0286e9259afcba7a7f7c0fd7b1aa49985d3f607163d2356c2a54bd0823bb6eb8

Sharing

Copy URL

Twitter E-mail

General

Target

0286e9259afcba7a7f7c0fd7b1aa49985d3f607163d2356c2a54bd0823bb6eb8
Size

1.5MB
MD5

ca757b504deda6175b985967838e359f
SHA1

a022631c6acc72f99b146560134a0ec189f4e587
SHA256

0286e9259afcba7a7f7c0fd7b1aa49985d3f607163d2356c2a54bd0823bb6eb8
SHA512

9cc5923eb8594874aded7696faf8a07bf4f2e5cb3122cb20dec11536d5cd7f78bde87389858f04701f824bbe0c2ce332f744ee566a554ad79a6f2146e4f0ad82
SSDEEP

24576:WondAPiaeUGp+4RSphn2Anp38qsZY9/AqaS9DsDyhbvWSvEsP:Xd9aYSpkAp38fZY9/Bn9DsSvLvEsP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0286e9259afcba7a7f7c0fd7b1aa49985d3f607163d2356c2a54bd0823bb6eb8

Files

0286e9259afcba7a7f7c0fd7b1aa49985d3f607163d2356c2a54bd0823bb6eb8
.exe windows:6 windows x86

5c3a34e2e5bdef266cc5007e9d86f35e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32FirstW
CloseHandle
GetSystemInfo
GetProcAddress
GetModuleHandleW
lstrcmpiW
MultiByteToWideChar
WideCharToMultiByte
SizeofResource
WriteFile
SetFilePointer
SetEndOfFile
FindResourceA
CreateFileA
LockResource
LoadResource
ReadFile
WaitForSingleObject
CreateFileW
ReleaseMutex
DeleteFileA
DeleteFileW
CreateThread
GetCurrentProcess
ReadProcessMemory
IsWow64Process
OutputDebugStringA
GetTempPathA
Module32FirstW
QueryFullProcessImageNameW
CreateDirectoryA
WriteConsoleW
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
Process32NextW
CreateToolhelp32Snapshot
OpenProcess
GetModuleHandleA
GetModuleFileNameA
FindFirstFileExW
GetLastError
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
GetTimeZoneInformation
GetProcessHeap
SetFilePointerEx
GetFileSizeEx
GetConsoleOutputCP
FlushFileBuffers
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetCommandLineW
GetCommandLineA
GetStdHandle
ExitProcess
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetFileInformationByHandle
GetDriveTypeW
HeapReAlloc
GetModuleHandleExW
ExitThread
HeapFree
HeapAlloc
RaiseException
RtlUnwind
LoadLibraryW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualProtect
VirtualFree
VirtualAlloc
GetVersionExW
LoadLibraryExW
GetModuleFileNameW
FreeLibraryAndExitThread
FreeLibrary
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
Sleep
FindClose
CreateMutexA
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
DuplicateHandle
WaitForSingleObjectEx
GetCurrentThread
GetExitCodeThread
GetNativeSystemInfo
QueryPerformanceCounter
QueryPerformanceFrequency
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
InitializeCriticalSection
Process32First
Process32Next
GetComputerNameA
GlobalAlloc
GlobalFree
FileTimeToSystemTime
FileTimeToLocalFileTime
lstrcmpiA
GetProcessTimes
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer

user32

GetWindowThreadProcessId
GetWindowRect
IsWindowVisible
GetClassNameA
IsWindow
GetWindowTextA
EnumWindows
IsIconic
GetSystemMetrics

advapi32

RegOpenKeyExA
RegQueryValueExA
RegEnumKeyExA
RegCloseKey

shell32

ShellExecuteA

ws2_32

send
socket
ntohs
recv
freeaddrinfo
getnameinfo
setsockopt
WSACleanup
gethostbyname
WSAStartup
inet_ntoa
getsockname
getpeername
getaddrinfo
WSASocketW
listen
shutdown
bind
accept
inet_addr
select
closesocket

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

winhttp

WinHttpConnect
WinHttpSetTimeouts
WinHttpSendRequest
WinHttpCloseHandle
WinHttpSetOption
WinHttpOpenRequest
WinHttpReadData
WinHttpQueryHeaders
WinHttpOpen
WinHttpReceiveResponse
WinHttpAddRequestHeaders
WinHttpQueryDataAvailable

shlwapi

PathRemoveExtensionA
PathRemoveFileSpecA
PathFileExistsA

wininet

InternetOpenUrlA
InternetOpenA
InternetCloseHandle
InternetReadFile

rpcrt4

UuidCreateSequential

iphlpapi

GetAdaptersInfo
SendARP

Sections

.text
Size: 771KB - Virtual size: 771KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 149KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 540KB - Virtual size: 539KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5c3a34e2e5bdef266cc5007e9d86f35e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ws2_32

version

winhttp

shlwapi

wininet

rpcrt4

iphlpapi

Sections

.text Size: 771KB - Virtual size: 771KB

.rdata Size: 149KB - Virtual size: 149KB

.data Size: 16KB - Virtual size: 42KB

.gfids Size: 3KB - Virtual size: 3KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 540KB - Virtual size: 539KB

.reloc Size: 31KB - Virtual size: 31KB

.text
Size: 771KB - Virtual size: 771KB

.rdata
Size: 149KB - Virtual size: 149KB

.data
Size: 16KB - Virtual size: 42KB

.gfids
Size: 3KB - Virtual size: 3KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 540KB - Virtual size: 539KB

.reloc
Size: 31KB - Virtual size: 31KB