ad5ac68082992aff850b8cae8d3bcba7492cc86cf2d03adc03a4c531e8d115db

Sharing

Copy URL Twitter E-mail

General

Target

ad5ac68082992aff850b8cae8d3bcba7492cc86cf2d03adc03a4c531e8d115db
Size

311KB
MD5

7f5aff74f8e7659e7253cca95a19e896
SHA1

c3fe773d377e5e0544fb1906bde5bb404b7669bd
SHA256

ad5ac68082992aff850b8cae8d3bcba7492cc86cf2d03adc03a4c531e8d115db
SHA512

1e3b48ee3c971e40ba0f6f6a44e988ab9cd7d703c012911c743c9d01b2fce29efee393f9c6eb7884216808e8d691153d317e49f898eaeec5198e89464c0ca00b
SSDEEP

6144:FDHtGkH7nOlAqLzQM5vQXc9ZmZrP+tpJL/FqZhfPqQDo:FDZH7nOlAszQM5vQs9ZmlPK3tundD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad5ac68082992aff850b8cae8d3bcba7492cc86cf2d03adc03a4c531e8d115db

Files

ad5ac68082992aff850b8cae8d3bcba7492cc86cf2d03adc03a4c531e8d115db
.exe windows x86

bb26179ef615c9f6ced3f65f14a257fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAEnumProtocolsA
WSASetLastError

fbclient

ord151
ord37
fb_get_master_interface
ord259
ord248
ord249
fb_interpret
ord44
fb_shutdown
ord250
ord51
ord1
ord42
ord20
ord228
ord227
ord226
ord225
ord173

msvcp140

?_W_Getmonths@_Locinfo@std@@QBEPBGXZ
?_Xbad_function_call@std@@YAXXZ
_Mbrtowc
?_Xbad_alloc@std@@YAXXZ
?_W_Getdays@_Locinfo@std@@QBEPBGXZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ

vcruntime140

__std_exception_copy
__std_terminate
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
_purecall
strchr
memchr
strstr
__std_type_info_destroy_list
_except_handler4_common
__std_exception_destroy
memset

api-ms-win-crt-stdio-l1-1-0

_sopen_dispatch
fopen
getc
__stdio_common_vsscanf
_getcwd
_get_osfhandle
ferror
feof
_set_fmode
_fileno
_isatty
_close
__stdio_common_vsprintf
_read
_write
fwrite
_setmode
__stdio_common_vfprintf
ftell
fseek
fread
fflush
fclose
__acrt_iob_func
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
setlocale

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_crt_at_quick_exit
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_seh_filter_dll
_exit
_initterm_e
_initialize_onexit_table
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_register_onexit_function
_set_app_type
_seh_filter_exe
_controlfp_s
terminate
abort
_invalid_parameter_noinfo_noreturn
_errno
exit
_initterm
_execute_onexit_table
strerror

api-ms-win-crt-convert-l1-1-0

atol
atoi

api-ms-win-crt-string-l1-1-0

strncmp
strncpy
isdigit
_strnicmp
isalpha
toupper

api-ms-win-crt-heap-l1-1-0

_set_new_mode
calloc

api-ms-win-crt-environment-l1-1-0

getenv
getenv_s
_putenv_s

api-ms-win-crt-filesystem-l1-1-0

_fstat64i32
_unlink
_mkdir
_stat64i32
_access

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_ftime64

api-ms-win-crt-math-l1-1-0

_except1
__setusermatherr

mpr

WNetCloseEnum
WNetEnumResourceA
WNetGetUniversalNameA
WNetOpenEnumA

kernel32

CreateEventW
WaitForSingleObjectEx
ResetEvent
GetModuleHandleW
lstrcmpA
lstrlenA
CreateEventA
GetCurrentThreadId
GetLastError
VirtualAlloc
VirtualFree
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeSListHead
GetSystemInfo
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
GetVersion
LocalAlloc
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTempPathA
SetFilePointer
ReadFile
WriteFile
WideCharToMultiByte
MultiByteToWideChar
GetFullPathNameA
GetDriveTypeA
LocalFree
GetProcessTimes
LoadLibraryExA
SetErrorMode
FileTimeToSystemTime
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
LoadLibraryA
GetCurrentProcess
GetModuleFileNameA
CreateSemaphoreA
ReleaseSemaphore
SetEvent
FindNextFileA
FindFirstFileA
FindClose
GetComputerNameA
WaitForSingleObject
GetCurrentProcessId
OpenProcess
SetConsoleCtrlHandler
GetVolumeInformationA
GetStartupInfoW
GetFileAttributesA
CreateFileA
CreateDirectoryA
SystemTimeToFileTime
IsDebuggerPresent
GetSystemTime
SetFileTime
GetFileInformationByHandle
SetConsoleMode
GetConsoleMode
QueryPerformanceFrequency
QueryPerformanceCounter
SetEnvironmentVariableA
GetEnvironmentVariableA
GetModuleHandleA
CloseHandle

user32

CharUpperBuffA
MessageBoxA
CharLowerBuffA

advapi32

CryptAcquireContextA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
SetSecurityInfo
GetSecurityInfo
GetUserNameA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CryptGenRandom
CryptReleaseContext
CreateWellKnownSid
SetNamedSecurityInfoA
GetNamedSecurityInfoA
SetEntriesInAclA
FreeSid
AllocateAndInitializeSid
ConvertStringSecurityDescriptorToSecurityDescriptorA
ConvertSidToStringSidA

ole32

CoCreateGuid

Sections

.text
Size: 248KB - Virtual size: 247KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bb26179ef615c9f6ced3f65f14a257fc

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

fbclient

msvcp140

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

mpr

kernel32

user32

advapi32

ole32

Sections

.text Size: 248KB - Virtual size: 247KB

.rdata Size: 56KB - Virtual size: 56KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 2KB - Virtual size: 1KB

.text
Size: 248KB - Virtual size: 247KB

.rdata
Size: 56KB - Virtual size: 56KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 2KB - Virtual size: 1KB