6e416721aaef8b18ed6f51fdafa6442d4e6bbe6440f764af18b8978b2c1c138f

Sharing

Copy URL Twitter E-mail

General

Target

6e416721aaef8b18ed6f51fdafa6442d4e6bbe6440f764af18b8978b2c1c138f
Size

412KB
MD5

85385c4c31f4f44a9540a910e9b798ea
SHA1

725abf24905c5e6f41ba0cc9c6fd9e2794b95469
SHA256

6e416721aaef8b18ed6f51fdafa6442d4e6bbe6440f764af18b8978b2c1c138f
SHA512

e44df8b10cbb67ab93b2d3ecef9ca8d945afee9df4d5f88ac132c5da38791c4e340fb227e6b1213e2c38906b72c2ebe535ac379ad26e71012c033355387f8770
SSDEEP

6144:psTIkdaZRLI6iPlzigexJI7TJ6iYCzhQsoYsqs9BhhKwaD/gLtgUxk23ON4cWzSM:pshUOlzNHmsob4Y7G2LbK5ZJG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6e416721aaef8b18ed6f51fdafa6442d4e6bbe6440f764af18b8978b2c1c138f

Files

6e416721aaef8b18ed6f51fdafa6442d4e6bbe6440f764af18b8978b2c1c138f
.exe windows x86

ee47d7596dae958b8b7b4bc30a43fb54

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord815
ord561
ord617
ord6354
ord5500
ord5214
ord296
ord6117
ord2621
ord1134
ord2725
ord939
ord3337
ord3811
ord2827
ord3573
ord1146
ord1168
ord6199
ord4160
ord2863
ord4476
ord2135
ord818
ord1949
ord4034
ord3706
ord2864
ord4396
ord3574
ord609
ord2452
ord4275
ord6197
ord2860
ord2859
ord6394
ord4129
ord5683
ord5572
ord2915
ord2405
ord3619
ord5875
ord1200
ord924
ord859
ord6378
ord6380
ord5981
ord6779
ord2614
ord4224
ord6605
ord536
ord446
ord743
ord5450
ord6383
ord5440
ord3626
ord1175
ord2818
ord5280
ord6215
ord2379
ord470
ord823
ord323
ord1640
ord1641
ord5785
ord537
ord2414
ord755
ord3571
ord4710
ord4299
ord1768
ord535
ord4853
ord4376
ord6334
ord4234
ord2302
ord2370
ord825
ord324
ord567
ord540
ord860
ord641
ord656
ord800
ord3610
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord3402
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord3663
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord2729
ord2730
ord6467
ord2727
ord4003
ord4226
ord290
ord2622
ord614
ord1799
ord2233
ord1265
ord3258
ord2764
ord533
ord5194
ord2393
ord5465
ord798
ord2763
ord1997
ord1601
ord6143
ord4278
ord6883
ord5861
ord4277
ord5710
ord4202
ord926
ord922
ord941
ord6663
ord940
ord923
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1776
ord4078
ord6055
ord3597
ord4425
ord1775
ord6052
ord2514
ord4998
ord5265
ord858
ord1576

msvcrt

wcsrchr
wcslen
__p___argc
__p___argv
strtok
_mbsicmp
_snprintf
__CxxFrameHandler
_purecall
strncpy
memmove
_stricmp
_ftol
printf
fclose
fprintf
vfprintf
fopen
_iob
localtime
time
strchr
wcsncpy
_getcwd
_vsnprintf
rand
srand
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
??1type_info@@UAE@XZ
_setmbcp
strncmp
_mkdir
memcpy
memset
strlen
_mbsinc
atoi
sprintf
strcpy
strrchr
_mbscmp
_CIpow
_snwprintf
strcat

kernel32

GetModuleHandleA
GetVersionExA
GetModuleFileNameA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
FreeLibrary
SetCurrentDirectoryA
GetModuleFileNameW
GetPrivateProfileIntW
OutputDebugStringA
CloseHandle
GetStartupInfoA
InterlockedDecrement
WriteFile
WaitForSingleObject
CreateThread
ReadFile
SetLastError
SetErrorMode
GetModuleHandleW
GetCurrentThreadId
GetCurrentProcessId
HeapAlloc
GetProcessHeap
HeapFree
TerminateProcess
CreateProcessW
DuplicateHandle
SearchPathW
GetCurrentProcess
CreateEventW
SetUnhandledExceptionFilter
VirtualAllocEx
GetPrivateProfileIntA
GlobalFree
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalAlloc
CopyFileA
SetFileAttributesA
GetFileAttributesA
GetShortPathNameA
CreateFileA
FindFirstFileA
DeleteFileA
FindNextFileA
GetLastError
FindClose
RemoveDirectoryA
CreateDirectoryA
CreateEventA
InterlockedIncrement
Sleep

user32

GetClientRect
GetSystemMetrics
IsIconic
RegisterHotKey
EnableWindow
KillTimer
InvalidateRect
GetWindowRect
SetTimer
SetWindowRgn
SendMessageA
PostMessageA
DestroyCursor
UnregisterHotKey
SetCursor
LoadCursorA
CopyRect
DrawIcon
GetParent
SetRect
EnumChildWindows
GetClassNameA
PtInRect
ReleaseCapture
SetCapture
ReleaseDC
GetDC
LoadImageA
MessageBoxA
SystemParametersInfoA
ScreenToClient
GetCursorPos
GetDesktopWindow
SetCursorPos
SetClassLongA
IsWindowVisible
GetWindowLongA
SetWindowLongA
GetSystemMenu
AppendMenuA
LoadIconA
FindWindowA
MoveWindow
IsWindow
SetForegroundWindow
SetActiveWindow
DestroyWindow
CreateWindowExA
RegisterClassA
UnregisterClassA
DefWindowProcA
mouse_event
LoadCursorFromFileA
FlashWindow

gdi32

DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
CreateSolidBrush
GetObjectA
CreateFontA
OffsetRgn
CreateRectRgn
CreateRectRgnIndirect
CombineRgn
SetTextColor
SetBkMode
TextOutA
CreateDIBSection
SelectObject
ExtCreateRegion
DeleteDC
GetTextExtentPoint32A
CreateFontIndirectA

advapi32

RegCloseKey
RegOpenKeyA
RegCreateKeyA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA

comctl32

_TrackMouseEvent

ole32

CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoInitialize
CoUninitialize
CoDisconnectObject

msvcp60

?_Copy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?_Xlen@std@@YAXXZ
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

shlwapi

PathFileExistsA

wsock32

gethostbyname
gethostname
htonl
ntohl
inet_addr

shell32

SHFileOperationA
SHBrowseForFolderA
SHGetPathFromIDListA

oleaut32

SysFreeString

Sections

.text
Size: 192KB - Virtual size: 190KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 172KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ee47d7596dae958b8b7b4bc30a43fb54

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

comctl32

ole32

msvcp60

version

shlwapi

wsock32

shell32

oleaut32

Sections

.text Size: 192KB - Virtual size: 190KB

.rdata Size: 32KB - Virtual size: 30KB

.data Size: 12KB - Virtual size: 10KB

.rsrc Size: 172KB - Virtual size: 172KB

.text
Size: 192KB - Virtual size: 190KB

.rdata
Size: 32KB - Virtual size: 30KB

.data
Size: 12KB - Virtual size: 10KB

.rsrc
Size: 172KB - Virtual size: 172KB