657acbace1774a3591d5af8aeade8e98e234b1d0d6f925983e48f794b4ee7bb4

Sharing

Copy URL Twitter E-mail

General

Target

657acbace1774a3591d5af8aeade8e98e234b1d0d6f925983e48f794b4ee7bb4
Size

337KB
MD5

448baf5c895f0c988a0ddda7943148cb
SHA1

712753d1a86d8a021094fc40c1d36c76062287d0
SHA256

657acbace1774a3591d5af8aeade8e98e234b1d0d6f925983e48f794b4ee7bb4
SHA512

e894841e03ee0deb70e194ed1cf7442a7616be2e736eb5519e6dd901424318356b36f8de6c8faf12d7c9a75256babaddbd660a469f3124e185821c474a4e50b9
SSDEEP

3072:2h3YddykO6kzoVVzfCoyhdniORw/8/Jp6cw7AouKav0xaeYU9chcW6jScWO:2h3Ydk6kfoyhdniOvJpqRubZeYRct3p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
657acbace1774a3591d5af8aeade8e98e234b1d0d6f925983e48f794b4ee7bb4

Files

657acbace1774a3591d5af8aeade8e98e234b1d0d6f925983e48f794b4ee7bb4
.exe windows:5 windows x86

f17ccb0c803aabec9094714f3fff70d3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

common

??1CTXStringW@@QAE@XZ
??0CTXStringW@@QAE@XZ
??0CTXStringW@@QAE@PB_W@Z
??0CTXStringW@@QAE@ABV0@@Z
??0CTXStringW@@QAE@PA_W@Z
??0CTXStringW@@QAE@UtagEN@@PBDH@Z
??4CTXStringW@@QAEAAV0@PB_W@Z
??4CTXStringW@@QAEAAV0@ABV0@@Z
??YCTXStringW@@QAEAAV0@ABV0@@Z
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
??H@YA?AVCTXStringW@@ABV0@0@Z
??M@YA_NABVCTXStringW@@0@Z
?IsEmpty@CTXStringW@@QBE_NXZ
?CompareNoCase@CTXStringW@@QBEHPB_W@Z
?Find@CTXStringW@@QBEHPB_WH@Z
?GetBSTR@CTXStringW@@QBEPA_WXZ
??BCTXStringW@@QBEPB_WXZ
??7CTXStringW@@QBE_NXZ
??0CTXBSTR@@QAE@PB_W@Z
?Format@CTXStringA@@QAAXPBDZZ
??1CTXBSTR@@QAE@XZ
??BCTXBSTR@@QBEPA_WXZ
?TXLog_DoTXLogVW@@YAXPAUtagLogObj@@PB_W1PAD@Z
?GetPlatformCore@Core@Util@@YAHPAPAUITXCore@@@Z
??4CTXStringW@@QAEAAV0@PA_W@Z
?GetLength@CTXStringW@@QBEHXZ
??ACTXStringW@@QBE_WH@Z
?ReverseFind@CTXStringW@@QBEH_W@Z
?Mid@CTXStringW@@QBE?AV1@HH@Z
?Left@CTXStringW@@QBE?AV1@H@Z
?OnExitWinMain@Misc@Util@@YAXXZ
?OnExitCoreCenter@Misc@Util@@YAXXZ
?SetMainAndLogicThreadId@Misc@Util@@YAXKK@Z
?InitPlatform@CoreCenter@Util@@YAHPA_W@Z
?PropertyStr@CFmtString@@QAEHPB_W0@Z
??0CFmtString@@QAE@XZ
??1CFmtString@@QAE@XZ
?AddFmtString@TXStringBundle@@YAXABVCFmtString@@@Z
?CreateObjectFromDllFile@Com@Util@@YGJPB_WABU_GUID@@1PAPAXPAUIUnknown@@@Z
?InitPlatformFileSystem@Boot@Util@@YAHXZ
?InitPlatformCoreConfig@Boot@Util@@YAHXZ
?InitPlatformI18NConfig@Boot@Util@@YAHXZ
?InitPlatformGFConfig@Boot@Util@@YAHXZ
??M@YA_NABVCTXStringA@@0@Z
??1CTXStringA@@QAE@XZ
??0CTXStringA@@QAE@XZ
??0CTXBSTR@@QAE@ABVCTXStringW@@@Z
?TXAssert@@YAHPB_W0H@Z

gf

?RawCreateGFElementByXtml@GF@Util@@YAJPA_WPAPAUIGFElement@@PAU3@PAUITXCore@@H@Z

kernel32

LeaveCriticalSection
CloseHandle
GetSystemTimeAsFileTime
GetTickCount
GetModuleFileNameW
QueryPerformanceCounter
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
GetModuleHandleW
TerminateProcess
GetCurrentProcess
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetProcAddress
InterlockedIncrement
InterlockedExchange
GetCurrentThreadId
SetEvent
InterlockedDecrement
GetCurrentProcessId
CreateEventW
InitializeSListHead
OutputDebugStringW
IsDebuggerPresent

user32

GetMessageW
DispatchMessageW
PostThreadMessageW
TranslateMessage

advapi32

RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

ole32

CoReleaseServerProcess
CoCreateInstance
CoAddRefServerProcess
CoInitialize

oleaut32

LoadRegTypeLi
SysFreeString
LoadTypeLi
SysStringLen

msvcp140

?_Throw_Cpp_error@std@@YAXH@Z
?_Throw_C_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPBD@Z
_Thrd_start
_Thrd_detach
_Mtx_init
_Mtx_destroy
_Mtx_lock
_Mtx_unlock
_Cnd_init
_Cnd_destroy
_Cnd_wait
_Cnd_signal
_Cnd_do_broadcast_at_thread_exit

vcruntime140

__std_exception_destroy
_except_handler4_common
__CxxFrameHandler3
__std_terminate
_CxxThrowException
__std_type_info_name
memset
__std_exception_copy
_purecall
memcmp

api-ms-win-crt-runtime-l1-1-0

_set_app_type
_seh_filter_exe
_cexit
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm_e
exit
_exit
_c_exit
_register_thread_local_exe_atexit_callback
_register_onexit_function
_initialize_onexit_table
terminate
_controlfp_s
_invalid_parameter_noinfo_noreturn
_initterm
_crt_atexit

api-ms-win-crt-string-l1-1-0

wcscmp
wcslen

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
_set_new_mode
free

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 198KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 79KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f17ccb0c803aabec9094714f3fff70d3

Headers

DLL Characteristics

File Characteristics

Imports

common

gf

kernel32

user32

advapi32

ole32

oleaut32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 27KB - Virtual size: 27KB

.rdata Size: 17KB - Virtual size: 16KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 198KB - Virtual size: 198KB

.reloc Size: 79KB - Virtual size: 80KB

.text
Size: 27KB - Virtual size: 27KB

.rdata
Size: 17KB - Virtual size: 16KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 198KB - Virtual size: 198KB

.reloc
Size: 79KB - Virtual size: 80KB