Au3Record[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Au3Record.exe
Size

181KB
MD5

22bcb11213c69620eee1e5fdd9c53666
SHA1

d8f849a28ac0cb89275accac8e9b0e3c05f8b0a0
SHA256

0e37803294f91fd03d43cd2b655063a0faa33c429bc7fd622d1d5611fba13d01
SHA512

d1c69ad7b2c25c2f14782477686328ba43bed30f55f9ccdf82bf88f2abfea108b9a7190f076504659cdbeadd37478c603e69893a14f9384e814b9df5b247341c
SSDEEP

3072:LrDq+U/cCj8+MBuFaLD38Rc34ISfDEaIz7L9QPhtzgzhthhL+IU/p:XzUkCj8+MR3sCHSfDEzz7ZQPXgtl6IA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Au3Record.exe

Files

Au3Record.exe
.exe windows x86

303a945292a249afbd45ad9e14ed902e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

InitCommonControlsEx

kernel32

SetStdHandle
HeapReAlloc
RtlUnwind
GetConsoleMode
GetConsoleCP
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
DeleteCriticalSection
CreateProcessW
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameW
ExitProcess
HeapSize
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
LCMapStringW
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
CloseHandle
WriteFile
CreateFileW
GetFileType
GetFileAttributesW
FreeLibrary
GetProcAddress
LoadLibraryW
Sleep
GetStdHandle
FlushFileBuffers
GetModuleHandleW
MulDiv
EncodePointer
DecodePointer
GetCommandLineW
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetLastError
HeapFree
HeapAlloc
RaiseException
EnterCriticalSection
LeaveCriticalSection
WriteConsoleW

user32

RegisterClassExW
LoadIconW
LoadCursorW
WaitForInputIdle
MapVirtualKeyW
GetKeyboardLayoutNameW
KillTimer
UnhookWindowsHookEx
SetWindowsHookExW
EnumChildWindows
GetClassNameW
GetWindowTextW
CallWindowProcW
CharLowerW
GetCursorPos
FindWindowW
GetForegroundWindow
SetWindowLongW
DefWindowProcW
PostQuitMessage
UnregisterClassW
DestroyWindow
MessageBoxW
PostMessageW
SetWindowTextW
GetWindowRect
GetParent
GetWindowLongW
GetFocus
SetFocus
EnableWindow
GetClientRect
MoveWindow
LoadImageW
CreateWindowExW
DispatchMessageW
TranslateMessage
IsDialogMessageW
GetMessageW
SetTimer
ShowWindow
SendMessageW
DestroyIcon
ReleaseDC
GetDC

gdi32

GetDeviceCaps
DeleteObject
CreateFontW
GetStockObject

comdlg32

GetOpenFileNameW

advapi32

RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

303a945292a249afbd45ad9e14ed902e

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

kernel32

user32

gdi32

comdlg32

advapi32

Sections

.text Size: 55KB - Virtual size: 55KB

.rdata Size: 17KB - Virtual size: 17KB

.data Size: 4KB - Virtual size: 21KB

.rsrc Size: 103KB - Virtual size: 102KB

.text
Size: 55KB - Virtual size: 55KB

.rdata
Size: 17KB - Virtual size: 17KB

.data
Size: 4KB - Virtual size: 21KB

.rsrc
Size: 103KB - Virtual size: 102KB