0f9ed32727b43d39a21422434932bed27bd7c3182117f7526f202a9f30782481

Sharing

Copy URL Twitter E-mail

General

Target

0f9ed32727b43d39a21422434932bed27bd7c3182117f7526f202a9f30782481
Size

1.0MB
MD5

aeac549f3eb31a162fea997e64b617d7
SHA1

2045cc59b74997896e3e267f816660ac4ab3913a
SHA256

0f9ed32727b43d39a21422434932bed27bd7c3182117f7526f202a9f30782481
SHA512

ab2a1185838002f4ff1f294708f9539607936638ec02ede4bb706601ae82e58728b63bb51ce90af40f049ddcd2aa9d1391d7bb1ff702623c3f365931025ee627
SSDEEP

24576:4BoD1y0fHcTnUUc7/WUSKe8mq+0auXSU4XZ:4R0dbuh0a7U6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f9ed32727b43d39a21422434932bed27bd7c3182117f7526f202a9f30782481

Files

0f9ed32727b43d39a21422434932bed27bd7c3182117f7526f202a9f30782481
.exe windows x86

61441a2390e94d42a24c7aa4d03a28a8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesW
GetCurrentThreadId
InterlockedDecrement
GetLastError
TerminateProcess
CloseHandle
ReleaseMutex
SetLastError
GetModuleFileNameW
OpenProcess
CreateMutexW
SetCurrentDirectoryW
RemoveDirectoryW
SetErrorMode
DeleteFileA
lstrlenW
GetVersionExW
GetCommandLineW
CreateFileW
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
GetTempFileNameW
GetTempPathW
Process32NextW
CreateToolhelp32Snapshot
GetPrivateProfileIntW
SetUnhandledExceptionFilter
GetCurrentThread
GetLocalTime
GetTickCount
ReadFile
SetFilePointer
GetFileType
InitializeCriticalSection
WritePrivateProfileStringW
WriteFile
Process32FirstW
GetPrivateProfileStringW
GetFileSize
Sleep
MoveFileW
SystemTimeToFileTime
GetSystemTime
GetFileAttributesExW
CreateThread
DeviceIoControl
InterlockedIncrement
lstrcmpiW
SetEndOfFile
GetFileSizeEx
WaitForSingleObject
CreateDirectoryW
VirtualQuery
VirtualAlloc
GetSystemInfo
VirtualFree
ResumeThread
GetThreadContext
SuspendThread
OpenThread
SetThreadPriority
GetThreadPriority
VirtualProtectEx
LoadLibraryExW
InterlockedCompareExchange
HeapFree
GetCurrentProcess
FlushInstructionCache
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringA
GetFullPathNameA
FlushFileBuffers
GetCurrentDirectoryA
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameW
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
QueryPerformanceCounter
HeapCreate
GetStartupInfoA
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
FindFirstFileA
GetDriveTypeA
GetStdHandle
WriteConsoleW
ExitThread
GetDriveTypeW
FileTimeToLocalFileTime
FileTimeToSystemTime
IsDebuggerPresent
UnhandledExceptionFilter
ExitProcess
RtlUnwind
GetStartupInfoW
lstrcmpiA
lstrcmpA
SleepEx
GetVersionExA
ExpandEnvironmentStringsA
LeaveCriticalSection
EnterCriticalSection
RaiseException
InterlockedExchange
GetModuleHandleW
GetSystemDirectoryW
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
GetCurrentProcessId
LoadLibraryW
HeapAlloc
LoadLibraryA
IsProcessorFeaturePresent
HeapDestroy
HeapReAlloc
HeapSize
CreateFileA
FormatMessageA
GetSystemDirectoryA
GetModuleHandleA
SetEvent
GetSystemTimeAsFileTime
GetProcAddress
GetProcessHeap
LocalFileTimeToFileTime
SetFilePointerEx
TlsGetValue
OutputDebugStringW
TlsSetValue
HeapUnlock
HeapLock
TlsFree
TlsAlloc
HeapWalk
FreeLibrary

user32

GetActiveWindow
UnregisterClassA
MessageBoxW
FindWindowW
CreateWindowExW
PostMessageW
GetWindowThreadProcessId
IsHungAppWindow
RegisterClassExW
DestroyWindow
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadCursorW
GetClassInfoExW
SetWindowLongW
ShowWindow
SendMessageTimeoutW
SetForegroundWindow
LockSetForegroundWindow
DefWindowProcW
wsprintfW
DestroyIcon
CreatePopupMenu
OffsetRect
InvalidateRect
UpdateWindow
EnableWindow
CopyRect
PtInRect
GetAsyncKeyState
DialogBoxParamW
GetParent
GetWindow
GetWindowRect
MonitorFromWindow
GetClientRect
MapWindowPoints
SetWindowPos
ScreenToClient
CharNextW
EndDialog
CallWindowProcW
DestroyMenu
GetSystemMenu
DeleteMenu
GetCursorPos
IsWindowVisible
TrackPopupMenu
PostQuitMessage
WindowFromPoint
IsWindow
IsChild
KillTimer
SetTimer
SetWindowTextW
SendMessageW
GetWindowLongW
MonitorFromPoint
GetMonitorInfoW
AppendMenuW
LoadImageW

advapi32

RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
OpenProcessToken
GetTokenInformation
RegCreateKeyExW
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegQueryValueExA
RegEnumKeyExA

shell32

ShellExecuteW
ExtractIconExW
Shell_NotifyIconW
SHFileOperationW
SHGetSpecialFolderPathW
ShellExecuteExW

ole32

CoCreateInstance
CLSIDFromProgID
CoUninitialize
CoInitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree

oleaut32

SysStringByteLen
SysAllocStringByteLen
VariantCopy
VarUI4FromStr
DispCallFunc
VariantClear
VariantInit
SysAllocString
SysFreeString

shlwapi

SHSetValueA
SHGetValueA
PathAppendW
PathCombineW
SHGetValueW
PathRemoveFileSpecW
StrStrIW
PathFindFileNameW
wvnsprintfW
StrStrIA
PathFileExistsW

comctl32

InitCommonControlsEx

psapi

GetModuleFileNameExW
EnumProcessModules

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueA
VerQueryValueW

ws2_32

freeaddrinfo
select
__WSAFDIsSet
WSASetLastError
connect
getpeername
bind
htons
htonl
setsockopt
ioctlsocket
socket
gethostbyname
getsockopt
getsockname
send
recv
ntohs
WSAStartup
inet_addr
sendto
closesocket
recvfrom
WSACleanup
WSAGetLastError
getaddrinfo

Sections

.text
Size: 579KB - Virtual size: 579KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 171KB - Virtual size: 189KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 196KB - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

61441a2390e94d42a24c7aa4d03a28a8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

psapi

version

ws2_32

Sections

.text Size: 579KB - Virtual size: 579KB

.rdata Size: 82KB - Virtual size: 81KB

.data Size: 171KB - Virtual size: 189KB

.rsrc Size: 196KB - Virtual size: 195KB

.reloc Size: 33KB - Virtual size: 33KB

.text
Size: 579KB - Virtual size: 579KB

.rdata
Size: 82KB - Virtual size: 81KB

.data
Size: 171KB - Virtual size: 189KB

.rsrc
Size: 196KB - Virtual size: 195KB

.reloc
Size: 33KB - Virtual size: 33KB