5f56d0dfc3dad2d85a4ee5ae9ad82ef1fe7a0b00ab75184671498de344989b48

Sharing

Copy URL Twitter E-mail

General

Target

5f56d0dfc3dad2d85a4ee5ae9ad82ef1fe7a0b00ab75184671498de344989b48
Size

433KB
MD5

bd9b48152569451b906339867b37e936
SHA1

2af4e819992047f46cd671c0fec0e7687c85497d
SHA256

5f56d0dfc3dad2d85a4ee5ae9ad82ef1fe7a0b00ab75184671498de344989b48
SHA512

5e1d2406b7e5987f4ad387319cb353f60f0fde9b52342d5fc44f0d2cc6240a65e510fd86fe9e7d033d86bf468be77f5190159388e99d3fc6757551db71bb11d8
SSDEEP

6144:nbqrXwGRNGbqSuG8qHSnbXKY78f5tITqGIlC:aGGSvHyzr8eIE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5f56d0dfc3dad2d85a4ee5ae9ad82ef1fe7a0b00ab75184671498de344989b48

Files

5f56d0dfc3dad2d85a4ee5ae9ad82ef1fe7a0b00ab75184671498de344989b48
.exe windows x86

fa7ed954ef020e281308b9766c9c6baa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

neci

dsc_SetSearchOpt
dsc_Login
dsc_SetCmdState
dsc_Logout
dsc_SaveAndRestart
dsc_Detach
dsc_GetDriverMode
dsc_GetIPLocation
dsc_GetUDPMode
dsc_GetDIOState
dsc_GetDIOMode
dsc_GetMaxDIO
dsc_GetKernelInfo
dsc_EnumSearch
dsc_GetName
dsc_GetSerialIOCtl
dsc_GetSerialInterface
dsc_GetIfConfig
dsc_Attach
dsc_GetCmdState

mfc140u

ord5422
ord14234
ord11333
ord9375
ord5419
ord13293
ord11000
ord12216
ord11021
ord9042
ord8977
ord11235
ord10570
ord11935
ord11933
ord11934
ord6309
ord11169
ord11932
ord3872
ord2993
ord8744
ord4222
ord7941
ord9128
ord6497
ord1070
ord14507
ord4664
ord4225
ord9132
ord5984
ord6589
ord1180
ord3696
ord8062
ord7820
ord6486
ord1511
ord540
ord3182
ord2215
ord4884
ord5850
ord13544
ord2753
ord14573
ord3874
ord2994
ord8745
ord4224
ord3189
ord9131
ord6588
ord7027
ord3359
ord3237
ord6801
ord1405
ord3797
ord2383
ord6248
ord12711
ord13473
ord13471
ord5425
ord2409
ord2034
ord11982
ord11983
ord14466
ord12531
ord8000
ord14667
ord6348
ord14669
ord6350
ord14668
ord6349
ord3852
ord5918
ord12239
ord12247
ord4589
ord8217
ord10433
ord12251
ord12219
ord12928
ord5763
ord10250
ord9209
ord6860
ord1179
ord6559
ord6566
ord3882
ord1446
ord1408
ord1411
ord4108
ord13911
ord2205
ord7997
ord2594
ord1072
ord366
ord1523
ord286
ord1472
ord995
ord7653
ord10379
ord12131
ord9040
ord11015
ord11396
ord10472
ord4092
ord3404
ord3403
ord3164
ord266
ord13752
ord3305
ord3302
ord8210
ord2760
ord14785
ord10285
ord10287
ord10286
ord10284
ord10288
ord4477
ord11725
ord11726
ord9139
ord12089
ord3838
ord11936
ord14588
ord8965
ord12172
ord6978
ord11002
ord9256
ord3266
ord13878
ord12262
ord12258
ord1722
ord1744
ord1770
ord1756
ord1777
ord4936
ord5003
ord4948
ord4966
ord4960
ord4954
ord5013
ord4997
ord4942
ord5019
ord4974
ord4912
ord4927
ord4988
ord4502
ord10498
ord3238
ord6220
ord13756
ord2761
ord12217
ord9253
ord3054
ord9225
ord2246
ord1928
ord4814
ord2303
ord280
ord1525
ord4323
ord7627
ord924
ord7379
ord8360
ord12884
ord8470
ord8386
ord9693
ord4494
ord3055
ord14590
ord7923
ord14596
ord6877
ord11717
ord13703
ord5935
ord2682
ord12124
ord3941
ord3372
ord3371
ord3265
ord12168
ord5249
ord5549
ord5760
ord9350
ord5525
ord5790
ord5252
ord5411
ord5228
ord7722
ord7723
ord7712
ord12865
ord8324
ord5409
ord8219
ord10255
ord9210
ord7493
ord1111
ord458
ord7107
ord2304
ord4815
ord1045
ord296
ord1513
ord4886
ord2522
ord7626
ord3697
ord5357
ord2486
ord6380
ord1002
ord6834
ord6129
ord12220
ord9135
ord3257
ord12541
ord12542
ord14589
ord1689
ord5110
ord13646
ord8067
ord2990
ord5921
ord285
ord4236
ord3009
ord14137
ord7922
ord14595
ord914
ord265
ord5882
ord4882
ord4881
ord8464
ord1526
ord290
ord4663
ord3846
ord1692
ord9398
ord5652
ord4152
ord7378
ord4090
ord6218
ord12027
ord12947
ord3147

kernel32

GlobalAlloc
GlobalLock
GlobalFree
GetLastError
GlobalUnlock
SetLastError
GetFileAttributesW
LocalAlloc
FormatMessageW
LocalFree
LoadLibraryW
GetSystemInfo
HeapAlloc
GetVersionExW
SearchPathW
WinExec
GetModuleHandleA
GetModuleFileNameA
GetModuleHandleW
GetModuleFileNameW
GetVersion
GetProcAddress
CloseHandle
OutputDebugStringW
lstrcmpiW
GetProcessHeap
WriteProfileStringW
HeapFree
CreateProcessW
WaitForSingleObject
CommConfigDialogW
CreateThread
Sleep
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
CreateEventW
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DeleteCriticalSection

user32

EnableWindow
GetSysColorBrush
GetParent
MessageBoxW
ReleaseDC
LoadBitmapW
SendMessageW
GetDC
RegisterDeviceNotificationW
GetSystemMetrics
PostMessageW

gdi32

GetTextExtentPoint32W
CreateFontW
GetTextMetricsW

winspool.drv

OpenPrinterW
XcvDataW
ClosePrinter
EnumPrinterDriversW
EnumPrintersW
GetPrinterW
EnumPortsW
EndDocPrinter
EndPagePrinter
WritePrinter
StartPagePrinter
StartDocPrinterW
DocumentPropertiesW

advapi32

RegGetKeySecurity
FreeSid
RegCreateKeyExW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegCreateKeyW
RegSetValueExW
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyW
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity

shell32

ShellExecuteExW

comctl32

ImageList_AddMasked
InitCommonControlsEx
ImageList_GetImageCount
ImageList_Remove

ws2_32

inet_ntoa

vcruntime140

_except_handler4_common
__current_exception_context
memset
wcschr
wcsstr
wcsrchr
__CxxFrameHandler3
__current_exception
memcpy

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode
__stdio_common_vswprintf
__stdio_common_vswprintf_s
__stdio_common_vsprintf

api-ms-win-crt-heap-l1-1-0

_set_new_mode
malloc
free

api-ms-win-crt-string-l1-1-0

wcsncpy
_wcsupr

api-ms-win-crt-runtime-l1-1-0

_controlfp_s
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_exit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 320KB - Virtual size: 319KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fa7ed954ef020e281308b9766c9c6baa

Headers

DLL Characteristics

File Characteristics

Imports

version

neci

mfc140u

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

ws2_32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 58KB - Virtual size: 57KB

.rdata Size: 39KB - Virtual size: 39KB

.data Size: 1KB - Virtual size: 149KB

.rsrc Size: 320KB - Virtual size: 319KB

.reloc Size: 13KB - Virtual size: 13KB

.text
Size: 58KB - Virtual size: 57KB

.rdata
Size: 39KB - Virtual size: 39KB

.data
Size: 1KB - Virtual size: 149KB

.rsrc
Size: 320KB - Virtual size: 319KB

.reloc
Size: 13KB - Virtual size: 13KB