ae3e97daabdcb34b552a05c394f11e02d86b9f8cee1f0799a3642950661b900c

Sharing

Copy URL Twitter E-mail

General

Target

ae3e97daabdcb34b552a05c394f11e02d86b9f8cee1f0799a3642950661b900c
Size

5.0MB
MD5

d298c21b2c05c6e937bad83c59eaef65
SHA1

276a042b22639acb580516e2182a31d2939c2b4a
SHA256

ae3e97daabdcb34b552a05c394f11e02d86b9f8cee1f0799a3642950661b900c
SHA512

9f004155e0e248532aadf489d4c7d5cb7da64c83af5ed1e9157edee68abf94cd42c1f02fb73505b2ee1f406669deb40abdf7cb68319bb6f0a9920f7cf14c270c
SSDEEP

98304:kQOz3/+yrx//BNduLVlKEl0U8xGKV7SXCbGWS8zJ5smKHN3g:kQOzv+WpuLVl5tlSSAG5Pt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ae3e97daabdcb34b552a05c394f11e02d86b9f8cee1f0799a3642950661b900c

Files

ae3e97daabdcb34b552a05c394f11e02d86b9f8cee1f0799a3642950661b900c
.exe windows x86

96b939c45c5f205d61a3110d34975dad

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

socket
connect
inet_ntoa
inet_addr
recv
ioctlsocket
setsockopt
WSAGetLastError
WSAStartup
htonl
ntohs
ntohl
send
WSASetLastError
listen
shutdown
select
gethostbyname
closesocket
bind
accept
__WSAFDIsSet
WSACleanup
gethostname
htons

zlib

compress
uncompress

pcre8

pcre_free
pcre_copy_substring
pcre_compile
pcre_study
pcre_exec

libmysql

mysql_set_character_set
mysql_real_escape_string
mysql_affected_rows
mysql_stmt_init
mysql_options
mysql_stmt_free_result
mysql_real_connect
mysql_errno
mysql_stmt_errno
mysql_store_result
mysql_stmt_result_metadata
mysql_stmt_fetch
mysql_stmt_error
mysql_fetch_field_direct
mysql_stmt_bind_result
mysql_ping
mysql_real_query
mysql_num_rows
mysql_stmt_store_result
mysql_stmt_fetch_column
mysql_error
mysql_fetch_lengths
mysql_close
mysql_init
mysql_num_fields
mysql_escape_string
mysql_stmt_execute
mysql_stmt_param_count
mysql_stmt_prepare
mysql_stmt_close
mysql_stmt_field_count
mysql_free_result
mysql_stmt_bind_param
mysql_fetch_row

kernel32

IsValidCodePage
PeekConsoleInputA
GetNumberOfConsoleInputEvents
HeapReAlloc
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
GetTimeZoneInformation
HeapFree
HeapAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetEnvironmentVariableW
GetCommandLineW
GetCommandLineA
GetModuleFileNameW
ReadFile
FreeLibraryAndExitThread
ExitThread
GetModuleHandleExW
GetOEMCP
LoadLibraryExW
FillConsoleOutputCharacterA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetStdHandle
WriteConsoleA
WriteFile
FillConsoleOutputAttribute
GetFileType
SetConsoleCursorPosition
SetConsoleCtrlHandler
GetTickCount64
GetUserDefaultUILanguage
GetACP
MultiByteToWideChar
SetConsoleCP
WideCharToMultiByte
SetConsoleOutputCP
FindFirstFileA
SetLastError
FindNextFileA
FindClose
GetLastError
GetFileAttributesA
FormatMessageA
GetModuleFileNameA
lstrcmpA
GetCurrentProcess
LocalAlloc
GetCurrentThread
CloseHandle
LocalFree
CreateMutexA
WaitForSingleObject
ReleaseMutex
IsDebuggerPresent
TlsFree
HeapSize
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
WriteConsoleW
SetEndOfFile
SetNamedPipeHandleState
WaitForMultipleObjects
TransactNamedPipe
ExitProcess
QueryPerformanceFrequency
TlsSetValue
TlsGetValue
TlsAlloc
RaiseException
InterlockedPushEntrySList
RtlUnwind
GetCurrentProcessId
GetStartupInfoW
InitializeSListHead
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
GetStringTypeW
GetCPInfo
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
GetSystemTime
RtlCaptureContext
EnterCriticalSection
ReleaseSemaphore
GetProcessId
LeaveCriticalSection
InitializeCriticalSection
CreateFileW
GetCurrentThreadId
LoadLibraryW
CreateThread
GetProcAddress
DeleteCriticalSection
FreeLibrary
CreateSemaphoreW
VirtualQueryEx
SetUnhandledExceptionFilter
QueryPerformanceCounter
WaitNamedPipeW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WaitForSingleObjectEx
Sleep
GetExitCodeThread
GetLocaleInfoEx
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
SetFileInformationByHandle
AreFileApisANSI
GetModuleHandleW
CopyFileW
GetFileInformationByHandleEx
InitializeCriticalSectionEx
GetSystemTimeAsFileTime

advapi32

SetSecurityDescriptorDacl
AccessCheck
SetSecurityDescriptorOwner
AllocateAndInitializeSid
IsValidSecurityDescriptor
OpenProcessToken
FreeSid
InitializeSecurityDescriptor
InitializeAcl
DuplicateToken
GetLengthSid
AddAccessAllowedAce
OpenThreadToken
SetSecurityDescriptorGroup

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

wininet

InternetOpenW
HttpQueryInfoW
InternetQueryDataAvailable
HttpSendRequestW
InternetCloseHandle
InternetConnectW
InternetReadFile
HttpAddRequestHeadersW
InternetCrackUrlW
HttpOpenRequestW

Exports

Exports

uchardet_data_end
uchardet_delete
uchardet_get_charset
uchardet_handle_data
uchardet_new
uchardet_reset

Sections

.text
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 829KB - Virtual size: 828KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 13.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 188KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

96b939c45c5f205d61a3110d34975dad

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

zlib

pcre8

libmysql

kernel32

advapi32

version

wininet

Exports

Exports

Sections

.text Size: 4.0MB - Virtual size: 4.0MB

.rdata Size: 829KB - Virtual size: 828KB

.data Size: 47KB - Virtual size: 13.9MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 188KB - Virtual size: 188KB

.text
Size: 4.0MB - Virtual size: 4.0MB

.rdata
Size: 829KB - Virtual size: 828KB

.data
Size: 47KB - Virtual size: 13.9MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 188KB - Virtual size: 188KB