f6ea68374a7e55a252489a021f47adce9a413e5c092382cac2acbec38abb6ba4

Sharing

Copy URL

Twitter E-mail

General

Target

f6ea68374a7e55a252489a021f47adce9a413e5c092382cac2acbec38abb6ba4
Size

2.7MB
MD5

231cea4d69dd6aafde37b708afe5c95e
SHA1

cdd651fee47ce07ddca77799f9b489d2edb7db2b
SHA256

f6ea68374a7e55a252489a021f47adce9a413e5c092382cac2acbec38abb6ba4
SHA512

8bd96e970bae84787490760eed604777c00283f35d8bd3b2c256655e98c55cd81b3724ff062314685fb84bda0bd38ee3592dfb4192b9a754c844104b42c96b6e
SSDEEP

49152:Hf/jh0dP20zYd22k4e2mLf2i8OXgDInT/mUASAUA/J2p://F0dP20Edbk5XgD7K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6ea68374a7e55a252489a021f47adce9a413e5c092382cac2acbec38abb6ba4

Files

f6ea68374a7e55a252489a021f47adce9a413e5c092382cac2acbec38abb6ba4
.exe windows:6 windows x86

59cd1d153af9e583145eff4585887dba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

gethostbyname
inet_ntoa
select
WSAGetLastError
setsockopt
WSACleanup
__WSAFDIsSet
accept
bind
WSAIoctl
closesocket
gethostname
shutdown
listen
WSAStartup
getpeername
inet_addr
getsockname
send
socket
connect
recv
getsockopt
htonl
htons

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock
ExpandEnvironmentStringsForUserA

kernel32

Process32First
WriteFile
OutputDebugStringA
WaitForMultipleObjects
WaitForSingleObject
CreateFileW
GetSystemDirectoryW
CreateToolhelp32Snapshot
lstrcatW
Process32Next
LoadLibraryW
GetCurrentProcessId
CreateEventA
WaitNamedPipeW
GetExitCodeProcess
GetEnvironmentVariableA
SetCurrentDirectoryA
SetFileAttributesA
ResumeThread
ResetEvent
CompareFileTime
CreateFileA
GetFileSize
GetFileTime
GetStdHandle
WriteConsoleA
FreeConsole
FormatMessageA
AllocConsole
GetExitCodeThread
MoveFileA
GetDriveTypeA
SetFileTime
SetErrorMode
SetFilePointer
SetEndOfFile
GetFileAttributesA
MoveFileExA
FileTimeToSystemTime
GetLogicalDriveStringsA
SystemTimeToFileTime
CreateDirectoryA
GetSystemTime
FlushFileBuffers
TerminateProcess
VirtualAllocEx
ReadProcessMemory
SetThreadExecutionState
VirtualFreeEx
TerminateThread
SizeofResource
FindResourceA
LockResource
LoadResource
CreateMutexA
ReleaseMutex
GlobalGetAtomNameA
VerSetConditionMask
GetModuleHandleW
SetLastError
SetProcessShutdownParameters
GetVolumeInformationA
ExitThread
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEnvironmentVariableW
GetCPInfo
SetStdHandle
SetFilePointerEx
ReadConsoleW
GetTimeZoneInformation
GetConsoleMode
GetConsoleOutputCP
GetModuleHandleExW
ExitProcess
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
LoadLibraryExW
EncodePointer
RtlUnwind
OutputDebugStringW
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateSemaphoreA
TlsFree
TlsGetValue
TlsAlloc
GetCurrentThread
DuplicateHandle
SetThreadPriority
ReleaseSemaphore
TlsSetValue
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SwitchToThread
GetFileType
lstrcatA
lstrcmpiA
lstrcpynA
DosDateTimeToFileTime
GetLocalTime
FileTimeToLocalFileTime
SetVolumeLabelA
LocalFileTimeToFileTime
GetVersion
GetLocaleInfoA
GetFullPathNameA
lstrcpyA
ReadFile
GlobalAddAtomA
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
CreateFileMappingA
WritePrivateProfileSectionA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileStructA
WritePrivateProfileStringA
WritePrivateProfileStructA
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
WinExec
GetComputerNameA
GetProcessHeap
HeapAlloc
GetSystemInfo
GetSystemDirectoryA
lstrlenA
HeapFree
MapViewOfFile
OpenFileMappingA
UnmapViewOfFile
FreeLibrary
DeleteFileA
GetTempPathA
FindClose
FindNextFileA
FindFirstFileA
GetProcessTimes
GetSystemTimeAsFileTime
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
GetCurrentProcess
EnterCriticalSection
GetVersionExA
SetEvent
GetLastError
OpenProcess
OpenEventA
CreateThread
CloseHandle
VerifyVersionInfoW
Sleep
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetCurrentThreadId
GetModuleFileNameA
GetTickCount
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
GlobalSize
MultiByteToWideChar
EnumSystemLocalesW
GetStringTypeW
HeapReAlloc
CreateDirectoryW
GetFileSizeEx
DeleteFileW
GetFileAttributesExW
SetFileAttributesW
MoveFileExW
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetUserDefaultLCID
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
RemoveDirectoryW
HeapSize
WriteConsoleW
FreeLibraryAndExitThread
GetModuleFileNameW
GlobalDeleteAtom

user32

CheckDlgButton
SetDlgItemInt
RedrawWindow
EnumWindows
LoadMenuA
GetMenuItemID
TrackPopupMenu
GetSubMenu
SetMenuDefaultItem
DestroyMenu
RemoveMenu
EnableMenuItem
EnableWindow
VkKeyScanA
GetAsyncKeyState
MapVirtualKeyA
ToAscii
SendInput
DestroyWindow
SetClipboardViewer
GetClipboardOwner
WaitMessage
PostThreadMessageA
ChangeClipboardChain
SendNotifyMessageA
PeekMessageA
IsWindowVisible
FillRect
GetIconInfo
GetClassNameA
WindowFromPoint
RegisterWindowMessageA
DrawTextA
GetDlgItemInt
OpenDesktopA
EnumDesktopWindows
SetRect
DrawIconEx
DestroyIcon
GetKeyboardState
PtInRect
SetActiveWindow
MessageBeep
FlashWindow
EnumDisplaySettingsExA
EnumDisplayDevicesA
ChangeDisplaySettingsExA
GetKeyState
keybd_event
EnumDisplaySettingsA
GetWindowRect
LoadStringA
ScreenToClient
EndDialog
GetScrollInfo
DialogBoxParamA
SetWindowTextA
MoveWindow
SetFocus
IsDlgButtonChecked
GetTopWindow
GetWindow
GetProcessWindowStation
FindWindowExA
SendDlgItemMessageA
SetDlgItemTextA
GetDlgItem
SetForegroundWindow
GetCursorPos
ExitWindowsEx
DrawIcon
SetLayeredWindowAttributes
GetClientRect
UpdateWindow
InvalidateRect
BeginPaint
EndPaint
GetWindowThreadProcessId
wsprintfA
SystemParametersInfoA
MessageBoxA
GetForegroundWindow
GetDesktopWindow
PostMessageA
SendMessageA
mouse_event
FindWindowA
GetMessageA
LoadImageA
DispatchMessageA
GetUserObjectInformationA
LoadCursorA
SetWindowPos
GetSystemMetrics
SetThreadDesktop
GetThreadDesktop
ShowWindow
CloseDesktop
SetTimer
SetWindowLongA
GetWindowLongA
AdjustWindowRect
DefWindowProcA
IsRectEmpty
CreateWindowExA
OpenInputDesktop
TranslateMessage
LoadIconA
KillTimer
PostQuitMessage
RegisterClassExA
GetDC
ReleaseDC
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
IsClipboardFormatAvailable
RegisterClipboardFormatA
IntersectRect
OemToCharA
CharToOemA
wvsprintfA
GetDlgItemTextA

gdi32

GetBitmapBits
SetDIBColorTable
GdiFlush
SetTextColor
SelectPalette
CreatePalette
SetBkColor
CreateFontIndirectA
GetObjectA
ExtEscape
GetSystemPaletteEntries
SetRectRgn
OffsetRgn
GetRegionData
PtInRegion
CombineRgn
GetRgnBox
CreateRectRgn
PatBlt
StretchBlt
GetStockObject
GetClipBox
SetBkMode
DeleteObject
DeleteDC
GetPixel
GetDeviceCaps
GetDIBits
CreateCompatibleDC
CreateDIBSection
SelectObject
CreateCompatibleBitmap
BitBlt
CreateDCA
RealizePalette
CreateSolidBrush

advapi32

GetSecurityDescriptorLength
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorControl
GetSecurityDescriptorOwner
IsValidSid
IsValidSecurityDescriptor
GetKernelObjectSecurity
SetKernelObjectSecurity
IsValidAcl
GetUserNameA
LookupAccountSidA
SetSecurityInfo
RegCreateKeyA
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
CreateServiceA
StartServiceCtrlDispatcherA
QueryServiceStatus
RegDeleteKeyA
SetServiceStatus
RegisterServiceCtrlHandlerA
DeleteService
AdjustTokenPrivileges
SetTokenInformation
LookupPrivilegeValueA
DuplicateTokenEx
RevertToSelf
EqualSid
AllocateAndInitializeSid
ImpersonateLoggedOnUser
FreeSid
GetTokenInformation
EnumServicesStatusA
CloseServiceHandle
QueryServiceConfigA
OpenSCManagerA
OpenServiceA
CreateProcessAsUserA
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
OpenProcessToken
RegOpenKeyExA
RegDeleteValueA

shell32

Shell_NotifyIconA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHFileOperationA
ShellExecuteA
ShellExecuteExA
SHGetMalloc

ole32

CoUninitialize
CoCreateInstance
CoInitialize

imm32

ImmGetDefaultIMEWnd

Exports

Exports

adler32
adler32_combine
adler32_z
compress
compress2
compressBound
crc32
crc32_combine
crc32_final
crc32_init
crc32_update
crc32_z
deflate
deflateBound
deflateCopy
deflateEnd
deflateGetDictionary
deflateInit2_
deflateInit_
deflateParams
deflatePending
deflatePrime
deflateReset
deflateResetKeep
deflateSetDictionary
deflateSetHeader
deflateTune
get_crc_table
inflate
inflateCodesUsed
inflateCopy
inflateEnd
inflateGetDictionary
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateResetKeep
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
inflateValidate
uncompress
uncompress2
zError
zlibCompileFlags
zlibVersion

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 422KB - Virtual size: 421KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 511KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 822KB - Virtual size: 821KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

59cd1d153af9e583145eff4585887dba

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

version

userenv

kernel32

user32

gdi32

advapi32

shell32

ole32

imm32

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 422KB - Virtual size: 421KB

.data Size: 7KB - Virtual size: 511KB

.rsrc Size: 822KB - Virtual size: 821KB

.reloc Size: 48KB - Virtual size: 47KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 422KB - Virtual size: 421KB

.data
Size: 7KB - Virtual size: 511KB

.rsrc
Size: 822KB - Virtual size: 821KB

.reloc
Size: 48KB - Virtual size: 47KB