18110b6aab5f96exeexeexeex[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

18110b6aab5f96exeexeexeex.exe
Size

179KB
MD5

18110b6aab5f96c9b23ef6dd7ad359b0
SHA1

bd247d88e00f67b5a7b69fc726057828b5c59850
SHA256

e35de78d0ed15f88502b01de2e1d1c3a5d3d714b6b863cc0b100a5ff41baf9ac
SHA512

3757a7401ef3ac7ce9b204c6e733362ea5e79e05984fd12e74586029e6236ab9314afc1451a3b9990f5a0060fa03c2ecf4db0e7b7dd74a052c9820c7ed0dc48a
SSDEEP

3072:QBSF3kHSHUN4yTGnBDhICj3AyxulLGGwmyK0z2FWqnSGhloPv2:0SF3kHScNTeBDhR3AbQJmyKHWDSl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18110b6aab5f96exeexeexeex.exe

Files

18110b6aab5f96exeexeexeex.exe
.exe windows x86

9a8e99aef6e95745bc22ffa8d40cfbbb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptBinaryToStringA
CryptStringToBinaryA
CryptDecodeObjectEx

shlwapi

StrStrIW
PathSkipRootW
StrPBrkA
StrCpyNW
PathFindFileNameW
StrStrA
PathMatchSpecW
StrCmpNA
StrSpnA
StrToInt64ExA
PathCombineW
StrToIntA
StrCmpNIW
StrChrA
StrCmpNIA
PathFindFileNameA
StrChrW
StrCmpNW

mpr

WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum

ws2_32

htons
inet_addr
htonl
shutdown
closesocket
gethostbyname
sendto
inet_ntoa
socket
WSAStartup

kernel32

ExitProcess
RtlUnwind
LocalFree
lstrcmpiA
GetCommandLineW
CreateMutexW
SetErrorMode
GetCurrentProcess
GetProcAddress
GetCurrentThread
WaitForMultipleObjects
TerminateProcess
GetModuleFileNameW
GetCurrentThreadId
SetThreadPriority
GetTempPathW
GetLastError
OutputDebugStringA
SetProcessShutdownParameters
IsBadStringPtrA
SetFilePointer
FlushFileBuffers
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
IsBadWritePtr
IsBadReadPtr
IsBadStringPtrW
lstrcpyA
PeekNamedPipe
SystemTimeToFileTime
MoveFileExW
SetFileTime
lstrlenW
CreateFileW
CreateProcessA
GetSystemDirectoryA
GetLocalTime
CreatePipe
GetTickCount
ReadFile
FileTimeToSystemTime
OpenEventW
GetFileAttributesW
GetModuleHandleW
TlsAlloc
CreateThread
lstrcpyW
MulDiv
FileTimeToLocalFileTime
DeleteCriticalSection
GetFileTime
VirtualProtect
GetFileSizeEx
CreateEventW
EnterCriticalSection
MoveFileW
lstrlenA
SearchPathW
GetTempFileNameW
FindFirstFileW
GetNativeSystemInfo
GetDriveTypeW
GetLogicalDrives
VirtualFree
FindClose
QueryDosDeviceW
GetTimeFormatW
lstrcmpiW
lstrcatW
FindNextFileW
SetFileAttributesW
HeapReAlloc
HeapAlloc
HeapFree
HeapCreate
HeapValidate
SetLastError
GetProcessHeaps
HeapSetInformation
GetCurrentProcessId
CreateDirectoryW
GetComputerNameA
LeaveCriticalSection
Sleep
InitializeCriticalSection
WriteFile
VirtualAlloc
OutputDebugStringW
SetEvent
lstrcpynW
WaitForSingleObject
lstrcpynA
OpenProcess
SetFilePointerEx
MultiByteToWideChar
GetVersionExW
GetFileSize
WideCharToMultiByte
GetDateFormatW
GetHandleInformation
CloseHandle
CreateToolhelp32Snapshot
GetModuleHandleA
Process32NextW
GetSystemInfo
Process32FirstW

user32

wsprintfW
GetForegroundWindow
RegisterClassExW
UnregisterClassW
DispatchMessageW
DefWindowProcW
RegisterClassW
FillRect
DrawTextA
GetDC
CreateWindowExW
SystemParametersInfoW
PeekMessageW
GetKeyboardLayoutList
GetSystemMetrics
CharLowerBuffA
TranslateMessage
wsprintfA
ReleaseDC

advapi32

CryptAcquireContextW
CryptGetKeyParam
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryValueExW
CreateWellKnownSid
CheckTokenMembership
DuplicateToken
CryptGenRandom
CryptReleaseContext
AdjustTokenPrivileges
FreeSid
AllocateAndInitializeSid
LookupPrivilegeValueW
RegOpenKeyW
GetTokenInformation
OpenProcessToken
RegOpenKeyExW
RegCloseKey
CryptDestroyKey

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitialize

shell32

SHGetFolderPathW
CommandLineToArgvW
ShellExecuteW
ShellExecuteExW
SHChangeNotify

gdi32

SetTextColor
DeleteDC
GetDeviceCaps
GetDIBits
SetBkColor
SetPixel
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
GetObjectW
GetStockObject

ntdll

_alldiv
memcpy
isspace
_allmul
RtlDosPathNameToNtPathName_U
NtDeleteFile
RtlFreeUnicodeString
ZwQuerySystemInformation
tolower
memmove
ZwOpenProcess
memset
_aulldvrm
NtQueryVirtualMemory

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 105KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9a8e99aef6e95745bc22ffa8d40cfbbb

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

shlwapi

mpr

ws2_32

kernel32

user32

advapi32

ole32

shell32

gdi32

ntdll

version

Sections

.text Size: 61KB - Virtual size: 61KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 105KB - Virtual size: 108KB

.CRT Size: 512B - Virtual size: 12B

.text
Size: 61KB - Virtual size: 61KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 105KB - Virtual size: 108KB

.CRT
Size: 512B - Virtual size: 12B