94ba4380accb11e054fda7e412d39ea99cf6728c9146c16c7e743768e9ae6a6d

Sharing

Copy URL Twitter E-mail

General

Target

94ba4380accb11e054fda7e412d39ea99cf6728c9146c16c7e743768e9ae6a6d
Size

227KB
MD5

f562218e3e3174747261bf44f70a4246
SHA1

50db43d095e0fa9944a5480fcb0f6838ea53cc13
SHA256

94ba4380accb11e054fda7e412d39ea99cf6728c9146c16c7e743768e9ae6a6d
SHA512

345552595bb9323f4b60c68a694b73f19f30db7027ec76297f3dd3777753eefcbe37959db3b991bcaf8176f67b4dc9f42a17b1cfd9ea71e19ea727aebd7daf28
SSDEEP

3072:SoYleiQt7HWKVs2yxfLir9jNkcfXO62/eNyQF/pstBaDqwONnct43bBl3N2UPbwu:FDts5Mj/fO62uF/p/uwONct43D92UPb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
94ba4380accb11e054fda7e412d39ea99cf6728c9146c16c7e743768e9ae6a6d

Files

94ba4380accb11e054fda7e412d39ea99cf6728c9146c16c7e743768e9ae6a6d
.exe windows x86

00b3a2654f4f432e22a339d642ad5560

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc100u

ord5280
ord12561
ord5279
ord10449
ord5297
ord7986
ord8485
ord10807
ord10799
ord4756
ord3407
ord4084
ord10511
ord9470
ord2782
ord10801
ord1763
ord9888
ord13943
ord5006
ord5005
ord6243
ord14014
ord14070
ord14065
ord14155
ord14156
ord14157
ord14154
ord4833
ord14158
ord14151
ord14215
ord10775
ord4360
ord684
ord1144
ord7767
ord11134
ord8703
ord3990
ord6523
ord1867
ord392
ord953
ord457
ord1006
ord661
ord1130
ord6714
ord8432
ord2851
ord2806
ord7629
ord7903
ord3754
ord5900
ord3482
ord1905
ord2188
ord11688
ord4359
ord1893
ord4522
ord12473
ord4608
ord4609
ord10552
ord7251
ord12504
ord8412
ord7095
ord12413
ord7399
ord1944
ord6413
ord554
ord13306
ord2303
ord12946
ord12948
ord11166
ord1987
ord788
ord1212
ord11940
ord3703
ord10391
ord3433
ord5799
ord4290
ord902
ord296
ord3446
ord5862
ord2185
ord2773
ord1934
ord2062
ord4358
ord2477
ord7552
ord5999
ord12050
ord8346
ord5397
ord3491
ord11116
ord5276
ord12557
ord10721
ord4415
ord4381
ord4377
ord4410
ord4432
ord4390
ord4418
ord4427
ord4398
ord4402
ord4406
ord4394
ord4423
ord4385
ord1517
ord1510
ord1506
ord8384
ord11198
ord13369
ord3402
ord11081
ord7385
ord4699
ord7350
ord7485
ord7418
ord7506
ord2382
ord2360
ord4824
ord3904
ord3568
ord4269
ord13120
ord1776
ord11425
ord2893
ord8135
ord8089
ord13010
ord5640
ord7605
ord11912
ord7971
ord2734
ord13244
ord10131
ord2918
ord10350
ord1516
ord3659
ord1759
ord4484
ord4489
ord2736
ord5613
ord12117
ord11139
ord3553
ord2329
ord7962
ord13122
ord7322
ord12358
ord10192
ord8142
ord8105
ord2817
ord2936
ord2275
ord1805
ord10172
ord2675
ord8425
ord8137
ord8104
ord8110
ord11600
ord12364
ord3552
ord4006
ord10293
ord13106
ord2932
ord11747
ord7550
ord7631
ord12205
ord7239
ord7240
ord7268
ord11579
ord11547
ord7842
ord7835
ord3150
ord703
ord7845
ord7846
ord7850
ord1947
ord3385
ord11790
ord5187
ord5150
ord12209
ord11659
ord2358
ord11794
ord7089
ord13198
ord11211
ord8000
ord10386
ord9434
ord10891
ord8226
ord8245
ord2313
ord3712
ord3725
ord1937
ord9073
ord8637
ord8642
ord8652
ord8019
ord4195
ord1786
ord3790
ord2911
ord8514
ord3890
ord8162
ord1695
ord12986
ord2316
ord8087
ord11887
ord7580
ord13065
ord5832
ord12034
ord8393
ord7351
ord7508
ord7392
ord6348
ord4555
ord4819
ord2351
ord3913
ord3584
ord8134
ord8088
ord13011
ord7593
ord11899
ord13243
ord10759
ord10346
ord2291
ord3647
ord3579
ord7320
ord8140
ord8106
ord13165
ord10171
ord2673
ord10501
ord8788
ord8103
ord3550
ord4004
ord13104
ord2759
ord2758
ord2920
ord7076
ord2342
ord13062
ord4821
ord2204
ord3198
ord3585
ord3570
ord13273
ord12163
ord7712
ord2735
ord13111
ord3713
ord1790
ord10733
ord13090
ord12217
ord2419
ord2440
ord10613
ord12056
ord11133
ord2723
ord8175
ord8289
ord8238
ord4096
ord8201
ord7782
ord2084
ord8868
ord8139
ord10722
ord11866
ord11749
ord2627
ord7382
ord7404
ord12109
ord12734
ord10983
ord2968
ord3000
ord12850
ord2774
ord4661
ord1821
ord6733
ord476
ord1025
ord14060
ord1070
ord657
ord1126
ord681
ord1143
ord5112
ord8439
ord477
ord3925
ord7707
ord7618
ord12951
ord3893
ord7205
ord2804
ord12486
ord3903
ord3563
ord13601
ord3870
ord1738
ord3979
ord3948
ord7682
ord7841
ord7534
ord12563
ord4331
ord2823
ord2057
ord11330
ord13396
ord11353
ord13415
ord6036
ord12177
ord7929
ord11101
ord13319
ord13048
ord691
ord3974
ord10694
ord2220
ord3996
ord12325
ord6534
ord6537
ord7680
ord6539
ord6535
ord6538
ord13583
ord14083
ord12830
ord6536
ord13416
ord7563
ord6940
ord10480
ord8354
ord13384
ord7105
ord8377
ord11174
ord3399
ord4446
ord11407
ord1529
ord12564
ord12562
ord10450
ord5296
ord7988
ord8487
ord10808
ord10803
ord3409
ord2861
ord6995
ord1764
ord9889
ord10509
ord2667
ord13142
ord10433
ord10527
ord1583
ord8342
ord8838
ord10520
ord1754
ord7581
ord11877
ord2906
ord3012
ord5103
ord9232
ord9235
ord9239
ord6869
ord891
ord1293
ord13956
ord7176
ord1990
ord1986
ord1895
ord13797
ord12753
ord7616
ord7131
ord7178
ord7203
ord12898
ord6891
ord6533
ord715
ord1592
ord345
ord923
ord11021
ord11235
ord13047
ord2005
ord4087
ord385
ord948
ord5801
ord950
ord6713
ord3627
ord1633
ord6141
ord9328
ord5118
ord11845
ord11209
ord11240
ord9498
ord7391
ord11236
ord11228
ord5261
ord3416
ord13568
ord13571
ord13569
ord13572
ord13567
ord13570
ord7179
ord11469
ord13267
ord10976
ord14162
ord1739

msvcr100

_initterm
_wcmdln
exit
_XcptFilter
_CxxThrowException
_exit
_cexit
__wgetmainargs
_amsg_exit
__CxxFrameHandler3
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_purecall

kernel32

ActivateActCtx
InterlockedIncrement
GetProcAddress
lstrcpyW
InterlockedExchange
LocalFree
GetModuleHandleW
LoadLibraryW
GetLastError
DeactivateActCtx
InterlockedDecrement
Sleep
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
DecodePointer
EncodePointer
GetStartupInfoW
HeapSetInformation
InterlockedCompareExchange
SetLastError

user32

RedrawWindow
GetSystemMetrics
LoadImageW
GetFocus
IsChild
EnableWindow
LoadBitmapW
GetSysColor
InflateRect
GetWindowRect
UpdateWindow
InvalidateRect
GetClientRect
ScreenToClient
SendMessageW
GetSubMenu
LoadMenuW
SetRectEmpty
GetParent
ClientToScreen

gdi32

CreateFontIndirectW
DeleteObject
GetStockObject
GetObjectW

comctl32

InitCommonControlsEx

oleaut32

SysAllocString
VariantClear

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 142KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

00b3a2654f4f432e22a339d642ad5560

Headers

DLL Characteristics

File Characteristics

Imports

mfc100u

msvcr100

kernel32

user32

gdi32

comctl32

oleaut32

Sections

.text Size: 36KB - Virtual size: 36KB

.rdata Size: 31KB - Virtual size: 31KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 142KB - Virtual size: 142KB

.reloc Size: 13KB - Virtual size: 13KB

.text
Size: 36KB - Virtual size: 36KB

.rdata
Size: 31KB - Virtual size: 31KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 142KB - Virtual size: 142KB

.reloc
Size: 13KB - Virtual size: 13KB