90cf0a026d5a1b292e1b7e34b1b0395ff9d51e84d21516c3691ae10faebcba3f

Sharing

Copy URL Twitter E-mail

General

Target

90cf0a026d5a1b292e1b7e34b1b0395ff9d51e84d21516c3691ae10faebcba3f
Size

450KB
MD5

aa23b61d9bce455ad6fefa71d5de9d6e
SHA1

7c17766f84fa0a1c75220adcf789bd80cd4408d6
SHA256

90cf0a026d5a1b292e1b7e34b1b0395ff9d51e84d21516c3691ae10faebcba3f
SHA512

c50699c5e1c6a761b108cb587e87db8efe828b5ffd2e49ef6a9452bb6870c58a8d65e13b9e45b5a8534e7e12f33fe2c5487948863c96fd772c4dbc4283d66800
SSDEEP

6144:QOKppC8/GrZ0PIsogVh6GY6BJq+rY7kTrqU2CP:0Hr/Gd0PI05j31TrxV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
90cf0a026d5a1b292e1b7e34b1b0395ff9d51e84d21516c3691ae10faebcba3f

Files

90cf0a026d5a1b292e1b7e34b1b0395ff9d51e84d21516c3691ae10faebcba3f
.exe windows x86

922b647c2fc1accc3c60101095554425

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

PurgeComm
SetCommMask
SetCommState
SetCommTimeouts
lstrcmpW
lstrlenW
WideCharToMultiByte
GetUserDefaultUILanguage
GetSystemDirectoryW
SetLastError
GetTickCount
CreateDirectoryA
GetSystemInfo
GetModuleHandleW
GetProcAddress
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileSize
GetCommState
GetModuleFileNameW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetPrivateProfileSectionW
MultiByteToWideChar
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
LoadLibraryExW
RaiseException
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
ClearCommError
SetupComm
FreeLibrary
ClearCommBreak
Sleep
CreateEventW
CancelIo
DeviceIoControl
GetOverlappedResult
GetLastError
CloseHandle
OutputDebugStringW
OutputDebugStringA
WriteFile
ReadFile
CreateFileW
SetFilePointer
CreateFileA

user32

GetDlgItem
CreateDialogParamW
SetWindowPos
ShowWindow
PostQuitMessage
PostMessageW
SendMessageW
SendMessageA
DispatchMessageW
GetWindowTextW
TranslateMessage
GetMessageW
wsprintfW
SetDlgItemTextW
EnableWindow
UpdateWindow
GetParent
GetWindowTextA
SetWindowTextW
GetDesktopWindow
GetWindowTextLengthW
GetWindowRect
MessageBoxW
CopyRect
OffsetRect

winspool.drv

EnumPrintersA
OpenPrinterA
SetJobA
EnumJobsA
DeletePrinter
GetPrinterA
ord204
SetPrinterDataW
AddPrinterDriverW
EnumPrintersW
EnumPortsW
OpenPrinterW
XcvDataW
DeleteMonitorA
AddMonitorW
EnumMonitorsA
EnumPortsA
ClosePrinter
DeletePrinterDriverA
GetPrinterDriverDirectoryW
EnumPrinterDriversA
AddPrinterW

advapi32

InitializeSecurityDescriptor
RegCloseKey
RegEnumKeyA
RegOpenKeyA
ChangeServiceConfigW
CloseServiceHandle
ControlService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
QueryServiceStatusEx
StartServiceW
SetFileSecurityA
SetSecurityDescriptorDacl

shell32

SHGetFolderPathW
SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
SHFileOperationW
ShellExecuteW

msvcp120

?_Release@_Pad@std@@QAEXXZ
?_Launch@_Pad@std@@QAEXPAU_Thrd_imp_t@@@Z
??1_Pad@std@@QAE@XZ
??0_Pad@std@@QAE@XZ
?_Throw_Cpp_error@std@@YAXH@Z
?_Throw_C_error@std@@YAXH@Z
_Thrd_detach
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
??0id@locale@std@@QAE@I@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ

winmm

timeGetTime

ws2_32

gethostname
sendto
recvfrom
WSAIoctl
WSAGetLastError
WSACleanup
WSAStartup
gethostbyname
socket
shutdown
setsockopt
send
recv
inet_ntoa
inet_addr
connect
closesocket
bind
htons

setupapi

SetupDiGetDeviceRegistryPropertyA
SetupDiCallClassInstaller
CM_Get_Parent
CM_Get_DevNode_Registry_PropertyW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailW
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdA

shlwapi

StrCpyW
PathFileExistsW
PathIsDirectoryA
PathAddBackslashA
SHDeleteKeyA
StrCmpW
wnsprintfW
wvnsprintfW
StrCatW
StrRChrW

comctl32

ord17

version

VerInstallFileW

msvcr120

_crt_debugger_hook
??1type_info@@UAE@XZ
_CRT_RTC_INITW
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
_vswprintf
wcstol
system
__crtUnhandledException
strncpy
_vsnprintf
wprintf
??_V@YAXPAX@Z
?terminate@@YAXXZ
exit
wcsstr
strchr
memcmp
swprintf_s
__crtTerminateProcess
_XcptFilter
__crtGetShowWindowMode
_amsg_exit
__wgetmainargs
__set_app_type
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_wcmdln
_fmode
_commode
strrchr
__CxxFrameHandler3
_CxxThrowException
_beginthreadex
_hypot
setlocale
_vsnwprintf
sprintf
_snprintf
printf
fprintf
__iob_func
_time64
_difftime64
malloc
free
wcstombs
strtol
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
_except_handler4_common
??2@YAPAXI@Z
??3@YAXPAX@Z
memcpy
memset
strcmp
strlen
memmove
strstr
wcscat_s
wcscpy_s
wcslen
atoi
mbstowcs
_purecall

Sections

.text
Size: 344KB - Virtual size: 343KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

922b647c2fc1accc3c60101095554425

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

winspool.drv

advapi32

shell32

msvcp120

winmm

ws2_32

setupapi

shlwapi

comctl32

version

msvcr120

Sections

.text Size: 344KB - Virtual size: 343KB

.rdata Size: 57KB - Virtual size: 56KB

.data Size: 22KB - Virtual size: 22KB

.idata Size: 9KB - Virtual size: 8KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 15KB - Virtual size: 14KB

.text
Size: 344KB - Virtual size: 343KB

.rdata
Size: 57KB - Virtual size: 56KB

.data
Size: 22KB - Virtual size: 22KB

.idata
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 15KB - Virtual size: 14KB