoveFileSpecW
PathFileExistsW
PathAppendW
StrStrIW
PathCombineW
SHSetValueA
StrCmpNIW
StrTrimA
StrStrIA
PathIsDirectoryW

comctl32

InitCommonControlsEx

gdiplus

GdiplusStartup

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

secur32

GetUserNameExW

winhttp

WinHttpOpen
WinHttpCloseHandle
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpOpenRequest
WinHttpSetTimeouts
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpQueryDataAvailable
WinHttpSetCredentials
WinHttpConnect
WinHttpReadData

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState

crypt32

CertGetNameStringW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

urlmon

URLDownloadToFileW
URLDownloadToCacheFileW

Sections

.text
Size: 755KB - Virtual size: 755KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 187KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 610KB - Virtual size: 610KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cb3b6e12b95e232d5be162290d4df803

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

version

secur32

winhttp

iphlpapi

wininet

crypt32

wintrust

urlmon

Sections

.text Size: 755KB - Virtual size: 755KB

.rdata Size: 187KB - Virtual size: 187KB

.data Size: 19KB - Virtual size: 45KB

.rsrc Size: 610KB - Virtual size: 610KB

.reloc Size: 39KB - Virtual size: 38KB

.text
Size: 755KB - Virtual size: 755KB

.rdata
Size: 187KB - Virtual size: 187KB

.data
Size: 19KB - Virtual size: 45KB

.rsrc
Size: 610KB - Virtual size: 610KB

.reloc
Size: 39KB - Virtual size: 38KB