3EB8712B0DB6BA466F8AFE1BF606983FE8341C941BDFCADC07068288C7CA5A9C

Sharing

Copy URL Twitter E-mail

General

Target

3EB8712B0DB6BA466F8AFE1BF606983FE8341C941BDFCADC07068288C7CA5A9C
Size

4.6MB
MD5

3885adc6619a8257c8b42dfa7349ce11
SHA1

42e62e7ccb19368e4cb83c640e0040265d55cb7f
SHA256

3eb8712b0db6ba466f8afe1bf606983fe8341c941bdfcadc07068288c7ca5a9c
SHA512

35ec30ca96f2b36ba283af2c3a62e71d9187ddfca8520adefe6961c254207664f197957524a490c2bdba715f47b03d8f3818538163547bfb8f77f9e3d59ae2ef
SSDEEP

98304:I4pHlQiOZpTi+dME8GBh7nEZA6BqeTYMJHRLNm5Vu1GIGH5kU91qewJwWC0rNzPf:I4pHOjZpXdp7OLBqeTXJ654GH7qewuW3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3EB8712B0DB6BA466F8AFE1BF606983FE8341C941BDFCADC07068288C7CA5A9C

Files

3EB8712B0DB6BA466F8AFE1BF606983FE8341C941BDFCADC07068288C7CA5A9C
.exe windows x86

df8f4167aa6bda1669539f02cf9472f2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

AdjustTokenPrivileges
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetTokenInformation
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA

bcrypt

BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptDecrypt
BCryptDestroyHash
BCryptDestroyKey
BCryptEncrypt
BCryptFinishHash
BCryptGenRandom
BCryptGetProperty
BCryptHashData
BCryptImportKey
BCryptImportKeyPair
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptSignHash
BCryptVerifySignature

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CryptDecodeObjectEx
PFXImportCertStore
PFXIsPFXBlob

iphlpapi

GetAdaptersAddresses

kernel32

AreFileApisANSI
CloseHandle
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateMutexW
CreateProcessW
CreateSemaphoreW
DeleteCriticalSection
DeleteFileA
DeleteFileW
DeviceIoControl
EnterCriticalSection
ExpandEnvironmentStringsA
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FormatMessageW
FreeLibrary
GetCommandLineW
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFileSizeEx
GetFullPathNameA
GetFullPathNameW
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetTickCount
GetTimeZoneInformation
GetVersionExA
GetVersionExW
GetWindowsDirectoryA
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitializeCriticalSection
InterlockedCompareExchange
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MoveFileExW
MultiByteToWideChar
OpenProcess
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
ReadFile
ReleaseSemaphore
SetConsoleCtrlHandler
SetConsoleTextAttribute
SetEndOfFile
SetFilePointer
SetFilePointerEx
SetFileTime
SetFileValidData
SetLastError
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnlockFile
UnlockFileEx
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
WriteFile

msvcrt

__argv
__dllonexit
__doserrno
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__pioinfo
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthreadex
_cexit
_commit
_endthreadex
_errno
_exit
_filelengthi64
_fileno
_fmode
_fstat64
_initterm
_iob
_lock
_lseeki64
_onexit
_setmode
_snwprintf
time
localtime
gmtime
_stricmp
_strnicmp
_unlock
calloc
exit
fclose
feof
ferror
fflush
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
fsetpos
fwprintf
fwrite
getc
getenv
getwc
islower
isspace
isupper
iswctype
isxdigit
ldiv
localeconv
log10
malloc
memchr
memcmp
memcpy
memmove
memset
perror
putc
putwc
qsort
raise
rand
realloc
rewind
setlocale
setvbuf
signal
sprintf
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncat
strncmp
strncpy
strpbrk
strtol
strtoul
strxfrm
_vsnprintf
_wfsopen
_wgetcwd
_wgetenv
_wmkdir
_wopen
_write
_wrmdir
_wsopen
_wunlink
abort
asctime
time
tolower
towlower
towupper
ungetc
ungetwc
vfprintf
wcscoll
wcscpy
wcsftime
wcslen
wcstombs
wcsxfrm
atoi
_wstati64
_tzname
_write
_tzset
_strnicmp
_strdup
_read
_open
_lseek
_isatty
_fileno
_fdopen
_dup
_close

secur32

AcceptSecurityContext
AcquireCredentialsHandleW
ApplyControlToken
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
InitializeSecurityContextA
QueryContextAttributesA

shell32

CommandLineToArgvW

user32

MessageBoxW

ws2_32

WSASend
freeaddrinfo
getaddrinfo
gethostname
getnameinfo
inet_addr

wsock32

WSACleanup
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
getpeername
getsockname
getsockopt
htonl
htons
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

Sections

.text
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 412KB - Virtual size: 412KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

df8f4167aa6bda1669539f02cf9472f2

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

bcrypt

crypt32

iphlpapi

kernel32

msvcrt

secur32

shell32

user32

ws2_32

wsock32

Sections

.text Size: 4.2MB - Virtual size: 4.2MB

.data Size: 12KB - Virtual size: 12KB

.rdata Size: 412KB - Virtual size: 412KB

.bss Size: - Virtual size: 12KB

.idata Size: 9KB - Virtual size: 8KB

.CRT Size: 512B - Virtual size: 52B

.tls Size: 512B - Virtual size: 32B

.text
Size: 4.2MB - Virtual size: 4.2MB

.data
Size: 12KB - Virtual size: 12KB

.rdata
Size: 412KB - Virtual size: 412KB

.bss
Size: - Virtual size: 12KB

.idata
Size: 9KB - Virtual size: 8KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 32B