1605c88bce5c73exeexeexeex[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

1605c88bce5c73exeexeexeex.exe
Size

2.1MB
MD5

1605c88bce5c731ce703a3a42a71c406
SHA1

8201ebb7f9f207fb8b94d2421504797ecf3f1207
SHA256

258b00c54811b85e8c603309cb40f067bdea053606888e17344a3f33bcb5b00a
SHA512

6545130b72639bb5319fe7219d07a4b5cb1f96ef1cef638aeaf61f32492fbd2a30d4a42047b12f08f6483db2fb0445250eefacddc5f35d2f0db765de6dc59bba
SSDEEP

49152:uWFgcbZ5t23arJksZy43gdRrKIdkHrYffsh3ANkTTl:NrbZ5t23ary4AdkHIc3AM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1605c88bce5c73exeexeexeex.exe

Files

1605c88bce5c73exeexeexeex.exe
.exe windows x86

fcdcf4239ade4bb66e6f89d5914ca08e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindClose
DeleteFileA
VirtualFree
GetEnvironmentVariableA
VirtualAlloc
CreateFileMappingA
SetFileTime
GetFileAttributesA
GetFileAttributesW
ReadFile
CreateFileW
lstrcatA
DeviceIoControl
lstrcpyW
SetLastError
GetComputerNameA
FindResourceA
FreeResource
LoadResource
WaitForSingleObject
GetProcessHeap
GetSystemWow64DirectoryA
SizeofResource
CreateEventA
CreateProcessA
GetSystemDirectoryA
ResetEvent
GetLocalTime
GetExitCodeThread
LockResource
GetSystemInfo
WinExec
FreeLibrary
IsBadReadPtr
LoadLibraryA
VirtualProtect
GetModuleHandleW
GetSystemDirectoryW
LoadLibraryW
GetCurrentThreadId
InterlockedIncrement
ExpandEnvironmentStringsA
LocalAlloc
ResumeThread
SetFilePointer
SystemTimeToFileTime
CreateDirectoryA
GetCurrentDirectoryA
LocalFileTimeToFileTime
GetDriveTypeA
GetPrivateProfileStringA
GetFileSize
WaitNamedPipeW
ReadProcessMemory
SetNamedPipeHandleState
VirtualFreeEx
VirtualAllocEx
SleepEx
lstrlenW
CreateProcessW
WriteProcessMemory
VirtualProtectEx
lstrcpyA
GetVersionExW
GetCurrentDirectoryW
GetModuleFileNameW
GetVersion
VirtualQueryEx
GetCurrentThread
CreateRemoteThread
GetWindowsDirectoryW
CreateFileMappingW
CreateMutexW
OpenMutexW
OpenFileMappingW
CreateEventW
OpenEventW
ExitThread
FlushInstructionCache
ReleaseMutex
GetThreadContext
InterlockedCompareExchange
SetEndOfFile
GetDriveTypeW
SetEnvironmentVariableA
CompareStringW
GetTimeZoneInformation
InterlockedExchange
GetStringTypeW
GetFullPathNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
LocalFree
FormatMessageA
GetTickCount
lstrlenA
FileTimeToLocalFileTime
CreateToolhelp32Snapshot
Process32Next
lstrcmpiA
FileTimeToSystemTime
GetProcessTimes
Process32First
WriteFile
WaitNamedPipeA
GetSystemTime
OpenFileMappingA
GetCurrentProcessId
CloseHandle
CreateMutexA
GetModuleHandleA
GetModuleFileNameA
GetProcAddress
GetLastError
MultiByteToWideChar
TerminateProcess
Sleep
WideCharToMultiByte
OpenProcess
FlushViewOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileA
ExitProcess
OutputDebugStringA
DeleteCriticalSection
AddVectoredExceptionHandler
EnterCriticalSection
HeapCreate
LeaveCriticalSection
InitializeCriticalSection
HeapFree
GetCurrentProcess
HeapAlloc
VirtualQuery
LCMapStringW
GetConsoleMode
GetConsoleCP
GetStartupInfoW
SetHandleCount
InitializeCriticalSectionAndSpinCount
SetStdHandle
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RaiseException
InterlockedDecrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
FindFirstFileExA
HeapSetInformation
GetCommandLineA
HeapReAlloc
GetStdHandle
WriteConsoleW
GetFileType
PeekNamedPipe
GetFileInformationByHandle
MoveFileA
CreateThread
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
DuplicateHandle

user32

GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
wsprintfA
CharNextA
GetParent
EnumWindows
PeekMessageA
GetSystemMetrics
GetWindowThreadProcessId
GetMessageA
TranslateMessage
DispatchMessageA
CloseDesktop

advapi32

OpenSCManagerA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetLengthSid
GetKernelObjectSecurity
AllocateAndInitializeSid
FreeSid
GetTokenInformation
LookupPrivilegeValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyW
RegDeleteKeyW
CreateServiceW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
QueryServiceStatus
ChangeServiceConfigW
StartServiceW
ControlService
OpenProcessToken
QueryServiceStatusEx
StartServiceA
CreateServiceA
EnumDependentServicesA
DeleteService
CloseServiceHandle
OpenServiceA
RegDeleteValueA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyA
BuildExplicitAccessWithNameA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
SetNamedSecurityInfoA
SetEntriesInAclA
AdjustTokenPrivileges
LookupPrivilegeValueA

shell32

ShellExecuteExA
SHFileOperationA

shlwapi

PathIsDirectoryA
PathIsRootA
PathFindFileNameA
PathStripToRootA
PathFileExistsA
PathRemoveFileSpecA
PathAddBackslashA

psapi

GetMappedFileNameA

ws2_32

getsockname
htons
inet_addr
connect
gethostname
WSACleanup
WSAStartup
WSAGetLastError
recv
send
socket
ntohs
bind
getsockopt
getpeername
WSASetLastError
freeaddrinfo
getaddrinfo
__WSAFDIsSet
select
ioctlsocket
closesocket
setsockopt
gethostbyname

imagehlp

CheckSumMappedFile

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 995KB - Virtual size: 994KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cpp0
Size: 577KB - Virtual size: 577KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 386KB - Virtual size: 385KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fcdcf4239ade4bb66e6f89d5914ca08e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

shlwapi

psapi

ws2_32

imagehlp

iphlpapi

Sections

.text Size: 995KB - Virtual size: 994KB

.rdata Size: 146KB - Virtual size: 146KB

.data Size: 27KB - Virtual size: 37KB

.cpp0 Size: 577KB - Virtual size: 577KB

.reloc Size: 49KB - Virtual size: 48KB

.rsrc Size: 386KB - Virtual size: 385KB

.text
Size: 995KB - Virtual size: 994KB

.rdata
Size: 146KB - Virtual size: 146KB

.data
Size: 27KB - Virtual size: 37KB

.cpp0
Size: 577KB - Virtual size: 577KB

.reloc
Size: 49KB - Virtual size: 48KB

.rsrc
Size: 386KB - Virtual size: 385KB