3634f6425dda8799bba7d9e047b8e5321e93dad2255be62e21edae6b20cf6274

Sharing

Copy URL Twitter E-mail

General

Target

3634f6425dda8799bba7d9e047b8e5321e93dad2255be62e21edae6b20cf6274
Size

220KB
MD5

f5ff21e832be0045591f035744449b46
SHA1

c554a318723baf17095ec2700c77adb652755b01
SHA256

3634f6425dda8799bba7d9e047b8e5321e93dad2255be62e21edae6b20cf6274
SHA512

ed838423c1949a983e19ca719db6c4862e17c0985e1327a1543feec78eb833250e5a261c953616b6081da9ecc646e6294ba9a83d9b08504999b7af1102b30ba8
SSDEEP

3072:J4zBTh+b+2DVMy4FQyUlXmSeuBktKCyZ:J4zM+2DVMy4MI0ktKC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3634f6425dda8799bba7d9e047b8e5321e93dad2255be62e21edae6b20cf6274

Files

3634f6425dda8799bba7d9e047b8e5321e93dad2255be62e21edae6b20cf6274
.exe windows x86

ac14f13c221efe79e9689efb238200a4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord4073
ord1767
ord4401
ord5237
ord2377
ord5157
ord6370
ord4347
ord5276
ord3793
ord4831
ord4435
ord2640
ord2047
ord6372
ord3744
ord5059
ord1720
ord5257
ord2438
ord2116
ord5273
ord4621
ord4419
ord3592
ord324
ord4229
ord2567
ord6051
ord1768
ord4390
ord5286
ord3397
ord3569
ord3614
ord861
ord2235
ord6048
ord1165
ord540
ord567
ord2282
ord2352
ord2281
ord2362
ord2294
ord6211
ord3087
ord6330
ord2810
ord6195
ord860
ord823
ord4155
ord2858
ord3084
ord4470
ord2371
ord755
ord470
ord2644
ord5568
ord2634
ord1662
ord2910
ord1197
ord4219
ord535
ord922
ord537
ord4124
ord5679
ord858
ord4704
ord4992
ord4847
ord4370
ord5261
ord1131
ord2613
ord2506
ord800
ord609
ord2406
ord641
ord3621
ord3658
ord1569
ord815
ord825
ord561
ord3733
ord4418
ord4616
ord4075
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5710
ord5285
ord5303
ord4692
ord4074
ord2717
ord5298
ord5296
ord3341
ord2388
ord5193
ord1089
ord3917
ord5727
ord2504
ord2546
ord4480
ord6371
ord4269
ord1143
ord4667

msvcrt

_controlfp
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_onexit
__dllonexit
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_XcptFilter
_exit
_purecall
fopen
fseek
ftell
fread
fclose
_beginthreadex
sprintf
swprintf
??1exception@@UAE@XZ
_CxxThrowException
__CxxFrameHandler
free
malloc
_wtoi
memmove
??0exception@@QAE@ABV0@@Z
strncpy
??0exception@@QAE@XZ

kernel32

GetLastError
LocalFree
GetSystemInfo
GetProcAddress
GetModuleHandleW
GetVersionExW
FreeLibrary
LoadLibraryW
CloseHandle
GetCurrentThread
GetCurrentProcess
CreateEventW
OpenEventW
SetEvent
WaitForSingleObject
CreateMutexW
GetTickCount
ReleaseMutex
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
UnmapViewOfFile
WideCharToMultiByte
TerminateThread
CreateFileW
DeviceIoControl
lstrlenW
GetStartupInfoW
GetCurrentProcessId
WaitForMultipleObjects
Sleep
OutputDebugStringA
OpenMutexW

user32

SetWindowLongW
wsprintfW
IsIconic
GetSystemMetrics
GetClientRect
DrawIcon
GetSystemMenu
AppendMenuW
SendMessageW
LoadIconW
EnableWindow
MessageBoxA
PostMessageW
RegisterWindowMessageW

comdlg32

GetOpenFileNameW

advapi32

SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
OpenThreadToken
OpenProcessToken
GetTokenInformation
InitializeSecurityDescriptor

winscard

g_rgSCardT1Pci
SCardBeginTransaction
SCardEndTransaction
g_rgSCardT0Pci
SCardStatusW
SCardListReadersW
SCardReconnect
SCardDisconnect
SCardReleaseStartedEvent
SCardReleaseContext
SCardTransmit
SCardAccessStartedEvent
SCardEstablishContext
SCardConnectW

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory
WTSQuerySessionInformationW

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW

Sections

.text
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac14f13c221efe79e9689efb238200a4

Headers

File Characteristics

Imports

mfc42u

msvcrt

kernel32

user32

comdlg32

advapi32

winscard

wtsapi32

setupapi

Sections

.text Size: 112KB - Virtual size: 111KB

.rdata Size: 20KB - Virtual size: 16KB

.data Size: 12KB - Virtual size: 25KB

.rsrc Size: 72KB - Virtual size: 69KB

.text
Size: 112KB - Virtual size: 111KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 12KB - Virtual size: 25KB

.rsrc
Size: 72KB - Virtual size: 69KB