1ff0f02a496f945221793132580562119fc628482fef10d3952119ac91a597d2

Sharing

Copy URL Twitter E-mail

General

Target

1ff0f02a496f945221793132580562119fc628482fef10d3952119ac91a597d2
Size

1.2MB
MD5

950356c59fd38d6b6df7bd31bfa2f535
SHA1

d1c4654bf7a359b85822aef4c7251c9f8ee0c9bf
SHA256

1ff0f02a496f945221793132580562119fc628482fef10d3952119ac91a597d2
SHA512

df9be37b15d8bed94efc973505469a02b7f7c8e75e91fbe9009ad083d9ea09634df29885dc733ffb30e381267f25b412d6347e74f78923faf65ea81c9c945ac0
SSDEEP

24576:loKNYKmgUSMCOJZpM05AgBcgYL9mNyweW2fsAt4hwu/UEl9bu0PwdSfQCH:7NqPM7gBcENQfZt4h5p9budA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1ff0f02a496f945221793132580562119fc628482fef10d3952119ac91a597d2

Files

1ff0f02a496f945221793132580562119fc628482fef10d3952119ac91a597d2
.exe windows:5 windows x86

cd88f298feb287e83e03a7aaee1d092c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetCurrentDirectoryW
LoadLibraryW
OutputDebugStringW
SetDllDirectoryW
GetModuleFileNameW
GetCommandLineW
OutputDebugStringA
CreateProcessW
CreateToolhelp32Snapshot
GetLastError
lstrlenW
lstrlenA
CreateFileW
WriteConsoleW
CompareStringW
GetConsoleMode
GetConsoleCP
GetExitCodeProcess
GetTimeZoneInformation
GetCurrentDirectoryW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
FatalAppExitA
HeapReAlloc
GetCurrentProcessId
Process32FirstW
Process32NextW
Sleep
GetTickCount
OpenProcess
WaitForSingleObject
CloseHandle
InterlockedExchange
IsValidCodePage
GetOEMCP
GetACP
QueryPerformanceCounter
HeapDestroy
HeapCreate
GetStartupInfoW
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
HeapSize
GetLocaleInfoW
GetStdHandle
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetLastError
TlsFree
TlsSetValue
TlsGetValue
WideCharToMultiByte
MultiByteToWideChar
GetFileAttributesW
InterlockedDecrement
GetDiskFreeSpaceExA
GetDriveTypeW
FindFirstFileW
LocalFree
LocalAlloc
lstrcpyW
GetDriveTypeA
GetLogicalDriveStringsA
DeleteFileA
SetFileAttributesA
GetFileAttributesA
GetModuleFileNameA
GetModuleHandleA
CreateFileA
GetLongPathNameW
HeapAlloc
GetProcessHeap
VirtualQuery
WriteProcessMemory
GetCurrentProcess
SetUnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
HeapFree
Thread32Next
Thread32First
SuspendThread
OpenThread
GetCurrentThreadId
TerminateProcess
WaitForMultipleObjects
SearchPathW
DuplicateHandle
CreateEventA
EnterCriticalSection
ReadProcessMemory
VirtualAllocEx
InitializeCriticalSection
SetErrorMode
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetPrivateProfileStringA
LoadLibraryA
GetPrivateProfileStringW
FreeLibrary
InterlockedIncrement
InterlockedCompareExchange
DeleteCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
FormatMessageA
GetEnvironmentVariableA
CreateFileMappingA
OpenFileMappingA
CreateThread
ExitThread
GetCurrentThread
GetExitCodeThread
SleepEx
GetSystemTimeAsFileTime
VirtualProtect
VirtualLock
VirtualUnlock
SetProcessWorkingSetSize
FlushViewOfFile
SetEndOfFile
SetFilePointer
Process32Next
Process32First
GetSystemInfo
GetVersionExA
GetLocalTime
Module32First
LockFile
LockFileEx
UnlockFile
UnlockFileEx
WriteFile
ReadFile
FlushFileBuffers
GetFileSize
CreateDirectoryA
CopyFileA
GetShortPathNameA
CreateMutexA
ReleaseMutex
ResetEvent
SetEvent
ExitProcess
GenerateConsoleCtrlEvent
RtlUnwind
RaiseException
GetCommandLineA
HeapSetInformation
LCMapStringW
GetCPInfo
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileExA
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
CreatePipe
CreateProcessA
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetFullPathNameA
SetConsoleCtrlHandler
SetEnvironmentVariableA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetFileInformationByHandle
PeekNamedPipe
GetTimeFormatA
GetDateFormatA
MoveFileA
TlsAlloc
OpenMutexA

user32

InflateRect
OffsetRect
SetWindowLongA
MessageBoxA
TranslateMessage
PeekMessageW
GetWindow
GetForegroundWindow
SetWindowPos
DispatchMessageA
SetCursor
ClipCursor

shell32

CommandLineToArgvW
SHCreateDirectoryExW
SHGetDesktopFolder
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW

version

GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoSizeW

shlwapi

PathFileExistsW
PathIsRelativeW

winmm

timeBeginPeriod
timeGetDevCaps
timeSetEvent
timeKillEvent

tx_log

?GetLogLevel@TxLogWrapper@@YG?AW4LogLevel@1@XZ
?MakeLogOutput@TxLogWrapper@@YGXPB_W0W4LogLevel@1@@Z
?SetLogPath@TxLogWrapper@@YGXPB_W@Z
?SetLogLevel@TxLogWrapper@@YGXW4LogLevel@1@@Z
?FlushLog@TxLogWrapper@@YGXXZ

crypt32

CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertGetNameStringA
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CertGetNameStringW

ws2_32

listen
socket
setsockopt
ioctlsocket
gethostbyname
htons
ntohl
inet_addr
bind
WSAGetLastError
connect
__WSAFDIsSet
select
accept
closesocket
send
recv
htonl
WSACleanup
getsockopt
inet_ntoa
WSAStartup

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoTaskMemFree
CoInitializeSecurity

oleaut32

SysFreeString
VariantClear
CreateErrorInfo
SetErrorInfo
VariantInit
VariantChangeType
GetErrorInfo
SysAllocString

comdlg32

GetOpenFileNameW

advapi32

RegCreateKeyExW
AllocateAndInitializeSid
InitializeSecurityDescriptor
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
FreeSid
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
GetLengthSid

Sections

.text
Size: 804KB - Virtual size: 804KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 145KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 45KB - Virtual size: 5.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 251KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cd88f298feb287e83e03a7aaee1d092c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

version

shlwapi

winmm

tx_log

crypt32

ws2_32

ole32

oleaut32

comdlg32

advapi32

Sections

.text Size: 804KB - Virtual size: 804KB

.rdata Size: 145KB - Virtual size: 145KB

.data Size: 45KB - Virtual size: 5.9MB

.rsrc Size: 251KB - Virtual size: 252KB

.text
Size: 804KB - Virtual size: 804KB

.rdata
Size: 145KB - Virtual size: 145KB

.data
Size: 45KB - Virtual size: 5.9MB

.rsrc
Size: 251KB - Virtual size: 252KB