Privateloaderbghbjfhbab3_browsingExe[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Privateloaderbghbjfhbab3_browsingExe.exe
Size

7.4MB
MD5

7e8a52950e2e85bedafb780ddd148398
SHA1

44867791704a448c9b9efd4f3658c35556f96c06
SHA256

d9445561cef089271565e3fe54b8da7aff3ecfe73506762ffcdaedc3615180ba
SHA512

2bc4343fde9f9f86d9dd47bec81ac6a72f8a4dd9731a01ab63636ec9a61d69c06897453c9801edd483f240fba80484e884803c17b7509486eacac63c91cf45e6
SSDEEP

196608:D+oSQIopSsqF10P1CPwDvt3uFTDC7LIKcosI3jhMSNB:VtpSfF1s1CPwDvt3uF/CfIKcoss

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Privateloaderbghbjfhbab3_browsingExe.exe

Files

Privateloaderbghbjfhbab3_browsingExe.exe
.exe windows x86

ee65cec89dda7827e9e6a8751b60247e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLocaleInfoA
FreeResource
CreateToolhelp32Snapshot
MultiByteToWideChar
Sleep
GetTempPathA
GetModuleHandleExA
GetTimeZoneInformation
GetTickCount64
CopyFileA
GetLastError
GetFileAttributesA
TzSpecificLocalTimeToSystemTime
CreateFileA
LoadLibraryA
GetVersionExA
LockResource
DeleteFileA
Process32Next
CloseHandle
GetSystemInfo
CreateThread
GetWindowsDirectoryA
LoadResource
SetFileAttributesA
GetLocalTime
GetProcAddress
LocalFree
RemoveDirectoryA
GetCurrentProcessId
GlobalMemoryStatusEx
FreeLibrary
WideCharToMultiByte
CreateDirectoryA
GetSystemTime
GetPrivateProfileStringA
IsWow64Process
GetComputerNameA
lstrcatA
lstrcpyA
lstrcpynA
ReadFile
SetFilePointer
CreateFileW
AreFileApisANSI
TryEnterCriticalSection
GetModuleHandleA
HeapFree
lstrlenA
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
GetFileAttributesW
UnmapViewOfFile
HeapValidate
HeapSize
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
WaitForSingleObjectEx
DeleteFileW
HeapReAlloc
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
LockFileEx
GetFileSize
DeleteCriticalSection
GetProcessHeap
SystemTimeToFileTime
GetSystemTimeAsFileTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
VirtualQuery
VirtualProtect
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
LoadLibraryExA
GetOEMCP
GetACP
GetCurrentThreadId
LocalAlloc
WaitForSingleObject
GetVolumeInformationA
HeapCreate
FindClose
FindResourceA
FindNextFileA
GetUserDefaultLocaleName
TerminateProcess
WriteFile
GetCurrentProcess
FindFirstFileA
Process32First
GetPrivateProfileSectionNamesA
IsValidCodePage
SetStdHandle
SizeofResource
EnterCriticalSection
GetModuleFileNameA
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetFileSizeEx
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
GetStdHandle
GetModuleFileNameW
FreeLibraryAndExitThread
FindFirstFileExW
FindNextFileW
GetFinalPathNameByHandleW
SetFilePointerEx
GetFileInformationByHandleEx
LCMapStringEx
InitializeCriticalSectionEx
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
GetModuleHandleW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
RtlUnwind
RaiseException
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetFileType
ExitProcess
GetModuleHandleExW
ExitThread

user32

GetDesktopWindow
wsprintfA
GetSystemMetrics
GetDC
EnumDisplayDevicesA
ReleaseDC
GetWindowRect
GetKeyboardLayoutList

gdi32

CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
DeleteObject
BitBlt

advapi32

RegQueryValueExA
RegOpenKeyExA
GetUserNameA
RegCloseKey
GetCurrentHwProfileA
RegEnumKeyExA
CredEnumerateA
CredFree

shell32

ShellExecuteA
SHGetFolderPathA

crypt32

CryptUnprotectData
CryptStringToBinaryA

gdiplus

GdipGetImageEncodersSize
GdipFree
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipAlloc
GdipCloneImage
GdipGetImageEncoders
GdiplusShutdown
GdiplusStartup
GdipSaveImageToFile

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiEnumDeviceInfo

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ee65cec89dda7827e9e6a8751b60247e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

crypt32

gdiplus

setupapi

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 132KB - Virtual size: 131KB

.data Size: 36KB - Virtual size: 40KB

.rsrc Size: 5.8MB - Virtual size: 5.8MB

.reloc Size: 29KB - Virtual size: 28KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 132KB - Virtual size: 131KB

.data
Size: 36KB - Virtual size: 40KB

.rsrc
Size: 5.8MB - Virtual size: 5.8MB

.reloc
Size: 29KB - Virtual size: 28KB