259f2515d0367123a139c95ac4862e612dbc7303d80ad7bef65a58f03765d28b

Sharing

Copy URL

Twitter E-mail

General

Target

259f2515d0367123a139c95ac4862e612dbc7303d80ad7bef65a58f03765d28b
Size

1.1MB
MD5

076fe859b5640406a307528f42e2691e
SHA1

fbeda651258965f6e04ed4f053a79fce79f3d564
SHA256

259f2515d0367123a139c95ac4862e612dbc7303d80ad7bef65a58f03765d28b
SHA512

ccf94051a4ba0c74b52166ebae88b27258ec291ff2b23c917a118f5eabcf548dc2e5a64aaf1f5e9db503c052da8ca2a7b944c3f4d976e0883f9b20bc995028e1
SSDEEP

24576:71tS5HUiXqfVkgkC8onW9hH/j/cdHQNMCcMrP6W7E/P0:GbH/rcN1CVPj7AP0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
259f2515d0367123a139c95ac4862e612dbc7303d80ad7bef65a58f03765d28b

Files

259f2515d0367123a139c95ac4862e612dbc7303d80ad7bef65a58f03765d28b
.exe windows x86

3c0232b851febde0af8cd0989971ca76

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

socket
inet_ntoa
inet_addr
recv
ioctlsocket
setsockopt
WSAGetLastError
WSAStartup
htons
htonl
ntohs
send
WSASetLastError
listen
shutdown
select
gethostbyname
closesocket
bind
accept
WSACleanup
gethostname
ntohl

libmysql

mysql_stmt_bind_param
mysql_stmt_close
mysql_stmt_prepare
mysql_stmt_init
mysql_close
mysql_set_character_set
mysql_real_escape_string
mysql_fetch_lengths
mysql_options
mysql_stmt_free_result
mysql_real_connect
mysql_errno
mysql_stmt_errno
mysql_store_result
mysql_stmt_error
mysql_ping
mysql_real_query
mysql_num_rows
mysql_stmt_store_result
mysql_fetch_row
mysql_stmt_param_count
mysql_stmt_execute
mysql_escape_string
mysql_num_fields
mysql_init
mysql_error
mysql_free_result

pcre8

pcre_compile
pcre_exec
pcre_free
pcre_study

kernel32

HeapSize
GetFileSizeEx
GetConsoleOutputCP
FlushFileBuffers
PeekConsoleInputA
GetNumberOfConsoleInputEvents
ReadConsoleW
GetConsoleMode
SetFilePointerEx
HeapReAlloc
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapAlloc
HeapFree
SetEnvironmentVariableW
GetCommandLineW
GetCommandLineA
GetModuleFileNameW
ReadFile
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetStdHandle
WriteConsoleA
WriteFile
FillConsoleOutputAttribute
GetFileType
SetConsoleCursorPosition
GetTickCount64
FormatMessageA
GetUserDefaultUILanguage
GetACP
MultiByteToWideChar
SetConsoleCP
WideCharToMultiByte
SetConsoleOutputCP
SetConsoleCtrlHandler
GetModuleFileNameA
FindFirstFileA
SetLastError
FindNextFileA
FindClose
lstrcmpA
GetLastError
GetCurrentProcess
LocalAlloc
GetCurrentThread
CloseHandle
LocalFree
CreateMutexA
WaitForSingleObject
ReleaseMutex
GetFileAttributesA
IsDebuggerPresent
GetModuleHandleExW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
SetEndOfFile
WriteConsoleW
SetNamedPipeHandleState
WaitForMultipleObjects
TransactNamedPipe
FillConsoleOutputCharacterA
QueryPerformanceFrequency
ExitProcess
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RaiseException
InterlockedPushEntrySList
RtlUnwind
GetCurrentProcessId
GetStartupInfoW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
GetStringTypeW
GetCPInfo
CompareStringEx
GetSystemTime
RtlCaptureContext
EnterCriticalSection
ReleaseSemaphore
GetProcessId
LeaveCriticalSection
InitializeCriticalSection
CreateFileW
GetCurrentThreadId
LoadLibraryW
CreateThread
GetProcAddress
DeleteCriticalSection
FreeLibrary
CreateSemaphoreW
VirtualQueryEx
SetUnhandledExceptionFilter
QueryPerformanceCounter
WaitNamedPipeW
GetLocaleInfoEx
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
SetFileInformationByHandle
AreFileApisANSI
GetModuleHandleW
CopyFileW
GetFileInformationByHandleEx
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime

advapi32

SetSecurityDescriptorDacl
AccessCheck
SetSecurityDescriptorOwner
AllocateAndInitializeSid
IsValidSecurityDescriptor
OpenProcessToken
FreeSid
InitializeSecurityDescriptor
InitializeAcl
DuplicateToken
GetLengthSid
AddAccessAllowedAce
OpenThreadToken
SetSecurityDescriptorGroup

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

wininet

InternetOpenW
HttpQueryInfoW
InternetQueryDataAvailable
HttpSendRequestW
InternetCloseHandle
InternetConnectW
InternetReadFile
HttpAddRequestHeadersW
InternetCrackUrlW
HttpOpenRequestW

Exports

Exports

uchardet_data_end
uchardet_delete
uchardet_get_charset
uchardet_handle_data
uchardet_new
uchardet_reset

Sections

.text
Size: 789KB - Virtual size: 789KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 298KB - Virtual size: 298KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 414KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3c0232b851febde0af8cd0989971ca76

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

libmysql

pcre8

kernel32

advapi32

version

wininet

Exports

Exports

Sections

.text Size: 789KB - Virtual size: 789KB

.rdata Size: 298KB - Virtual size: 298KB

.data Size: 22KB - Virtual size: 414KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 40KB - Virtual size: 40KB

.text
Size: 789KB - Virtual size: 789KB

.rdata
Size: 298KB - Virtual size: 298KB

.data
Size: 22KB - Virtual size: 414KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 40KB - Virtual size: 40KB