acd2325947da985f91c8abdc627fcec529e1ea396cfafa989bca0d8f33c40adf

Sharing

Copy URL Twitter E-mail

General

Target

acd2325947da985f91c8abdc627fcec529e1ea396cfafa989bca0d8f33c40adf
Size

4.4MB
MD5

ff53a92f1aec82f2fab31774c42ae6b3
SHA1

0f23df33fb1cc3e1c817138d42751b0de13ac656
SHA256

acd2325947da985f91c8abdc627fcec529e1ea396cfafa989bca0d8f33c40adf
SHA512

bd5bc062d5c5c1ac5bfee90bfa0f83739f8dad03b2e32acc9c9e3691638e2d244639d7d771a8fa52b97846f8264a3e3d8b2adc4df13ba134288643f839f87568
SSDEEP

98304:ndDGer/TINVrnnFFmveLXoatN0eZHgPa:R/T2VDFzKeZAPa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
acd2325947da985f91c8abdc627fcec529e1ea396cfafa989bca0d8f33c40adf

Files

acd2325947da985f91c8abdc627fcec529e1ea396cfafa989bca0d8f33c40adf
.exe windows:5 windows x64

4635686e23fc993d969d5a33a71cdd72

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

OpenProcess
GetSystemDirectoryW
WideCharToMultiByte
LoadLibraryW
GetLocaleInfoW
Sleep
GetModuleFileNameW
CreateFileW
lstrcmpW
lstrlenW
GetStartupInfoW
GetLastError
GetProcAddress
GetLocalTime
Process32FirstW
GlobalMemoryStatusEx
DeviceIoControl
GetSystemInfo
Process32NextW
lstrcatW
CreateToolhelp32Snapshot
GetDiskFreeSpaceExW
CloseHandle
GetCurrentProcessId
lstrcpyW
QueryPerformanceCounter
WaitForSingleObject
SetEvent
ResetEvent
CreateEventW
QueryPerformanceFrequency
WriteFile
CopyFileW
ExpandEnvironmentStringsW
CreateEventA
FormatMessageW
GetNativeSystemInfo
IsBadReadPtr
SetLastError
LoadLibraryA
VirtualProtect
MoveFileExA
SetErrorMode
SetUnhandledExceptionFilter
GetModuleFileNameA
GetCurrentDirectoryA
GetCurrentThreadId
CreateThread
GetFileSize
SetFilePointer
MapViewOfFileEx
ReadFile
FlushFileBuffers
SetStdHandle
WriteConsoleW
GetTickCount
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetModuleHandleW
HeapFree
GetCurrentProcess
HeapAlloc
lstrlenA
CreateProcessW
FreeLibrary
GetDriveTypeW
CreateFileA
GetCommandLineW
ExitProcess
DeleteCriticalSection
EnterCriticalSection
VirtualAlloc
LeaveCriticalSection
InitializeCriticalSection
VirtualFree
CreateWaitableTimerW
HeapDestroy
FreeEnvironmentStringsW
GetStringTypeW
IsValidCodePage
GetOEMCP
HeapCreate
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
EncodePointer
GetACP
FlsAlloc
FlsFree
FlsSetValue
FlsGetValue
HeapSize
GetConsoleMode
LocalFree
GetConsoleCP
GetStdHandle
GetProcessHeap
HeapSetInformation
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetCPInfo
LCMapStringW
RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
GetSystemTimeAsFileTime
HeapReAlloc
ExitThread
VirtualQuery
SetThreadStackGuarantee
TryEnterCriticalSection
CancelWaitableTimer
SetWaitableTimer
UnmapViewOfFile
SwitchToThread
MultiByteToWideChar
CreateFileMappingW
GetVersion

user32

MsgWaitForMultipleObjects
GetMonitorInfoW
FindWindowA
SendMessageW
PeekMessageW
TranslateMessage
DispatchMessageW
GetLastInputInfo
GetWindowTextW
GetWindowTextA
GetForegroundWindow
wsprintfW
GetClassNameA
EnumDisplayMonitors
OpenWindowStationW
IsWindow
GetInputState
PostThreadMessageA
SetProcessWindowStation
GetWindow

advapi32

RegEnumKeyExA
GetTokenInformation
RegSetValueExW
RegDeleteValueW
RegCreateKeyW
RegCloseKey
CheckTokenMembership
GetCurrentHwProfileW
RegOpenKeyExW
FreeSid
AllocateAndInitializeSid
LookupAccountSidW
RegOpenKeyExA
RegQueryInfoKeyW
RegQueryValueExW
OpenProcessToken

ole32

CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

VariantClear
SysStringLen
SysFreeString
VariantInit
SysAllocString

shlwapi

PathIsDirectoryA
StrChrW

ws2_32

getsockname
getpeername
WSASetLastError
WSAStringToAddressW
shutdown
closesocket
send
setsockopt
WSAIoctl
htons
ntohs
WSAGetLastError
gethostname
inet_ntoa
gethostbyname
freeaddrinfo
getaddrinfo
WSAStartup
WSAResetEvent
WSAEventSelect
WSACleanup
bind
connect
recv
WSACloseEvent
WSACreateEvent
socket
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
InetNtopW

netapi32

NetWkstaGetInfo

winmm

timeGetDevCaps
timeEndPeriod
timeBeginPeriod
timeGetTime

Sections

.text
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.FEFE0
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.FEFE1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.FEFE2
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.l1
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4635686e23fc993d969d5a33a71cdd72

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

ws2_32

netapi32

winmm

Sections

.text Size: 192KB - Virtual size: 192KB

.rdata Size: 68KB - Virtual size: 68KB

.data Size: 48KB - Virtual size: 48KB

.pdata Size: 12KB - Virtual size: 12KB

.FEFE0 Size: 1.8MB - Virtual size: 1.8MB

.FEFE1 Size: 4KB - Virtual size: 4KB

.FEFE2 Size: 2.3MB - Virtual size: 2.3MB

.reloc Size: 4KB - Virtual size: 4KB

.rsrc Size: 3KB - Virtual size: 3KB

.l1 Size: 10KB - Virtual size: 10KB

.text
Size: 192KB - Virtual size: 192KB

.rdata
Size: 68KB - Virtual size: 68KB

.data
Size: 48KB - Virtual size: 48KB

.pdata
Size: 12KB - Virtual size: 12KB

.FEFE0
Size: 1.8MB - Virtual size: 1.8MB

.FEFE1
Size: 4KB - Virtual size: 4KB

.FEFE2
Size: 2.3MB - Virtual size: 2.3MB

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 3KB - Virtual size: 3KB

.l1
Size: 10KB - Virtual size: 10KB