eb2d9fdbebff53d49af756954f83632e5cb166a9fc9597af4ac252eda963b262

Sharing

Copy URL Twitter E-mail

General

Target

eb2d9fdbebff53d49af756954f83632e5cb166a9fc9597af4ac252eda963b262
Size

2.0MB
MD5

213095d51d3824c2cb8580730608cd3d
SHA1

0bdd3b29e53bae29f25b345b004fb02c9b64e0cd
SHA256

eb2d9fdbebff53d49af756954f83632e5cb166a9fc9597af4ac252eda963b262
SHA512

ca07d362aaa4b6a307907c3d0e7dcd319f2ac53b5a69a0face6d5ea49decd91d60ef8258d50c93eb2d76edd98361e1f8a99e783fe930b92d3806143cc89bcda7
SSDEEP

49152:SIgffNTbXQCSpgDWFkAbbfh8fM8TNzP2jbp0Vyd/QTyWzk5:efhbACSpgDWFkpfM+aU6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb2d9fdbebff53d49af756954f83632e5cb166a9fc9597af4ac252eda963b262

Files

eb2d9fdbebff53d49af756954f83632e5cb166a9fc9597af4ac252eda963b262
.exe windows x86

a134a1d96a1490af217ca4c604fc05d8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore

kernel32

MapViewOfFileEx
LoadLibraryExW
LocalAlloc
GetUserDefaultUILanguage
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
MoveFileExW
RemoveDirectoryW
OutputDebugStringW
Module32FirstW
Module32NextW
ProcessIdToSessionId
MoveFileExA
GetSystemInfo
LoadLibraryA
FlushInstructionCache
VirtualFree
VirtualAlloc
ReleaseSemaphore
CreateSemaphoreW
GetStdHandle
GetTempFileNameW
MoveFileW
GetFullPathNameW
CreateFileA
GlobalAlloc
GlobalLock
GetComputerNameExW
FlushFileBuffers
CreatePipe
lstrlenA
GetTempPathW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetDriveTypeA
GetLocaleInfoW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetCurrentDirectoryA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
HeapCreate
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
RtlUnwind
FindNextFileA
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetSystemTimeAsFileTime
ExitProcess
IsDebuggerPresent
UnhandledExceptionFilter
GetModuleHandleA
VirtualProtect
ExitThread
GetStartupInfoW
IsProcessorFeaturePresent
HeapSize
HeapReAlloc
HeapDestroy
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
GetLocalTime
GetCPInfo
ReleaseMutex
VirtualQuery
GetSystemDefaultLangID
DeleteFileW
CreateFileW
GetFileSize
CloseHandle
MultiByteToWideChar
ReadFile
WaitForSingleObject
SetEvent
GetTickCount
Sleep
CopyFileW
GetVersionExW
CreateEventW
ResetEvent
DeleteCriticalSection
HeapFree
GetProcessHeap
InterlockedIncrement
HeapAlloc
InitializeCriticalSectionAndSpinCount
GetLastError
CreateMutexW
OpenMutexW
RaiseException
SetCurrentDirectoryW
lstrcmpiW
GlobalMemoryStatus
GetVersion
FreeResource
SetEndOfFile
lstrcmpW
InterlockedExchange
FreeLibrary
OpenFileMappingW
DeviceIoControl
InterlockedCompareExchange
FindNextFileW
SetFilePointer
UnmapViewOfFile
GetPrivateProfileIntA
MapViewOfFile
GetExitCodeProcess
WritePrivateProfileStringA
CreateThread
GetPrivateProfileIntW
CreateFileMappingW
GetFileSizeEx
GetPrivateProfileStringW
GetDriveTypeW
GetLogicalDriveStringsW
WriteFile
QueryDosDeviceW
GetFileAttributesW
GetDiskFreeSpaceExW
CreateDirectoryW
WritePrivateProfileStringW
GetCurrentDirectoryW
GetWindowsDirectoryW
ExpandEnvironmentStringsW
lstrlenW
WideCharToMultiByte
TerminateProcess
CreateProcessW
OpenProcess
SearchPathW
InitializeCriticalSection
SetErrorMode
GetCurrentThreadId
GetCurrentProcessId
GetModuleFileNameW
GetCommandLineW
lstrcpynW
VirtualAllocEx
WriteProcessMemory
SetUnhandledExceptionFilter
LoadResource
LockResource
LocalFree
SizeofResource
FindResourceW
FindClose
FindFirstFileW
GetCurrentThread
GetModuleHandleW
SetFileAttributesW
SetLastError
FindResourceExW
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
InterlockedDecrement
WaitForMultipleObjects
LeaveCriticalSection
EnterCriticalSection
DuplicateHandle
GetCurrentProcess

user32

PostQuitMessage
FrameRect
RedrawWindow
TrackMouseEvent
GetWindowTextW
SetWindowLongW
DestroyWindow
UnregisterClassA
DefWindowProcW
PostMessageW
DrawTextW
DrawIconEx
SetCursor
CreateWindowExW
MessageBoxW
FindWindowW
SendMessageTimeoutW
ExitWindowsEx
MessageBoxA
AttachThreadInput
ShowWindow
SetWindowPos
SetForegroundWindow
CharNextW
GetWindowThreadProcessId
GetForegroundWindow
SendMessageW
CharUpperW
GetWindowLongW
KillTimer
SetTimer
CallWindowProcW
SetLayeredWindowAttributes
GetDC
TrackPopupMenu
GetDlgCtrlID
ReleaseCapture
RegisterClassExW
GetClassInfoExW
SetWindowTextW
LoadCursorW
OffsetRect
PtInRect
EqualRect
SetFocus
CharLowerW
IsWindow
GetSystemMenu
IsWindowVisible
FillRect
GetWindowDC
GetWindowTextLengthW
InvalidateRect
ReleaseDC
SetCapture
ClientToScreen
IsWindowEnabled
PostThreadMessageW
GetDlgItem
MoveWindow
GetMonitorInfoW
MonitorFromWindow
GetDesktopWindow
UpdateLayeredWindow
GetMessageW
GetParent
SetRect
DispatchMessageW
GetClientRect
MapWindowPoints
PeekMessageW
EndPaint
EnableWindow
GetActiveWindow
TranslateMessage
GetWindow
CopyRect
GetKeyState
BeginPaint
SetActiveWindow
InflateRect
DrawFrameControl
LoadImageW
LoadIconW
CopyImage
SystemParametersInfoW
GetWindowRect

gdi32

GetTextMetricsW
CreateSolidBrush
ExtSelectClipRgn
RectInRegion
Rectangle
RoundRect
CreatePen
MoveToEx
LineTo
BitBlt
CreateBitmap
SetBkColor
CreateDIBSection
SetTextColor
StretchBlt
ExtTextOutW
SetBkMode
CreateRectRgnIndirect
CombineRgn
SelectClipRgn
CreateCompatibleBitmap
GetObjectW
CreateFontIndirectW
GetStockObject
GetTextExtentPoint32W
SelectObject
CreateCompatibleDC
DeleteDC
DeleteObject
AddFontResourceW

advapi32

InitializeSecurityDescriptor
RegOpenKeyExW
RegCloseKey
GetTokenInformation
GetNamedSecurityInfoW
InitializeAcl
GetSecurityInfo
CopySid
AddAce
SetSecurityInfo
SetNamedSecurityInfoW
GetAclInformation
LookupPrivilegeValueW
FreeSid
AllocateAndInitializeSid
CreateProcessAsUserW
SetTokenInformation
DuplicateTokenEx
ConvertSidToStringSidW
DeleteService
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegDeleteKeyW
AdjustTokenPrivileges
SetSecurityDescriptorDacl
RegEnumKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegLoadKeyW
RegDeleteValueA
SetEntriesInAclW
RegQueryValueExA
BuildExplicitAccessWithNameW
RegOpenKeyExA
RegDeleteValueW
RegQueryValueExW
RegSetValueExW
GetUserNameW
RegOpenKeyW
RegCreateKeyExW
IsValidSid
GetLengthSid
GetAce
LookupAccountNameW
OpenThreadToken
OpenProcessToken

shell32

SHGetPathFromIDListW
ShellExecuteW
ord680
SHFileOperationW
SHGetFolderPathW
SHGetSpecialFolderPathW
SHGetSpecialFolderLocation
SHBrowseForFolderW

ole32

CoCreateGuid
CreateStreamOnHGlobal
CoUninitialize
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoInitialize

oleaut32

VariantInit
VarUI4FromStr
SysFreeString
SysAllocString
OleLoadPicture
VariantCopy
VariantClear

shlwapi

PathIsDirectoryW
StrCpyW
PathIsRelativeW
StrToIntA
PathRemoveExtensionW
PathAddExtensionW
PathFindFileNameW
PathCanonicalizeW
PathAddBackslashW
StrCatW
PathFileExistsW
PathAppendW
PathRemoveFileSpecW
PathRemoveBackslashW
StrStrW
StrChrW

comctl32

_TrackMouseEvent
InitCommonControlsEx

ws2_32

inet_addr
htons
htonl

wininet

HttpAddRequestHeadersW
HttpOpenRequestW
InternetSetOptionW
InternetConnectW
InternetQueryOptionW
HttpSendRequestW
InternetCrackUrlW
InternetCloseHandle
InternetReadFile
HttpQueryInfoW
InternetOpenW

userenv

CreateEnvironmentBlock
UnloadUserProfile
DestroyEnvironmentBlock

psapi

GetModuleFileNameExW
GetProcessImageFileNameW

wtsapi32

WTSEnumerateProcessesW
WTSFreeMemory

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

netapi32

Netbios
NetWkstaTransportEnum
NetApiBufferFree

Sections

.text
Size: 744KB - Virtual size: 742KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 192KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a134a1d96a1490af217ca4c604fc05d8

Headers

File Characteristics

Imports

crypt32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

ws2_32

wininet

userenv

psapi

wtsapi32

version

netapi32

Sections

.text Size: 744KB - Virtual size: 742KB

.rdata Size: 192KB - Virtual size: 190KB

.data Size: 20KB - Virtual size: 40KB

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.text
Size: 744KB - Virtual size: 742KB

.rdata
Size: 192KB - Virtual size: 190KB

.data
Size: 20KB - Virtual size: 40KB

.rsrc
Size: 1.1MB - Virtual size: 1.1MB