765efc81c371e4f868b5afaac75e64412b8618f28ecb186cf66ec4c013e3d331

Sharing

Copy URL Twitter E-mail

General

Target

765efc81c371e4f868b5afaac75e64412b8618f28ecb186cf66ec4c013e3d331
Size

685KB
MD5

b9146bd964484d4ba596f4c9567546f4
SHA1

e5d421a5705c0a388bb129c2df8943745982d8d0
SHA256

765efc81c371e4f868b5afaac75e64412b8618f28ecb186cf66ec4c013e3d331
SHA512

4cd2356557a8fb51af011e77127e6930d9a6ba4fa36d7425563bc16b5bf39ca93ce8a22242141026f16257025d5a1181e76aa931b6d863ccec8fe09d7204e916
SSDEEP

6144:+W9VBgBBBBzHczHxz91ygNoqcala/FiIwiCdRKkDO2vyyLEnrqePgN2jwk+UjgIX:687xzigNoqcwa9+igkY2B+igI7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
765efc81c371e4f868b5afaac75e64412b8618f28ecb186cf66ec4c013e3d331

Files

765efc81c371e4f868b5afaac75e64412b8618f28ecb186cf66ec4c013e3d331
.exe windows:5 windows x64

123cf208188f3e53ad401a4526242e91

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

GetClientRect
ModifyMenuW
MessageBoxW
MapWindowPoints
LoadStringW
InsertMenuW
GetSubMenu
GetMenuItemID
GetMenuItemCount
MapVirtualKeyW
EnableMenuItem
DrawMenuBar
DestroyMenu
DeleteMenu
CreatePopupMenu
ClipCursor
AppendMenuW
ToAscii

gdi32

DeleteObject
CreatePalette
SetPaletteEntries

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

comdlg32

CommDlgExtendedError
GetOpenFileNameW

msvcrt

memmove
__lconv_init
signal
_wcmdln
__winitenv
_initterm
_fpreset
_cexit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__setusermatherr
malloc
wcsrchr
_vscwprintf
_vscprintf
wcslen
_snwprintf
wcsncmp
wcstoul
_vsnprintf
strrchr
_snprintf
toupper
_strupr
_strnicmp
_wfopen
fgetws
fclose
_vsnwprintf
__C_specific_handler
memcpy
strncpy
strchr
strlen
wprintf
strcpy
memset
strtoul

kernel32

SetUnhandledExceptionFilter
GetStartupInfoW
SetLastConsoleEventActive
GetCurrentProcessId
ConsoleMenuControl
SetConsoleMode
SetConsoleCtrlHandler
GetConsoleWindow
GetCurrentThreadId
GetSystemTimeAsFileTime
GetModuleHandleA
QueryPerformanceCounter
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
TlsGetValue
ShowConsoleCursor
GetEnvironmentStrings
GetConsoleMode
GetSystemDirectoryW
GetModuleHandleW
GetModuleFileNameW
GetFileType
GetCommandLineA
ExitProcess
LoadLibraryW
LoadLibraryA
GetProcAddress
FreeLibrary
GetConsoleInputWaitHandle
ReadConsoleInputExW
WaitForMultipleObjects
Sleep
ResetEvent
DebugBreak
ExitVDM
GetNextVDMCommand
SetConsoleTitleA
SetEvent
ResumeThread
GetExitCodeProcess
FindNextFileA
FindFirstFileA
FindClose
DeleteFileA
CreateThread
CreateEventW
GetBinaryTypeA
ExpandEnvironmentStringsA
CreateProcessA
GetStdHandle
UnlockFile
SetEndOfFile
LockFile
SetFileTime
SetFileAttributesA
SetCurrentDirectoryA
RemoveDirectoryA
MoveFileA
GetTempFileNameA
GetShortPathNameA
GetFullPathNameA
GetFileTime
GetFileAttributesA
GetDriveTypeA
GetDiskFreeSpaceA
GetTickCount
GetLastError
Beep
CloseHandle
CreateFileW
GetLocalTime
ReadFile
SetFilePointer
SetLastError
SetLocalTime
WriteFile
RtlCompareMemory
FlushFileBuffers
GetFileInformationByHandle
GetFileSize
CreateMutexW
ReleaseMutex
WaitForSingleObject
CreateConsoleScreenBuffer
GetConsoleCursorInfo
GetConsoleScreenBufferInfo
InvalidateConsoleDIBits
ReadConsoleOutputA
SetConsoleActiveScreenBuffer
SetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleScreenBufferSize
SetConsoleWindowInfo
SetConsolePalette
WriteConsoleOutputA
FreeEnvironmentStringsA
GetCurrentDirectoryA
GetLocaleInfoA
CreateFileA
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CreateDirectoryA
DosDateTimeToFileTime
FileTimeToDosDateTime

ntdll

RtlClearBits
RtlFindNextForwardRunClear
RtlInitializeBitMap
RtlNumberOfClearBits
RtlSetBits
RtlAreBitsClear
RtlFindLastBackwardRunClear
RtlReAllocateHeap
RtlAnsiStringToUnicodeString
RtlIsNameLegalDOS8Dot3
RtlCreateUnicodeString
RtlFreeUnicodeString
NtAllocateVirtualMemory
NtFreeVirtualMemory
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
RtlQueryRegistryValues
NtQueryInformationProcess
RtlUpcaseUnicodeChar
DbgPrint
RtlAssert
RtlAllocateHeap
RtlFreeHeap
NtQueryPerformanceCounter
RtlInitUnicodeString
NtCreateFile
NtDeviceIoControlFile
NtClose
RtlEqualString
RtlInitAnsiString
RtlUpperChar

Exports

Exports

MGetVdmPointer
Sim32pGetVDMPointer
VDDAllocMem
VDDDeInstallIOHook
VDDDeInstallMemoryHook
VDDDeInstallUserHook
VDDExcludeMem
VDDFreeMem
VDDIncludeMem
VDDInstallIOHook
VDDInstallMemoryHook
VDDInstallUserHook
VDDQueryDMA
VDDReleaseIrqLine
VDDRequestDMA
VDDReserveIrqLine
VDDSetDMA
VDDSimulate16
VDDTerminateVDM
VdmMapFlat
c_getAF
c_getAH
c_getAL
c_getAX
c_getBH
c_getBL
c_getBP
c_getBX
c_getCF
c_getCH
c_getCL
c_getCS
c_getCX
c_getDF
c_getDH
c_getDI
c_getDL
c_getDS
c_getDX
c_getEAX
c_getEBP
c_getEBX
c_getECX
c_getEDI
c_getEDX
c_getEIP
c_getES
c_getESI
c_getESP
c_getFS
c_getGS
c_getIF
c_getIP
c_getMSW
c_getOF
c_getPF
c_getSF
c_getSI
c_getSP
c_getSS
c_getZF
c_setAF
c_setAH
c_setAL
c_setAX
c_setBH
c_setBL
c_setBP
c_setBX
c_setCF
c_setCH
c_setCL
c_setCS
c_setCX
c_setDF
c_setDH
c_setDI
c_setDL
c_setDS
c_setDX
c_setEAX
c_setEBP
c_setEBX
c_setECX
c_setEDI
c_setEDX
c_setEIP
c_setES
c_setESI
c_setESP
c_setFS
c_setGS
c_setIF
c_setIP
c_setMSW
c_setOF
c_setPF
c_setSF
c_setSI
c_setSP
c_setSS
c_setZF
call_ica_hw_interrupt
demClientErrorEx
demFileDelete
demFileFindFirst
demFileFindNext
demGetPhysicalDriveType
demIsShortPathName
demSetCurrentDirectoryGetDrive
getAF
getAH
getAL
getAX
getBH
getBL
getBP
getBX
getCF
getCH
getCL
getCS
getCX
getDF
getDH
getDI
getDL
getDS
getDX
getEAX
getEBP
getEBX
getECX
getEDI
getEDX
getEFLAGS
getEIP
getES
getESI
getESP
getFS
getGS
getIF
getIP
getIntelRegistersPointer
getMSW
getOF
getPF
getSF
getSI
getSP
getSS
getZF
host_simulate
setAF
setAH
setAL
setAX
setBH
setBL
setBP
setBX
setCF
setCH
setCL
setCS
setCX
setDF
setDH
setDI
setDL
setDS
setDX
setEAX
setEBP
setEBX
setECX
setEDI
setEDX
setEFLAGS
setEIP
setES
setESI
setESP
setFS
setGS
setIF
setIP
setMSW
setOF
setPF
setSF
setSI
setSP
setSS
setZF

Sections

.text
Size: 464KB - Virtual size: 464KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 10.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 139KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

123cf208188f3e53ad401a4526242e91

Headers

DLL Characteristics

File Characteristics

Imports

user32

gdi32

advapi32

comdlg32

msvcrt

kernel32

ntdll

Exports

Exports

Sections

.text Size: 464KB - Virtual size: 464KB

.rdata Size: 63KB - Virtual size: 63KB

.data Size: 6KB - Virtual size: 10.6MB

.pdata Size: 9KB - Virtual size: 9KB

.rsrc Size: 139KB - Virtual size: 138KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 464KB - Virtual size: 464KB

.rdata
Size: 63KB - Virtual size: 63KB

.data
Size: 6KB - Virtual size: 10.6MB

.pdata
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 139KB - Virtual size: 138KB

.reloc
Size: 1KB - Virtual size: 1KB