f70604da1fe8f599c3973964084f9a0bf3e4bcd231daff685515e4a78099598b

Sharing

Copy URL Twitter E-mail

General

Target

f70604da1fe8f599c3973964084f9a0bf3e4bcd231daff685515e4a78099598b
Size

2.4MB
MD5

4f2544ba07b8414dab0c94434a87f64a
SHA1

ad5ce0b6b98bd932493fb16d5c9f4bbbc8131441
SHA256

f70604da1fe8f599c3973964084f9a0bf3e4bcd231daff685515e4a78099598b
SHA512

320b3f18a4409a6043c666df2d54523b62c7ed504ae4fcf484ad578959f8caf5c14d17bd6a772fa7b0fe04f704fd48061d8a18ec6df6f6697675de2aba0270a4
SSDEEP

49152:oRw6/KNsjxImlDO3lOtgCSc04+s7tPOFg5kvWgVwgRrYXM:oRw7rcgCZ0v84Fg5gVwg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f70604da1fe8f599c3973964084f9a0bf3e4bcd231daff685515e4a78099598b

Files

f70604da1fe8f599c3973964084f9a0bf3e4bcd231daff685515e4a78099598b
.exe windows x86

422ed27ff99c78be73bca371d5d53ccb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winhttp

WinHttpOpen
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl

ws2_32

WSAStartup
freeaddrinfo
htonl
WSACleanup
ntohs
WSASetLastError
getaddrinfo
inet_addr
htons
__WSAFDIsSet
accept
bind
closesocket
select
listen
send
socket
connect
recv
WSAGetLastError
getnameinfo
getservbyname

advapi32

CryptDecrypt
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CredWriteW
RegEnumKeyA
RegCloseKey
QueryServiceStatus
RegDeleteKeyA
CryptGetHashParam
ConvertStringSecurityDescriptorToSecurityDescriptorW
InitializeSecurityDescriptor
CryptHashData
CryptDeriveKey
SetSecurityDescriptorDacl
CloseServiceHandle
RegQueryValueExA
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDestroyKey
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
OpenServiceA
RegDeleteValueA
RegOpenKeyExA
CredDeleteA
OpenSCManagerA

wintrust

WinVerifyTrust

kernel32

GetConsoleCP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileAttributesExW
CreatePipe
SetStdHandle
FlushFileBuffers
SetFilePointerEx
InitializeCriticalSection
CreateMutexA
WaitForSingleObject
ReleaseMutex
GetCommandLineA
Sleep
GetLastError
CreateThread
GlobalFree
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringW
DeleteCriticalSection
GetModuleFileNameA
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
GetSystemTime
FindFirstFileW
SetLastError
GetCurrentProcess
GetTempPathW
FindClose
GetFileAttributesW
GetVersionExW
GetModuleHandleA
GetTempPathA
CloseHandle
GetProcAddress
GetStartupInfoA
CreateProcessA
GetCurrentDirectoryW
GetExitCodeProcess
GetExitCodeThread
TerminateThread
GetTickCount
OpenEventA
UnmapViewOfFile
OpenMutexA
SetEvent
OpenFileMappingA
MapViewOfFile
GetFileAttributesA
CreateProcessW
CopyFileW
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetStdHandle
GetEnvironmentVariableW
GetFileType
WriteFile
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
RaiseException
LoadLibraryA
LoadLibraryW
FindNextFileW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
SystemTimeToFileTime
ReadFile
CreateFileA
DeleteFileA
CreateDirectoryA
GetFileTime
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
DecodePointer
EncodePointer
SwitchToThread
GetStringTypeW
GetFullPathNameW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
LoadLibraryExW
DuplicateHandle
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
HeapSize
WriteConsoleW
SetEndOfFile
ExitProcess
SetConsoleCtrlHandler
CreateFileW
GetDriveTypeW
GetFileSizeEx
LocalFree
RtlUnwind
GetComputerNameExA
FreeLibrary
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
HeapAlloc
HeapReAlloc
HeapFree

user32

EnableWindow
DefWindowProcW
PostMessageW
GetWindowRect
FillRect
CreateWindowExW
SendMessageW
UnregisterClassW
CreatePopupMenu
RegisterClassExW
TrackPopupMenu
SetDlgItemTextW
LoadIconW
LoadCursorW
SetDlgItemTextA
AppendMenuW
GetCursorPos
GetMessageW
DispatchMessageW
IsDialogMessageW
TranslateMessage
CreateDialogParamW
DestroyWindow
SetWindowPos
MessageBoxW
ShowWindow
GetDlgItemTextA
SetWindowTextA
FlashWindowEx
GetClientRect
GetDlgItem
PostQuitMessage
GetDesktopWindow
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW
GetSystemMetrics

gdi32

CreateSolidBrush
SetBkColor
GetStockObject

shell32

ShellExecuteW
ShellExecuteA
FindExecutableA
ShellExecuteExA
SHCreateDirectoryExW
SHGetSpecialFolderPathW
Shell_NotifyIconW
SHGetSpecialFolderPathA

ole32

CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance

oleaut32

VariantInit
SysFreeString
SysAllocString
VariantClear
VariantChangeType
VariantCopy

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

bcrypt

BCryptGenRandom

rpcrt4

UuidCreate
RpcStringFreeA
UuidToStringA

crypt32

CertOpenStore
CertCloseStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 495KB - Virtual size: 495KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

422ed27ff99c78be73bca371d5d53ccb

Headers

DLL Characteristics

File Characteristics

Imports

winhttp

ws2_32

advapi32

wintrust

kernel32

user32

gdi32

shell32

ole32

oleaut32

version

bcrypt

rpcrt4

crypt32

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 495KB - Virtual size: 495KB

.data Size: 21KB - Virtual size: 36KB

.rsrc Size: 144KB - Virtual size: 143KB

.reloc Size: 69KB - Virtual size: 69KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 495KB - Virtual size: 495KB

.data
Size: 21KB - Virtual size: 36KB

.rsrc
Size: 144KB - Virtual size: 143KB

.reloc
Size: 69KB - Virtual size: 69KB