tmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tmp
Size

8.1MB
MD5

81b5667b7dd76ef4a7b8cbf236a55725
SHA1

261e9c4402a220f9a450d5be32ad7f279b49cc63
SHA256

28ed14dab82bc3f075850cfd947516405e0d11b600aff06d9c11495c09c2f30c
SHA512

50775f653ecd900a927b5cee6d369c962cf4ccb895c15453961aab40df31f5d163553c5b0ed8911c9c3e996d0241c92192c0977bb75ebe6e7bdb9b13c648e6c0
SSDEEP

196608:MONCQk2Zf+abIY3nDIICOegtyIbwyPMguoC0DbfVo9f:MgjC+nUqtyIbnPMg7P3Vk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp

Files

tmp
.exe windows:5 windows x86

845da2673135de81ea88a992eb7e6056

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

d3dx9_43

D3DXCreateTextureFromFileInMemoryEx
D3DXCreateVolumeTextureFromFileInMemoryEx
D3DXCreateFontA
D3DXSaveSurfaceToFileA
D3DXGetImageInfoFromFileInMemory
D3DXCreateCubeTextureFromFileInMemoryEx
D3DXCreateTextureFromFileInMemory

d3d9

Direct3DCreate9

kernel32

InterlockedDecrement
GetSystemInfo
FreeLibrary
FindNextFileW
lstrlenA
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetStdHandle
DeleteCriticalSection
GetCurrentDirectoryW
GetFullPathNameW
LocalFree
GetLastError
InterlockedIncrement
GetCurrentThread
ExitProcess
InitializeCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceA
SetFileAttributesA
MoveFileA
DeleteFileA
SetConsoleTitleA
AllocConsole
GlobalAlloc
Sleep
GlobalUnlock
GlobalLock
CreateThread
GetCurrentProcess
TerminateProcess
GetCurrentDirectoryA
GetFullPathNameA
CreateEventA
GetTimeZoneInformation
LCMapStringW
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleHandleA
LCMapStringA
GetEnvironmentStringsW
FreeEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
InterlockedExchange
ReadFile
FormatMessageA
CreateFileW
GetFileSize
VirtualQuery
GetEnvironmentStrings
FreeEnvironmentStringsA
SetEvent
OutputDebugStringA
OpenEventA
HeapCreate
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetCPInfo
GetStdHandle
SetHandleCount
LeaveCriticalSection
EnterCriticalSection
CloseHandle
TerminateThread
WaitForSingleObject
GetVersionExA
GetProcAddress
GlobalMemoryStatusEx
CopyFileA
GetModuleFileNameA
MultiByteToWideChar
LoadLibraryA
WriteFile
HeapSize
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
HeapReAlloc
GetFileType
GetDriveTypeA
FileTimeToLocalFileTime
RaiseException
RtlUnwind
GetStartupInfoA
GetCommandLineA
GetModuleHandleW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ExitThread
GetSystemTimeAsFileTime
Process32First
Process32Next
GetProcessHeap
HeapAlloc
HeapFree
OpenProcess
QueryFullProcessImageNameA
FindFirstFileExW
GetComputerNameA
WriteProcessMemory
VirtualProtect
VirtualAlloc
VirtualFree
Thread32First
GetCurrentProcessId
Thread32Next
OpenThread
ResumeThread
CreateToolhelp32Snapshot
Module32First
Module32Next
CreateFileMappingA
UnmapViewOfFile
MulDiv
DuplicateHandle
TryEnterCriticalSection
InterlockedExchangeAdd
SetEndOfFile
GetFileTime
MapViewOfFile
GetOEMCP
GetACP
GetTickCount
GetLocalTime
GetSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
GetCurrentThreadId
CreateFileA
GetFileAttributesA
CreateDirectoryA
FindFirstFileA
FindClose
SetFileAttributesW
CreateDirectoryW
GetFileAttributesW
SetFilePointer
DeleteFileW
MoveFileW
GetTempPathA
GetTempPathW
WideCharToMultiByte

user32

SetFocus
MessageBoxA
LoadIconA
LoadCursorA
LoadStringW
SetRect
AdjustWindowRect
GetWindowLongA
SetWindowPos
ClipCursor
ReleaseCapture
GetCursorPos
GetWindowRect
SetCapture
LoadImageA
RegisterClassExA
DestroyWindow
UnregisterClassA
DrawTextA
GetDC
EnumDisplayMonitors
ReleaseDC
EnumWindows
IsWindowVisible
ShowCursor
GetMonitorInfoA
PeekMessageW
GetMessageW
EnumDisplayDevicesA
GetSystemMetrics
PostQuitMessage
RegisterClassA
CreateWindowExA
GetActiveWindow
InvalidateRect
UpdateWindow
BeginPaint
EndPaint
SetClipboardViewer
ChangeClipboardChain
DefWindowProcA
SendMessageA
SetWindowLongA
SetWindowTextA
ShowWindow
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
GetWindowThreadProcessId
GetCaretBlinkTime
GetFocus
GetKeyState
OpenClipboard
GetClipboardData
CloseClipboard
GetAsyncKeyState
SwitchToThisWindow
GetClassNameA
GetClientRect
ClientToScreen

gdi32

SetMapMode
CreateDIBSection
DeleteDC
GetDeviceCaps
CreateICA
SetTextAlign
GetStockObject
CreateFontA
CreateCompatibleDC
LineTo
MoveToEx
ExtTextOutA
GetObjectA
SetBkMode
CreateCompatibleBitmap
BitBlt
SelectObject
GetTextExtentPoint32A
DeleteObject
SetTextColor
SetBkColor
CreatePen

advapi32

GetTokenInformation
OpenProcessToken
GetSidSubAuthority
GetSidSubAuthorityCount
AdjustTokenPrivileges
LookupPrivilegeValueA
RegOpenKeyExW
CryptGetHashParam
CryptAcquireContextW
CryptGetProvParam
CryptEnumProvidersA
CryptGetUserKey
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptExportKey
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
GetUserNameA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA

shell32

ShellExecuteA

ole32

CoUninitialize
CoSetProxyBlanket
CoInitialize
CoCreateInstance
CoInitializeEx

oleaut32

VariantInit
VariantClear
SysFreeString
SysAllocString

iphlpapi

GetInterfaceInfo
GetAdaptersInfo

psapi

GetModuleBaseNameA

dbghelp

MakeSureDirectoryPathExists
ImageNtHeader

wininet

InternetConnectA
DeleteUrlCacheEntry
InternetCloseHandle
FtpPutFileA
FtpCreateDirectoryA
InternetOpenA

sensapi

IsNetworkAlive

gdiplus

GdiplusShutdown
GdipCloneImage
GdipGetImageEncoders
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipDisposeImage
GdipAlloc
GdipFree
GdipGetImageEncodersSize

urlmon

URLDownloadToFileA

ws2_32

ntohs
setsockopt
ioctlsocket
WSAGetLastError
socket
WSAStartup
getsockopt
inet_ntoa
getsockname
gethostbyname
inet_addr
htons
connect
select
__WSAFDIsSet
bind
closesocket
shutdown
recv
send

dinput8

DirectInput8Create

crypt32

CryptEncodeObject
CryptDecryptMessage
CryptMsgOpenToDecode
CryptMsgUpdate
CryptMsgClose
CryptMsgGetParam
CryptMsgControl
CertGetSubjectCertificateFromStore
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertCreateCertificateContext
CertGetCertificateContextProperty
CryptDecodeObject
CertSetCertificateContextProperty
CertDuplicateCertificateContext
CertNameToStrW
CertFreeCertificateContext
CryptEncryptMessage

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 749KB - Virtual size: 749KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 100KB - Virtual size: 860KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 166KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

845da2673135de81ea88a992eb7e6056

Headers

DLL Characteristics

File Characteristics

Imports

d3dx9_43

d3d9

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

iphlpapi

psapi

dbghelp

wininet

sensapi

gdiplus

urlmon

ws2_32

dinput8

crypt32

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 749KB - Virtual size: 749KB

.data Size: 100KB - Virtual size: 860KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 5.1MB - Virtual size: 5.1MB

.reloc Size: 166KB - Virtual size: 165KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 749KB - Virtual size: 749KB

.data
Size: 100KB - Virtual size: 860KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 5.1MB - Virtual size: 5.1MB

.reloc
Size: 166KB - Virtual size: 165KB