3ab508af09cae88d9db0873dce82c095ede2c52c8c3d0bf3bbb870511980e839

Sharing

Copy URL

Twitter E-mail

General

Target

3ab508af09cae88d9db0873dce82c095ede2c52c8c3d0bf3bbb870511980e839
Size

202KB
MD5

6b084155cac87e8847c03ba1d1fe5e2a
SHA1

af808a0a789c62c3f272cdd10a95aea9aae40835
SHA256

3ab508af09cae88d9db0873dce82c095ede2c52c8c3d0bf3bbb870511980e839
SHA512

227b6819acce01a7caae09b97448d05f752091a0088c1612bf763ccda17cfa675b499974414aee1c77a109841437d05feaad2f7817d2eb64c03f794f1b6a7460
SSDEEP

3072:emHr2WdyosbmQy3YCQ/0+faxMqqDLy/CREjoOoe7Jb:ezIGmQy3YCQ/0+fzqqDLuCREjoOoe7J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3ab508af09cae88d9db0873dce82c095ede2c52c8c3d0bf3bbb870511980e839

Files

3ab508af09cae88d9db0873dce82c095ede2c52c8c3d0bf3bbb870511980e839
.exe windows x64

2df79a9420b0d548883ecb965fdf8e14

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mfc100u

ord4935
ord10841
ord2759
ord2858
ord2859
ord3362
ord10798
ord2286
ord5064
ord12208
ord10414
ord5910
ord13009
ord6837
ord13003
ord2577
ord3850
ord13687
ord3857
ord4256
ord4223
ord4219
ord4253
ord4274
ord4232
ord4261
ord4270
ord4240
ord4244
ord4248
ord4236
ord4265
ord4228
ord1497
ord1490
ord1492
ord1486
ord1479
ord10926
ord10928
ord12359
ord2760
ord8084
ord9734
ord5998
ord10892
ord7803
ord13001
ord10626
ord3282
ord10763
ord7957
ord13681
ord13680
ord13752
ord13769
ord13765
ord13767
ord13768
ord13766
ord2355
ord7088
ord2791
ord2794
ord12255
ord5340
ord2659
ord3608
ord7596
ord2530
ord3310
ord1877
ord2172
ord3854
ord5868
ord7968
ord908
ord2850
ord4200
ord1276
ord266
ord369
ord5582
ord8038
ord10845
ord2354
ord12251
ord5338
ord2663
ord2884
ord2885
ord9216
ord10101
ord9747
ord7870
ord10805
ord6451
ord3160
ord3242
ord3163
ord3249
ord3261
ord9770
ord1190
ord776
ord12581
ord3836
ord5255
ord12926
ord958
ord1288
ord5426
ord1868
ord410
ord286
ord2541
ord285
ord5052
ord5017
ord7315
ord3998
ord12840
ord7573
ord280
ord2445
ord959
ord4043
ord411
ord957
ord2444
ord10642
ord409
ord5344
ord290
ord3704
ord1428
ord5019
ord12756
ord2029
ord2025
ord13017
ord2054
ord4115
ord7068
ord287
ord291
ord11012
ord1991
ord2140
ord468
ord1457
ord12841
ord265
ord1240
ord926
ord1270
ord7321
ord7246
ord11463
ord13475
ord4570
ord2117
ord11157
ord11158
ord13002
ord6836
ord13008
ord8221
ord3543
ord3484
ord11542
ord6853
ord1716
ord13782
ord10658
ord12889
ord11150
ord6898
ord13191
ord13188
ord13193
ord13190
ord13192
ord13189
ord3295
ord5049
ord10910
ord10918
ord7094
ord9189
ord10922
ord10891
ord11523
ord4473
ord4737
ord4907
ord8174
ord4715
ord4910
ord4476
ord4612
ord4457
ord6669
ord6670
ord6660
ord4610
ord7096
ord9019
ord8037
ord5894
ord878
ord9138
ord6609
ord11225
ord2449
ord9024
ord5570
ord885
ord3277
ord4199
ord1900
ord2019
ord3969
ord4623
ord310
ord890
ord4131
ord395
ord11713
ord946
ord469
ord324
ord2439
ord5025
ord1953
ord3486
ord891
ord3487
ord3942
ord3368
ord898
ord1005
ord1290
ord5790
ord296
ord12434
ord2023
ord12431
ord12436
ord12430
ord2748
ord1278
ord2050

msvcr100

_fmode
free
calloc
memset
malloc
_wtoi
memcpy
_amsg_exit
__wgetmainargs
__C_specific_handler
_CxxThrowException
__crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
__set_app_type
__CxxFrameHandler3
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter

kernel32

GetProcAddress
RemoveDirectoryW
lstrlenW
GetLastError
FindFirstFileW
SetFileAttributesW
DeleteFileW
FindNextFileW
FindClose
WinExec
GetModuleHandleW
LocalFree
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
DecodePointer
EncodePointer
GetStartupInfoW
SetEnvironmentVariableW
Sleep
LoadLibraryW
FreeLibrary

user32

LoadIconW
EnableWindow
GetClientRect
IsIconic
GetSystemMenu
SendMessageW
AppendMenuW
DrawIcon
GetSystemMetrics

advapi32

RegCloseKey
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyW
RegOpenKeyExW

shell32

SHGetSpecialFolderLocation
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc

ole32

OleRun
CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VariantChangeType
VariantClear
VariantInit
SetErrorInfo
CreateErrorInfo
GetErrorInfo

Sections

.text
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2df79a9420b0d548883ecb965fdf8e14

Headers

DLL Characteristics

File Characteristics

Imports

mfc100u

msvcr100

kernel32

user32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 95KB - Virtual size: 94KB

.rdata Size: 38KB - Virtual size: 37KB

.data Size: 16KB - Virtual size: 18KB

.pdata Size: 4KB - Virtual size: 3KB

.idata Size: 10KB - Virtual size: 9KB

.rsrc Size: 37KB - Virtual size: 37KB

.text
Size: 95KB - Virtual size: 94KB

.rdata
Size: 38KB - Virtual size: 37KB

.data
Size: 16KB - Virtual size: 18KB

.pdata
Size: 4KB - Virtual size: 3KB

.idata
Size: 10KB - Virtual size: 9KB

.rsrc
Size: 37KB - Virtual size: 37KB