4cd2d9f90f95e44376ddb0432cd9b8dbc77cb208e6ccd9080b7ad784ddd871b1

Sharing

Copy URL Twitter E-mail

General

Target

4cd2d9f90f95e44376ddb0432cd9b8dbc77cb208e6ccd9080b7ad784ddd871b1
Size

1.7MB
MD5

786a2720e7401083dcdd00c6476c16ee
SHA1

5ee65522608b8f20e935c1ce166e14307b88a840
SHA256

4cd2d9f90f95e44376ddb0432cd9b8dbc77cb208e6ccd9080b7ad784ddd871b1
SHA512

cd4b6c38129d6a44e4dca8da527b0e759b374adf778d54cf4280fac895e880c746f81b73c7d92d159ee0886ea0034ed4732e53ed962311360946bda836cab979
SSDEEP

24576:TBcb6rk5AAfBKG1/8yJ2sRR6+RAdKAJrLI/fFMPKv0wdDNwX5Fn1ISzx:aJKG1lfRR6fdKARsXFMPKv02uXX1ISt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4cd2d9f90f95e44376ddb0432cd9b8dbc77cb208e6ccd9080b7ad784ddd871b1

Files

4cd2d9f90f95e44376ddb0432cd9b8dbc77cb208e6ccd9080b7ad784ddd871b1
.exe windows:6 windows x86

11ec5b52013ee91a157c5ce079cdd6f3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSASetLastError
WSACleanup
WSAStartup
recv
connect
socket
send
shutdown
setsockopt
htons
WSAGetLastError
htonl
getservbyname
inet_ntoa
ntohs
gethostbyname
inet_addr
gethostbyaddr
closesocket
getservbyport

wininet

InternetGetConnectedState
HttpOpenRequestA
InternetWriteFile
InternetCrackUrlA
InternetOpenW
HttpEndRequestW
HttpAddRequestHeadersW
InternetConnectA
InternetCloseHandle
HttpSendRequestExW

kernel32

LoadLibraryW
GetSystemDirectoryW
GlobalUnlock
FreeLibrary
GetCurrentProcessId
GlobalLock
ResetEvent
LoadLibraryA
GetSystemDirectoryA
GlobalSize
Sleep
GetModuleFileNameW
GetProcAddress
InitializeCriticalSectionAndSpinCount
DecodePointer
RaiseException
GetVersion
InitializeCriticalSectionEx
lstrlenW
GetModuleHandleW
DeleteCriticalSection
SetEvent
GetLastError
CreateEventW
OpenEventW
WaitForSingleObject
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetTickCount
CloseHandle
OutputDebugStringW
SetEndOfFile
WriteConsoleW
SetEnvironmentVariableA
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
FindFirstFileExW
SetStdHandle
GetConsoleCP
GetOEMCP
IsValidCodePage
ReadConsoleW
GetConsoleMode
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
GetStdHandle
MultiByteToWideChar
GetCommandLineW
GetCurrentProcess
GetTempPathW
CreateToolhelp32Snapshot
GlobalAlloc
GlobalFree
OpenMutexW
GetCurrentThreadId
CreateDirectoryW
CreateFileW
GetFileAttributesW
SetFileAttributesW
FileTimeToSystemTime
DeleteFileW
MoveFileExW
CreateProcessW
CopyFileW
GetTempFileNameW
GetFileTime
ReadFile
SetLastError
WriteFile
SetFilePointer
DuplicateHandle
ExitThread
FormatMessageW
CreateThread
LocalFree
GetFileSize
Thread32Next
Thread32First
GetThreadTimes
OpenThread
OpenFileMappingW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
FindFirstFileW
FindNextFileW
RemoveDirectoryW
FindClose
OpenProcess
HeapFree
LocalAlloc
HeapAlloc
GetProcessHeap
lstrcpyW
CreateMutexW
ReleaseMutex
FlushFileBuffers
LoadLibraryExW
GetModuleFileNameA
OutputDebugStringA
GetEnvironmentVariableW
GetEnvironmentVariableA
SuspendThread
GetCurrentDirectoryA
ResumeThread
GetVersionExA
GetThreadContext
GetThreadId
ReadProcessMemory
VirtualQuery
GetSystemInfo
GetSystemTimeAsFileTime
GetProcessTimes
GetVersionExW
VirtualFree
VirtualAlloc
QueryPerformanceFrequency
QueryPerformanceCounter
GetDiskFreeSpaceExW
GetSystemTime
TryEnterCriticalSection
HeapSize
HeapReAlloc
TerminateProcess
lstrcatW
GetLocalTime
IsDebuggerPresent
SetUnhandledExceptionFilter
ExpandEnvironmentStringsW
SetWaitableTimer
CreateNamedPipeW
ConnectNamedPipe
DisconnectNamedPipe
GetOverlappedResult
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
WaitForSingleObjectEx
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
FreeLibraryAndExitThread
GetModuleHandleA
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
RtlUnwind
GetModuleHandleExW
ExitProcess
GetTimeZoneInformation
GetFileType

user32

TranslateMessage
PostThreadMessageW
SetTimer
DispatchMessageW
SetRectEmpty
GetSystemMetrics
KillTimer
wvsprintfW
LoadStringW
wsprintfW
DestroyIcon
UnloadKeyboardLayout
LoadKeyboardLayoutW
GetKeyboardLayoutList
SystemParametersInfoW
CreateWindowExW
DefWindowProcW
GetMessageW
PostMessageW
SetClipboardViewer
SendMessageW
RegisterClassExW
IsWindow
OpenClipboard
IsDialogMessageW
ChangeClipboardChain
CloseClipboard
PeekMessageW
GetClipboardData
IsClipboardFormatAvailable

advapi32

CryptAcquireContextW
CryptDecrypt
CryptSetKeyParam
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptReleaseContext
SetEntriesInAclW
BuildExplicitAccessWithNameW
GetNamedSecurityInfoW
SetSecurityDescriptorSacl
GetUserNameA
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
SetSecurityInfo
RegNotifyChangeKeyValue
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTokenInformation
LookupAccountSidW
OpenProcessToken
RegQueryValueExW
RegEnumValueW
RegSetValueExW
RegFlushKey
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumKeyW
RegOpenKeyW
GetLengthSid
AddAccessAllowedAceEx
SetNamedSecurityInfoW

ole32

CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

SysFreeString
SysAllocString

imm32

ImmDisableIME

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

GetProcessMemoryInfo

shlwapi

SHDeleteKeyW

shell32

SHFileOperationW
SHGetSpecialFolderPathW
SHGetFolderPathW
ShellExecuteW

Sections

.text
Size: 1000KB - Virtual size: 1000KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 482KB - Virtual size: 482KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 30KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 136KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

11ec5b52013ee91a157c5ce079cdd6f3

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wininet

kernel32

user32

advapi32

ole32

oleaut32

imm32

version

psapi

shlwapi

shell32

Sections

.text Size: 1000KB - Virtual size: 1000KB

.rdata Size: 482KB - Virtual size: 482KB

.data Size: 30KB - Virtual size: 126KB

.rsrc Size: 32KB - Virtual size: 31KB

.reloc Size: 136KB - Virtual size: 140KB

.text
Size: 1000KB - Virtual size: 1000KB

.rdata
Size: 482KB - Virtual size: 482KB

.data
Size: 30KB - Virtual size: 126KB

.rsrc
Size: 32KB - Virtual size: 31KB

.reloc
Size: 136KB - Virtual size: 140KB