bf6fdd3402123b0dd36bde8b02088d44c7d2efb8210ac4d74a3212fd3c152513

Sharing

Copy URL

Twitter E-mail

General

Target

bf6fdd3402123b0dd36bde8b02088d44c7d2efb8210ac4d74a3212fd3c152513
Size

1.8MB
MD5

66b3d124f444985db79ed851a54fc293
SHA1

bb5e12cd94a685e40d89f3470a2b7550b59d34c0
SHA256

bf6fdd3402123b0dd36bde8b02088d44c7d2efb8210ac4d74a3212fd3c152513
SHA512

943f0a4db7e4d23c5025695ba598b4b411284dd5720616b470d830fbff055b80d251c0540f682badfbe5af69b80274d4c08da23b03538f7e750c2888b41c3e75
SSDEEP

24576:J1mp5mO2KUfHHVlvw7WjJvEzI5g/WLK8wYyj0ejLFAAxO4w4uRshW:JEp5mO2tHHuWdMgef8BD4wN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bf6fdd3402123b0dd36bde8b02088d44c7d2efb8210ac4d74a3212fd3c152513

Files

bf6fdd3402123b0dd36bde8b02088d44c7d2efb8210ac4d74a3212fd3c152513
.exe windows x86

118c7ee11b48176c04c0d7727655b74b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_except_handler3

mpr

WNetCloseEnum

comctl32

InitializeFlatSB

version

VerQueryValueW
GetFileVersionInfoW

kernel32

GetTickCount
GetCurrentThreadId
GetCurrentProcessId
LoadLibraryA
LeaveCriticalSection
ExitProcess
EnterCriticalSection
InitializeCriticalSection
GetCommandLineA
IsValidCodePage
lstrcmpA
CopyFileW
CreateDirectoryW
CreateEventW
CreateFileA
CreateFileW
CreateMutexW
CreatePipe
CreateProcessW
CreateThread
DeleteCriticalSection
DeleteFileW
EnumSystemLocalesA
ExitThread
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileW
FindResourceExW
FindResourceW
FlushFileBuffers
FlushInstructionCache
FormatMessageA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
FreeResource
GetACP
GetCommandLineW
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCPInfo
GetCurrentDirectoryA
GetDiskFreeSpaceExW
GetDriveTypeA
GetEnvironmentStringsW
GetExitCodeThread
GetFileAttributesW
GetFileSize
GetFileType
GetFullPathNameA
GetLastError
GetLocaleInfoA
GetLocaleInfoW
GetLocalTime
GetLogicalDriveStringsW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetPrivateProfileIntW
GetPrivateProfileStringW
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetThreadLocale
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExA
Module32NextW
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsProcessorFeaturePresent
IsValidLocale
LCMapStringA
LCMapStringW
LoadLibraryW
LoadResource
LocalFree
LockResource
lstrlenA
lstrlenW
MoveFileExW
MoveFileW
MultiByteToWideChar
OpenEventW
OpenProcess
OutputDebugStringW
QueryDosDeviceW
QueryPerformanceCounter
RaiseException
ReadFile
RemoveDirectoryW
ResetEvent
SetEndOfFile
SetEnvironmentVariableA
SetEvent
SetFileAttributesW
SetFilePointer
SetHandleCount
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SizeofResource
SleepEx
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualAlloc
VirtualFree
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleA
WriteConsoleW
WriteFile
WritePrivateProfileStringW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Module32FirstW
GetVersionExW

user32

UnregisterClassA
TranslateMessage
SystemParametersInfoW
ShowWindow
SetWindowPos
SetWindowLongW

winspool.drv

OpenPrinterW
DocumentPropertiesW
EnumPrintersW

advapi32

LookupPrivilegeValueW
InitializeSecurityDescriptor
GetSecurityDescriptorSacl
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenProcessToken
OpenSCManagerW
OpenServiceW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegOpenKeyW
RegQueryValueExW
RegSetValueExW
SetSecurityDescriptorDacl
StartServiceW
SetSecurityDescriptorSacl

shlwapi

StrToIntW
StrToIntA
PathRemoveFileSpecW

Sections

.text
Size: 412KB - Virtual size: 410KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 14.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 420KB - Virtual size: 420KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.cmm526
Size: 999KB - Virtual size: 999KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

118c7ee11b48176c04c0d7727655b74b

Headers

File Characteristics

Imports

msvcrt

mpr

comctl32

version

kernel32

user32

winspool.drv

advapi32

shlwapi

Sections

.text Size: 412KB - Virtual size: 410KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 14.0MB

.tls Size: 4KB - Virtual size: 16B

.rsrc Size: 420KB - Virtual size: 420KB

.cmm526 Size: 999KB - Virtual size: 999KB

.text
Size: 412KB - Virtual size: 410KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 14.0MB

.tls
Size: 4KB - Virtual size: 16B

.rsrc
Size: 420KB - Virtual size: 420KB

.cmm526
Size: 999KB - Virtual size: 999KB