55ceb986fcd5e20a3becaa5c9d910b03e40f7b4acd38c15a85e8752db9aec4ad

Sharing

Copy URL Twitter E-mail

General

Target

55ceb986fcd5e20a3becaa5c9d910b03e40f7b4acd38c15a85e8752db9aec4ad
Size

481KB
MD5

225c0fd0d46c2e6b04a0ec5206c7201c
SHA1

0816ae90cbf8e8875a8eade401a23b124c2e4c4e
SHA256

55ceb986fcd5e20a3becaa5c9d910b03e40f7b4acd38c15a85e8752db9aec4ad
SHA512

22855f281c76d557568e8b72f4b421e2e9ac074e99440bde488ca28b8f902f88f83c34c8640319b198f49dc46beb044bf488164064eeaa364adc80fc7005aaa2
SSDEEP

12288:9In3k0IHHHHHHDmZyUBHZH0HVHHHHqa9EV:9In3k9HHHHHHDmZyUBHZH0HVHHHH79EV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
55ceb986fcd5e20a3becaa5c9d910b03e40f7b4acd38c15a85e8752db9aec4ad

Files

55ceb986fcd5e20a3becaa5c9d910b03e40f7b4acd38c15a85e8752db9aec4ad
.exe windows x86

41a4f9a47bcf13a5b97c46fa0cb8b043

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CryptAcquireContextW
CryptCreateHash
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
CryptExportKey
CryptGetHashParam
CryptHashData
CryptImportKey
CryptReleaseContext
CryptSetHashParam
RegCloseKey
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW

comctl32

InitCommonControlsEx

comdlg32

GetOpenFileNameW
GetSaveFileNameW

crypt32

CertCreateCertificateContext
CertFreeCertificateContext
CertVerifySubjectCertificateContext
CryptImportPublicKeyInfoEx
CryptMemAlloc
CryptMemFree

kernel32

CloseHandle
CreateFileW
DeleteCriticalSection
EnterCriticalSection
FormatMessageW
FreeLibrary
GetComputerNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetFileSize
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetSystemTimeAsFileTime
GetTickCount
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
QueryPerformanceCounter
ReadFile
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WriteFile
lstrlenW

msvcrt

__dllonexit
__lconv_init
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_fmode
_fpreset
_initterm
_iob
_lock
_onexit
_snprintf
_snwprintf
_unlock
_wcmdln
_winmajor
_wtoi
abort
atoi
calloc
exit
fprintf
free
fwrite
gmtime
localtime
malloc
memcmp
memcpy
memmove
memset
mktime
printf
putchar
rand
realloc
signal
sprintf
strcat
strcpy
strncmp
strncpy
strtok
swprintf
time
vfprintf
vsprintf
wcscat
wcscmp
wcscpy
wcslen
wcsncmp
wcstok

ole32

CoTaskMemFree

secur32

AcquireCredentialsHandleW
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
InitializeSecurityContextA
QueryContextAttributesW
QueryCredentialsAttributesA

shell32

SHGetFolderLocation
SHGetPathFromIDListW

ws2_32

WSAAsyncSelect
WSACleanup
WSAGetLastError
WSAStartup
closesocket
connect
gethostbyname
getpeername
getsockname
getsockopt
htons
inet_addr
recv
select
send
setsockopt
socket

gdi32

BitBlt
CreateCompatibleDC
CreateDIBSection
CreateFontIndirectW
CreateICW
CreatePen
CreateRectRgn
CreateSolidBrush
DPtoLP
DeleteDC
DeleteObject
GetDeviceCaps
GetObjectW
IntersectClipRect
LineTo
MoveToEx
SelectClipRgn
SelectObject
SetBkMode
SetTextColor
StretchBlt

user32

AdjustWindowRectEx
BeginPaint
BringWindowToTop
CreateCursor
CreateDialogParamW
CreateWindowExW
DefWindowProcW
DestroyCursor
DestroyIcon
DialogBoxParamW
DispatchMessageW
DrawTextW
EndDialog
EndPaint
EnumDisplayDevicesW
EnumDisplaySettingsExW
FillRect
GetClientRect
GetDlgItem
GetDlgItemTextW
GetKeyState
GetMessageW
GetSystemMetrics
GetWindowDC
GetWindowLongW
IntersectRect
InvalidateRgn
IsRectEmpty
LoadCursorW
LoadIconW
LoadImageW
LoadStringW
MessageBoxW
PostQuitMessage
RegisterClassW
ReleaseDC
ScreenToClient
ScrollWindowEx
SendDlgItemMessageW
SendMessageW
SetCursor
SetDlgItemTextW
SetScrollPos
SetScrollRange
SetTimer
SetWindowLongW
SetWindowPos
ShowWindow
TranslateMessage
UpdateWindow

Sections

.text
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 210KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rossym
Size: 150KB - Virtual size: 150KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

41a4f9a47bcf13a5b97c46fa0cb8b043

Headers

File Characteristics

Imports

advapi32

comctl32

comdlg32

crypt32

kernel32

msvcrt

ole32

secur32

shell32

ws2_32

gdi32

user32

Sections

.text Size: 101KB - Virtual size: 101KB

.data Size: 1KB - Virtual size: 1KB

.rdata Size: 8KB - Virtual size: 8KB

/4 Size: 512B - Virtual size: 20B

.bss Size: - Virtual size: 1.0MB

.idata Size: 6KB - Virtual size: 6KB

.CRT Size: 512B - Virtual size: 52B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 210KB - Virtual size: 209KB

.rossym Size: 150KB - Virtual size: 150KB

.text
Size: 101KB - Virtual size: 101KB

.data
Size: 1KB - Virtual size: 1KB

.rdata
Size: 8KB - Virtual size: 8KB

/4
Size: 512B - Virtual size: 20B

.bss
Size: - Virtual size: 1.0MB

.idata
Size: 6KB - Virtual size: 6KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 210KB - Virtual size: 209KB

.rossym
Size: 150KB - Virtual size: 150KB