1f9d321fabed3d22aa8fa306685748fd5dfdefeb4e8037655f7e25c35e4c9144

Sharing

Copy URL Twitter E-mail

General

Target

1f9d321fabed3d22aa8fa306685748fd5dfdefeb4e8037655f7e25c35e4c9144
Size

780KB
MD5

030184a3dc2490c9e391dd40be7163b2
SHA1

f900944c7f4c355f1eec12ee123db5603c4ba637
SHA256

1f9d321fabed3d22aa8fa306685748fd5dfdefeb4e8037655f7e25c35e4c9144
SHA512

71a367558430267735e626de97f34bec95c2f8389891249a06c484470c11e557f60c9812f5c85131920689f030ae89146a6457abd1c74958e3ff0550fc074957
SSDEEP

24576:hBURwWW0D1Uqhj+cpeSn/zn2UP8xAMo5gTXgJjsfu:ywMDZpVajA5gTQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1f9d321fabed3d22aa8fa306685748fd5dfdefeb4e8037655f7e25c35e4c9144

Files

1f9d321fabed3d22aa8fa306685748fd5dfdefeb4e8037655f7e25c35e4c9144
.exe windows x86

23698ddcc5f1451136da0340798b17eb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

iphlpapi

GetAdaptersInfo

kernel32

DecodePointer
CloseHandle
RaiseException
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
Sleep
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleHandleW
LoadLibraryExW
lstrcmpiW
GetPrivateProfileStringW
MultiByteToWideChar
CreateFileW
OpenThread
OpenProcess
VirtualQueryEx
ReadProcessMemory
GetThreadSelectorEntry
CreateToolhelp32Snapshot
Thread32First
Thread32Next
Module32FirstW
Module32NextW
MoveFileExW
WideCharToMultiByte
GetVolumeInformationW
GlobalAlloc
GlobalFree
VerSetConditionMask
GetModuleFileNameA
MulDiv
lstrlenW
GetPrivateProfileStringA
VerifyVersionInfoW
CompareStringW
GetCommandLineW
GetTempPathW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
GetCurrentProcess
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetFileType
GetVersionExW
GlobalMemoryStatus
LoadLibraryA
FlushConsoleInputBuffer
FindResourceExW
FreeLibrary
GetTickCount
GetProcessHeap
GetProcAddress
LoadResource
LockResource
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
SizeofResource
LoadLibraryW
FindResourceW
GetStdHandle
OutputDebugStringW
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsFree
GetSystemTime
GetModuleFileNameW
GetPrivateProfileIntW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
FreeConsole
AllocConsole
WriteConsoleW
DeleteFileW
IsDebuggerPresent

user32

GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
RedrawWindow
InvalidateRect
EndPaint
GetClientRect
GetWindowRect
SetCursor
GetCursorPos
ScreenToClient
MapWindowPoints
GetSysColor
DrawFocusRect
FillRect
SetRectEmpty
BeginPaint
PtInRect
GetWindowLongW
GetParent
EnumChildWindows
GetClassNameW
GetWindow
LoadCursorW
LoadImageW
SystemParametersInfoW
GetMonitorInfoW
GetDC
UpdateWindow
DrawTextW
GetSystemMetrics
GetDesktopWindow
GetUserObjectInformationW
GetProcessWindowStation
IsWindowEnabled
ReleaseCapture
SetCapture
GetCapture
GetKeyState
OffsetRect
ReleaseDC
DefWindowProcW
UnregisterClassW
DestroyWindow
DialogBoxParamW
MonitorFromWindow
CharNextW
GetActiveWindow
SetWindowLongW
MessageBoxW
SendMessageW
CallWindowProcW
CreateWindowExW
IsWindow
ShowWindow
MoveWindow
SetWindowPos
IsWindowVisible
EndDialog
GetDlgItem
GetDlgCtrlID
SetFocus
GetFocus

gdi32

CreateFontIndirectW
DeleteObject
GetObjectW
SetTextColor
SetBkMode
SelectObject
GetStockObject
DeleteDC
CreateFontW

advapi32

ReportEventW
RegCloseKey
RegisterEventSourceW
DeregisterEventSource
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegQueryValueExW

shell32

SHCreateDirectoryExW
ShellExecuteW

ole32

CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree

oleaut32

VarUI4FromStr

comctl32

_TrackMouseEvent
InitCommonControlsEx

msvcp140

?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ

dbghelp

MiniDumpWriteDump
SymLoadModule64
SymFromAddr
SymUnloadModule64
SymInitialize
SymGetLineFromAddr
SymGetModuleBase
SymFunctionTableAccess
SymSetOptions
StackWalk
SymCleanup

psapi

GetModuleFileNameExW

wininet

HttpQueryInfoW
InternetSetOptionW
InternetReadFile
InternetOpenUrlW
InternetOpenW
HttpQueryInfoA
HttpEndRequestA
HttpSendRequestExA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetWriteFile
InternetConnectA
InternetCloseHandle
InternetOpenA
InternetSetOptionA

vcruntime140

wcsrchr
wcsstr
strrchr
wcschr
__std_exception_copy
__std_exception_destroy
strchr
__vcrt_InitializeCriticalSectionEx
_except_handler4_common
strstr
__CxxFrameHandler3
_CxxThrowException
memset
memmove
memcpy
_purecall

api-ms-win-crt-runtime-l1-1-0

raise
_invalid_parameter_noinfo
_register_thread_local_exe_atexit_callback
_c_exit
_errno
terminate
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_invalid_parameter_noinfo_noreturn
_seh_filter_exe
_set_app_type
_controlfp_s
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
signal

api-ms-win-crt-string-l1-1-0

strnlen
strncmp
tolower
isupper
isxdigit
_strnicmp
wcscmp
isspace
isdigit
wcslen
wmemcpy_s
strncpy
strcpy_s
strcmp
iswdigit
strcat_s
wcscpy_s
strlen
wcsspn
wcsncmp
wcsncpy_s
wcscspn
wcsnlen
_wcsicmp
_wcslwr_s
_wcsnicmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf
feof
fwrite
fread
__p__commode
__stdio_common_vswprintf
fputs
fgets
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsprintf
fgetws
__stdio_common_vsprintf_s
fflush
__stdio_common_vfwprintf_s
_wfopen_s
fputws
fclose
_wfopen
ferror
_fileno
fopen
fseek
ftell
_setmode
__stdio_common_vsnwprintf_s
__stdio_common_vfwprintf
fputc
_wfsopen
__stdio_common_vswprintf_s
_set_fmode

api-ms-win-crt-time-l1-1-0

_localtime64_s
_time64
_gmtime64
wcsftime

api-ms-win-crt-heap-l1-1-0

_recalloc
realloc
free
_callnewh
_set_new_mode
calloc
malloc

api-ms-win-crt-convert-l1-1-0

_wtoi
strtoul
atoi
wcstol

api-ms-win-crt-filesystem-l1-1-0

_waccess_s
_wstat64i32
_wstat32
_waccess

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

_fdopen
_except1
__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-conio-l1-1-0

_getch

Sections

.text
Size: 458KB - Virtual size: 457KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 176KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 90KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

23698ddcc5f1451136da0340798b17eb

Headers

DLL Characteristics

File Characteristics

Imports

iphlpapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

msvcp140

dbghelp

psapi

wininet

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-conio-l1-1-0

Sections

.text Size: 458KB - Virtual size: 457KB

.rdata Size: 176KB - Virtual size: 175KB

.data Size: 6KB - Virtual size: 14KB

.tls Size: 512B - Virtual size: 9B

.gfids Size: 512B - Virtual size: 76B

.rsrc Size: 30KB - Virtual size: 30KB

.reloc Size: 90KB - Virtual size: 92KB

.text
Size: 458KB - Virtual size: 457KB

.rdata
Size: 176KB - Virtual size: 175KB

.data
Size: 6KB - Virtual size: 14KB

.tls
Size: 512B - Virtual size: 9B

.gfids
Size: 512B - Virtual size: 76B

.rsrc
Size: 30KB - Virtual size: 30KB

.reloc
Size: 90KB - Virtual size: 92KB