8f28d04776b1a1aab951dadc5803bf70c78ec42e6d373c17fe6418b78458bc63

Sharing

Copy URL Twitter E-mail

General

Target

8f28d04776b1a1aab951dadc5803bf70c78ec42e6d373c17fe6418b78458bc63
Size

1.7MB
MD5

ed2b12b54d06f47b6ca5347d9fdba8fd
SHA1

a852b56d401670c215691140642873ca1db741cd
SHA256

8f28d04776b1a1aab951dadc5803bf70c78ec42e6d373c17fe6418b78458bc63
SHA512

fd22e842a71fa38486c364681ed5cf62226bd62db8f18dfc6c11168ac4a2483cfb1ba89875321b534ff8d3696a902dd466a6fcaff05fa5a7b0561f84dbc8028b
SSDEEP

49152:Hd7y+lAMDWONgzyISwy8JJv/WvTUdynBhurj9G9TeRteJ:HYONgzyq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8f28d04776b1a1aab951dadc5803bf70c78ec42e6d373c17fe6418b78458bc63

Files

8f28d04776b1a1aab951dadc5803bf70c78ec42e6d373c17fe6418b78458bc63
.exe windows x86

7ac8838a8d955300b6844574541093a6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

DbgPrint
NtAllocateVirtualMemory
NtClose
NtCreateFile
NtDeviceIoControlFile
NtFreeVirtualMemory
NtQueryInformationProcess
NtQueryPerformanceCounter
RtlAllocateHeap
RtlAnsiStringToUnicodeString
RtlAreBitsClear
RtlAssert
RtlClearBits
RtlCompareMemory
RtlCreateUnicodeString
RtlEqualString
RtlFindLastBackwardRunClear
RtlFindNextForwardRunClear
RtlFreeAnsiString
RtlFreeHeap
RtlFreeUnicodeString
RtlInitAnsiString
RtlInitUnicodeString
RtlInitializeBitMap
RtlIsNameLegalDOS8Dot3
RtlNumberOfClearBits
RtlQueryRegistryValues
RtlReAllocateHeap
RtlSetBits
RtlUnicodeStringToAnsiString
RtlUpcaseUnicodeChar
RtlUpperChar

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

comdlg32

CommDlgExtendedError
GetOpenFileNameW

kernel32

Beep
CloseHandle
ConsoleMenuControl
CreateConsoleScreenBuffer
CreateDirectoryA
CreateEventW
CreateFileA
CreateFileMappingW
CreateFileW
CreateMutexW
CreateProcessA
CreateThread
DebugBreak
DeleteCriticalSection
DeleteFileA
DosDateTimeToFileTime
EnterCriticalSection
ExitProcess
ExitVDM
ExpandEnvironmentStringsA
FileTimeToDosDateTime
FindClose
FindFirstFileA
FindNextFileA
FlushFileBuffers
FreeEnvironmentStringsA
FreeLibrary
GetBinaryTypeA
GetCommandLineA
GetConsoleCursorInfo
GetConsoleInputWaitHandle
GetConsoleMode
GetConsoleScreenBufferInfo
GetConsoleWindow
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceA
GetDriveTypeA
GetEnvironmentStrings
GetExitCodeProcess
GetFileAttributesA
GetFileInformationByHandle
GetFileSize
GetFileTime
GetFileType
GetFullPathNameA
GetLastError
GetLocalTime
GetLocaleInfoA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetNextVDMCommand
GetProcAddress
GetShortPathNameA
GetStartupInfoW
GetStdHandle
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTempFileNameA
GetTickCount
InitializeCriticalSection
InvalidateConsoleDIBits
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LockFile
MapViewOfFile
MoveFileA
QueryPerformanceCounter
ReadConsoleInputExW
ReadConsoleOutputA
ReadFile
ReleaseMutex
RemoveDirectoryA
ResetEvent
ResumeThread
RtlUnwind
SetConsoleActiveScreenBuffer
SetConsoleCtrlHandler
SetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleMode
SetConsolePalette
SetConsoleScreenBufferSize
SetConsoleTitleA
SetConsoleWindowInfo
SetCurrentDirectoryA
SetEndOfFile
SetEvent
SetFileAttributesA
SetFilePointer
SetFileTime
SetLastConsoleEventActive
SetLastError
SetLocalTime
SetUnhandledExceptionFilter
ShowConsoleCursor
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
UnlockFile
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WriteConsoleOutputA
WriteFile

msvcrt

__dllonexit
__lconv_init
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_fpreset
_initterm
_iob
_lock
_onexit
_snprintf
_snwprintf
_strnicmp
_strupr
_unlock
_vscprintf
_vscwprintf
_vsnprintf
_vsnwprintf
_wcmdln
_wfopen
abort
calloc
exit
fclose
fgetws
free
fwrite
malloc
memcpy
memmove
memset
signal
strchr
strcpy
strncmp
strncpy
strrchr
strtoul
toupper
vfprintf
wcslen
wcsncmp
wcsrchr
wcstoul
wprintf

gdi32

CreatePalette
DeleteObject
SetPaletteEntries

user32

AppendMenuW
ClipCursor
CreatePopupMenu
DeleteMenu
DestroyMenu
DrawMenuBar
EnableMenuItem
GetClientRect
GetMenuItemCount
GetMenuItemID
GetSubMenu
InsertMenuW
LoadStringW
MapVirtualKeyW
MapWindowPoints
MessageBoxW
ModifyMenuW
ToAscii

Exports

Exports

MGetVdmPointer
Sim32pGetVDMPointer
VDDAllocMem
VDDDeInstallIOHook
VDDDeInstallMemoryHook
VDDDeInstallUserHook
VDDExcludeMem
VDDFreeMem
VDDIncludeMem
VDDInstallIOHook
VDDInstallMemoryHook
VDDInstallUserHook
VDDQueryDMA
VDDReleaseIrqLine
VDDRequestDMA
VDDReserveIrqLine
VDDSetDMA
VDDSimulate16
VDDTerminateVDM
VdmMapFlat
c_getAF
c_getAH
c_getAL
c_getAX
c_getBH
c_getBL
c_getBP
c_getBX
c_getCF
c_getCH
c_getCL
c_getCS
c_getCX
c_getDF
c_getDH
c_getDI
c_getDL
c_getDS
c_getDX
c_getEAX
c_getEBP
c_getEBX
c_getECX
c_getEDI
c_getEDX
c_getEIP
c_getES
c_getESI
c_getESP
c_getFS
c_getGS
c_getIF
c_getIP
c_getMSW
c_getOF
c_getPF
c_getSF
c_getSI
c_getSP
c_getSS
c_getZF
c_setAF
c_setAH
c_setAL
c_setAX
c_setBH
c_setBL
c_setBP
c_setBX
c_setCF
c_setCH
c_setCL
c_setCS
c_setCX
c_setDF
c_setDH
c_setDI
c_setDL
c_setDS
c_setDX
c_setEAX
c_setEBP
c_setEBX
c_setECX
c_setEDI
c_setEDX
c_setEIP
c_setES
c_setESI
c_setESP
c_setFS
c_setGS
c_setIF
c_setIP
c_setMSW
c_setOF
c_setPF
c_setSF
c_setSI
c_setSP
c_setSS
c_setZF
call_ica_hw_interrupt
demClientErrorEx
demFileDelete
demFileFindFirst
demFileFindNext
demGetPhysicalDriveType
demIsShortPathName
demSetCurrentDirectoryGetDrive
getAF
getAH
getAL
getAX
getBH
getBL
getBP
getBX
getCF
getCH
getCL
getCS
getCX
getDF
getDH
getDI
getDL
getDS
getDX
getEAX
getEBP
getEBX
getECX
getEDI
getEDX
getEFLAGS
getEIP
getES
getESI
getESP
getFS
getGS
getIF
getIP
getIntelRegistersPointer
getMSW
getOF
getPF
getSF
getSI
getSP
getSS
getZF
host_simulate
setAF
setAH
setAL
setAX
setBH
setBL
setBP
setBX
setCF
setCH
setCL
setCS
setCX
setDF
setDH
setDI
setDL
setDS
setDX
setEAX
setEBP
setEBX
setECX
setEDI
setEDX
setEFLAGS
setEIP
setES
setESI
setESP
setFS
setGS
setIF
setIP
setMSW
setOF
setPF
setSF
setSI
setSP
setSS
setZF

Sections

.text
Size: 573KB - Virtual size: 573KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 7.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 139KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rossym
Size: 958KB - Virtual size: 958KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7ac8838a8d955300b6844574541093a6

Headers

File Characteristics

Imports

ntdll

advapi32

comdlg32

kernel32

msvcrt

gdi32

user32

Exports

Exports

Sections

.text Size: 573KB - Virtual size: 573KB

.data Size: 4KB - Virtual size: 3KB

.rdata Size: 60KB - Virtual size: 59KB

.bss Size: - Virtual size: 7.3MB

.edata Size: 4KB - Virtual size: 3KB

.idata Size: 7KB - Virtual size: 6KB

.CRT Size: 512B - Virtual size: 52B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 139KB - Virtual size: 138KB

.reloc Size: 19KB - Virtual size: 19KB

.rossym Size: 958KB - Virtual size: 958KB

.text
Size: 573KB - Virtual size: 573KB

.data
Size: 4KB - Virtual size: 3KB

.rdata
Size: 60KB - Virtual size: 59KB

.bss
Size: - Virtual size: 7.3MB

.edata
Size: 4KB - Virtual size: 3KB

.idata
Size: 7KB - Virtual size: 6KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 139KB - Virtual size: 138KB

.reloc
Size: 19KB - Virtual size: 19KB

.rossym
Size: 958KB - Virtual size: 958KB