ed8ec7a8dd089019cfd29143f008fa0951c56a35d73b2e1b274315152d0c0ee6

Sharing

Copy URL

Twitter E-mail

General

Target

ed8ec7a8dd089019cfd29143f008fa0951c56a35d73b2e1b274315152d0c0ee6
Size

2.8MB
MD5

c027d641c4c1e9d9ad048cda2af85db6
SHA1

f141f9dfc7e082521c9d26980bfc8bf100bb2f61
SHA256

ed8ec7a8dd089019cfd29143f008fa0951c56a35d73b2e1b274315152d0c0ee6
SHA512

37ceef84d42bdeb8d4828d20e9e68106d94e773eb42bfd95535594fdf7a969833450cc50945435fae9dae651e67dbbe99074fd49a613444304a479cac0c3c010
SSDEEP

49152:Scex+64nsTPT1vTjCWoDRMDx+4Jsv6tWKFdu9CiRYPUFwR0FqWvbUbnsGw52whWg:Sc7ab1v9oODxTJsv6tWKFdu9Cz5ek

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ed8ec7a8dd089019cfd29143f008fa0951c56a35d73b2e1b274315152d0c0ee6

Files

ed8ec7a8dd089019cfd29143f008fa0951c56a35d73b2e1b274315152d0c0ee6
.exe windows x86

f93308db69f1a16e0893b1a468b4597c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeEnvironmentStringsW
GetStdHandle
SetFilePointer
DuplicateHandle
ConnectNamedPipe
CreateNamedPipeW
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetConsoleWindow
GetCommandLineW
GetCurrentProcessId
SetEvent
CreateEventW
SwitchToThread
CreateThread
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
GetThreadPriority
TerminateThread
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemInfo
WaitForMultipleObjects
GetSystemTime
GetLocalTime
OutputDebugStringW
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount
GetModuleHandleW
GetSystemDirectoryW
ReadFile
PeekNamedPipe
CancelIo
GetModuleHandleA
WriteFile
GetOverlappedResult
FlushFileBuffers
GetFileType
GetLogicalDrives
SetEndOfFile
SetFilePointerEx
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
MoveFileExW
GetStartupInfoW
GetModuleFileNameW
GetFileAttributesExW
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
GetFileAttributesW
GetEnvironmentStringsW
GetFullPathNameW
GetLongPathNameW
RemoveDirectoryW
GetTempPathW
SetErrorMode
CopyFileW
MoveFileW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FreeLibrary
ResetEvent
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GetCurrencyFormatW
GetUserDefaultUILanguage
MultiByteToWideChar
WideCharToMultiByte
ReleaseMutex
CreateMutexW
VirtualFree
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
ReleaseSemaphore
CreateSemaphoreW
GetTimeZoneInformation
GetGeoInfoW
GetUserGeoID
FindFirstFileExW
FindNextFileW
LCMapStringW
WriteConsoleW
GetStringTypeW
SetEnvironmentVariableA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetModuleFileNameA
DeleteCriticalSection
GetProcessHeap
SetLastError
HeapSize
SetFileAttributesW
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetStdHandle
LeaveCriticalSection
EnterCriticalSection
IsProcessorFeaturePresent
GetUserDefaultLCID
CompareStringW
VerifyVersionInfoW
FormatMessageW
LocalFree
GetVersionExW
VerSetConditionMask
GetLastError
LoadLibraryW
SetHandleInformation
GetProcAddress
DeviceIoControl
CloseHandle
GetFileInformationByHandle
CreateFileW
IsDebuggerPresent
LoadLibraryExW
ExitThread
GetModuleHandleExW
ExitProcess
HeapReAlloc
HeapAlloc
HeapFree
GetCommandLineA
RtlUnwind
RaiseException
DecodePointer
EncodePointer

user32

UnregisterClassW
CreateWindowExW
DestroyWindow
GetQueueStatus
MsgWaitForMultipleObjectsEx
SetTimer
RegisterClassW
GetWindowLongW
SetWindowLongW
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
CharNextExA
DefWindowProcW
KillTimer
DispatchMessageW
TranslateMessage
GetWindowThreadProcessId
EnumWindows
PostThreadMessageW
PostMessageW
PeekMessageW

shell32

CommandLineToArgvW
SHGetSpecialFolderPathW

ole32

CoCreateInstance
CoInitialize
CoTaskMemFree
CoUninitialize

advapi32

RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
GetTokenInformation
GetLengthSid
FreeSid
CopySid
OpenProcessToken

ws2_32

gethostname
gethostbyname
gethostbyaddr
WSAGetLastError
inet_addr
htonl
select
__WSAFDIsSet
bind
closesocket
getpeername
getsockname
getsockopt
listen
WSAAsyncSelect
WSASocketW
WSASendTo
WSASend
WSARecvFrom
WSARecv
WSANtohs
WSANtohl
WSAIoctl
WSAHtons
WSAHtonl
WSAConnect
WSAAccept
WSACleanup
WSAStartup
setsockopt
ntohl

Exports

Exports

z_adler32
z_adler32_combine
z_adler32_combine64
z_compress
z_compress2
z_compressBound
z_crc32
z_crc32_combine
z_crc32_combine64
z_deflate
z_deflateBound
z_deflateCopy
z_deflateEnd
z_deflateInit2_
z_deflateInit_
z_deflateParams
z_deflatePrime
z_deflateReset
z_deflateSetDictionary
z_deflateSetHeader
z_deflateTune
z_get_crc_table
z_inflate
z_inflateCopy
z_inflateEnd
z_inflateGetHeader
z_inflateInit2_
z_inflateInit_
z_inflateMark
z_inflatePrime
z_inflateReset
z_inflateReset2
z_inflateSetDictionary
z_inflateSync
z_inflateSyncPoint
z_inflateUndermine
z_uncompress
z_zError
z_zlibCompileFlags
z_zlibVersion

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmetad
Size: 1024B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f93308db69f1a16e0893b1a468b4597c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

ole32

advapi32

ws2_32

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 1.4MB - Virtual size: 1.4MB

.data Size: 15KB - Virtual size: 42KB

.qtmetad Size: 1024B - Virtual size: 516B

.rsrc Size: 1024B - Virtual size: 736B

.reloc Size: 57KB - Virtual size: 56KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 15KB - Virtual size: 42KB

.qtmetad
Size: 1024B - Virtual size: 516B

.rsrc
Size: 1024B - Virtual size: 736B

.reloc
Size: 57KB - Virtual size: 56KB