6f639b7f199f1fexeexeexeex[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

6f639b7f199f1fexeexeexeex.exe
Size

179KB
MD5

6f639b7f199f1fcaf0ff91abd555990e
SHA1

9f5f0fe351a1c60b055e705e9c1cb830893c0dca
SHA256

138ea8af6e86437e39ef533496337249d3f2e5311cd868535ff6b4597da65709
SHA512

788ff8c14914d6da2088db92a3b710af3a9164f78bb82f842edc2676243f8427a868b57573b8703cbe815e2fd1a9339eecef9acb8944fb53c6a7a79348d2e9e2
SSDEEP

3072:YXpNCF55JbY7shPBwTmdGg3oexMDGptV0gic8MDuzASMwaiaf5YAr:WpQF55NUsFBwTmr3oz6pMjEDuzAhf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6f639b7f199f1fexeexeexeex.exe

Files

6f639b7f199f1fexeexeexeex.exe
.exe windows x86

625bb0ef934524e100aaa86c0947b22e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptDecodeObjectEx
CryptBinaryToStringA
CryptStringToBinaryA

shlwapi

PathCombineW
StrSpnA
StrPBrkA
StrStrIW
PathSkipRootW
PathFindFileNameW
StrStrA
StrCmpNA
StrToIntA
StrCmpNIW
StrChrA
StrCmpNIA
PathFindFileNameA
StrChrW
StrCmpNW
PathMatchSpecW
StrToInt64ExA
StrCpyNW

mpr

WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum

ws2_32

closesocket
gethostbyname
htonl
sendto
inet_addr
socket
WSAStartup
inet_ntoa
shutdown
htons

kernel32

GetCommandLineW
SearchPathW
CreateMutexW
GetTempFileNameW
GetCurrentProcess
GetCurrentThread
TerminateProcess
GetModuleFileNameW
SetErrorMode
SetThreadPriority
GetTempPathW
GetLastError
LeaveCriticalSection
Sleep
OutputDebugStringA
SetProcessShutdownParameters
SetFilePointer
lstrlenA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
InitializeCriticalSection
WriteFile
lstrcpyA
OutputDebugStringW
PeekNamedPipe
SystemTimeToFileTime
MoveFileExW
SetFileTime
SetEvent
WaitForSingleObject
SetFilePointerEx
CreateProcessA
GetSystemDirectoryA
GetLocalTime
CreatePipe
GetTickCount
GetFileSize
GetDateFormatW
OpenEventW
GetCurrentThreadId
LocalFree
GetProcAddress
GetTimeFormatW
lstrcpynW
GetModuleHandleW
MulDiv
GetFileSizeEx
lstrcpynA
GetFileAttributesW
CreateThread
lstrcpyW
FileTimeToLocalFileTime
DeleteCriticalSection
GetFileTime
FileTimeToSystemTime
CreateEventW
MultiByteToWideChar
WideCharToMultiByte
FindFirstFileW
GetNativeSystemInfo
GetDriveTypeW
GetLogicalDrives
VirtualFree
VirtualAlloc
FindClose
QueryDosDeviceW
IsBadStringPtrW
lstrcmpiW
lstrcatW
FindNextFileW
SetFileAttributesW
GetCurrentProcessId
HeapReAlloc
HeapAlloc
HeapFree
HeapCreate
HeapValidate
SetLastError
GetProcessHeaps
HeapSetInformation
CreateDirectoryW
GetComputerNameA
IsBadReadPtr
IsBadWritePtr
IsBadStringPtrA
CloseHandle
WaitForMultipleObjects
CreateToolhelp32Snapshot
VirtualProtect
EnterCriticalSection
GetModuleHandleA
OpenProcess
lstrcmpiA
Process32NextW
GetVersionExW
ExitProcess
GetSystemInfo
GetHandleInformation
TlsAlloc
FlushFileBuffers
lstrlenW
CreateFileW
RtlUnwind
Process32FirstW
MoveFileW
ReadFile

user32

ReleaseDC
GetKeyboardLayoutList
GetSystemMetrics
CharLowerBuffA
SystemParametersInfoW
wsprintfA
RegisterClassExW
UnregisterClassW
TranslateMessage
PeekMessageW
CreateWindowExW
RegisterClassW
DefWindowProcW
DispatchMessageW
GetForegroundWindow
FillRect
DrawTextA
wsprintfW
GetDC

advapi32

InitializeSecurityDescriptor
AllocateAndInitializeSid
FreeSid
LookupPrivilegeValueW
GetTokenInformation
AdjustTokenPrivileges
OpenProcessToken
RegOpenKeyExW
RegCloseKey
RegOpenKeyW
RegQueryValueExW
SetSecurityDescriptorDacl
CryptReleaseContext
CryptGenRandom
DuplicateToken
CheckTokenMembership
CreateWellKnownSid
CryptGetKeyParam
CryptAcquireContextW
CryptDestroyKey

ole32

CoInitializeEx
CoCreateInstance
CoInitialize
CoUninitialize

shell32

ShellExecuteExW
SHGetFolderPathW
CommandLineToArgvW
SHChangeNotify
ShellExecuteW

gdi32

DeleteObject
SetTextColor
DeleteDC
GetDeviceCaps
GetDIBits
SetBkColor
SetPixel
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
CreateFontW
GetObjectW
GetStockObject

ntdll

ZwOpenProcess
memcpy
isspace
_allmul
RtlDosPathNameToNtPathName_U
NtDeleteFile
RtlFreeUnicodeString
_alldiv
tolower
memmove
ZwQuerySystemInformation
memset
_aulldvrm
NtQueryVirtualMemory

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 105KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

625bb0ef934524e100aaa86c0947b22e

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

shlwapi

mpr

ws2_32

kernel32

user32

advapi32

ole32

shell32

gdi32

ntdll

version

Sections

.text Size: 61KB - Virtual size: 61KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 105KB - Virtual size: 108KB

.CRT Size: 512B - Virtual size: 12B

.text
Size: 61KB - Virtual size: 61KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 105KB - Virtual size: 108KB

.CRT
Size: 512B - Virtual size: 12B