1e1a29757e27e6exeexeexeex[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

1e1a29757e27e6exeexeexeex.exe
Size

4.3MB
MD5

1e1a29757e27e6a80223a2edbf63a1de
SHA1

a57fbad80d4aa5189d44543cb2fd158d9e93abb1
SHA256

8583e7aca6dd3e59bdb7e9c9a47318bdf44dbcc2db1afa7fc5b28d46612c19ee
SHA512

dc8715f67673a93c51f32e5f6b2d77dec4b466a78533af211f663bec2cc21b5119a41086644776a5c195375ab9acb668867482613124bf6d0df5eba10651c7a5
SSDEEP

49152:xa/gJDdhafR6W/zzhxInjEeEeougjBDpkgrpN+q23K8hjhC6UlpDmg27RnWGj:x02TafRF/zjeougtN9yVYD527BWG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1e1a29757e27e6exeexeexeex.exe

Files

1e1a29757e27e6exeexeexeex.exe
.exe windows x86

239920a45cc67472724c2e99cea6ff79

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FormatMessageW
LocalFree
LoadLibraryW
GetProcAddress
FreeLibrary
QueryPerformanceFrequency
GetVersionExW
CreateProcessW
GetTempPathW
GetDiskFreeSpaceExW
CreateThread
GetExitCodeThread
GetExitCodeProcess
GetCurrentProcess
TerminateThread
CreateEventW
OpenEventW
ResetEvent
SetEvent
GetLocalTime
GetSystemTime
GetFileAttributesW
CreateDirectoryW
GetShortPathNameW
GetFileSizeEx
PeekNamedPipe
GetEnvironmentVariableW
TryEnterCriticalSection
WaitForMultipleObjects
CreatePipe
GetStartupInfoW
GlobalMemoryStatusEx
FlushViewOfFile
GetSystemDefaultLCID
GetSystemDefaultUILanguage
GetUserDefaultLCID
GetLocaleInfoW
FindFirstFileW
FindNextFileW
FindClose
DeleteFileW
GetComputerNameExW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetUserDefaultLangID
LocalAlloc
GlobalAlloc
ProcessIdToSessionId
GlobalLock
GlobalUnlock
GlobalFree
GetFileTime
DeviceIoControl
GetSystemDirectoryW
MoveFileExW
CopyFileW
SetFileAttributesW
VerifyVersionInfoW
FindResourceExW
GetPrivateProfileStringA
WritePrivateProfileStringW
WritePrivateProfileStringA
FileTimeToSystemTime
SystemTimeToFileTime
GetFullPathNameW
RemoveDirectoryW
MoveFileW
GetUserGeoID
GetGeoInfoW
VerSetConditionMask
LeaveCriticalSection
GetModuleHandleW
SearchPathW
GetTimeZoneInformation
GetFileSize
ReadFile
InterlockedIncrement
InterlockedCompareExchange
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetTimeFormatW
GetDateFormatW
HeapSetInformation
ExitThread
GetCPInfo
RtlUnwind
LCMapStringW
GetTimeFormatA
GetDateFormatA
CompareStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleW
SetEndOfFile
SetEnvironmentVariableA
lstrlenA
lstrlenW
FindResourceW
GetLongPathNameW
GetTempFileNameW
GetCommandLineW
GetFileAttributesExW
LoadResource
LockResource
SizeofResource
UnmapViewOfFile
CloseHandle
OpenMutexW
OpenFileMappingW
ReleaseMutex
CreateMutexW
MapViewOfFile
OpenProcess
GetCurrentThreadId
OutputDebugStringW
WriteFile
SetFilePointer
Sleep
CreateFileW
GetSystemInfo
DeleteCriticalSection
EnterCriticalSection
MultiByteToWideChar
GetCurrentProcessId
InitializeCriticalSection
ExpandEnvironmentStringsW
GetModuleFileNameW
QueryPerformanceCounter
SetLastError
WideCharToMultiByte
GetTickCount
InterlockedDecrement
FreeResource
GetLastError
CreateFileMappingW
WaitForSingleObject
GetPrivateProfileStringW
FileTimeToDosDateTime
GetFileInformationByHandle
CancelIo
GetOverlappedResult
lstrcmpiW

user32

WaitForInputIdle
OpenWindowStationW
CloseWindowStation
GetProcessWindowStation
SetProcessWindowStation
GetThreadDesktop
SetThreadDesktop
EnumWindows
IsWindow
GetWindowThreadProcessId
MsgWaitForMultipleObjectsEx
GetAsyncKeyState
PeekMessageW
MsgWaitForMultipleObjects
GetKeyState
SendMessageCallbackW
GetMessageW
IsWindowVisible
ShowWindow
SetForegroundWindow
SetTimer
GetSystemMetrics
SystemParametersInfoW
OpenDesktopW
GetRawInputDeviceList
ExitWindowsEx
CloseDesktop
AllowSetForegroundWindow
LoadIconW
DestroyIcon
RegisterWindowMessageW

rpcrt4

UuidCreate
RpcStringFreeW
UuidToStringW

shlwapi

PathIsFileSpecW
PathFindFileNameW
PathRemoveFileSpecW
PathFindExtensionW

psapi

EnumProcessModules
EnumProcesses
GetModuleBaseNameW
GetModuleFileNameExW

advapi32

RevertToSelf
RegDeleteValueW
RegEnumValueW
GetUserNameW
RegQueryInfoKeyW
RegDeleteKeyW
CheckTokenMembership
OpenProcessToken
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
AllocateAndInitializeSid
RegSetValueExW
SetEntriesInAclW
InitializeSecurityDescriptor
DuplicateToken
ImpersonateLoggedOnUser
ConvertStringSecurityDescriptorToSecurityDescriptorW
AdjustTokenPrivileges
LookupPrivilegeValueW
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
SetSecurityDescriptorDacl
FreeSid

shell32

SHGetSpecialFolderPathW
ShellExecuteW
ShellExecuteExW
SHGetFolderPathW
CommandLineToArgvW
ExtractIconW

ole32

CoCreateInstance
OleUninitialize
OleInitialize
CoCreateGuid
CreateStreamOnHGlobal
CoSetProxyBlanket
CLSIDFromString
CoInitialize
CoUninitialize
CoInitializeSecurity
GetHGlobalFromStream
CLSIDFromProgID
OleRun
PropVariantClear
CoInitializeEx

oleaut32

VariantInit
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
VariantCopy
SysAllocString
SysFreeString
VariantClear
GetErrorInfo
VariantChangeType
SafeArrayLock
SafeArrayCreate
SafeArrayRedim
SafeArrayUnlock
SafeArrayDestroy
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCopy
SysAllocStringByteLen
SysStringByteLen
SafeArrayGetVartype
DispCallFunc
SysStringLen

wininet

InternetWriteFile
InternetCrackUrlW
HttpEndRequestW
InternetGetConnectedState
HttpAddRequestHeadersW
InternetOpenW
InternetQueryOptionW
InternetCloseHandle
HttpOpenRequestW
InternetConnectW
InternetSetOptionW
HttpSendRequestW
HttpSendRequestExW
HttpQueryInfoW
InternetReadFileExA

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

secur32

GetUserNameExW

setupapi

SetupDiCreateDeviceInfoList
SetupDiSetDeviceInstallParamsW
SetupDiGetClassDevsW
SetupDiSetClassInstallParamsW
CMP_WaitNoPendingInstallEvents
SetupCloseInfFile
SetupGetLineTextW
SetupFindFirstLineW
SetupOpenInfFileW
CM_Disable_DevNode
CM_Set_DevNode_Registry_PropertyW
CM_Get_DevNode_Registry_PropertyW
CM_Get_Device_IDW
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
SetupDiRemoveDevice
SetupDiDestroyDriverInfoList
SetupDiBuildDriverInfoList
SetupDiOpenDevRegKey
SetupDiCreateDevRegKeyW
SetupDiOpenClassRegKey
SetupDiCallClassInstaller
CM_Get_DevNode_Status
SetupDiGetDeviceInstallParamsW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiCreateDeviceInfoW
SetupDiOpenDeviceInfoW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
CM_Locate_DevNodeW
SetupDiDestroyDeviceInfoList

ws2_32

getaddrinfo
freeaddrinfo
WSAAddressToStringW
send
WSAGetLastError
WSAStartup
recv
accept
listen
bind
WSADuplicateSocketW
WSACloseEvent
closesocket
shutdown
WSAResetEvent
WSAEnumNetworkEvents
WSAConnect
WSAEventSelect
WSAStringToAddressW
WSACreateEvent
setsockopt
WSASocketW
WSACleanup

gdi32

EndDoc
EndPage
DeleteEnhMetaFile
PlayEnhMetaFile
SetEnhMetaFileBits
GetDeviceCaps
StartPage
StartDocW
CreateDCW
DeleteDC

winspool.drv

StartDocPrinterW
StartPagePrinter
WritePrinter
EndPagePrinter
EndDocPrinter
FindFirstPrinterChangeNotification
FindNextPrinterChangeNotification
FindClosePrinterChangeNotification
DocumentPropertiesW
OpenPrinterW
ClosePrinter
AddPrinterW
DeletePrinter
EnumPortsW
EnumPrintersW
SetPrinterDataExW
AddPrinterDriverW
GetPrinterDriverW
XcvDataW
GetPrinterW
DeletePrinterDriverExW
GetPrinterDriverDirectoryW
EnumPrinterDriversW
SetPrinterW
SetJobW
GetJobW
EnumJobsW
ord204
ord203
AddMonitorW
DeleteMonitorW
EnumMonitorsW
GetPrinterDataExW

iphlpapi

GetAdaptersInfo
GetIfEntry
GetInterfaceInfo
IpReleaseAddress
IpRenewAddress
AddIPAddress
DeleteIPAddress
IcmpCreateFile
IcmpSendEcho
IcmpCloseHandle
NotifyAddrChange
GetAdaptersAddresses

crypt32

CertAddEncodedCertificateToStore
CertOpenStore
CryptUnprotectData
CertCloseStore
CertDeleteCertificateFromStore

Exports

Exports

Create_Config_JobFactory

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 196KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 956KB - Virtual size: 960KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

239920a45cc67472724c2e99cea6ff79

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

rpcrt4

shlwapi

psapi

advapi32

shell32

ole32

oleaut32

wininet

version

secur32

setupapi

ws2_32

gdi32

winspool.drv

iphlpapi

crypt32

Exports

Exports

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 2.0MB - Virtual size: 2.0MB

.data Size: 33KB - Virtual size: 71KB

.rsrc Size: 196KB - Virtual size: 196KB

.reloc Size: 956KB - Virtual size: 960KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 2.0MB - Virtual size: 2.0MB

.data
Size: 33KB - Virtual size: 71KB

.rsrc
Size: 196KB - Virtual size: 196KB

.reloc
Size: 956KB - Virtual size: 960KB