67b7b3d163cd98fa7714e70fd1a9d21594edafd82dbcbe898b55f01f2e026456

Sharing

Copy URL

Twitter E-mail

General

Target

67b7b3d163cd98fa7714e70fd1a9d21594edafd82dbcbe898b55f01f2e026456
Size

440KB
MD5

62f3bf0aeeccf7811300598669ec9ac4
SHA1

f92fb2d68dccff42617583037b5f7b9a6faed871
SHA256

67b7b3d163cd98fa7714e70fd1a9d21594edafd82dbcbe898b55f01f2e026456
SHA512

0a9e12f0e34ad3a50d44d232519f6ca81bdef237b95d187dd6a992feb78f5ce64eaf15c78cf173256775e24b9d0a4044ca7aa5cac196bb30c927fe7316c78970
SSDEEP

12288:GQnXnVXyikYms8hQYu5XBRJxI24yu18DiJSYMdLb8j:FXnZyikYms8hQYuTR/xbu1iiJSQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
67b7b3d163cd98fa7714e70fd1a9d21594edafd82dbcbe898b55f01f2e026456

Files

67b7b3d163cd98fa7714e70fd1a9d21594edafd82dbcbe898b55f01f2e026456
.exe windows x86

afa92db56df8d750578d4922b749654d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc80

ord2392
ord2408
ord2413
ord2396
ord2398
ord2400
ord2394
ord2410
ord2390
ord934
ord930
ord932
ord928
ord923
ord5233
ord5235
ord5960
ord1600
ord4282
ord4722
ord3403
ord5203
ord4185
ord6275
ord5073
ord1908
ord5152
ord4244
ord1401
ord3946
ord1617
ord1620
ord5912
ord6724
ord1551
ord1670
ord1671
ord2020
ord4580
ord4890
ord4735
ord4212
ord5182
ord2415
ord6282
ord3605
ord2991
ord5214
ord1402
ord5915
ord6725
ord3215
ord1559
ord1638
ord3292
ord1581
ord1643
ord2403
ord2385
ord2387
ord2405
ord2178
ord2172
ord1522
ord6279
ord3802
ord6277
ord3345
ord4967
ord1362
ord5175
ord1964
ord1656
ord1655
ord1599
ord5200
ord2862
ord4486
ord4262
ord3182
ord4038
ord4014
ord6278
ord3801
ord6276
ord4326
ord2063
ord2018
ord5583
ord3806
ord1010
ord2468
ord5102
ord6219
ord5382
ord3832
ord1920
ord2931
ord5224
ord5226
ord2248
ord3948
ord4568
ord5230
ord5213
ord5566
ord2537
ord2731
ord2835
ord4307
ord2714
ord2838
ord2540
ord2646
ord2533
ord3718
ord3719
ord3709
ord2644
ord3949
ord4481
ord3441
ord3908
ord3596
ord911
ord1794
ord795
ord1203
ord1187
ord1191
ord4104
ord2372
ord4261
ord3333
ord3683
ord4541
ord3641
ord1207
ord1084
ord3920
ord1614
ord572
ord643
ord760
ord6090
ord266
ord757
ord310
ord566
ord578
ord297
ord605
ord1489
ord6118
ord2902
ord876
ord299
ord6703
ord1482
ord781
ord2322
ord304
ord784
ord1054
ord762
ord354
ord715
ord6236
ord1903
ord1063
ord4749
ord709
ord501
ord1024
ord5833
ord6065
ord1425
ord6067
ord1123
ord1395

msvcr80

_lock
__dllonexit
_unlock
_crt_debugger_hook
??1exception@std@@UAE@XZ
fclose
fwrite
fopen
_splitpath
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
_time64
_CxxThrowException
memcpy_s
_invalid_parameter_noinfo
atoi
__CxxUnregisterExceptionObject
__CxxDetectRethrow
__CxxRegisterExceptionObject
__CxxExceptionFilter
__CxxQueryExceptionSize
__FrameUnwindFilter
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_except_handler4_common
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_resetstkoflw
_onexit
memset
_controlfp_s
_invoke_watson
_decode_pointer
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
__CxxFrameHandler3
_purecall
??3@YAXPAX@Z
malloc
free
_setmbcp

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
Sleep
lstrlenA
lstrcmpiA
GetLastError
WideCharToMultiByte
MultiByteToWideChar
InterlockedExchange
QueryPerformanceCounter
CreateDirectoryA
InterlockedIncrement
LocalFree
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceA
GetTempPathA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
InterlockedDecrement
WinExec
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSection
DeleteCriticalSection
GetLocaleInfoA
GetACP
GetVersionExA
GetThreadLocale

user32

SetClassLongA
CallNextHookEx
IsDialogMessageA
UnhookWindowsHookEx
SetWindowsHookExA
UpdateWindow
GetWindowRect
SetCapture
IsWindow
LoadIconA
EnableWindow
EnableScrollBar
IsChild
BringWindowToTop
IsIconic
InvalidateRect
DrawIcon
SetRect
DefWindowProcA
GetFocus
GetParent
GetSystemMetrics
GetDC
IsRectEmpty
SendMessageA
MessageBoxA
ReleaseDC
EqualRect
PostQuitMessage
SetWindowLongA
BeginPaint
EndPaint
ReleaseCapture
GetClientRect
GetCursorPos
SetWindowPos

oleaut32

SysAllocString
VariantClear
SysAllocStringByteLen
SysStringLen
VariantInit
GetErrorInfo
SysFreeString

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z

ws2_32

WSACleanup
WSAStartup

gdi32

DeleteDC
DeleteObject
CreateCompatibleDC
CreateDIBSection
SelectObject
GetDeviceCaps

shell32

ShellExecuteA

comctl32

ord17

shlwapi

PathFileExistsA

ole32

OleCreate
OleSetContainedObject
CoTaskMemAlloc
CoTaskMemFree
OleDraw
OleInitialize
OleUninitialize

msvcm80

?RegisterModuleUninitializer@<CrtImplementationDetails>@@YAXP$AAVEventHandler@System@@@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@@Z
?ThrowNestedModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVException@System@@0@Z
?DoCallBackInDefaultDomain@<CrtImplementationDetails>@@YAXP6GJPAX@Z0@Z
?DoDllLanguageSupportValidation@<CrtImplementationDetails>@@YAXXZ
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@P$AAVException@3@@Z

mscoree

_CorExeMain

Sections

.text
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 264KB - Virtual size: 260KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

afa92db56df8d750578d4922b749654d

Headers

File Characteristics

Imports

mfc80

msvcr80

kernel32

user32

oleaut32

msvcp80

ws2_32

gdi32

shell32

comctl32

shlwapi

ole32

msvcm80

mscoree

Sections

.text Size: 44KB - Virtual size: 41KB

.rdata Size: 112KB - Virtual size: 109KB

.data Size: 8KB - Virtual size: 39KB

.rsrc Size: 264KB - Virtual size: 260KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 44KB - Virtual size: 41KB

.rdata
Size: 112KB - Virtual size: 109KB

.data
Size: 8KB - Virtual size: 39KB

.rsrc
Size: 264KB - Virtual size: 260KB

.reloc
Size: 8KB - Virtual size: 7KB