9795b2a258ad79exeexeexeex[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

9795b2a258ad79exeexeexeex.exe
Size

149KB
MD5

9795b2a258ad79b7f58aac6a20c80059
SHA1

9d477cd76d045cead3831ad3bef0ce30b24f5a41
SHA256

e4a04f6dd033ed1cbfea57ac4e67b3514f1ebe600ea343edaae5dffde375c06a
SHA512

e7fb39498ee8d7b1ef93f4e05d07961695d2998f7322b6cc598cb892da57699019ba80507f15c507118dc8c45fcc22ded55b5a485c734cbbc9a12a49560c4faa
SSDEEP

3072:ae9naR6ueHeleaZProDe3zWB/phlqxLoxP/4Q6/t+fr3:ayuyelZlroDejWB/pqoF4N/Mz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9795b2a258ad79exeexeexeex.exe

Files

9795b2a258ad79exeexeexeex.exe
.exe windows x86

935f6f601eeda74cacddee4087bfd860

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptBinaryToStringA
CryptStringToBinaryA
CryptDecodeObjectEx

wininet

InternetCloseHandle
InternetOpenA
InternetConnectA
InternetCrackUrlA
InternetReadFile
HttpOpenRequestA
HttpSendRequestA

shlwapi

PathFindFileNameW
StrSpnA
StrStrIA
StrChrA
StrChrIA
StrCpyNW
StrPBrkA
StrCmpNIW
StrStrIW
StrCmpNIA
PathSkipRootW
StrChrW
StrCmpNW
PathMatchSpecW
StrToInt64ExA
StrToIntA
PathCombineW
PathUnquoteSpacesW
StrCmpIW
PathRemoveExtensionW

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoW
GetFileVersionInfoA
GetFileVersionInfoSizeW
VerQueryValueW

mpr

WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW

imagehlp

CheckSumMappedFile

ws2_32

inet_ntoa
inet_addr
htonl
shutdown
closesocket
gethostbyname
WSAStartup
socket
sendto
htons

kernel32

Sleep
LeaveCriticalSection
GetTimeFormatW
GetFileAttributesW
FileTimeToSystemTime
ReadFile
FlushFileBuffers
GetFileSizeEx
MoveFileW
EnterCriticalSection
CreateEventW
InitializeCriticalSection
GetFileTime
DeleteCriticalSection
CloseHandle
FileTimeToLocalFileTime
lstrcpyW
CreateThread
OpenMutexW
CreateFileW
LocalFree
ExitProcess
RtlUnwind
GetLastError
GetTempFileNameW
MapViewOfFile
UnmapViewOfFile
FindResourceW
FreeLibrary
LoadResource
CreateProcessW
LoadLibraryExW
LoadLibraryW
CopyFileW
SizeofResource
ReadProcessMemory
GetSystemWow64DirectoryW
lstrcpynW
CreateProcessA
TerminateProcess
FlushInstructionCache
GetTempPathW
SetFileTime
CreateFileMappingW
LockResource
OpenEventW
GetWindowsDirectoryW
DeleteFileW
WriteProcessMemory
ResumeThread
FindFirstFileW
GetModuleFileNameW
FindClose
SetFileAttributesW
GetCommandLineW
CreateMutexW
GetCurrentProcess
GetCurrentThread
OutputDebugStringW
SetThreadPriority
WaitForMultipleObjects
GetCurrentThreadId
SetCurrentDirectoryW
OutputDebugStringA
SetProcessShutdownParameters
IsBadStringPtrA
IsBadCodePtr
IsBadReadPtr
lstrlenA
IsBadStringPtrW
lstrcpyA
GetEnvironmentVariableW
GetModuleHandleW
WriteFile
GetVersionExW
lstrcmpiA
GetTickCount
GetSystemWindowsDirectoryW
SetEvent
WaitForSingleObject
SetFilePointerEx
SetFilePointer
MulDiv
GetFileSize
GetDateFormatW
GetProcAddress
lstrlenW
lstrcatW
GetSystemDirectoryW
VirtualAllocEx
GetVolumeInformationW
GetNativeSystemInfo
GetDriveTypeW
GetLogicalDrives
VirtualFree
VirtualAlloc
QueryDosDeviceW
FindNextFileW
SetErrorMode
HeapReAlloc
HeapAlloc
HeapFree
HeapCreate
HeapValidate
SetLastError
GetProcessHeaps
HeapSetInformation
GetCurrentProcessId
GetComputerNameA
CreateDirectoryW
ExpandEnvironmentStringsW
TlsAlloc
IsBadWritePtr
lstrcpynA
MultiByteToWideChar
WideCharToMultiByte
OpenProcess
GetFileAttributesA
SearchPathW
GetHandleInformation
CreateToolhelp32Snapshot
VirtualProtect
GetModuleHandleA
lstrcmpiW
Process32NextW
GetSystemInfo
Process32FirstW

advapi32

GetTokenInformation
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyW
CryptDestroyKey
CryptAcquireContextW
RegEnumValueW
RegDeleteValueW
CreateWellKnownSid
CheckTokenMembership
DuplicateToken
ConvertSidToStringSidW
GetLengthSid
CryptGenRandom
CryptReleaseContext
AdjustTokenPrivileges
FreeSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
AllocateAndInitializeSid
SetKernelObjectSecurity
LookupPrivilegeValueW
CryptGetKeyParam
OpenProcessToken
RegSetValueExW
RegFlushKey
RegOpenKeyW
RegCreateKeyExW
RegCloseKey

user32

wsprintfA
CharLowerBuffA
TranslateMessage
PeekMessageW
CreateWindowExW
GetSystemMetrics
RegisterClassW
DefWindowProcW
FillRect
DrawTextA
GetDC
SystemParametersInfoW
ReleaseDC
DispatchMessageW
GetForegroundWindow
RegisterClassExW
UnregisterClassW
GetKeyboardLayoutList
wsprintfW
GetLastInputInfo

ole32

CoInitializeSecurity
CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitialize

shell32

ShellExecuteW
ShellExecuteExW
CommandLineToArgvW
SHGetFolderPathW
SHChangeNotify

ntdll

ZwQueryInformationProcess
_aullshr
_allmul
_chkstk
isspace
_alldiv
memmove
ZwQuerySystemInformation
ZwOpenDirectoryObject
RtlDosPathNameToNtPathName_U
NtDeleteFile
RtlFreeUnicodeString
ZwOpenSection
ZwClose
ZwOpenProcess
memset
_aulldvrm
memcpy
NtQueryVirtualMemory

oleaut32

SysAllocString
SysFreeString

gdi32

SetTextColor
GetDeviceCaps
GetDIBits
SetBkColor
SetPixel
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
GetObjectW
GetStockObject
DeleteDC

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetInfo

Sections

.text
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cdata
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

935f6f601eeda74cacddee4087bfd860

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

wininet

shlwapi

version

mpr

imagehlp

ws2_32

kernel32

advapi32

user32

ole32

shell32

ntdll

oleaut32

gdi32

netapi32

Sections

.text Size: 79KB - Virtual size: 78KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 4KB - Virtual size: 13KB

.cdata Size: 50KB - Virtual size: 50KB

.CRT Size: 512B - Virtual size: 4B

.text
Size: 79KB - Virtual size: 78KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 4KB - Virtual size: 13KB

.cdata
Size: 50KB - Virtual size: 50KB

.CRT
Size: 512B - Virtual size: 4B