65eff390bec6383ce685f5aaa539af433aa9612f58ccd97f7ad6c75f01bfc5f0

Sharing

Copy URL Twitter E-mail

General

Target

65eff390bec6383ce685f5aaa539af433aa9612f58ccd97f7ad6c75f01bfc5f0
Size

197KB
MD5

655f797a192886ccb817377151f2779d
SHA1

53026363c64c0b2d2669665de71b111b90aac60f
SHA256

65eff390bec6383ce685f5aaa539af433aa9612f58ccd97f7ad6c75f01bfc5f0
SHA512

8041f17f6adb73077ad6ffa880fa3895ffb6d07595df00ef24be4d53789a573bb04856a97f599a43f7e431d762eedbb5298f58e522bb97749c9d903895d301d2
SSDEEP

3072:vOJIPAvrGwMD8fDMNX33qLqhuGIcrfhS/LFqjSfZSOgNucfE3tmgR5x2p/X:vLoT7yODK3SqvjdS/LFSasucQReB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
65eff390bec6383ce685f5aaa539af433aa9612f58ccd97f7ad6c75f01bfc5f0

Files

65eff390bec6383ce685f5aaa539af433aa9612f58ccd97f7ad6c75f01bfc5f0
.exe windows:5 windows x86

7cb01374093d6adcb8714b75c7f24f02

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHDeleteKeyA

kernel32

MoveFileExA
HeapAlloc
HeapFree
GetProcessHeap
GetLocalTime
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GlobalAlloc
GlobalSize
GlobalLock
GlobalUnlock
GlobalFree
TerminateProcess
WaitForMultipleObjects
CreatePipe
DisconnectNamedPipe
PeekNamedPipe
GetStartupInfoA
SetErrorMode
ReleaseMutex
OpenEventA
FreeConsole
LocalSize
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentThreadId
lstrcmpiA
SetFilePointerEx
HeapSize
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExA
GetTickCount
GetFileType
LCMapStringW
CompareStringW
GetStringTypeW
HeapReAlloc
DecodePointer
GetACP
GetCommandLineW
GetCommandLineA
ExitProcess
GetStdHandle
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
RaiseException
WriteProcessMemory
CreateRemoteThread
GetCurrentProcess
OpenProcess
VirtualAllocEx
GetModuleFileNameA
SetLastError
GetVolumeInformationA
MoveFileA
FindNextFileA
FindFirstFileA
DeleteFileA
GetFileAttributesA
CreateFileA
RemoveDirectoryA
CreateDirectoryA
GetDiskFreeSpaceExA
GetDriveTypeA
CreateProcessA
GetLogicalDriveStringsA
FindClose
CreateFileW
SetFilePointer
ReadFile
WriteFile
GetFileSize
GetLastError
LocalFree
LocalReAlloc
LocalAlloc
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetWindowsDirectoryA
GetPrivateProfileSectionNamesA
GetPrivateProfileStringA
LoadLibraryA
lstrlenA
lstrcatA
lstrcmpA
GetProcAddress
FreeLibrary
CancelIo
lstrcpyA
Sleep
ResetEvent
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
CreateEventA
CloseHandle
WaitForSingleObject
RtlUnwind
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
SetEvent
ResumeThread
TerminateThread
GetSystemDirectoryA
CreateThread
WriteConsoleW

user32

keybd_event
mouse_event
MapVirtualKeyA
SetCapture
GetSystemMetrics
SetCursorPos
WindowFromPoint
LoadCursorA
DestroyCursor
GetThreadDesktop
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
CharNextA
GetActiveWindow
SystemParametersInfoA
GetKeyNameTextA
GetWindowTextA
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
SendMessageA
OpenClipboard
BlockInput
GetDC
ReleaseDC
GetCursorPos
SetRect
GetDesktopWindow
GetCursorInfo
ExitWindowsEx
IsWindowVisible
EnumWindows
GetWindowThreadProcessId
CloseClipboard
SetClipboardData
GetClipboardData
OpenDesktopA
CloseWindow
IsWindow
CreateWindowExA
PostMessageA
GetUserObjectInformationA
OpenInputDesktop
CloseDesktop
SetThreadDesktop
EmptyClipboard

gdi32

CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
CreateDIBSection
SelectObject
GetDIBits
DeleteObject
BitBlt

advapi32

RegSetValueExA
IsValidSid
LookupAccountNameA
LsaFreeMemory
LsaClose
LsaOpenPolicy
LsaRetrievePrivateData
LookupAccountSidA
GetTokenInformation
SetServiceStatus
RegisterServiceCtrlHandlerA
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
FreeSid
AllocateAndInitializeSid
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
OpenEventLogA
CloseEventLog
ClearEventLogA
QueryServiceStatus
OpenServiceA
OpenSCManagerA
DeleteService
ControlService
CloseServiceHandle
RegQueryValueExA
RegOpenKeyA
RegQueryValueA
RegOpenKeyExA
RegCloseKey

shell32

SHGetFileInfoA
SHGetSpecialFolderPathA

winmm

waveOutWrite
waveOutReset
waveInGetNumDevs
waveOutPrepareHeader
waveInClose
waveInPrepareHeader
waveInUnprepareHeader
waveInAddBuffer
waveInStart
waveOutUnprepareHeader
waveOutClose
waveOutOpen
waveOutGetNumDevs
waveInOpen
waveInStop
waveInReset

ws2_32

ntohs
recv
select
closesocket
htons
gethostname
send
setsockopt
socket
gethostbyname
WSAStartup
WSACleanup
WSAIoctl
getsockname
connect

imm32

ImmGetCompositionStringA
ImmReleaseContext
ImmGetContext

wininet

InternetCloseHandle
InternetOpenUrlA
InternetReadFile
InternetOpenA

avicap32

capCreateCaptureWindowA
capGetDriverDescriptionA

msvfw32

ICClose
ICSendMessage
ICSeqCompressFrameStart
ICSeqCompressFrameEnd
ICSeqCompressFrame
ICCompressorFree
ICOpen

psapi

GetModuleFileNameExA
EnumProcessModules

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationA

Exports

Exports

ServiceMain

Sections

.text
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7cb01374093d6adcb8714b75c7f24f02

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

gdi32

advapi32

shell32

winmm

ws2_32

imm32

wininet

avicap32

msvfw32

psapi

wtsapi32

Exports

Exports

Sections

.text Size: 137KB - Virtual size: 136KB

.rdata Size: 41KB - Virtual size: 40KB

.data Size: 8KB - Virtual size: 11KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 137KB - Virtual size: 136KB

.rdata
Size: 41KB - Virtual size: 40KB

.data
Size: 8KB - Virtual size: 11KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 7KB