fedfc580df5daa31b447d0da82dd7758aca00af52801daa27b59178a4963051c

Sharing

Copy URL Twitter E-mail

General

Target

fedfc580df5daa31b447d0da82dd7758aca00af52801daa27b59178a4963051c
Size

1.0MB
MD5

85f7c780a55970f9e7840b457f2d25ce
SHA1

73d3202bd618ce126a8ef2dba765e5c9cfa314d6
SHA256

fedfc580df5daa31b447d0da82dd7758aca00af52801daa27b59178a4963051c
SHA512

02ee482efe540bf31db702293f2be3e210add3396ad2dc294759cec985b414b43ce01d4f5a249029627d4c6e1fb6d58478d5b4ca8628c60b8fe08aab9ae848b9
SSDEEP

24576:2BoD1y0fHcTnUUc7/WUSKe8mq+0auXSL4XZ:2R0dbuh0a7L6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fedfc580df5daa31b447d0da82dd7758aca00af52801daa27b59178a4963051c

Files

fedfc580df5daa31b447d0da82dd7758aca00af52801daa27b59178a4963051c
.exe windows x86

61441a2390e94d42a24c7aa4d03a28a8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesW
GetCurrentThreadId
InterlockedDecrement
GetLastError
TerminateProcess
CloseHandle
ReleaseMutex
SetLastError
GetModuleFileNameW
OpenProcess
CreateMutexW
SetCurrentDirectoryW
RemoveDirectoryW
SetErrorMode
DeleteFileA
lstrlenW
GetVersionExW
GetCommandLineW
CreateFileW
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
GetTempFileNameW
GetTempPathW
Process32NextW
CreateToolhelp32Snapshot
GetPrivateProfileIntW
SetUnhandledExceptionFilter
GetCurrentThread
GetLocalTime
GetTickCount
ReadFile
SetFilePointer
GetFileType
InitializeCriticalSection
WritePrivateProfileStringW
WriteFile
Process32FirstW
GetPrivateProfileStringW
GetFileSize
Sleep
MoveFileW
SystemTimeToFileTime
GetSystemTime
GetFileAttributesExW
CreateThread
DeviceIoControl
InterlockedIncrement
lstrcmpiW
SetEndOfFile
GetFileSizeEx
WaitForSingleObject
CreateDirectoryW
VirtualQuery
VirtualAlloc
GetSystemInfo
VirtualFree
ResumeThread
GetThreadContext
SuspendThread
OpenThread
SetThreadPriority
GetThreadPriority
VirtualProtectEx
LoadLibraryExW
InterlockedCompareExchange
HeapFree
GetCurrentProcess
FlushInstructionCache
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringA
GetFullPathNameA
FlushFileBuffers
GetCurrentDirectoryA
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameW
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
QueryPerformanceCounter
HeapCreate
GetStartupInfoA
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
FindFirstFileA
GetDriveTypeA
GetStdHandle
WriteConsoleW
ExitThread
GetDriveTypeW
FileTimeToLocalFileTime
FileTimeToSystemTime
IsDebuggerPresent
UnhandledExceptionFilter
ExitProcess
RtlUnwind
GetStartupInfoW
lstrcmpiA
lstrcmpA
SleepEx
GetVersionExA
ExpandEnvironmentStringsA
LeaveCriticalSection
EnterCriticalSection
RaiseException
InterlockedExchange
GetModuleHandleW
GetSystemDirectoryW
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
GetCurrentProcessId
LoadLibraryW
HeapAlloc
LoadLibraryA
IsProcessorFeaturePresent
HeapDestroy
HeapReAlloc
HeapSize
CreateFileA
FormatMessageA
GetSystemDirectoryA
GetModuleHandleA
SetEvent
GetSystemTimeAsFileTime
GetProcAddress
GetProcessHeap
LocalFileTimeToFileTime
SetFilePointerEx
TlsGetValue
OutputDebugStringW
TlsSetValue
HeapUnlock
HeapLock
TlsFree
TlsAlloc
HeapWalk
FreeLibrary

user32

GetActiveWindow
UnregisterClassA
MessageBoxW
FindWindowW
CreateWindowExW
PostMessageW
GetWindowThreadProcessId
IsHungAppWindow
RegisterClassExW
DestroyWindow
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadCursorW
GetClassInfoExW
SetWindowLongW
ShowWindow
SendMessageTimeoutW
SetForegroundWindow
LockSetForegroundWindow
DefWindowProcW
wsprintfW
DestroyIcon
CreatePopupMenu
OffsetRect
InvalidateRect
UpdateWindow
EnableWindow
CopyRect
PtInRect
GetAsyncKeyState
DialogBoxParamW
GetParent
GetWindow
GetWindowRect
MonitorFromWindow
GetClientRect
MapWindowPoints
SetWindowPos
ScreenToClient
CharNextW
EndDialog
CallWindowProcW
DestroyMenu
GetSystemMenu
DeleteMenu
GetCursorPos
IsWindowVisible
TrackPopupMenu
PostQuitMessage
WindowFromPoint
IsWindow
IsChild
KillTimer
SetTimer
SetWindowTextW
SendMessageW
GetWindowLongW
MonitorFromPoint
GetMonitorInfoW
AppendMenuW
LoadImageW

advapi32

RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
OpenProcessToken
GetTokenInformation
RegCreateKeyExW
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegQueryValueExA
RegEnumKeyExA

shell32

ShellExecuteW
ExtractIconExW
Shell_NotifyIconW
SHFileOperationW
SHGetSpecialFolderPathW
ShellExecuteExW

ole32

CoCreateInstance
CLSIDFromProgID
CoUninitialize
CoInitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree

oleaut32

SysStringByteLen
SysAllocStringByteLen
VariantCopy
VarUI4FromStr
DispCallFunc
VariantClear
VariantInit
SysAllocString
SysFreeString

shlwapi

SHSetValueA
SHGetValueA
PathAppendW
PathCombineW
SHGetValueW
PathRemoveFileSpecW
StrStrIW
PathFindFileNameW
wvnsprintfW
StrStrIA
PathFileExistsW

comctl32

InitCommonControlsEx

psapi

GetModuleFileNameExW
EnumProcessModules

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueA
VerQueryValueW

ws2_32

freeaddrinfo
select
__WSAFDIsSet
WSASetLastError
connect
getpeername
bind
htons
htonl
setsockopt
ioctlsocket
socket
gethostbyname
getsockopt
getsockname
send
recv
ntohs
WSAStartup
inet_addr
sendto
closesocket
recvfrom
WSACleanup
WSAGetLastError
getaddrinfo

Sections

.text
Size: 579KB - Virtual size: 579KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 171KB - Virtual size: 189KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 196KB - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

61441a2390e94d42a24c7aa4d03a28a8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

psapi

version

ws2_32

Sections

.text Size: 579KB - Virtual size: 579KB

.rdata Size: 82KB - Virtual size: 81KB

.data Size: 171KB - Virtual size: 189KB

.rsrc Size: 196KB - Virtual size: 195KB

.reloc Size: 33KB - Virtual size: 33KB

.text
Size: 579KB - Virtual size: 579KB

.rdata
Size: 82KB - Virtual size: 81KB

.data
Size: 171KB - Virtual size: 189KB

.rsrc
Size: 196KB - Virtual size: 195KB

.reloc
Size: 33KB - Virtual size: 33KB