e1ed6e7a405be6exeexeexeex[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

e1ed6e7a405be6exeexeexeex.exe
Size

2.1MB
MD5

e1ed6e7a405be63a9f57529ab83bd666
SHA1

f9f858d2501e660ebb26dece75983065a64dd5de
SHA256

d6a69b263a2e9c4567692b88e370304811d4f480aa66421d74afbfaa1ecef568
SHA512

346ac55c129c500e660e6dc32a61c810bbe32c4f81cbe02d7a6298e7f945b9aa82b5444e1d60d0ed43751ca82457080fc5d6531ed48c651a5e923de6861561ce
SSDEEP

49152:87p0nOfmAIP2bEQMW8hclDWmBWjSl8PJtO59Ly:8d9fmAIP2bDMW8hclDWmsjSl8ht+Ry

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e1ed6e7a405be6exeexeexeex.exe

Files

e1ed6e7a405be6exeexeexeex.exe
.exe windows x86

ced04ba91d340a6b29c3bb531d1b5116

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipCreateFromHDC
GdipSetPageUnit
GdipDrawImageRectI
GdiplusShutdown
GdipCloneImage
GdipGetImageHeight
GdipGetImageWidth
GdiplusStartup
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipCreateBitmapFromFile
GdipFree

turbine

?ClosePort@CTurbine@@QAEHPAX@Z
?WritePort@CTurbine@@QAEHPAXPAEKK@Z
?OpenPort@CTurbine@@QAEPAXPBD@Z
??0CTurbine@@QAE@XZ
?SendData@CTurbine@@QAEHPAEK@Z
?ClosePort@CTurbine@@QAEHH@Z
?ParQueryDeviceId@CTurbine@@QAEHPAXPADKK@Z
?OpenPort@CTurbine@@QAEHPBDI@Z
?WritePort@CTurbine@@QAEHIHPAEK@Z
?ReadPort@CTurbine@@QAEHIHPADK@Z
?SendFile@CTurbine@@QAEHPBD@Z
?EndCommand@CTurbine@@QAEHPAE@Z
?BeginCommand@CTurbine@@QAEHPAE@Z
?ReadPort@CTurbine@@QAEHPAXPADKK@Z
??1CTurbine@@UAE@XZ

strgene

?GetStrImage@@YAXPAEHPAY1KIM@DA@E@Z

rmtcmd

??1CRemoteCmd@@UAE@XZ
?RemoteModeEnd@CRemoteCmd@@QAEHPAE@Z
?SM@CRemoteCmd@@QAEHPAEE@Z
?RemoteModeStart@CRemoteCmd@@QAEHPAE@Z
??0CRemoteCmd@@QAE@XZ
?ST@CRemoteCmd@@QAEHPAEE@Z

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

kernel32

VirtualProtect
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetCurrentThreadId
FreeResource
GetModuleFileNameW
FindNextFileA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetThreadLocale
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetCurrentProcess
GetFullPathNameA
GetCurrentProcessId
GetFileTime
lstrcmpA
LoadLibraryExA
GetLocaleInfoA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThread
FindResourceExA
LocalAlloc
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteFileA
TlsFree
GlobalFlags
InterlockedIncrement
GetCPInfo
GetOEMCP
SetErrorMode
GetCurrentDirectoryA
RtlUnwind
GetSystemTimeAsFileTime
ExitProcess
GetTimeFormatA
GetDateFormatA
RaiseException
VirtualAlloc
GetSystemInfo
VirtualQuery
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
SetStdHandle
GetFileType
HeapSize
GetTimeZoneInformation
GetACP
IsValidCodePage
GetStdHandle
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapDestroy
HeapCreate
VirtualFree
SetHandleCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetDriveTypeA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
FindFirstFileA
FindClose
GetFileSize
LocalFree
IsDBCSLeadByte
GetNumberFormatA
MulDiv
CreateFileW
SizeofResource
LockResource
CompareStringW
CompareStringA
GetVersion
InterlockedExchange
OpenMutexA
CreateMutexA
ReleaseMutex
lstrcpyA
ReadFile
GetFileAttributesA
CreateProcessA
WritePrivateProfileStringA
LoadResource
CreateDirectoryA
FormatMessageA
GetVolumeInformationA
GetPrivateProfileIntA
GetPrivateProfileStringA
SetLastError
GetModuleHandleA
GetTickCount
InterlockedDecrement
CreateFileA
CloseHandle
GetLastError
GetVersionExA
DeviceIoControl
MultiByteToWideChar
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
Sleep
lstrlenA
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
SetCurrentDirectoryA
WideCharToMultiByte
FindResourceA
DeleteCriticalSection

user32

IsDlgButtonChecked
IsDialogMessageA
SetWindowTextA
MoveWindow
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
ClientToScreen
GetWindowDC
BeginPaint
EndPaint
EndDialog
CreateDialogIndirectParamA
GetDesktopWindow
GetWindowThreadProcessId
WaitMessage
ValidateRect
GetCursorPos
GetMessageA
DestroyMenu
PostQuitMessage
SetCursor
SetWindowContextHelpId
UnregisterClassA
CharNextA
CopyAcceleratorTableA
IsRectEmpty
SetRect
InvalidateRgn
SetCapture
ReleaseCapture
GetNextDlgGroupItem
RegisterClipboardFormatA
PostThreadMessageA
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
IsWindow
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
GetKeyState
IsWindowVisible
UpdateWindow
SetDlgItemTextA
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
IntersectRect
SystemParametersInfoA
GetWindowPlacement
SetPropA
GetCapture
GetActiveWindow
SetActiveWindow
MapDialogRect
SetWindowPos
ShowWindow
GetPropA
RemovePropA
GetAsyncKeyState
SetFocus
GetWindowLongA
GetDlgItem
IsWindowEnabled
GetSystemMetrics
IsIconic
DrawIcon
DrawFocusRect
CopyRect
InflateRect
CharUpperA
MessageBoxA
ReleaseDC
GetTopWindow
GetWindow
GetSystemMenu
RemoveMenu
AppendMenuA
GetSysColor
GetSysColorBrush
ScreenToClient
GetNextDlgTabItem
GetFocus
OffsetRect
SetClassLongA
wsprintfA
LoadCursorA
IsChild
PostMessageA
SetForegroundWindow
GetParent
GetClientRect
GetWindowRect
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuA
GetMenuState
EnableMenuItem
LoadBitmapA
InvalidateRect
KillTimer
SetTimer
DispatchMessageA
PeekMessageA
TranslateMessage
MessageBeep
LoadIconA
EnableWindow
SendMessageA
GetMenu
CheckMenuItem
GetDC

gdi32

CreateDCA
GetTextExtentPoint32A
GetClipBox
SetTextColor
SetBkColor
CreateBitmap
SaveDC
RestoreDC
SetBkMode
DeleteDC
StretchBlt
SetMapMode
LineTo
MoveToEx
DeleteObject
GetViewportExtEx
GetWindowExtEx
CreateCompatibleDC
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
GetStockObject
CreateRectRgnIndirect
GetMapMode
EnumFontFamiliesExA
GetBkColor
GetTextColor
GetRgnBox
CreateCompatibleBitmap
CreatePen
CreateFontA
StartDocA
StartPage
GetDeviceCaps
EndPage
EndDoc
GetObjectA
CreateFontIndirectA
CreateSolidBrush

comdlg32

GetFileTitleA

winspool.drv

StartDocPrinterA
StartPagePrinter
EnumPortsA
EndPagePrinter
EndDocPrinter
OpenPrinterA
EnumPrintersA
DocumentPropertiesA
WritePrinter
ClosePrinter
GetPrinterDriverA

advapi32

RegEnumKeyA
RegOpenKeyA
RegEnumKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteKeyA
RegQueryValueA

shell32

ShellExecuteA

shlwapi

PathStripToRootA
PathIsUNCA
PathFindExtensionA
PathFindFileNameA

oledlg

ord8

ole32

CoFreeUnusedLibraries
CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
CoTaskMemFree
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize
CoGetClassObject
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes

oleaut32

SysStringLen
SysAllocStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
VariantClear
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantChangeType
VariantInit
SysAllocStringByteLen
VariantCopy
SafeArrayDestroy
OleCreateFontIndirect
SysFreeString
SysAllocString

ws2_32

accept
WSASetLastError
WSAAsyncSelect
recvfrom
sendto
htonl
bind
inet_addr
setsockopt
select
recv
WSAStartup
htons
socket
connect
closesocket
WSACleanup
gethostname
gethostbyname
inet_ntoa
WSAGetLastError
send

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 312KB - Virtual size: 309KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ced04ba91d340a6b29c3bb531d1b5116

Headers

File Characteristics

Imports

gdiplus

turbine

strgene

rmtcmd

version

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

oledlg

ole32

oleaut32

ws2_32

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 312KB - Virtual size: 309KB

.data Size: 48KB - Virtual size: 215KB

.rsrc Size: 56KB - Virtual size: 54KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 312KB - Virtual size: 309KB

.data
Size: 48KB - Virtual size: 215KB

.rsrc
Size: 56KB - Virtual size: 54KB