780ecb34576bf1897e045937b8269a4ef38708d0cfa4ca865658e471d665a8b4

Sharing

Copy URL Twitter E-mail

General

Target

780ecb34576bf1897e045937b8269a4ef38708d0cfa4ca865658e471d665a8b4
Size

3.9MB
MD5

b1eb8526b94d21fff072c14b9e34fe86
SHA1

da49497cd3898c2da49b62c5abf688fe903f3aff
SHA256

780ecb34576bf1897e045937b8269a4ef38708d0cfa4ca865658e471d665a8b4
SHA512

308c971ce26f96e67580c64e75f38844bd23b62dfcdca381552084374b647e5d4a31864e1f6a3c3abf438ca4574ee17969cbfc142ab19e8b9389eb6d06034650
SSDEEP

24576:mUmBJWaOHr9Wmxh9vOfL73+CDnhO9rWcUuVjCU+v0GGNfW:m0a4M7OCDnhOVnVjCU+v0GGNf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
780ecb34576bf1897e045937b8269a4ef38708d0cfa4ca865658e471d665a8b4

Files

780ecb34576bf1897e045937b8269a4ef38708d0cfa4ca865658e471d665a8b4
.exe windows:6 windows x86

d197ea2196a92290b5d63b83e97e09c4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

iphlpapi

GetInterfaceInfo
NotifyIpInterfaceChange
GetAdaptersAddresses
IpRenewAddress
GetExtendedTcpTable
GetAdaptersInfo
CancelIPChangeNotify
CancelMibChangeNotify2
SetTcpEntry
GetPerAdapterInfo
NotifyRouteChange
GetIpAddrTable

cfgmgr32

CM_Get_Device_Interface_ListA
CM_Get_Device_Interface_List_SizeA

winhttp

WinHttpAddRequestHeaders
WinHttpOpen
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpReadData
WinHttpSetOption
WinHttpCloseHandle
WinHttpQueryAuthSchemes
WinHttpSendRequest
WinHttpQueryDataAvailable
WinHttpSetCredentials
WinHttpConnect
WinHttpOpenRequest

api-ms-win-core-synch-l1-2-0

SignalObjectAndWait
Sleep

api-ms-win-core-kernel32-legacy-l1-1-1

SetDllDirectoryW
VerifyVersionInfoW

api-ms-win-core-processenvironment-l1-1-0

SetStdHandle
GetCommandLineA
GetCommandLineW
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetEnvironmentVariableW
GetCurrentDirectoryW
ExpandEnvironmentStringsW

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW
GetFileVersionInfoSizeW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegSetValueExW
RegSetKeySecurity
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegCreateKeyExW
RegDeleteKeyExW

ws2_32

closesocket
WSASend
select
WSAEnumNetworkEvents
WSAEventSelect
inet_ntoa
htonl
shutdown
listen
htons
WSAStartup
getpeername
getsockname
send
socket
ntohs
ntohl
bind
recv
getsockopt
ioctlsocket
getnameinfo
freeaddrinfo
accept
getservbyname
gethostbyaddr
getaddrinfo
setsockopt
__WSAFDIsSet
inet_addr
gethostname
getservbyport
WSASetLastError
connect
WSACleanup
WSAGetLastError
WSAAddressToStringA
WSACloseEvent
WSACreateEvent
WSAAccept
gethostbyname

api-ms-win-core-com-l1-1-0

CoImpersonateClient
PropVariantClear
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoSetProxyBlanket
CoRevertToSelf
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoInitializeSecurity
CoRevokeClassObject
CoReleaseServerProcess
CoAddRefServerProcess
CoRegisterClassObject
CoResumeClassObjects

oleaut32

VarBstrCat
SysAllocString
SysFreeString
VariantInit
VariantClear
SysStringLen
UnRegisterTypeLi
LoadRegTypeLi
SafeArrayCreate
SafeArrayGetUBound
VarUI4FromStr
RegisterTypeLi
VariantChangeType
SafeArrayGetLBound
SafeArrayLock
SafeArrayUnlock
SafeArrayPutElement
SafeArrayCreateVector
SysStringByteLen
SysAllocStringByteLen
LoadTypeLi
SysAllocStringLen

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-synch-l1-1-0

TryEnterCriticalSection
InitializeCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
CreateMutexW
CreateMutexA
ReleaseMutex
ReleaseSemaphore
SetEvent
ResetEvent
CreateEventW
EnterCriticalSection
CreateEventA
WaitForMultipleObjectsEx
WaitForSingleObjectEx

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
OpenProcessToken
GetCurrentThreadId
GetCurrentThread
CreateThread
GetCurrentProcess
SwitchToThread
TerminateProcess
SetThreadPriority
GetThreadId
GetCurrentProcessId
ExitProcess
ExitThread
TlsGetValue
TlsFree
SuspendThread
GetThreadPriority
TlsAlloc
TlsSetValue
GetExitCodeThread
ResumeThread
GetStartupInfoW

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
LoadStringW
SizeofResource
LoadLibraryExA
FreeLibrary
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleExW
FreeLibraryAndExitThread

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
FindResourceW
LoadLibraryA

api-ms-win-security-base-l1-1-0

CopySid
InitializeSecurityDescriptor
IsValidSid
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
AdjustTokenPrivileges
GetTokenInformation
SetSecurityDescriptorDacl
AllocateAndInitializeSid
FreeSid
GetLengthSid
EqualSid
CreateWellKnownSid

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrcmpiW

api-ms-win-core-string-l2-1-0

CharNextW
CharUpperW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringW
GetStringTypeW
MultiByteToWideChar

api-ms-win-core-registry-l2-1-0

RegCreateKeyW
RegDeleteKeyW

api-ms-win-service-management-l2-1-0

ChangeServiceConfigW
ChangeServiceConfig2W

api-ms-win-service-management-l1-1-0

DeleteService
OpenServiceW
OpenSCManagerW
CloseServiceHandle
CreateServiceW

api-ms-win-service-winsvc-l1-1-0

ControlService

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus
StartServiceCtrlDispatcherW

api-ms-win-core-heap-l2-1-0

GlobalAlloc
GlobalFree
LocalFree
LocalAlloc

api-ms-win-core-localization-l1-2-0

IsValidCodePage
GetACP
GetOEMCP
EnumSystemLocalesW
LCMapStringW
GetLocaleInfoW
GetCPInfo
GetSystemDefaultLCID
GetUserDefaultLCID
IsValidLocale
FormatMessageW

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW
LookupPrivilegeValueW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-sysinfo-l1-1-0

GetComputerNameExA
GetTickCount
GetLogicalProcessorInformation
GetSystemTimeAsFileTime
GetSystemInfo
GetSystemTime
GetVersionExW
GetSystemDirectoryA

crypt32

CertFindCertificateInStore
CryptQueryObject
CertFreeCertificateContext
CryptMsgClose
CertGetNameStringW
CertCloseStore
CryptMsgGetParam
CertOpenStore

api-ms-win-core-file-l1-1-0

FindFirstFileW
GetFileAttributesW
CreateFileA
GetFileType
GetFullPathNameW
UnlockFileEx
SetFilePointerEx
FindClose
LockFileEx
ReadFile
WriteFile
SetFilePointer
SetEndOfFile
CreateFileW
GetDriveTypeW
FindFirstFileExW
FindNextFileW
GetFinalPathNameByHandleW
FlushFileBuffers
GetFileInformationByHandle

wintrust

WinVerifyTrust

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
GetThreadTimes

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus
GetComputerNameA
UnregisterWait
RegisterWaitForSingleObject

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW
WaitForMultipleObjects

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-core-io-l1-1-0

GetOverlappedResult
DeviceIoControl

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-heap-l1-1-0

HeapSize
GetProcessHeap
HeapAlloc
HeapReAlloc
HeapFree

rpcrt4

RpcStringFreeW
UuidCreate
UuidToStringW

api-ms-win-power-setting-l1-1-0

PowerReadDCValue
PowerReadACValue

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetSpecialFolderPathW

api-ms-win-core-shutdown-l1-1-0

InitiateSystemShutdownExW

powrprof

SetSuspendState

api-ms-win-power-base-l1-1-0

GetPwrCapabilities

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect

advapi32

ReportEventW
DeregisterEventSource
RegisterEventSourceW

user32

MessageBoxW
PostThreadMessageW
UnregisterDeviceNotification
DispatchMessageW
RegisterDeviceNotificationW
GetMessageW
TranslateMessage

api-ms-win-core-interlocked-l1-1-0

InterlockedFlushSList
QueryDepthSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
UnregisterWaitEx
ChangeTimerQueueTimer
CreateTimerQueueTimer
CreateTimerQueue

api-ms-win-core-systemtopology-l1-1-0

GetNumaHighestNodeNumber

api-ms-win-core-processtopology-obsolete-l1-1-0

SetThreadAffinityMask
GetProcessAffinityMask

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwind

api-ms-win-core-console-l1-1-0

ReadConsoleW
GetConsoleCP
SetConsoleCtrlHandler
GetConsoleMode
WriteConsoleW

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 896KB - Virtual size: 896KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 220KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d197ea2196a92290b5d63b83e97e09c4

Headers

DLL Characteristics

File Characteristics

Imports

iphlpapi

cfgmgr32

winhttp

api-ms-win-core-synch-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-core-registry-l1-1-0

ws2_32

api-ms-win-core-com-l1-1-0

oleaut32

api-ms-win-core-util-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-security-base-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

crypt32

api-ms-win-core-file-l1-1-0

wintrust

api-ms-win-security-provider-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-heap-l1-1-0

rpcrt4

api-ms-win-power-setting-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

ext-ms-win-shell32-shellfolders-l1-1-0

api-ms-win-core-shutdown-l1-1-0

powrprof

api-ms-win-power-base-l1-1-0

api-ms-win-core-memory-l1-1-0

advapi32

user32

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-systemtopology-l1-1-0

api-ms-win-core-processtopology-obsolete-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-datetime-l1-1-0

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 896KB - Virtual size: 896KB

.data Size: 220KB - Virtual size: 220KB

.didat Size: 4KB - Virtual size: 4KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 896KB - Virtual size: 896KB

.data
Size: 220KB - Virtual size: 220KB

.didat
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 36KB - Virtual size: 36KB

.reloc
Size: 236KB - Virtual size: 236KB