325afec3ce9328exeexeexeex[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

325afec3ce9328exeexeexeex.exe
Size

1.5MB
MD5

325afec3ce9328cc545da23712000b0f
SHA1

e6bfc81e4802272d2665085831e0b1a186570a39
SHA256

5b3956f08b2e93d5a161f323123e063345edaae024d897868add6a96a1e90d7b
SHA512

eb703a28d26ba95412ae5ba1b8b0a85efec0f8823740cf3ddb069b962010a2129d74431165adb66370a0ff205d0a7c74f04c2b94f6584987c2e1852a7e7add06
SSDEEP

24576:47Bho98dpQt210g4MQHkbMD1Nkr67pfz/KXqv1:4jpdpQI10g4MQHkUX865DKU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
325afec3ce9328exeexeexeex.exe

Files

325afec3ce9328exeexeexeex.exe
.exe windows x86

5b9a3ebe28f4047a0ebe12396b5b4083

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
ExpandEnvironmentStringsW
InitializeCriticalSection
GetCurrentProcessId
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetTickCount
CreateFileW
Sleep
SetFilePointer
WriteFile
CloseHandle
OutputDebugStringW
GetCurrentThreadId
OpenProcess
GetFileAttributesExW
GetCommandLineW
GetTempFileNameW
GetLongPathNameW
SearchPathW
FormatMessageW
LocalFree
CreateMutexW
WaitForSingleObject
CreateFileMappingW
MapViewOfFile
ReleaseMutex
UnmapViewOfFile
LoadLibraryW
GetProcAddress
FreeLibrary
QueryPerformanceFrequency
CreateDirectoryW
GetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
GetEnvironmentVariableW
GlobalAlloc
GlobalFree
lstrcmpiW
WideCharToMultiByte
RemoveDirectoryW
SetFileAttributesW
DeleteFileW
GetPrivateProfileStringW
GetPrivateProfileStringA
QueryPerformanceCounter
WritePrivateProfileStringA
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
HeapSetInformation
GetStartupInfoW
HeapFree
GetSystemTimeAsFileTime
GetTimeFormatW
GetDateFormatW
RaiseException
RtlUnwind
HeapAlloc
LCMapStringW
GetCPInfo
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
GetModuleHandleW
ExitProcess
IsProcessorFeaturePresent
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
HeapCreate
GetTimeZoneInformation
GetLocaleInfoW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapReAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
WriteConsoleW
SetStdHandle
CompareStringW
SetEnvironmentVariableA
CopyFileW
SetLastError
GetLastError
ExitThread
GetConsoleWindow
WritePrivateProfileStringW
MoveFileExW
GetSystemDirectoryW
DeviceIoControl
GetFileTime
SizeofResource
LockResource
LoadResource
FindResourceExW
FindResourceW
GlobalUnlock
GlobalLock
ProcessIdToSessionId
LocalAlloc
GetUserDefaultLangID
SetCurrentDirectoryW
GetCurrentDirectoryW
GetComputerNameExW
GetSystemDefaultUILanguage
GetSystemDefaultLCID
GetVersionExW
CreateProcessW
GetTempPathW
GetDiskFreeSpaceExW
CreateThread
GetExitCodeThread
GetExitCodeProcess
TerminateThread
CreateEventW
OpenEventW
ResetEvent
SetEvent
GetLocalTime
GetSystemTime
OpenMutexW
GetShortPathNameW
GetFileSizeEx
PeekNamedPipe
TryEnterCriticalSection
WaitForMultipleObjects
CreatePipe
GlobalMemoryStatusEx
OpenFileMappingW
FlushViewOfFile

user32

MsgWaitForMultipleObjectsEx
WaitForInputIdle
GetAsyncKeyState
OpenWindowStationW
CloseWindowStation
GetProcessWindowStation
SetProcessWindowStation
GetThreadDesktop
SetThreadDesktop
OpenDesktopW
CloseDesktop
ExitWindowsEx
AllowSetForegroundWindow
PeekMessageW
MsgWaitForMultipleObjects
GetSystemMetrics
SystemParametersInfoW
LoadIconW
DestroyIcon
RegisterWindowMessageW
SetTimer
GetMessageW
SendMessageCallbackW
GetKeyState
ShowWindow

shlwapi

PathIsFileSpecW
PathFindFileNameW
PathRemoveFileSpecW
PathFindExtensionW

psapi

EnumProcessModules
GetModuleFileNameExW
GetModuleBaseNameW
EnumProcesses

advapi32

RegQueryValueExW
RegCreateKeyExW
GetUserNameW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteValueW
RegSetValueExW
RegDeleteKeyW
CheckTokenMembership
OpenProcessToken
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW

shell32

ExtractIconW
ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoInitialize
CLSIDFromString
CoCreateInstance
CoUninitialize

oleaut32

SysAllocString
SysFreeString

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

secur32

GetUserNameExW

winspool.drv

AddPrinterDriverW
SetPrinterDataExW
XcvDataW
GetPrinterW
DeletePrinterDriverExW
GetPrinterDriverDirectoryW
EnumPrinterDriversW
SetPrinterW
SetJobW
GetJobW
EnumJobsW
ord204
ord203
AddMonitorW
DeleteMonitorW
EnumMonitorsW
EnumPortsW
StartDocPrinterW
StartPagePrinter
WritePrinter
EndPagePrinter
EndDocPrinter
FindFirstPrinterChangeNotification
FindNextPrinterChangeNotification
FindClosePrinterChangeNotification
DocumentPropertiesW
GetPrinterDataExW
EnumPrintersW
DeletePrinter
AddPrinterW
ClosePrinter
GetPrinterDriverW
OpenPrinterW

Sections

.text
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5b9a3ebe28f4047a0ebe12396b5b4083

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shlwapi

psapi

advapi32

shell32

ole32

oleaut32

version

secur32

winspool.drv

Sections

.text Size: 158KB - Virtual size: 157KB

.rdata Size: 47KB - Virtual size: 47KB

.data Size: 8KB - Virtual size: 18KB

.rsrc Size: 56KB - Virtual size: 56KB

.reloc Size: 1.2MB - Virtual size: 1.8MB

.text
Size: 158KB - Virtual size: 157KB

.rdata
Size: 47KB - Virtual size: 47KB

.data
Size: 8KB - Virtual size: 18KB

.rsrc
Size: 56KB - Virtual size: 56KB

.reloc
Size: 1.2MB - Virtual size: 1.8MB