cb8c9d32c7d729c24c8829f32e337750751fc8cc1d4bac14282c17774ff37e58

Sharing

Copy URL Twitter E-mail

General

Target

cb8c9d32c7d729c24c8829f32e337750751fc8cc1d4bac14282c17774ff37e58
Size

1.5MB
MD5

6737272e5c011a6900cd60a27228baae
SHA1

30a92e0163108550ea43cae2ccd01c18a938b465
SHA256

cb8c9d32c7d729c24c8829f32e337750751fc8cc1d4bac14282c17774ff37e58
SHA512

38eaf6b22c5de71bd08a764f66729b8caaf90f6b1044cb8c5e33a8e514040d2fe90d336d6170627bc74367e627452dc082c2697ee2e3c58f6aa8c62fccd48c19
SSDEEP

24576:mGMcKU4M208/l2YdR6r01qFP5hdgRp51ey6q8H7jkO+l1K2OsVjMkxrLEu2ImWUR:mGMryp892Yf12I3Pefjknl1ffVjnLEP5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cb8c9d32c7d729c24c8829f32e337750751fc8cc1d4bac14282c17774ff37e58

Files

cb8c9d32c7d729c24c8829f32e337750751fc8cc1d4bac14282c17774ff37e58
.exe windows:5 windows x86

60a314454d37286165d916a9dac74fbd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
CreateMutexW
lstrcmpiW
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetCommandLineW
WriteFile
CreateFileW
FindAtomW
GlobalAddAtomW
GetTickCount
WideCharToMultiByte
lstrcpyW
FindNextFileW
FindClose
GetFullPathNameW
FindFirstFileW
CreateFileA
GetTempPathA
CreateThread
Sleep
GetCurrentProcess
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
CompareFileTime
GetTempFileNameW
MoveFileW
MoveFileExW
CopyFileW
GetDriveTypeW
GetModuleHandleW
lstrcmpiA
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringA
GetModuleHandleA
GetDateFormatA
GetTimeFormatA
GetTimeZoneInformation
LCMapStringW
QueryPerformanceCounter
GetStartupInfoA
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleMode
GetConsoleCP
GetModuleFileNameA
MulDiv
IsValidCodePage
GetOEMCP
GetCPInfo
DeleteCriticalSection
GetStartupInfoW
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
SystemTimeToFileTime
LocalFileTimeToFileTime
DeviceIoControl
InitializeCriticalSectionAndSpinCount
GetACP
InitializeCriticalSection
SetLastError
GetCurrentThreadId
RaiseException
GetPrivateProfileStringW
GetFileAttributesW
GetTempPathW
GlobalFindAtomW
CreateDirectoryW
WritePrivateProfileStringW
SetFileAttributesW
lstrlenA
OutputDebugStringW
SetEnvironmentVariableW
TlsFree
TlsAlloc
TlsSetValue
TlsGetValue
ReleaseMutex
GetFileSizeEx
SetFilePointerEx
GetFileType
lstrcmpA
FormatMessageW
GetSystemTime
LocalFree
GetSystemTimeAsFileTime
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetStdHandle
SetEndOfFile
SetFileTime
ReadFile
GetFileSize
UnmapViewOfFile
SetFilePointer
MapViewOfFile
CreateFileMappingW
FindResourceExW
DebugBreak
GetProcAddress
ReadProcessMemory
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
ExitProcess
CloseHandle
GetFileTime
GetExitCodeProcess
WaitForSingleObject
GetLongPathNameW
TerminateProcess
OpenProcess
GetCurrentProcessId
GetEnvironmentVariableW
GetVersionExW
LockResource
Thread32Next
Thread32First
Module32NextW
InterlockedIncrement
GetModuleFileNameW
RemoveDirectoryW
DeleteFileW
GetSystemDirectoryW
LoadLibraryW
lstrlenW
InterlockedDecrement
FreeLibrary
HeapCreate
SuspendThread
Module32FirstW
CreateToolhelp32Snapshot
GetFileAttributesExW
OpenThread

user32

wvsprintfW
SendMessageTimeoutW
LoadStringW
EnumWindows
GetClassNameW
GetWindowThreadProcessId
UpdateWindow
GetDC
ReleaseDC
GetActiveWindow
MessageBoxW
GetWindowPlacement
CopyRect
KillTimer
SetTimer
ScreenToClient
DefWindowProcW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
BringWindowToTop
GetSystemMetrics
LoadImageW
LoadIconW
CreateDialogParamW
IsIconic
PostQuitMessage
InflateRect
GetWindow
MonitorFromWindow
GetMonitorInfoW
IsDialogMessageW
MoveWindow
GetSystemMenu
PostMessageW
EnableMenuItem
GetParent
SetWindowTextW
IsWindowEnabled
EnableWindow
GetWindowTextLengthW
GetWindowTextW
MapWindowPoints
MessageBeep
SetFocus
SetWindowLongW
IsWindow
GetDlgItem
SetDlgItemTextW
RedrawWindow
IsWindowVisible
ShowWindow
InvalidateRect
GetClientRect
wsprintfW
ExitWindowsEx
UnregisterClassA
GetWindowRect
SetWindowPos
GetWindowLongW
DestroyWindow
CreateWindowExW
FindWindowW
SendMessageW
CharNextW
CharUpperW

gdi32

DeleteObject
GetStockObject

advapi32

RegDeleteKeyW
RegEnumKeyExA
RegQueryValueExA
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExA
RegOpenKeyW
RegEnumKeyExW
RegCloseKey
OpenProcessToken

shell32

SHGetSpecialFolderLocation
ShellExecuteW
SHGetSpecialFolderPathW
ShellExecuteExW
SHGetMalloc
ord680
SHBrowseForFolderW
SHGetFolderPathW
SHGetPathFromIDListW
ord165
SHFileOperationW
SHChangeNotify

ole32

CoUninitialize
CoCreateInstance
CoTaskMemFree
OleRun
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateGuid
CoInitialize

oleaut32

VarUI4FromStr
SysStringByteLen
SysAllocStringByteLen
SysFreeString
SysAllocString
VariantClear
SysStringLen
SystemTimeToVariantTime
VarUdateFromDate
VariantTimeToSystemTime
VariantInit

shlwapi

SHDeleteValueW
SHGetValueW
SHSetValueW
PathFileExistsW
PathCombineW
PathAppendW
PathIsRelativeW
PathRemoveFileSpecW
SHDeleteKeyW
PathIsDirectoryW
PathRemoveExtensionW
PathMatchSpecW
StrRetToStrW
PathIsPrefixW
SHSetValueA
PathCombineA
PathAppendA
PathFindExtensionW
wnsprintfW
PathFindFileNameW
SHGetValueA

comctl32

InitCommonControlsEx

urlmon

URLDownloadToFileW
URLDownloadToCacheFileW

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState

netapi32

Netbios

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW
EnumProcesses

setupapi

SetupIterateCabinetW

crypt32

CryptMsgClose
CertCloseStore
CryptMsgUpdate
CryptMsgOpenToDecode
CertOpenStore
CertGetCertificateContextProperty
CertGetNameStringW

wintrust

WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData

Sections

.text
Size: 436KB - Virtual size: 436KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 952KB - Virtual size: 952KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

60a314454d37286165d916a9dac74fbd

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

urlmon

iphlpapi

wininet

netapi32

version

psapi

setupapi

crypt32

wintrust

Sections

.text Size: 436KB - Virtual size: 436KB

.rdata Size: 87KB - Virtual size: 87KB

.data Size: 14KB - Virtual size: 25KB

.rsrc Size: 952KB - Virtual size: 952KB

.reloc Size: 36KB - Virtual size: 36KB

.text
Size: 436KB - Virtual size: 436KB

.rdata
Size: 87KB - Virtual size: 87KB

.data
Size: 14KB - Virtual size: 25KB

.rsrc
Size: 952KB - Virtual size: 952KB

.reloc
Size: 36KB - Virtual size: 36KB