ebc6dbe98a0447e8b09add8e8789bc6d5f5395a10bfb345a4f026d65cfde84ec

Sharing

Copy URL Twitter E-mail

General

Target

ebc6dbe98a0447e8b09add8e8789bc6d5f5395a10bfb345a4f026d65cfde84ec
Size

2.8MB
MD5

a5e3261c8cd89cce1608e5a8967d9f1a
SHA1

d3ef0e238ac35700405509ba4a36665db1593cb9
SHA256

ebc6dbe98a0447e8b09add8e8789bc6d5f5395a10bfb345a4f026d65cfde84ec
SHA512

ee5e7d96b5aecbe8ce3e684ffa75ec46d17739010bbc4d36d2624d700e35af7d31f5932054fd3d997d13ed644d02652c52a72260f774dd69e5612d0dceeb3b05
SSDEEP

49152:lWS/p9CXYj1XpMS1XzEf/+L7HUbRKKGSLiDh/7NrhOPe5v+1owe5LLI:US/p9Coj1ZMaXAfWL+lGsc7NrhSowwE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ebc6dbe98a0447e8b09add8e8789bc6d5f5395a10bfb345a4f026d65cfde84ec

Files

ebc6dbe98a0447e8b09add8e8789bc6d5f5395a10bfb345a4f026d65cfde84ec
.exe windows x86

6d04c4fe6f5f94a4138bacd4508e64e9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

EnumProcessModules
GetProcessImageFileNameW
GetModuleFileNameExW

crypt32

CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CryptMsgClose
CryptMsgGetParam
CryptQueryObject
CertGetNameStringW
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CertOpenStore

advapi32

ImpersonateLoggedOnUser
SetTokenInformation
GetSidSubAuthority
GetSidSubAuthorityCount
LookupAccountSidW
CreateProcessAsUserW
DuplicateTokenEx
DeregisterEventSource
RegisterEventSourceA
ReportEventA
RegCloseKey
RegCreateKeyW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueW
RegSetValueExW
ChangeServiceConfig2W
CloseServiceHandle
ControlService
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
StartServiceW
RevertToSelf
OpenProcessToken
EqualSid
GetLengthSid
InitializeAcl
GetAclInformation
AddAce
GetAce
AddAccessAllowedAce
InitializeSecurityDescriptor
GetSecurityDescriptorControl
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
SetFileSecurityW
GetFileSecurityW
LookupAccountNameW
RegEnumKeyW
RegOpenKeyW
CryptAcquireContextA
CryptReleaseContext
CryptEnumProvidersA
CryptSignHashA
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
GetTokenInformation

ole32

CoInitialize
CoUninitialize
CoCreateInstance

shell32

SHGetFolderPathW
ShellExecuteExW
SHFileOperationW
SHGetSpecialFolderPathW

shlwapi

SHDeleteKeyW
PathFileExistsW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

user32

MessageBoxA
GetUserObjectInformationW
wsprintfA
wsprintfW
LoadStringW
GetProcessWindowStation

kernel32

HeapAlloc
HeapFree
GetProcessHeap
SetLastError
GetNativeSystemInfo
LoadLibraryA
IsBadReadPtr
CloseHandle
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
OpenFileMappingW
CreateThread
TerminateThread
GetExitCodeThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObject
Sleep
VirtualAlloc
LoadLibraryW
GetSystemWow64DirectoryW
LocalAlloc
LocalFree
OpenProcess
GetCurrentProcessId
GetLastError
GetLogicalDriveStringsW
GetModuleHandleW
QueryDosDeviceW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetCurrentProcess
DeleteFileW
OutputDebugStringW
MoveFileExW
GetLocalTime
GetModuleFileNameW
GetFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CreateFileW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
VirtualProtect
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetTickCount
GetTempPathW
GetLongPathNameW
GetFileAttributesW
GetTempFileNameW
WriteFile
GetExitCodeProcess
GetFileSize
ReadFile
lstrcpyW
SetFileAttributesW
GetFileAttributesExW
RemoveDirectoryW
GlobalAlloc
GlobalFree
ReadProcessMemory
CreateProcessW
DecodePointer
HeapReAlloc
HeapSize
RaiseException
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
WideCharToMultiByte
GetSystemInfo
ReleaseMutex
CreateMutexW
GetVolumeInformationW
GetWindowsDirectoryW
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceW
DeviceIoControl
OutputDebugStringA
SetPriorityClass
FlushConsoleInputBuffer
FormatMessageA
TerminateProcess
VirtualFree
PeekNamedPipe
GetProcAddress
FreeLibrary
WritePrivateProfileStringW
GetVersionExW
CopyFileW
FindNextFileW
FindFirstFileW
CreateDirectoryW
GetSystemDirectoryW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrlenW
WinExec
FindClose
GlobalMemoryStatus
GetSystemTime
SystemTimeToFileTime
ExitThread
FreeLibraryAndExitThread
GetDriveTypeW
ReadConsoleInputA
SetConsoleMode
GetCurrentDirectoryW
GetFullPathNameW
CreateEventW
WaitForMultipleObjects
ExpandEnvironmentStringsA
VerifyVersionInfoA
GetSystemDirectoryA
GetModuleHandleA
VerSetConditionMask
SleepEx
GetFileAttributesExA
QueryPerformanceFrequency
SetEndOfFile
WriteConsoleW
FlushFileBuffers
GetTimeZoneInformation
GetConsoleCP
SetFilePointerEx
ReadConsoleW
GetConsoleMode
SetStdHandle
SetConsoleCtrlHandler
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStringTypeW
GetFileType
GetACP
GetStdHandle
GetModuleHandleExW
ExitProcess
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
RtlUnwind

iphlpapi

GetAdaptersInfo

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

wininet

InternetOpenW
InternetSetOptionW
InternetReadFile
InternetOpenUrlW
InternetCloseHandle
HttpQueryInfoW

ws2_32

WSACleanup
getaddrinfo
gethostname
freeaddrinfo
accept
WSAStartup
WSAIoctl
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
WSAGetLastError
socket
__WSAFDIsSet
listen
recvfrom
sendto
ioctlsocket
select
shutdown
htonl
gethostbyname
getservbyname
WSASetLastError
recv
bind
closesocket
connect
send

wldap32

ord200
ord211
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord217
ord143
ord33
ord35
ord79
ord30
ord46
ord301

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 438KB - Virtual size: 437KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 46KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 452B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 674KB - Virtual size: 676KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6d04c4fe6f5f94a4138bacd4508e64e9

Headers

DLL Characteristics

File Characteristics

Imports

psapi

crypt32

advapi32

ole32

shell32

shlwapi

version

user32

kernel32

iphlpapi

userenv

wininet

ws2_32

wldap32

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 438KB - Virtual size: 437KB

.data Size: 46KB - Virtual size: 71KB

.gfids Size: 512B - Virtual size: 452B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 674KB - Virtual size: 676KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 438KB - Virtual size: 437KB

.data
Size: 46KB - Virtual size: 71KB

.gfids
Size: 512B - Virtual size: 452B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 674KB - Virtual size: 676KB