95a22827614f97c52bd1a21c9e457ed8727d3e2984c371adfa77e77637870bc8

Sharing

Copy URL Twitter E-mail

General

Target

95a22827614f97c52bd1a21c9e457ed8727d3e2984c371adfa77e77637870bc8
Size

271KB
MD5

4d70b29f76dd03d4accbb51dae73f0cc
SHA1

4f9539dfac5f6084bb1ea211f5555db07309e462
SHA256

95a22827614f97c52bd1a21c9e457ed8727d3e2984c371adfa77e77637870bc8
SHA512

c4d6868a75dd64398eb4a19837e41f928519c740d6f6b1e2acc3b9b2e76e3d28d2e327f949161a98fcc444a242dda18c91c37bc8a954b7817319a3d13fcc53ed
SSDEEP

6144:2XfcSMpzSJFJaE3jKiDG5yh07+uFAb27BdX3eVZkCYx8/4vchmtLXGk7Op5pwqqP:oncEmeVZkFx8QvWmtLGp1qnu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
95a22827614f97c52bd1a21c9e457ed8727d3e2984c371adfa77e77637870bc8

Files

95a22827614f97c52bd1a21c9e457ed8727d3e2984c371adfa77e77637870bc8
.dll windows:5 windows x64

0c645df6e72c1579a39de52316046542

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

iphlpapi

GetIfTable

mfc90u

ord2457
ord2473
ord2478
ord2461
ord2463
ord2465
ord2459
ord2475
ord2455
ord949
ord945
ord947
ord943
ord938
ord5365
ord5367
ord6101
ord1635
ord4393
ord4843
ord3494
ord5346
ord4294
ord6421
ord5201
ord1954
ord5284
ord4345
ord1430
ord4048
ord1658
ord1661
ord6056
ord3137
ord1578
ord2136
ord4205
ord1514
ord1977
ord602
ord3405
ord4355
ord1623
ord1690
ord753
ord3535
ord1938
ord1839
ord1840
ord1927
ord4699
ord4856
ord6381
ord4465
ord3343
ord1205
ord5449
ord6432
ord266
ord3740
ord2411
ord1614
ord258
ord617
ord362
ord4373
ord5335
ord1429
ord6053
ord3135
ord1582
ord1713
ord1714
ord913
ord4322
ord5314
ord5460
ord261
ord6443
ord5550
ord1468
ord641
ord5217
ord392
ord280
ord887
ord4214
ord2975
ord1963
ord4035
ord595
ord1463
ord323
ord319
ord6434
ord914
ord1961
ord290
ord5452
ord2977
ord6456
ord1222
ord2981
ord680
ord6438
ord440
ord3480
ord4139
ord6441
ord5455
ord677
ord3105
ord4174
ord435
ord883
ord2364
ord2314
ord1237
ord287
ord291
ord1185
ord2330
ord1018
ord542
ord5575
ord736
ord840
ord847
ord1516
ord3196
ord5548
ord911
ord2480
ord2326
ord6314
ord4359
ord751
ord5363
ord4776
ord5796
ord5495
ord1526
ord4400
ord4275
ord4866
ord4989
ord5780
ord5492
ord1479
ord941
ord3403
ord560
ord394
ord2336
ord2344
ord2817
ord1469
ord643
ord393
ord2068
ord642
ord3173
ord3008
ord285
ord1519
ord2531
ord5532
ord1211
ord1215
ord2184
ord286
ord5658
ord4103
ord789
ord916
ord567
ord5225
ord759
ord5475
ord4213
ord6315
ord6321
ord1481
ord1512
ord5568
ord1521
ord4140
ord2067
ord1022
ord1149
ord2331
ord5577
ord1021
ord320
ord296
ord569
ord791
ord588
ord761
ord1575
ord1061
ord1103
ord777
ord1209
ord265
ord2378
ord1148
ord4145
ord4121
ord6422
ord2468
ord2450
ord2452
ord2470
ord2233
ord2226
ord1553
ord6423
ord3902
ord3901
ord6424
ord4438
ord2110
ord2065
ord5713
ord6425
ord3436
ord5093
ord6027
ord3014
ord1389
ord5307
ord2010
ord1699
ord1698
ord1634
ord5332
ord3906
ord1025
ord5230
ord6363
ord5511
ord3932
ord1966
ord3005
ord5356
ord5358
ord2303
ord4050
ord2932
ord4687
ord3073
ord4601
ord3257
ord5362
ord5345
ord583
ord592
ord1235
ord1203
ord1201
ord1225
ord1146
ord1195
ord379
ord1118
ord1234
ord1232
ord1111
ord1053
ord321
ord780
ord927
ord5696
ord2602
ord2797
ord2904
ord4419
ord2780
ord2907
ord2605
ord2711
ord2598
ord3818
ord3819
ord3809
ord2709
ord4051
ord4596
ord4372
ord3424
ord577
ord772
ord3783
ord4191
ord2515
ord4936
ord3947
ord779
ord5013

msvcr90

memcmp
sprintf
memset
__clean_type_info_names_internal
__crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__CppXcptFilter
_amsg_exit
_encoded_null
_initterm_e
_initterm
_malloc_crt
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
__C_specific_handler
floor
_wcsicmp
malloc
free
wcstol
wcslen
_mktime64
strcpy_s
wcscpy
strcat
strcmp
fgets
fputc
feof
fgetc
fprintf
fopen
fclose
strlen
memcpy
_itow
_ltow
wcstoul
srand
rand
strncmp
_wtoi
strncpy
_wtol
_time64
_waccess
ceil
_localtime64_s
_purecall
__CxxFrameHandler3

kernel32

lstrcatA
CreateMutexA
GetVersionExA
IsBadReadPtr
IsBadWritePtr
lstrcpyA
GetComputerNameW
WaitForSingleObject
SetEvent
ReleaseMutex
CloseHandle
ReadFile
GetOverlappedResult
GetLastError
GetModuleFileNameW
MultiByteToWideChar
lstrlenA
GetPrivateProfileIntW
Sleep
GetTempPathW
DeleteFileW
LocalFree
WriteFile
CreateEventA
CreateFileA
OpenEventA
WideCharToMultiByte
lstrlenW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LocalAlloc

user32

PostQuitMessage
MessageBoxW
PostMessageW
SetTimer
KillTimer
PostThreadMessageW
SendMessageW
EnableWindow

advapi32

RegCloseKey
RegCreateKeyExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW

shell32

SHGetSpecialFolderLocation
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc

oleaut32

VariantTimeToSystemTime
SystemTimeToVariantTime
VarBstrFromDate
SysFreeString

wsock32

WSACleanup
inet_addr
gethostname
WSAStartup
gethostbyname

msvcp90

?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV12@_KD@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAX_K@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBAPEBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@XZ

hid

HidD_FreePreparsedData
HidP_GetCaps
HidD_GetPreparsedData
HidD_FlushQueue
HidD_GetAttributes
HidD_GetHidGuid

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces

netapi32

Netbios

Exports

Exports

GetLicenseClass
GetLicenseClass1
GetLicenseClass10
GetLicenseClass11
GetLicenseClass12
GetLicenseClass13
GetLicenseClass14
GetLicenseClass15
GetLicenseClass16
GetLicenseClass17
GetLicenseClass18
GetLicenseClass2
GetLicenseClass3
GetLicenseClass4
GetLicenseClass5
GetLicenseClass6
GetLicenseClass7
GetLicenseClass8
GetLicenseClass9
GetNetLicenseClass
GetSafeguardClass
GetSignLicenseClass
GetSoftLicenseClass

Sections

.text
Size: 150KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0c645df6e72c1579a39de52316046542

Headers

File Characteristics

Imports

iphlpapi

mfc90u

msvcr90

kernel32

user32

advapi32

shell32

oleaut32

wsock32

msvcp90

hid

setupapi

netapi32

Exports

Exports

Sections

.text Size: 150KB - Virtual size: 150KB

.rdata Size: 58KB - Virtual size: 57KB

.data Size: 16KB - Virtual size: 37KB

.pdata Size: 10KB - Virtual size: 10KB

.rsrc Size: 32KB - Virtual size: 31KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 150KB - Virtual size: 150KB

.rdata
Size: 58KB - Virtual size: 57KB

.data
Size: 16KB - Virtual size: 37KB

.pdata
Size: 10KB - Virtual size: 10KB

.rsrc
Size: 32KB - Virtual size: 31KB

.reloc
Size: 3KB - Virtual size: 2KB