80e4caf8096095exeexeexeex[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

80e4caf8096095exeexeexeex.exe
Size

1.7MB
MD5

80e4caf80960958736b7e5cc2c0d2fc2
SHA1

4198a63c5ef2d55d4abc7235ff9a614b4a2a2e2b
SHA256

8b25bcbb452edd94310dcc810e5c9bd90bebf07d3026a5a6bf421c5cae0393d2
SHA512

7457863a364280471f7a63c0debdec21b5a598ae5c4d5e208a1d958e02608926150aa2b6ceff8a1a9c61e1403f97febc50dfea16b461f3178e29585d4e6bddd9
SSDEEP

24576:TI6r5I6NfN4IdNhZkm/LS8VgrNKfvpnN/BsYcVPUjYhh67sbCO541NTmuhlAQjrz:TRI6NfNZdXZLLSIVbBOfCTnAQjr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
80e4caf8096095exeexeexeex.exe

Files

80e4caf8096095exeexeexeex.exe
.exe windows x86

928d5ad3b3667bdbed6c3e97555301e2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

netapi32

DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation

wininet

InternetSetOptionA

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

mpr

WNetGetUniversalNameW

kernel32

HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
SetHandleCount
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetStringTypeA
HeapDestroy
IsBadReadPtr
IsBadCodePtr
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetLocaleInfoW
InterlockedExchange
GetProfileStringA
GetEnvironmentVariableA
GetStringTypeW
CloseHandle
CreateThread
GetPrivateProfileStringA
GetModuleFileNameA
OpenProcess
GetVersionExA
GetVersion
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
lstrlenW
GetCPInfo
LockResource
LoadResource
FindResourceA
lstrcmpiA
LocalFree
DisconnectNamedPipe
FlushFileBuffers
ReadFile
ConnectNamedPipe
GetLastError
CreateNamedPipeA
LocalAlloc
FreeLibrary
CreateProcessA
CreateMutexA
CreateFileA
GetCurrentProcess
ResumeThread
GetSystemDefaultLCID
lstrcatA
lstrcpyA
WaitForSingleObject
Sleep
GetTickCount
WritePrivateProfileStringA
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
WriteFile
GetFileSize
EnterCriticalSection
LeaveCriticalSection
TerminateThread
GetExitCodeThread
CopyFileA
MoveFileA
DeleteFileA
FindClose
FindNextFileA
FindFirstFileA
CreateDirectoryA
GetLongPathNameA
TerminateProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
OutputDebugStringA
FormatMessageA
GlobalUnlock
GlobalLock
GlobalAlloc
GetProcAddress
LoadLibraryA
ProcessIdToSessionId
InterlockedDecrement
InterlockedIncrement
SetFileTime
SystemTimeToFileTime
GetSystemTime
GetExitCodeProcess
ExpandEnvironmentStringsA
GetLocalTime
SuspendThread
HeapAlloc
GetProcessHeap
GetFileAttributesA
lstrcmpA
GetCurrentDirectoryA
RemoveDirectoryA
SetFileAttributesA
CreateFileW
GetModuleHandleA
SetEndOfFile
SetFilePointer
GetComputerNameA
GetComputerNameW
Process32NextW
Process32FirstW
DeviceIoControl
QueryDosDeviceW
GetFileAttributesW
HeapFree
WinExec
QueryDosDeviceA
DefineDosDeviceA
GetDriveTypeA
SetEvent
ReadDirectoryChangesW
CreateEventA
SetLastError
MulDiv
lstrcpynA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
SetThreadPriority
GetCurrentThread
GlobalFree
FileTimeToSystemTime
FileTimeToLocalFileTime
DuplicateHandle
LockFile
UnlockFile
GetVolumeInformationA
GetFullPathNameA
GetThreadLocale
GetFileTime
GlobalFlags
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
GetProcessVersion
GetOEMCP
SizeofResource
FindResourceExA
SetErrorMode
RtlUnwind
RaiseException
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetStartupInfoA
GetCommandLineA
ExitProcess
ExitThread
GetACP
SetStdHandle
GetFileType
HeapSize
HeapReAlloc

user32

SetWindowsHookExA
UnregisterClassA
HideCaret
ShowCaret
ExcludeUpdateRgn
DefDlgProcA
IsWindowUnicode
GetLastInputInfo
PostThreadMessageA
SetTimer
KillTimer
PostQuitMessage
GetAsyncKeyState
LoadIconA
IsIconic
DrawIcon
GetWindowDC
GetSystemMenu
SetForegroundWindow
RegisterWindowMessageA
FrameRect
LoadImageA
GetIconInfo
CreateIconIndirect
DrawStateA
OffsetRect
GetClientRect
InflateRect
DrawFocusRect
GetWindowRect
ClientToScreen
WindowFromPoint
GetActiveWindow
InvalidateRect
SetCursor
GetParent
GetNextDlgTabItem
CreateWindowExA
SendMessageA
GetWindowLongA
DestroyCursor
EnableWindow
GrayStringA
TabbedTextOutA
GetSubMenu
LoadBitmapA
GetSysColorBrush
GetMenuStringA
CreateMenu
CreatePopupMenu
GetMenuItemID
GetMenuState
ModifyMenuA
GetMenuItemCount
AppendMenuA
GetSystemMetrics
CallNextHookEx
GetWindow
wsprintfA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetWindowTextW
DestroyMenu
ScreenToClient
BeginPaint
EndPaint
IntersectRect
GetDesktopWindow
GetDC
DrawTextA
ReleaseDC
GetWindowPlacement
DestroyIcon
RemovePropA
GetSysColor
CopyRect
FillRect
DrawEdge
SetRect
GetMenuItemInfoA
DestroyWindow
GetKeyState
PostMessageA
MapDialogRect
GetDlgCtrlID
GetWindowTextLengthA
GetDlgItem
TrackPopupMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
IsChild
GetTopWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
SetScrollInfo
GetScrollInfo
ScrollWindow
IsWindowVisible
DeferWindowPos
EqualRect
AdjustWindowRectEx
SetFocus
IsWindow
SetActiveWindow
GetFocus
DispatchMessageA
PeekMessageA
MapWindowPoints
SendDlgItemMessageA
UpdateWindow
GetCursorPos
ValidateRect
TranslateMessage
GetMessageA
SetRectEmpty
PtInRect
SetDlgItemTextA
IsDialogMessageA
SetWindowTextA
MoveWindow
ShowWindow
IsWindowEnabled
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadStringA
SetWindowContextHelpId
SetParent
MessageBeep
GetNextDlgGroupItem
CopyAcceleratorTableA
CharNextA
SetCapture
LockWindowUpdate
GetDCEx
LoadCursorA
GetClassNameA
CharUpperA
FindWindowA
SetWindowPos
SetWindowLongA
GetForegroundWindow
GetLastActivePopup
GetMessagePos
ReleaseCapture
GetMessageTime
DrawIconEx
DefWindowProcA
EndDialog
CallWindowProcA
GetPropA
UnhookWindowsHookEx
SetPropA
SystemParametersInfoA
GetClassLongA
MessageBoxA
GetWindowTextA
GetWindowThreadProcessId
CreateDialogIndirectParamA
RegisterClipboardFormatA
IsMenu

gdi32

SetDIBitsToDevice
GetTextExtentPointA
GetDeviceCaps
EnumFontFamiliesExA
GetBkColor
GetTextColor
LPtoDP
GetCharWidthA
StretchDIBits
DPtoLP
CombineRgn
SetRectRgn
GetMapMode
CreatePatternBrush
GetWindowExtEx
GetViewportExtEx
ExtSelectClipRgn
CreateRectRgn
LineTo
MoveToEx
IntersectClipRect
ExcludeClipRect
SelectClipRgn
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetStretchBltMode
SetBkMode
RestoreDC
SaveDC
CreateRectRgnIndirect
GetTextMetricsA
CreateFontA
CreateBitmap
SetBkColor
SetTextColor
GetStockObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
PatBlt
GetObjectA
GetPixel
SetPixel
CreateDIBSection
SelectObject
DeleteObject
DeleteDC
Ellipse
GetTextExtentPoint32A
GetTextExtentPoint32W
CreateCompatibleBitmap
BitBlt
CreateCompatibleDC
CreateFontIndirectA
CreateSolidBrush
CreatePen
GetBkMode
CreateDIBitmap

comdlg32

GetFileTitleA
GetOpenFileNameA
GetSaveFileNameA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
LookupAccountSidA
IsValidSid
RegOpenKeyExA
RegQueryValueExA
GetNamedSecurityInfoA
GetTokenInformation
OpenProcessToken
GetUserNameA
RegQueryValueA
RegDeleteValueA
RegOpenKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
RegDeleteKeyA
RegEnumKeyExA
RegQueryInfoKeyA
RegCreateKeyExA
RegSetValueA
RegSetValueExA
RegSaveKeyA
RegRestoreKeyA
RevertToSelf
ImpersonateLoggedOnUser
CreateProcessAsUserA
StartServiceA
LookupAccountSidW
ControlService
OpenSCManagerA
OpenServiceA
CloseServiceHandle
RegCloseKey
ConvertStringSidToSidA
SetEntriesInAclA
SetNamedSecurityInfoA
ConvertSidToStringSidA
CryptAcquireContextW
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptGetHashParam
DuplicateTokenEx
SetTokenInformation

shell32

ExtractIconA
SHFileOperationA
ShellExecuteExA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc
SHGetFolderPathA
Shell_NotifyIconA
SHGetSpecialFolderPathA
ShellExecuteA
SHChangeNotify

comctl32

ImageList_Draw
ImageList_GetImageCount
ImageList_GetIcon
ImageList_AddMasked
ImageList_ReplaceIcon
_TrackMouseEvent
ImageList_Remove
ImageList_Destroy
ImageList_Create
ord17
PropertySheetA
DestroyPropertySheetPage
CreatePropertySheetPageA

oledlg

ord8

ole32

CoRevokeClassObject
CoRegisterMessageFilter
CoTaskMemAlloc
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CLSIDFromString
CLSIDFromProgID
CoInitialize
CoInitializeEx
CoUninitialize
CoCreateInstance
OleFlushClipboard
OleIsCurrentClipboard
CoTaskMemFree

olepro32

ord253

oleaut32

SysFreeString
SysStringLen
SysAllocString
VariantClear
SysAllocStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
VariantCopy
SysAllocStringByteLen
VariantChangeType
VariantTimeToSystemTime

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

activeds

ord3

shlwapi

SHDeleteKeyA
PathIsDirectoryA

log4cplus

?sleep@helpers@log4cplus@@YAXKK@Z
??0Logger@log4cplus@@QAE@ABV01@@Z
?doConfigure@PropertyConfigurator@log4cplus@@SAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVHierarchy@2@@Z
?getDefaultHierarchy@Logger@log4cplus@@SAAAVHierarchy@2@XZ
?forcedLog@Logger@log4cplus@@QAEXHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBDH@Z
??1Logger@log4cplus@@UAE@XZ
?getInstance@Logger@log4cplus@@SA?AV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?isEnabledFor@Logger@log4cplus@@QBE_NH@Z

winmm

PlaySoundA

wsock32

bind
closesocket
accept
recv
gethostname
gethostbyname
WSACleanup
WSAStartup
socket
htons
ioctlsocket
listen

psapi

GetModuleFileNameExW
GetProcessImageFileNameW
GetProcessMemoryInfo

globalhookdll

ord1
ord2

rpcrt4

RpcStringFreeW
UuidCreateSequential
RpcStringFreeA
UuidToStringA
UuidToStringW

iphlpapi

GetAdaptersInfo

libcurl

curl_easy_init
curl_slist_append
curl_easy_perform
curl_easy_setopt
curl_formfree
curl_slist_free_all
curl_easy_cleanup
curl_easy_getinfo
curl_easy_strerror
curl_formadd

msvcrt

fread
printf
ungetwc
fgetwc
free
malloc
floor
?set_new_handler@@YAP6AXXZP6AXXZ@Z
__RTDynamicCast
_strlwr
_rmdir
_chdir
strtod
_snprintf
abort
getenv
sscanf
_iob
fprintf
exit
isprint
fwrite
_CIfmod
_setjmp3
longjmp
_CIpow
sprintf
strncpy
fscanf
fgets
getc
fputc
fflush
ftell
fseek
fopen
fclose

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 180KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 320KB - Virtual size: 319KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

928d5ad3b3667bdbed6c3e97555301e2

Headers

File Characteristics

Imports

netapi32

wininet

version

userenv

mpr

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

setupapi

activeds

shlwapi

log4cplus

winmm

wsock32

psapi

globalhookdll

rpcrt4

iphlpapi

libcurl

msvcrt

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 180KB - Virtual size: 178KB

.data Size: 72KB - Virtual size: 99KB

.rsrc Size: 320KB - Virtual size: 319KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 180KB - Virtual size: 178KB

.data
Size: 72KB - Virtual size: 99KB

.rsrc
Size: 320KB - Virtual size: 319KB