38a89cd92944e3e082517a1406175390c240306eefb7a90c0f8c644bdcbdf750

Sharing

Copy URL Twitter E-mail

General

Target

38a89cd92944e3e082517a1406175390c240306eefb7a90c0f8c644bdcbdf750
Size

1.1MB
MD5

8164be9babb212652e1aba80a499db4e
SHA1

1d88438f9be9c887da4e12e8d5ae11f4513e58ec
SHA256

38a89cd92944e3e082517a1406175390c240306eefb7a90c0f8c644bdcbdf750
SHA512

7fe2efb5fde4aa78b4f0026cb770fdfb27cfdf17a1ba402f72064de88a9943de682f60dd6b422117df6202f4fa15c265d750b74bd71623c44de595f366125989
SSDEEP

24576:iDsNp4tZQtO/9x2llfcBy+b0n5qCHlSJe9JdMIxOPsA:iwp4rQtSmW6Io1OPsA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
38a89cd92944e3e082517a1406175390c240306eefb7a90c0f8c644bdcbdf750

Files

38a89cd92944e3e082517a1406175390c240306eefb7a90c0f8c644bdcbdf750
.exe windows:6 windows x86

82f09fbf192b8d3db0441ed5c4a07f78

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc140

ord14149
ord4869
ord8426
ord8026
ord890
ord1389
ord10986
ord9320
ord1526
ord5828
ord5795
ord2376
ord12291
ord14518
ord2381
ord12348
ord14571
ord6724
ord8031
ord13584
ord13574
ord5792
ord13475
ord8705
ord4218
ord6581
ord3924
ord2524
ord11928
ord500
ord1140
ord11907
ord14520
ord2880
ord5827
ord3319
ord7855
ord7873
ord6290
ord4468
ord5407
ord12969
ord9373
ord6507
ord4656
ord8672
ord1064
ord4210
ord3140
ord9083
ord6464
ord3688
ord3685
ord3796
ord7782
ord1696
ord4655
ord14380
ord12474
ord7964
ord14581
ord6322
ord14583
ord6324
ord14582
ord6323
ord3844
ord5894
ord12182
ord12190
ord8180
ord10383
ord12194
ord12162
ord12869
ord5742
ord10202
ord6831
ord4580
ord13830
ord952
ord2200
ord7961
ord1468
ord993
ord7618
ord10330
ord14421
ord9248
ord9077
ord8974
ord10480
ord11681
ord10216
ord10093
ord10448
ord10544
ord10094
ord11415
ord14444
ord8996
ord10962
ord4085
ord8776
ord10942
ord5750
ord7453
ord13946
ord6200
ord1141
ord501
ord7099
ord11410
ord12808
ord13230
ord13966
ord4866
ord12894
ord1066
ord362
ord3825
ord7784
ord7619
ord4868
ord1000
ord9166
ord6104
ord9213
ord12163
ord2759
ord13681
ord6195
ord7094
ord266
ord1507
ord265
ord4870
ord5404
ord14054
ord13407
ord13405
ord3808
ord1529
ord310
ord14322
ord12074
ord8997
ord11343
ord4084
ord3396
ord3395
ord3159
ord6193
ord13677
ord3298
ord3295
ord8173
ord2758
ord14699
ord10237
ord10239
ord10238
ord10236
ord10240
ord5631
ord11671
ord11672
ord9096
ord12032
ord3830
ord11881
ord14502
ord8922
ord12116
ord6947
ord10950
ord9192
ord3259
ord13798
ord12205
ord12201
ord1717
ord1739
ord1765
ord1751
ord1772
ord4920
ord4987
ord4932
ord4950
ord4944
ord4938
ord4997
ord4981
ord4926
ord5003
ord4958
ord4896
ord4911
ord4972
ord4493
ord9647
ord4485
ord3050
ord14510
ord7887
ord14508
ord12115
ord13887
ord6848
ord11663
ord13628
ord5911
ord2680
ord12067
ord3933
ord3364
ord3363
ord3258
ord12111
ord5228
ord5528
ord5739
ord9305
ord5504
ord5769
ord5231
ord5390
ord5210
ord7687
ord7688
ord7677
ord5388
ord8182
ord10207
ord9167
ord10963
ord8713
ord13262
ord13256
ord3177
ord3689
ord6925
ord2241
ord2210
ord1460
ord5406
ord6822
ord6097
ord1178
ord6563
ord5960
ord5401
ord9089
ord10421
ord4216
ord7461
ord1111
ord1169
ord540
ord1456
ord982
ord13576
ord8036
ord8429
ord8347
ord12806
ord8285
ord5336
ord6463
ord2484
ord12484
ord12485
ord14509
ord7886
ord14507
ord9353
ord6540
ord3874
ord4143
ord4082
ord316
ord12888
ord7905
ord2027
ord1131
ord1044
ord11927
ord4807
ord1698
ord2298
ord1109
ord462
ord7078
ord14291
ord2407
ord1509

kernel32

GetTempPathA
Sleep
DeleteFileA
CreateThread
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
WinExec
CopyFileA
WaitForSingleObjectEx
DeleteFileW
AreFileApisANSI
ReadFile
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapAlloc
GetModuleFileNameA
CloseHandle
GetLastError
CreateSemaphoreA
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryA
CreateFileA
FlushViewOfFile
OutputDebugStringW
HeapCompact
HeapDestroy
UnlockFile
GetVolumeInformationA
GetFileAttributesExW
LeaveCriticalSection
FormatMessageW
GetProcAddress
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
GetSystemTimeAsFileTime
GetFileAttributesA
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
InitializeCriticalSectionEx
GetLogicalDriveStringsA
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetDiskFreeSpaceA
IsProcessorFeaturePresent
CreateEventW
IsDebuggerPresent
InitializeSListHead
GetStartupInfoW

user32

SetForegroundWindow
GetLastActivePopup
LoadIconW
GetSystemMenu
AppendMenuA
GetSystemMetrics
DrawIcon
LoadMenuW
GetSubMenu
ShowWindow
GetDlgItem
SetCapture
ClientToScreen
ReleaseCapture
WindowFromPoint
ScreenToClient
GetWindowRect
InvalidateRect
RemovePropA
IsIconic
PostMessageA
GetPropA
IsWindow
GetDesktopWindow
GetWindow
IsWindowVisible
DrawTextA
GetSysColor
GetClientRect
GetParent
EnableWindow
SendMessageA
GetCursorPos
FindWindowA
OffsetRect

gdi32

SelectObject

shell32

SHGetSpecialFolderPathA
ShellExecuteA

comctl32

ImageList_DragMove
ImageList_DragLeave
InitCommonControlsEx
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragShowNolock
ImageList_EndDrag

oleaut32

VariantClear

ws2_32

htons
gethostbyname
inet_ntoa
inet_addr
ioctlsocket
connect
select
closesocket
WSAStartup
socket

msvcp140

?_Xlength_error@std@@YAXPBD@Z

crypt32

CryptProtectData

vcruntime140

__CxxFrameHandler3
__std_terminate
__std_exception_copy
__std_exception_destroy
strrchr
strstr
strchr
memset
__current_exception
__current_exception_context
_except_handler4_common
memmove
_CxxThrowException
memcpy

api-ms-win-crt-string-l1-1-0

strncmp
strcat_s
strcspn
strcpy_s

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
_set_fmode
__stdio_common_vfprintf
__stdio_common_vsprintf_s
__p__commode

api-ms-win-crt-runtime-l1-1-0

exit
_invalid_parameter_noinfo
_errno
_controlfp_s
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
_c_exit
_endthreadex
_exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
terminate
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_beginthreadex

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-time-l1-1-0

_localtime64_s
clock

api-ms-win-crt-heap-l1-1-0

free
malloc
_msize
realloc
_set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_setmbcp
_configthreadlocale

Sections

.text
Size: 717KB - Virtual size: 717KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 340KB - Virtual size: 339KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

82f09fbf192b8d3db0441ed5c4a07f78

Headers

DLL Characteristics

File Characteristics

Imports

mfc140

kernel32

user32

gdi32

shell32

comctl32

oleaut32

ws2_32

msvcp140

crypt32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 717KB - Virtual size: 717KB

.rdata Size: 78KB - Virtual size: 78KB

.data Size: 7KB - Virtual size: 8KB

.rsrc Size: 340KB - Virtual size: 339KB

.reloc Size: 22KB - Virtual size: 22KB

.text
Size: 717KB - Virtual size: 717KB

.rdata
Size: 78KB - Virtual size: 78KB

.data
Size: 7KB - Virtual size: 8KB

.rsrc
Size: 340KB - Virtual size: 339KB

.reloc
Size: 22KB - Virtual size: 22KB