ba2d37420fba01ada84363dbe207f6606c39f00ac2fd8a9b726b5d77a73b559e

Sharing

Copy URL Twitter E-mail

General

Target

ba2d37420fba01ada84363dbe207f6606c39f00ac2fd8a9b726b5d77a73b559e
Size

3.8MB
MD5

0008a25802c627adcbffb2436c67ec5e
SHA1

4ecd191d3611769ef63c6ccc0b19d112777b4294
SHA256

ba2d37420fba01ada84363dbe207f6606c39f00ac2fd8a9b726b5d77a73b559e
SHA512

293ed8cdad4c007e424dda1189b502cc4120251a059443340d5cb6c12a3f00cd7094cfd7b3622843a07de2a9377e5e62f1b42d76eace2b00da2d8b36902407af
SSDEEP

98304:2Am/ZPYT/D9DIzpeCRyS1ZVBzLb2HQ1xRhsbgqxaVWL4RW2jGSn:bm/ZQT/D9DIzpeCRr/VpZxRhsbgqxaVD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ba2d37420fba01ada84363dbe207f6606c39f00ac2fd8a9b726b5d77a73b559e

Files

ba2d37420fba01ada84363dbe207f6606c39f00ac2fd8a9b726b5d77a73b559e
.exe windows x86

2c927f9bb92b3423c20d3597707820d0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

UpdateWindow
DestroyWindow
ReleaseDC
ChangeDisplaySettingsA
SetFocus
SetForegroundWindow
ShowWindow
GetDC
SetWindowPos
AdjustWindowRect
GetWindowLongA
SetWindowLongA
UnregisterClassA
CreateWindowExA
RegisterClassA
DefWindowProcA
ToAscii
MapVirtualKeyA
PostMessageA
CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
SetClipboardData
EmptyClipboard
PostQuitMessage
MessageBoxA
ShowCursor
SetCursorPos
GetCursorPos
GetWindowRect
MsgWaitForMultipleObjects
GetWindowThreadProcessId
GetForegroundWindow
DispatchMessageA
TranslateMessage
PeekMessageA
ReleaseCapture
SetCapture
GetSystemMetrics
GetKeyState
LoadCursorA
LoadIconA
GetDesktopWindow
ClientToScreen
SetClassLongA
GetClientRect
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
EnumDisplaySettingsA
LoadBitmapA
SendMessageA
GetWindowTextA
GetParent
GetWindowModuleFileNameA

advapi32

RegCloseKey
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA

gdi32

SetBkColor
SetTextColor
GetTextMetricsA
GetGlyphOutlineA
GetTextExtentPoint32A
GetPixel
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
SetPixelFormat
SetDeviceGammaRamp
GetDeviceGammaRamp
CreateFontA
GetStockObject
GetDeviceCaps
SelectObject

winmm

auxSetVolume
auxGetNumDevs
mixerClose
mixerGetControlDetailsA
auxGetVolume
auxGetDevCapsA
mixerSetControlDetails
mciSendCommandA
mixerGetLineControlsA
mixerGetLineInfoA
mixerOpen
mixerGetNumDevs
mciGetErrorStringA

wsock32

WSAStartup
WSAGetLastError
connect
closesocket
WSAAsyncSelect
select
WSACancelAsyncRequest
WSAAsyncGetHostByName
ioctlsocket
htons
socket
sendto
recvfrom
listen
accept
bind
setsockopt
inet_ntoa
send
recv
gethostbyname
htonl
ntohs
inet_addr
shutdown
getsockopt
WSACleanup

avifil32

AVIStreamReadFormat
AVIStreamRelease
AVIFileGetStream
AVIStreamSampleToTime
AVIFileRelease
AVIFileOpenA
AVIFileExit
AVIFileInit
AVIStreamRead
AVIStreamTimeToSample
AVIStreamFindSample
AVIStreamInfoA

msvfw32

ICClose
ICSendMessage
ICDrawBegin
ICLocate

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

kernel32

HeapCreate
HeapDestroy
GetFileType
SetHandleCount
GetCPInfo
GetOEMCP
GetACP
HeapSize
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
SetLastError
TlsAlloc
GetCommandLineA
GetStartupInfoA
RaiseException
HeapReAlloc
GetSystemTimeAsFileTime
HeapFree
VirtualFree
VirtualAlloc
IsBadWritePtr
VirtualProtect
GetSystemInfo
VirtualQuery
LCMapStringW
GetTimeZoneInformation
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
SetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
HeapAlloc
GetCurrentProcess
TerminateProcess
IsBadReadPtr
RtlUnwind
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
FindNextFileA
GetLogicalDriveStringsA
GetVolumeInformationA
CreateDirectoryA
FindFirstFileA
QueryPerformanceFrequency
Process32First
Process32Next
CreateToolhelp32Snapshot
Module32First
Module32Next
CreateProcessA
QueryPerformanceCounter
GetModuleFileNameA
GetModuleHandleA
GetCurrentProcessId
Sleep
ReleaseMutex
CreateMutexA
CreateThread
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreA
GetDriveTypeA
ExitProcess
DebugBreak
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
InterlockedExchange
IsBadCodePtr
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
GetLocaleInfoW
SetFileTime
LocalFileTimeToFileTime
FindClose
ReadFile
GetLastError
CloseHandle
SystemTimeToFileTime
GetFileSize
InitializeCriticalSection
GlobalAlloc
GlobalLock
GlobalUnlock
GetStdHandle
SetConsoleTitleA
AllocConsole
FlushFileBuffers
WriteFile
ReadConsoleInputA
GetNumberOfConsoleInputEvents
GetTickCount
GetVersionExA
GetProcAddress
LoadLibraryA
FreeLibrary
DeleteFileA
CreateFileA
SetFilePointer
GetCurrentDirectoryA

msvcp71

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 436KB - Virtual size: 434KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 332KB - Virtual size: 49.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 216KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2c927f9bb92b3423c20d3597707820d0

Headers

File Characteristics

Imports

user32

advapi32

gdi32

winmm

wsock32

avifil32

msvfw32

version

kernel32

msvcp71

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

.rdata Size: 436KB - Virtual size: 434KB

.data Size: 332KB - Virtual size: 49.6MB

.rsrc Size: 216KB - Virtual size: 216KB

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 436KB - Virtual size: 434KB

.data
Size: 332KB - Virtual size: 49.6MB

.rsrc
Size: 216KB - Virtual size: 216KB