4fef1ec03885ace1c255bdeff1ab170c89d1340307b789c2d0a6a18253e88c29

Sharing

Copy URL Twitter E-mail

General

Target

4fef1ec03885ace1c255bdeff1ab170c89d1340307b789c2d0a6a18253e88c29
Size

404KB
MD5

e5809df2ac55fc01c9e88dce85183d73
SHA1

5688f44af70f0058c267cd30da09950fd126e1c7
SHA256

4fef1ec03885ace1c255bdeff1ab170c89d1340307b789c2d0a6a18253e88c29
SHA512

b18a0201636b423494ae637cdc9013d3e3fc859c3940f8d720fc2fc826817280dc8f2ec2d479762001729be9c85f2ddce192ebaaf51e45b94cb3f8cd3414db8d
SSDEEP

6144:TO9sWinzwlBZWzvT0rvrIY8obOlF/p/uwONct43j92UTi1F:TO9knzwvgXG8BoA9pGHNu4B2UT6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4fef1ec03885ace1c255bdeff1ab170c89d1340307b789c2d0a6a18253e88c29

Files

4fef1ec03885ace1c255bdeff1ab170c89d1340307b789c2d0a6a18253e88c29
.exe windows x86

3b2e15ccf82c5a0b5e3dc4277d8e4d5d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc100ud

ord8219
ord1439
ord735
ord14230
ord2645
ord4609
ord13088
ord3305
ord9969
ord10089
ord10035
ord5004
ord9995
ord10680
ord9933
ord12635
ord14018
ord13895
ord3202
ord9042
ord9069
ord14286
ord14792
ord15156
ord12916
ord3572
ord3610
ord15320
ord4881
ord10514
ord13089
ord1265
ord8028
ord13410
ord1067
ord498
ord424
ord7234
ord14208
ord2698
ord4673
ord10148
ord4142
ord13071
ord6560
ord14929
ord5368
ord5334
ord5330
ord5363
ord5385
ord5343
ord5371
ord5380
ord5351
ord5355
ord5359
ord5347
ord5376
ord5338
ord1775
ord1768
ord1764
ord10196
ord2744
ord4886
ord15952
ord4037
ord13035
ord9045
ord8991
ord9179
ord9090
ord9207
ord2895
ord5776
ord5946
ord5574
ord9054
ord5941
ord2917
ord2886
ord4796
ord4230
ord5209
ord4246
ord13471
ord3487
ord9928
ord9880
ord15533
ord6986
ord9327
ord14051
ord9751
ord15457
ord3317
ord15813
ord12674
ord12014
ord3519
ord12242
ord2825
ord4310
ord2100
ord5460
ord5465
ord3319
ord6955
ord14295
ord13094
ord4215
ord9740
ord15662
ord4241
ord8953
ord14631
ord12076
ord9934
ord9898
ord3403
ord3537
ord2809
ord2148
ord15717
ord12055
ord3250
ord12398
ord10600
ord9931
ord9895
ord13730
ord14638
ord4212
ord4905
ord12188
ord15641
ord3344
ord3343
ord3521
ord8652
ord2876
ord15589
ord5943
ord2727
ord3823
ord4247
ord4232
ord15847
ord14366
ord3318
ord15648
ord4387
ord2131
ord12646
ord15626
ord14460
ord2967
ord2992
ord12514
ord712
ord7401
ord14224
ord2642
ord4606
ord6687
ord12634
ord10187
ord13156
ord8990
ord9205
ord4785
ord15660
ord2117
ord9929
ord9881
ord15532
ord9339
ord14064
ord15814
ord12246
ord1774
ord2837
ord4322
ord2863
ord8955
ord9936
ord9897
ord12056
ord3252
ord10231
ord9896
ord9902
ord4214
ord4907
ord15643
ord3392
ord3533
ord13893
ord9271
ord9363
ord9266
ord9366
ord14440
ord8829
ord8830
ord8874
ord13709
ord13677
ord4020
ord13939
ord6432
ord6375
ord14447
ord13792
ord2893
ord13943
ord8667
ord15765
ord13170
ord9782
ord12283
ord11257
ord12812
ord10023
ord10043
ord2847
ord4386
ord4400
ord10885
ord10448
ord10453
ord10463
ord9804
ord5111
ord2127
ord4473
ord3509
ord10322
ord4770
ord9956
ord2032
ord15505
ord2850
ord9879
ord14039
ord9305
ord15592
ord12690
ord6918
ord1251
ord1124
ord1148
ord5648
ord5649
ord2247
ord5531
ord13825
ord7552
ord7718
ord9310
ord532
ord15031
ord3438
ord10239
ord12450
ord4997
ord14865
ord8852
ord15884
ord605
ord9064
ord2298
ord7918
ord14708
ord14152
ord8678
ord14092
ord10217
ord2205
ord15459
ord5625
ord7553
ord13124
ord15939
ord8891
ord2365
ord1340
ord4376
ord14093
ord8559
ord862
ord12288
ord3033
ord14807
ord1804
ord3358
ord5483
ord1028
ord2204
ord9269
ord351
ord4076
ord9522
ord2474
ord5313
ord6265
ord2318
ord9585
ord9590
ord9586
ord3760
ord754
ord9575
ord9582
ord9507
ord2303
ord7853
ord9452
ord2342
ord2449
ord2214
ord3359
ord5714
ord8238
ord2164
ord1264
ord1247
ord1191
ord1144
ord6337
ord732
ord708
ord595
ord523
ord10156
ord15967
ord8688
ord10180
ord13132
ord4034
ord5400
ord13453
ord1788
ord14937
ord14935
ord12347
ord6586
ord9769
ord10295
ord12723
ord6177
ord4045
ord3452
ord8552
ord2105
ord11745
ord12406
ord3244
ord15686
ord12330
ord12424
ord10144
ord10650
ord12417
ord2095
ord9307
ord14029
ord3503
ord3622
ord6323
ord9702
ord14388
ord15421
ord9250
ord4867
ord2079
ord4747
ord16188
ord4225
ord4783
ord14814
ord1003
ord3390
ord4773
ord15463
ord1674
ord9352
ord302
ord4809
ord524
ord10246
ord13056
ord15897
ord14776
ord2308
ord2637
ord4601
ord15572
ord4862
ord742
ord12607
ord1427
ord15999
ord13508
ord8041
ord7713
ord16683
ord16170
ord8043
ord8040
ord8044
ord9420
ord8042
ord14592
ord8039
ord990
ord9285
ord12377
ord1298
ord778
ord7438
ord9581
ord9422
ord9447
ord4834
ord8793
ord8486
ord1855
ord13398
ord15998
ord9172
ord5887
ord1619
ord1631
ord4613
ord2649
ord5276
ord4895
ord15979
ord3409
ord8218
ord8374
ord11059
ord11055
ord11052
ord1429
ord16556
ord992
ord7543
ord2695
ord4670
ord11148
ord6343
ord13997
ord13167
ord13216
ord11324
ord9053
ord13206
ord13198
ord6535
ord4053
ord16155
ord16158
ord16156
ord16159
ord16154
ord16157
ord8765
ord13525
ord15841
ord12908
ord16763
ord2080
ord8712
ord14016
ord4288
ord4347
ord10338
ord15970
ord8691
ord15964
ord13533
ord13532
ord2561
ord5851
ord16444
ord13931
ord9264
ord9358
ord9349
ord3013
ord14075
ord12815
ord15551
ord9908
ord10147
ord9368
ord15653

msvcr100d

__CxxFrameHandler3
__set_app_type
_fmode
_commode
__setusermatherr
_errno
_CxxThrowException
_CrtDbgReport
free
strcpy
wcscpy
_vsnprintf_s
memset
_vsnwprintf_s
_snwprintf_s
wcscpy_s
wcsncpy_s
strcpy_s
calloc
_recalloc
memcmp
_wcsicmp
memmove_s
wcslen
_configthreadlocale
??_V@YAXPAX@Z
_purecall
_snprintf_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
_invoke_watson
_controlfp_s
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
_CRT_RTC_INITW
_initterm_e
_initterm
_CrtDbgReportW
_CrtSetCheckCount
_wcmdln
exit
_cexit
_XcptFilter
_exit
__wgetmainargs
_amsg_exit

kernel32

LocalFree
OpenFileMappingA
GetCurrentThread
CreateFileMappingA
MapViewOfFile
GetSystemInfo
UnmapViewOfFile
VirtualAlloc
GetLastError
OutputDebugStringW
OutputDebugStringA
OpenEventA
SetEvent
CloseHandle
MulDiv
InterlockedExchange
Sleep
lstrlenW
HeapSetInformation
GetStartupInfoW
DecodePointer
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
WideCharToMultiByte
MultiByteToWideChar
RaiseException
InterlockedIncrement
lstrlenA
GetProcAddress
LoadLibraryW
HeapFree
EncodePointer
lstrcpyW
InterlockedDecrement
InterlockedCompareExchange
HeapAlloc
FreeLibrary
VirtualQuery
GetModuleFileNameW
GetProcessHeap

user32

SubtractRect
IntersectRect
OffsetRect
InflateRect
EqualRect
SetRectEmpty
SetRect
PtInRect
IsRectEmpty
CopyRect
GetSystemMetrics
LoadImageW
GetFocus
IsChild
EnableWindow
GetSysColor
UnionRect

gdi32

GetStockObject
DeleteObject

comctl32

InitCommonControlsEx

oleaut32

VariantClear
SysFreeString
GetErrorInfo
VariantChangeType
VariantInit
CreateErrorInfo
SysAllocString
SetErrorInfo

advapi32

RevertToSelf
OpenThreadToken
SetThreadToken

Sections

.textbss
Size: - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 159KB - Virtual size: 159KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3b2e15ccf82c5a0b5e3dc4277d8e4d5d

Headers

DLL Characteristics

File Characteristics

Imports

mfc100ud

msvcr100d

kernel32

user32

gdi32

comctl32

oleaut32

advapi32

Sections

.textbss Size: - Virtual size: 65KB

.text Size: 159KB - Virtual size: 159KB

.rdata Size: 43KB - Virtual size: 42KB

.data Size: 3KB - Virtual size: 4KB

.idata Size: 12KB - Virtual size: 12KB

.rsrc Size: 170KB - Virtual size: 170KB

.reloc Size: 15KB - Virtual size: 14KB

.textbss
Size: - Virtual size: 65KB

.text
Size: 159KB - Virtual size: 159KB

.rdata
Size: 43KB - Virtual size: 42KB

.data
Size: 3KB - Virtual size: 4KB

.idata
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 170KB - Virtual size: 170KB

.reloc
Size: 15KB - Virtual size: 14KB