aa45e46faa194d98c5b235aa1055aad8c27dfd922b53e0dac725e4934603aed8

Sharing

Copy URL Twitter E-mail

General

Target

aa45e46faa194d98c5b235aa1055aad8c27dfd922b53e0dac725e4934603aed8
Size

264KB
MD5

1d217f68ca7c2011d63ef9bbb7934ea6
SHA1

9314975dac21787efc9dc68c7cbe19c149da50f5
SHA256

aa45e46faa194d98c5b235aa1055aad8c27dfd922b53e0dac725e4934603aed8
SHA512

04f58b3287db1b6c9a81f31b0d44222808a72d74a91181397e39495753959e1dcbcfe1f5755b9ccb35d0af6dff8e60140e3505de7a40d5ec2094e2c59a0c2600
SSDEEP

6144:qc2u0N/c5nJga84mxyjc/x6WpPaRdf7uWoS:q9u0Rcsa84mxUWpCnoS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa45e46faa194d98c5b235aa1055aad8c27dfd922b53e0dac725e4934603aed8

Files

aa45e46faa194d98c5b235aa1055aad8c27dfd922b53e0dac725e4934603aed8
.exe windows x86

a163df42bfeec7c5d0f3619270506ef8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipFree
GdipCreateFromHDC
GdipLoadImageFromFile
GdipAlloc
GdipCloneImage
GdipDrawImageRectI
GdipDisposeImage
GdiplusShutdown
GdiplusStartup
GdipDeleteGraphics

otu

O096bc0c1d3c04985ee397132938131e3
O17a97e5080f5dec80949de34cad8025e
O1a826a4be9241424cab1570457e2a032
O22c6f0a139e4c1d04530a97705d48954
O23facd9c10d7facb909f4e3ab6090b50
O352f4e74381224f12364653ce010327c
O3b36e193ca9f5c775ca462d0023b238d
O432e5d00c68345cea0ac979a0ec8e72d
O4afe8a243b541c8d1bb5fdaaa53a1475
O52db1d40b2eee325b89fde52f77b2dd7
O886b4a666e150477dededbf52c03b9b1
O8ee1c48f4b197e3c24f76b194df283df
O965cc8967378ef9cf55c6368cec01f42
Obb27c0419edb9cfa1598ddb90fd05f57
Of2bd6f285c3d5b40a42f09d8b4fcf13f

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

eboot

ord32
ord31
ord12
ord62
ord61
ord4
ord5
ord6
ord33
ord35
ord19
ord34

flashtoollib

ord181
ord180
ord24
ord14
ord35
ord26
ord25
ord34
ord13
ord137
ord32
ord237
ord238
ord15
ord16
ord18
ord153
ord51
ord21
ord50
ord235
ord151
ord44
ord169
ord106
ord53
ord149
ord152
ord163
ord150
ord147
ord45
ord4
ord174
ord28
ord145

mfc42

ord1158
ord4278
ord4202
ord5710
ord926
ord4277
ord1105
ord922
ord283
ord2764
ord781
ord6442
ord6070
ord3797
ord2086
ord6134
ord5265
ord4376
ord4853
ord4998
ord2514
ord6052
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5280
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4425
ord3597
ord641
ord6648
ord800
ord4129
ord6663
ord2818
ord860
ord540
ord324
ord825
ord2370
ord4234
ord3619
ord3626
ord2414
ord2452
ord1641
ord2860
ord3092
ord4710
ord3663
ord2411
ord2023
ord4218
ord2578
ord6055
ord1776
ord4398
ord5290
ord3402
ord4424
ord3582
ord567
ord616
ord2302
ord6199
ord755
ord6172
ord5875
ord537
ord5789
ord2859
ord470
ord1576
ord6200
ord2642
ord6880
ord2379
ord858
ord2822
ord1200
ord3874
ord3811
ord6215
ord6453
ord3767
ord924
ord5683
ord2575
ord4396
ord3574
ord3721
ord609
ord795
ord2863
ord5981
ord3873
ord2864
ord1146
ord1168
ord823
ord6605
ord4299
ord6197
ord4275
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord815
ord561
ord2621
ord1134
ord6438
ord2725
ord535
ord6877
ord5572
ord2915
ord3089
ord3708

msvcrt

?terminate@@YAXXZ
_strcmpi
_itoa
_setmbcp
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
atoi
free
malloc
__CxxFrameHandler
swprintf
fclose
fputc
fopen
fgetc
_mbscmp
sprintf
exit
_ftol
strtoul
difftime
time
strncmp
__dllonexit
_onexit
_exit

kernel32

GetStartupInfoA
GetModuleHandleA
CreateFileA
CloseHandle
WinExec
FreeLibrary
GetPrivateProfileStringA
GetSystemDefaultLangID
FindResourceA
MultiByteToWideChar
Sleep
GetModuleFileNameA
VirtualFree
GetProcAddress
LoadResource
VirtualAlloc
LockResource
LoadLibraryA

user32

EnableWindow
RedrawWindow
GetWindowRect
FillRect
IsIconic
GetSystemMetrics
DrawIcon
GetWindow
ScreenToClient
LoadIconA
SetTimer
GetParent
SendMessageA
MessageBeep
GetSystemMenu
GetClientRect
EnableMenuItem
MessageBoxA
wsprintfA
KillTimer
GetDC

gdi32

GetTextExtentPoint32A
CreateFontA
GetObjectA
CreateFontIndirectA

advapi32

IsTextUnicode

shell32

ShellExecuteA

comctl32

ord17

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 168KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a163df42bfeec7c5d0f3619270506ef8

Headers

File Characteristics

Imports

gdiplus

otu

version

eboot

flashtoollib

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

Sections

.text Size: 64KB - Virtual size: 64KB

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 16KB - Virtual size: 16KB

.data Size: 8KB - Virtual size: 13KB

.rsrc Size: 168KB - Virtual size: 168KB

.text
Size: 64KB - Virtual size: 64KB

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 8KB - Virtual size: 13KB

.rsrc
Size: 168KB - Virtual size: 168KB