e39761f0d8b62c9287a734586942a145ed89823cd5609498b536937840c098c8

Sharing

Copy URL Twitter E-mail

General

Target

e39761f0d8b62c9287a734586942a145ed89823cd5609498b536937840c098c8
Size

513KB
MD5

29959ffd8ecec6a26ca19ede1a18649c
SHA1

e5d582fe5be2dbeb79c1ba9b7972d26e6e2b077e
SHA256

e39761f0d8b62c9287a734586942a145ed89823cd5609498b536937840c098c8
SHA512

df0d1901b5dec5c81d7fc82c005ecaad07d5ead03a489c9e631b6b874a4d7970859928d51ec1be6c4be554998e1466178ecae20624abbe7af7b00bfabf640660
SSDEEP

12288:l0J5hirl9mJUGODGEpadw+UKOfa8LNeI6+65LcI6/KN9ugCiXmTVYj/zvi:iirlxXQdxp6aQzYL6/KN9uQXmT0b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e39761f0d8b62c9287a734586942a145ed89823cd5609498b536937840c098c8

Files

e39761f0d8b62c9287a734586942a145ed89823cd5609498b536937840c098c8
.exe windows:5 windows x86

0e3f53bbcb955b38b6c474b112cb4e50

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemInfo
CancelIoEx
DeleteCriticalSection
CreateEventA
CreateIoCompletionPort
GetCurrentThreadId
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
OpenEventA
GetModuleFileNameA
LoadLibraryExA
GetTempPathA
GetProcAddress
FreeLibrary
WinExec
MultiByteToWideChar
WideCharToMultiByte
CreateMutexA
ReleaseMutex
CloseHandle
FindNextFileA
FindClose
SetEvent
GetLocalTime
WriteFile
CreateFileA
CreateDirectoryA
ReadFile
CreateFileW
HeapSize
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetLastError
PostQueuedCompletionStatus
WaitForSingleObject
GetQueuedCompletionStatus
InitializeCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
EnterCriticalSection
GetOEMCP
IsValidCodePage
FindFirstFileExA
SetEndOfFile
SetStdHandle
FlushFileBuffers
CreateDirectoryW
GetTimeZoneInformation
GetFileAttributesExW
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
HeapFree
HeapAlloc
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetACP
GetCommandLineW
GetCommandLineA
GetStdHandle
ExitProcess
GetFileType
SetFilePointerEx
GetModuleHandleExW
ExitThread
RaiseException
RtlUnwind
LoadLibraryW
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
DuplicateHandle
VirtualFree
VirtualProtect
VirtualAlloc
GetVersionExW
LoadLibraryExW
GetModuleHandleA
GetModuleFileNameW
FreeLibraryAndExitThread
GetThreadTimes
GetCurrentThread
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
Sleep
WaitForSingleObjectEx
InitializeSListHead
QueryPerformanceCounter
QueryPerformanceFrequency
TryEnterCriticalSection
GetStringTypeW
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId

user32

PeekMessageA
GetMessageA
DispatchMessageA
TranslateMessage
PostThreadMessageA
PostMessageA

advapi32

InitializeSecurityDescriptor
StartServiceCtrlDispatcherA
SetServiceStatus
RegisterServiceCtrlHandlerExA
SetSecurityDescriptorDacl

ole32

CoCreateGuid

libcurl

curl_easy_perform
curl_global_init
curl_easy_escape
curl_easy_init
curl_slist_append
curl_easy_cleanup
curl_easy_setopt
curl_global_cleanup

ws2_32

WSACloseEvent
WSACreateEvent
WSASetEvent
WSAStartup
WSAEventSelect
WSAResetEvent
socket
listen
WSASocketA
WSARecv
getsockopt
htonl
htons
setsockopt
WSAGetLastError
WSASend
closesocket
WSAIoctl
bind
WSAWaitForMultipleEvents
WSACleanup

libeay32

ord233
ord246
ord109
ord3866
ord223
ord298
ord95
ord227
ord89
ord224
ord52
ord78
ord196
ord197
ord1804
ord188

ssleay32

ord125
ord48
ord75
ord8
ord183
ord74
ord111
ord30
ord24
ord12
ord83
ord21
ord78
ord82
ord141
ord5
ord96
ord166
ord58
ord108

Sections

.text
Size: 371KB - Virtual size: 370KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0e3f53bbcb955b38b6c474b112cb4e50

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

libcurl

ws2_32

libeay32

ssleay32

Sections

.text Size: 371KB - Virtual size: 370KB

.rdata Size: 112KB - Virtual size: 112KB

.data Size: 9KB - Virtual size: 13KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 19KB - Virtual size: 19KB

.text
Size: 371KB - Virtual size: 370KB

.rdata
Size: 112KB - Virtual size: 112KB

.data
Size: 9KB - Virtual size: 13KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 19KB - Virtual size: 19KB