7005383d61644f742d6489e51e8b816ac1dece6146def1ab6bc5c7fedf3bbf7f

Sharing

Copy URL Twitter E-mail

General

Target

7005383d61644f742d6489e51e8b816ac1dece6146def1ab6bc5c7fedf3bbf7f
Size

1.4MB
MD5

2ecc1aafbf1936eddd20b53bbabe8785
SHA1

5b0c372441c015dddfba59635d6caddad8e87c77
SHA256

7005383d61644f742d6489e51e8b816ac1dece6146def1ab6bc5c7fedf3bbf7f
SHA512

d2ebafa79e544a972d5372eac74dc586665cc78fdfd1c4a5f6368f55c722b47685756fb6ef5132bed8edd941701818baf0ab602fd33cbb317aa90b0f65752d46
SSDEEP

24576:9eqh8aRfb8fq/XeGhCp2FP5hdgRp51ey6qth77rDrjdAT9bImIitV2ImWUu6CgCS:9eqhjRjUq/X20I3PeyBrDrJA3tQ+gCS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7005383d61644f742d6489e51e8b816ac1dece6146def1ab6bc5c7fedf3bbf7f

Files

7005383d61644f742d6489e51e8b816ac1dece6146def1ab6bc5c7fedf3bbf7f
.exe windows:5 windows x86

f83eea2af4406cf8ea6de530f310449b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
CreateMutexW
lstrcmpiW
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetCommandLineW
WriteFile
CreateFileW
FindAtomW
GlobalAddAtomW
GetTickCount
WideCharToMultiByte
lstrcpyW
FindNextFileW
FindClose
GetFullPathNameW
FindFirstFileW
CreateFileA
GetTempPathA
CreateThread
TlsGetValue
ReleaseMutex
GetFileSizeEx
SetFilePointerEx
GetFileType
lstrcmpA
FormatMessageW
GetSystemTime
LocalFree
GetSystemTimeAsFileTime
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
Sleep
GetCurrentProcess
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
CompareFileTime
GetTempFileNameW
MoveFileW
MoveFileExW
CopyFileW
GetDriveTypeW
GetModuleHandleW
lstrcmpiA
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
MulDiv
GetModuleHandleA
GetDateFormatA
DeleteCriticalSection
GetTimeZoneInformation
LCMapStringW
QueryPerformanceCounter
GetStartupInfoA
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleMode
GetConsoleCP
GetModuleFileNameA
HeapCreate
IsValidCodePage
GetOEMCP
GetCPInfo
InitializeCriticalSection
SetLastError
GetCurrentThreadId
RaiseException
GetPrivateProfileStringW
GetFileAttributesW
GetTempPathW
GlobalFindAtomW
SetFileAttributesW
CreateDirectoryW
WritePrivateProfileStringW
GetProcAddress
lstrlenA
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetStdHandle
ExitProcess
GetStartupInfoW
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
SetEndOfFile
SetFileTime
ReadFile
GetFileSize
UnmapViewOfFile
SetFilePointer
MapViewOfFile
CreateFileMappingW
FindResourceExW
ReadProcessMemory
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetFileTime
GetExitCodeProcess
WaitForSingleObject
GetLongPathNameW
TerminateProcess
OpenProcess
GetCurrentProcessId
GetEnvironmentVariableW
OutputDebugStringW
DebugBreak
GetVersionExW
SystemTimeToFileTime
LocalFileTimeToFileTime
GetTimeFormatA
CloseHandle
DeviceIoControl
LockResource
Thread32Next
InitializeCriticalSectionAndSpinCount
GetACP
Thread32First
Module32NextW
SuspendThread
Module32FirstW
CreateToolhelp32Snapshot
InterlockedIncrement
GetModuleFileNameW
RemoveDirectoryW
DeleteFileW
GetSystemDirectoryW
LoadLibraryW
lstrlenW
InterlockedDecrement
FreeLibrary
LCMapStringA
SetEnvironmentVariableW
TlsFree
TlsAlloc
GetFileAttributesExW
OpenThread
TlsSetValue

user32

GetWindow
InvalidateRect
GetClientRect
GetWindowRect
SetWindowPos
IsWindowVisible
RedrawWindow
SetDlgItemTextW
GetDlgItem
wvsprintfW
SendMessageTimeoutW
LoadStringW
CharUpperW
CharNextW
SendMessageW
FindWindowW
CreateWindowExW
DestroyWindow
GetWindowLongW
EnumWindows
GetClassNameW
GetWindowThreadProcessId
UpdateWindow
GetDC
ReleaseDC
GetActiveWindow
MessageBoxW
GetWindowPlacement
CopyRect
KillTimer
SetTimer
ScreenToClient
DefWindowProcW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
BringWindowToTop
GetSystemMetrics
LoadImageW
LoadIconW
CreateDialogParamW
IsIconic
PostQuitMessage
InflateRect
IsWindow
MonitorFromWindow
GetMonitorInfoW
IsDialogMessageW
MoveWindow
GetSystemMenu
PostMessageW
EnableMenuItem
GetParent
SetWindowTextW
wsprintfW
ExitWindowsEx
UnregisterClassA
IsWindowEnabled
EnableWindow
GetWindowTextLengthW
GetWindowTextW
MapWindowPoints
MessageBeep
SetFocus
SetWindowLongW
ShowWindow

gdi32

DeleteObject
GetStockObject

advapi32

RegQueryInfoKeyW
RegEnumKeyExA
RegQueryValueExA
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyW
RegEnumKeyExW
RegCloseKey
RegOpenKeyExA

shell32

ShellExecuteExW
SHChangeNotify
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetMalloc
SHFileOperationW
ShellExecuteW
ord680
SHBrowseForFolderW
ord165

ole32

OleRun
CoTaskMemFree
CoCreateGuid
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

SystemTimeToVariantTime
VarUdateFromDate
VariantTimeToSystemTime
VariantInit
SysStringLen
SysStringByteLen
SysAllocStringByteLen
VariantClear
SysAllocString
VarUI4FromStr
SysFreeString

shlwapi

PathRemoveExtensionW
PathFindFileNameW
PathIsDirectoryW
SHSetValueW
SHGetValueW
SHDeleteValueW
PathFileExistsW
PathMatchSpecW
StrRetToStrW
PathIsPrefixW
SHSetValueA
PathCombineA
PathAppendA
PathFindExtensionW
wnsprintfW
SHGetValueA
PathCombineW
PathAppendW
PathIsRelativeW
PathRemoveFileSpecW
SHDeleteKeyW

comctl32

InitCommonControlsEx

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState

netapi32

Netbios

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

psapi

GetModuleFileNameExW
EnumProcesses

setupapi

SetupIterateCabinetW

crypt32

CryptMsgClose
CertCloseStore
CryptMsgUpdate
CryptMsgOpenToDecode
CertOpenStore
CertGetCertificateContextProperty
CertGetNameStringW

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain

Sections

.text
Size: 433KB - Virtual size: 433KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 897KB - Virtual size: 897KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f83eea2af4406cf8ea6de530f310449b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

urlmon

iphlpapi

wininet

netapi32

version

psapi

setupapi

crypt32

wintrust

Sections

.text Size: 433KB - Virtual size: 433KB

.rdata Size: 87KB - Virtual size: 87KB

.data Size: 14KB - Virtual size: 25KB

.rsrc Size: 897KB - Virtual size: 897KB

.reloc Size: 35KB - Virtual size: 35KB

.text
Size: 433KB - Virtual size: 433KB

.rdata
Size: 87KB - Virtual size: 87KB

.data
Size: 14KB - Virtual size: 25KB

.rsrc
Size: 897KB - Virtual size: 897KB

.reloc
Size: 35KB - Virtual size: 35KB