f84c6d5375978f8766454ba1c8bd4edbea2463021705554e6ed0a5a9496aad7c

Sharing

Copy URL Twitter E-mail

General

Target

f84c6d5375978f8766454ba1c8bd4edbea2463021705554e6ed0a5a9496aad7c
Size

1.6MB
MD5

952f5458e88814c58ab605f76b91241c
SHA1

bd9be5058cceadbd51dcba7f4e53c73ed2f7d685
SHA256

f84c6d5375978f8766454ba1c8bd4edbea2463021705554e6ed0a5a9496aad7c
SHA512

18ce7038e610ca2c16bf54da0486262e5fb0af324a2d1df4819aa3b9efb4130ef2b1658d4851ed32819e992e638cd2a5be7db5015eed5364c07d5dc546c773ae
SSDEEP

24576:DsqYkG4gZhaAsjsGVxoQGqbNZfJJ9FxsW6:DsqYkG5a55bfT9FxsW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f84c6d5375978f8766454ba1c8bd4edbea2463021705554e6ed0a5a9496aad7c

Files

f84c6d5375978f8766454ba1c8bd4edbea2463021705554e6ed0a5a9496aad7c
.exe windows x86

1777b61904f3de60963105b3313804ff

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

PurgeComm
SetCommMask
SetCommState
SetCommTimeouts
lstrcmpW
lstrlenW
WideCharToMultiByte
GetUserDefaultUILanguage
GetSystemDirectoryW
SetLastError
GetTickCount
CreateDirectoryA
GetSystemInfo
GetModuleHandleW
GetProcAddress
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileSize
SetFilePointer
GetModuleFileNameW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetPrivateProfileSectionW
MultiByteToWideChar
SetStdHandle
LoadLibraryW
WaitForMultipleObjectsEx
GetFileAttributesExW
CreateProcessA
GetExitCodeProcess
VirtualQuery
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
ReleaseSemaphore
SetProcessAffinityMask
VirtualProtect
VirtualFree
VirtualAlloc
GetVersionExW
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
HeapAlloc
GetModuleFileNameA
HeapQueryInformation
GetCommState
HeapReAlloc
HeapFree
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetProcessHeap
GetStringTypeW
FreeLibrary
WriteConsoleW
SetConsoleCtrlHandler
SetupComm
ClearCommError
ClearCommBreak
Sleep
CreateEventW
CancelIo
DeviceIoControl
GetOverlappedResult
GetLastError
CloseHandle
OutputDebugStringW
OutputDebugStringA
WriteFile
ReadFile
CreateFileW
GetFileType
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStdHandle
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
WaitForSingleObjectEx
SetEvent
RtlCaptureStackBackTrace
CreateTimerQueue
TryEnterCriticalSection
HeapValidate
CreateSemaphoreW
GetStartupInfoW
TlsFree
TlsSetValue
SetEnvironmentVariableA
TlsGetValue
TlsAlloc
TerminateProcess
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FatalAppExitA
GetCommandLineW
AreFileApisANSI
ExitProcess
RtlUnwind
RaiseException
LoadLibraryExW
ExitThread
CreateThread
GetModuleHandleExW
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
DeleteCriticalSection
LeaveCriticalSection
HeapSize
CreateFileA
EnterCriticalSection
GetExitCodeThread
DuplicateHandle
WaitForSingleObject
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId

user32

SendMessageW
PostMessageW
PostQuitMessage
ShowWindow
SetWindowPos
SendMessageA
GetDlgItem
EnableWindow
UpdateWindow
SetWindowTextW
GetWindowTextA
GetWindowTextW
GetWindowTextLengthW
GetWindowRect
MessageBoxW
CopyRect
OffsetRect
DispatchMessageW
TranslateMessage
GetMessageW
wsprintfW
CreateDialogParamW
SetDlgItemTextW
GetDesktopWindow
GetParent

winspool.drv

XcvDataW
EnumPrintersW
AddMonitorW
EnumMonitorsA
EnumPortsA
ClosePrinter
DeletePrinterDriverA
GetPrinterDriverDirectoryW
EnumPrinterDriversA
AddPrinterDriverW
OpenPrinterW
DeletePrinter
EnumJobsA
SetJobA
OpenPrinterA
EnumPrintersA
AddPrinterW
SetPrinterDataW
ord204
EnumPortsW
GetPrinterA
DeleteMonitorA

advapi32

ControlService
SetFileSecurityA
StartServiceW
QueryServiceStatusEx
QueryServiceStatus
OpenServiceW
OpenSCManagerW
InitializeSecurityDescriptor
CloseServiceHandle
ChangeServiceConfigW
RegOpenKeyA
RegEnumKeyA
RegCloseKey
SetSecurityDescriptorDacl

shell32

ShellExecuteW
SHGetFolderPathW
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
SHFileOperationW

winmm

timeGetTime

ws2_32

closesocket
connect
htons
inet_addr
inet_ntoa
recv
send
setsockopt
shutdown
socket
gethostbyname
WSAStartup
WSACleanup
WSAGetLastError
WSAIoctl
recvfrom
sendto
gethostname
bind

setupapi

SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Registry_PropertyW
CM_Get_Parent
SetupDiCallClassInstaller
SetupDiGetDeviceRegistryPropertyA
SetupDiGetDeviceInstanceIdA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsA
SetupDiGetClassDevsW

shlwapi

wvnsprintfW
wnsprintfW
StrCmpW
SHDeleteKeyA
PathAddBackslashA
PathIsDirectoryA
PathFileExistsW
StrCpyW
StrCatW
StrRChrW

comctl32

ord17

version

VerInstallFileW

Sections

.textbss
Size: - Virtual size: 599KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1777b61904f3de60963105b3313804ff

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

winspool.drv

advapi32

shell32

winmm

ws2_32

setupapi

shlwapi

comctl32

version

Sections

.textbss Size: - Virtual size: 599KB

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 264KB - Virtual size: 264KB

.data Size: 34KB - Virtual size: 55KB

.idata Size: 9KB - Virtual size: 9KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 56KB - Virtual size: 55KB

.textbss
Size: - Virtual size: 599KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 264KB - Virtual size: 264KB

.data
Size: 34KB - Virtual size: 55KB

.idata
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 56KB - Virtual size: 55KB