e1c0de00090d5db459ece8e030dbdaa33c9470eb8598bee642711e2dbda1aed5

Sharing

Copy URL Twitter E-mail

General

Target

e1c0de00090d5db459ece8e030dbdaa33c9470eb8598bee642711e2dbda1aed5
Size

5.9MB
MD5

038dc543a4be82e0cd7815c9d7d44a54
SHA1

fe7e0bf81a3ff77471931cf14048b2dbf80bd94e
SHA256

e1c0de00090d5db459ece8e030dbdaa33c9470eb8598bee642711e2dbda1aed5
SHA512

d237863a557c6e32e10bb890fb019ac2514ae56b7bbaa529cc94d1aea59deabc4be486a834e36db8c24b2967402fdc0e260402aba0a128e1c39109d8ab935aac
SSDEEP

98304:zWbKz2ybPxCw+GsibNP4WytDz8T6QdVsHhD08pxnUNeygy5LHH8wufpQP8:zp/bPxF+GsibNP4plYdVsHhD08pxnUIF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e1c0de00090d5db459ece8e030dbdaa33c9470eb8598bee642711e2dbda1aed5

Files

e1c0de00090d5db459ece8e030dbdaa33c9470eb8598bee642711e2dbda1aed5
.exe windows x86

75dcfcf14ec172e41b52487ccbc1d561

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LeaveCriticalSection
EnterCriticalSection
RaiseException
GetCurrentProcess
GetCurrentThreadId
SetLastError
InitializeCriticalSectionAndSpinCount
CreateProcessA
GetExitCodeProcess
SetThreadPriority
MoveFileA
OpenProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
TerminateThread
SetEvent
WaitForSingleObject
CreateEventA
SetEnvironmentVariableA
CompareStringW
GetProcessHeap
SetEndOfFile
CreateFileW
WriteConsoleW
SetStdHandle
GetCurrentDirectoryW
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetDriveTypeW
GetLocaleInfoW
HeapSize
GetStdHandle
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
TlsFree
TlsSetValue
TlsGetValue
lstrlenA
IsProcessorFeaturePresent
GetCPInfo
LCMapStringW
GetTimeZoneInformation
FindNextFileA
FindFirstFileExA
FileTimeToLocalFileTime
GetStartupInfoW
HeapSetInformation
GetModuleHandleA
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
GetModuleFileNameW
LoadLibraryW
MultiByteToWideChar
GetPrivateProfileStringA
FindFirstFileA
FindClose
CopyFileA
Sleep
WritePrivateProfileStringA
GetModuleFileNameA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GlobalMemoryStatus
GetLastError
CreateThread
GetPrivateProfileIntA
LoadLibraryA
WideCharToMultiByte
GetCommandLineA
GetModuleHandleW
GetFullPathNameA
GetDateFormatA
GetTimeFormatA
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
RtlUnwind
DecodePointer
EncodePointer
InterlockedExchange
ReadFile
GetCurrentProcessId
GetVersionExA
WriteFile
IsBadStringPtrA
LocalFree
VirtualQuery
FormatMessageA
CreateFileA
SetFilePointer
ExitProcess
SetUnhandledExceptionFilter
QueryPerformanceFrequency
QueryPerformanceCounter
GetProcessAffinityMask
GetCurrentThread
MapViewOfFile
UnmapViewOfFile
CloseHandle
OpenFileMappingA
CreateFileMappingA
GetTickCount
WinExec
SetCurrentDirectoryA
GetCurrentDirectoryA
DeleteFileA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFullPathNameW
GetEnvironmentVariableW
InitializeCriticalSection
GetLocalTime
CreateDirectoryA
GetVolumeInformationA
WritePrivateProfileSectionA
GetFileAttributesA
GetProcAddress
SetFileAttributesA
GetPrivateProfileSectionA
OutputDebugStringA
VirtualAlloc
VirtualFree
FreeLibrary
TlsAlloc

user32

LoadImageA
PostQuitMessage
InvalidateRect
GetWindowRect
PtInRect
UpdateWindow
GetActiveWindow
LoadStringA
BeginPaint
CreateWindowExA
ShowWindow
UnregisterClassA
EmptyClipboard
SetClipboardData
wsprintfA
GetKeyboardState
KillTimer
EndPaint
LoadCursorA
RegisterClassExA
LoadIconA
SetTimer
GetKeyState
GetDC
GetDesktopWindow
GetWindowLongA
SetWindowLongA
MoveWindow
DestroyWindow
ShowCursor
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA
CharPrevA
OpenClipboard
GetClipboardData
CloseClipboard
GetKeyboardLayoutNameA
LoadKeyboardLayoutA
GetClientRect
IsWindow
GetWindowTextA
FindWindowExA
GetWindowThreadProcessId
PostMessageA
SetParent
SetCapture
ReleaseCapture
FlashWindowEx
SetFocus
SetWindowTextA
CharNextA
SendMessageA
GetFocus
MessageBoxA

gdi32

StretchBlt
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject

advapi32

OpenProcessToken
AdjustTokenPrivileges
RegOpenKeyExA
RegEnumValueA
RegCreateKeyA
RegSetValueExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
LookupPrivilegeValueA

oleaut32

VariantClear
SysAllocString
VariantChangeType
SysFreeString

winmm

timeGetTime

shlwapi

PathIsRelativeW
SHDeleteKeyA
PathFileExistsA

gdiplus

GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageRectI
GdipLoadImageFromFile
GdiplusShutdown
GdipLoadImageFromFileICM
GdipAlloc
GdipCloneImage
GdipDisposeImage
GdipFree
GdiplusStartup

ws2_32

inet_ntoa
ntohs
shutdown
closesocket
WSASend
inet_addr
htons
socket
setsockopt
htonl
WSAAsyncSelect
WSACleanup
ntohl
connect
WSAGetLastError
WSARecv
WSAStartup

wininet

InternetCloseHandle
InternetReadFile
HttpQueryInfoA
InternetOpenUrlA
InternetOpenA

iphlpapi

GetIfTable

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

dbghelp

SymCleanup
SymGetTypeInfo
SymGetModuleBase
SymFunctionTableAccess
StackWalk
SymFromAddr
SymGetLineFromAddr
SymSetContext
SymSetOptions
SymInitialize
SymEnumSymbols

shell32

SHGetPathFromIDListA
SHGetSpecialFolderPathA
ShellExecuteA
SHGetSpecialFolderLocation
SHGetMalloc

psapi

EnumProcessModules
GetModuleFileNameExA
GetModuleBaseNameA

Sections

.text
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 636KB - Virtual size: 636KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 42.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 376KB - Virtual size: 376KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

75dcfcf14ec172e41b52487ccbc1d561

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

oleaut32

winmm

shlwapi

gdiplus

ws2_32

wininet

iphlpapi

version

dbghelp

shell32

psapi

Sections

.text Size: 4.9MB - Virtual size: 4.9MB

.rdata Size: 636KB - Virtual size: 636KB

.data Size: 23KB - Virtual size: 42.9MB

.rsrc Size: 7KB - Virtual size: 6KB

.reloc Size: 376KB - Virtual size: 376KB

.text
Size: 4.9MB - Virtual size: 4.9MB

.rdata
Size: 636KB - Virtual size: 636KB

.data
Size: 23KB - Virtual size: 42.9MB

.rsrc
Size: 7KB - Virtual size: 6KB

.reloc
Size: 376KB - Virtual size: 376KB