281402 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

281402
Size

1.8MB
MD5

ab82a9baeb05c75312bea44a5e088953
SHA1

e4c132d60ae151dc504177e06a127d9362417c46
SHA256

1b33d7a3e75b64e84ecf2d3f7a79a5e4f8b32e2da140617dae962864dce27e28
SHA512

d20d8021327f2a40baa3aa0e590e370b368108240001162c5257187ed0955fc10534012adf426d73f331fe272ff06b69be03fa3d795227661c27e2e998bc1b56
SSDEEP

49152:pSDn5k0TxJY5MMSLvOsnw9uad4YMHNHOsBVt:OnS0TYyMSLvOB9ld1AOs/t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
281402

Files

281402
.exe windows x86

59438a80f8d4c50142cc925c4a9e031b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LockResource
LoadResource
SizeofResource
FindResourceA
lstrlenA
GetExitCodeThread
ReadFile
GetFileSize
CreateFileA
GetCurrentDirectoryA
SetThreadPriority
GetCurrentThread
SetEvent
Sleep
CreateEventA
GetVersionExA
GetCurrentProcess
SetStdHandle
SetFilePointer
CreateProcessA
DuplicateHandle
CreatePipe
GetStdHandle
WriteFile
InitializeCriticalSection
DeleteCriticalSection
GetExitCodeProcess
OpenProcess
EnterCriticalSection
WaitForMultipleObjects
LeaveCriticalSection
PulseEvent
GetCommandLineA
GetVersion
ExitProcess
RtlUnwind
HeapFree
HeapReAlloc
HeapAlloc
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
WideCharToMultiByte
TerminateProcess
SetConsoleCtrlHandler
GetTimeZoneInformation
GetSystemTime
GetLocalTime
CreateThread
GetCurrentThreadId
GetModuleFileNameA
TlsGetValue
ExitThread
FindFirstFileA
FindNextFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
ResumeThread
GetFileType
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoA
TlsAlloc
SetLastError
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
HeapSize
GetCPInfo
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetACP
GetOEMCP
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
CompareStringA
CompareStringW
SetEnvironmentVariableA
FlushFileBuffers
GetStringTypeA
GetStringTypeW
GetLocaleInfoW
GetCurrentProcessId
GetFileAttributesA
SetCurrentDirectoryA
GetFullPathNameA
CreateFileMappingA
MapViewOfFile
GetModuleHandleA
CreateMutexA
WaitForSingleObject
ReleaseMutex
UnmapViewOfFile
CloseHandle
GetLastError
FormatMessageA
LocalFree
GetProcAddress
SetErrorMode
LoadLibraryA
TlsSetValue
FreeLibrary
SetEnvironmentVariableW

user32

KillTimer
SetTimer
GetClassInfoA
LoadCursorA
RegisterClassA
GetSystemMetrics
CreateWindowExA
ShowWindow
UpdateWindow
GetClientRect
BeginPaint
EndPaint
PostQuitMessage
PostMessageA
DefWindowProcA
GetMessageA
TranslateMessage
DispatchMessageA
LoadBitmapA
MessageBoxA

gdi32

GetObjectA
CreateCompatibleDC
SelectObject
BitBlt
DeleteObject
DeleteDC

advapi32

RegOpenKeyExA
RegQueryValueExA
OpenProcessToken
GetTokenInformation
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA

comctl32

InitCommonControlsEx

Exports

Exports

_Java_com_regexlab_j2e_Instances_flush@8
_Java_com_regexlab_j2e_Instances_getCurrentInstance@8
_Java_com_regexlab_j2e_Instances_getFirstInstance@8
_Java_com_regexlab_j2e_Instances_getInstances@8
_Java_com_regexlab_j2e_Instances_sendObject@16
_Java_com_regexlab_j2e_Instances_setReceiver@12
_Java_com_regexlab_j2e_RedirOutputStream_write@12
_Java_com_regexlab_j2e_SplashScreen_nativeAutoClose@12
_Java_com_regexlab_j2e_SplashScreen_nativeClose@8
_Java_com_regexlab_j2e_SplashScreen_nativeGetSplashScreen@8

Sections

.text
Size: 128KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHMMESS
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

59438a80f8d4c50142cc925c4a9e031b

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

comctl32

Exports

Exports

Sections

.text Size: 128KB - Virtual size: 125KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 16KB - Virtual size: 22KB

.SHMMESS Size: 4KB - Virtual size: 3KB

.rsrc Size: 12KB - Virtual size: 9KB

.text
Size: 128KB - Virtual size: 125KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 16KB - Virtual size: 22KB

.SHMMESS
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 12KB - Virtual size: 9KB