fb1a7196315307d4b3c886f3fd70fe0654dbbebe0a82949895ddf4862576b76c

Sharing

Copy URL Twitter E-mail

General

Target

fb1a7196315307d4b3c886f3fd70fe0654dbbebe0a82949895ddf4862576b76c
Size

12.7MB
MD5

a586768886b15871741ecf62211dbb65
SHA1

f04358b3cd167d1d06df1501bcb7eb85fe6ca6e1
SHA256

fb1a7196315307d4b3c886f3fd70fe0654dbbebe0a82949895ddf4862576b76c
SHA512

a355fefcc76e9f02b309730d5c606bd7616f2963f1f6c821c555109f367e4528714e41ef1b8c157f5f88cfb19e34fd32a4b8a05f64c6ba9a0af48c4e94a8ff49
SSDEEP

196608:kuq3kxptc6RFC10ofksKV3qLcyPNKBEtkojDIg9Cbk/V8OeRoxTESbeRoR962T:kuQ6tU10WvKVyc+KCtnDGUTQA6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb1a7196315307d4b3c886f3fd70fe0654dbbebe0a82949895ddf4862576b76c

Files

fb1a7196315307d4b3c886f3fd70fe0654dbbebe0a82949895ddf4862576b76c
.exe windows:5 windows x86

fb17b233dcba34b489f9ccd7dfe62c49

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetLocalTime
SystemTimeToFileTime
GetTempPathA
GetDiskFreeSpaceA
GetACP
GetThreadLocale
IsBadReadPtr
GetComputerNameA
IsValidLocale
GetSystemDirectoryA
GetWindowsDirectoryA
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoA
SetStdHandle
GetConsoleCP
HeapSize
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
IsValidCodePage
GetOEMCP
HeapReAlloc
VirtualAlloc
LCMapStringW
LCMapStringA
GetSystemInfo
SetLastError
GetExitCodeThread
DuplicateHandle
GetProcessHeap
HeapAlloc
TerminateProcess
HeapFree
GetModuleHandleA
GetModuleFileNameA
VirtualQuery
GetCurrentThreadId
GetCPInfo
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleHandleW
VirtualFree
HeapDestroy
HeapCreate
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
LockFile
UnlockFile
IsBadStringPtrW
IsBadStringPtrA
VirtualProtect
FlushInstructionCache
GetLogicalDrives
GetDriveTypeA
DeviceIoControl
ReleaseSemaphore
OpenSemaphoreA
CreateSemaphoreA
GetFileTime
GetFileSize
SetEndOfFile
FlushFileBuffers
SetFilePointer
ReadFile
WriteFile
GetSystemTimeAsFileTime
CreateDirectoryA
SetConsoleCtrlHandler
CreateFileA
GetCurrentDirectoryA
GetTickCount
GetCurrentProcess
GetCommandLineA
SetFileTime
GetCurrentProcessId
GetVersion
GetVersionExA
WaitForMultipleObjects
SetEvent
CreateEventA
MultiByteToWideChar
WideCharToMultiByte
TlsSetValue
LocalAlloc
LocalFree
TlsGetValue
TlsFree
ExitProcess
TlsAlloc
GetFileAttributesA
GetFullPathNameA
SetCurrentDirectoryA
FileTimeToSystemTime
GetTimeZoneInformation
GetSystemTime
CloseHandle
UnmapViewOfFile
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
Sleep
WaitForSingleObject
GetCurrentThread
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetLastError
GetPrivateProfileSectionA
WritePrivateProfileSectionA
AreFileApisANSI
LoadLibraryA
GetEnvironmentVariableA
FreeLibrary
GetProcAddress
OpenProcess
GetExitCodeProcess
GetProfileStringA
DeleteFileA
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetConsoleMode
IsBadWritePtr
OpenEventA

user32

GetSystemMenu
CharLowerBuffA
AppendMenuA
GetSystemMetrics
MessageBoxA
PeekMessageA
CallMsgFilterA
TranslateMessage
DispatchMessageA
DrawMenuBar
CharUpperBuffA
wsprintfA
LoadStringA

advapi32

RegOpenKeyExA
SetSecurityDescriptorDacl
OpenSCManagerA
OpenServiceA
StartServiceA
CloseServiceHandle
RegDeleteValueA
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
GetUserNameA
RegEnumValueA
RegEnumKeyExA
RegDeleteKeyA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegFlushKey
RegCloseKey

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

shell32

ShellExecuteExA

wsock32

getpeername
accept
WSAStartup
WSACleanup
__WSAFDIsSet
select
gethostname
gethostbyaddr
htons
inet_addr
gethostbyname
WSAGetLastError
ioctlsocket
connect
inet_ntoa
setsockopt
socket
listen
closesocket
shutdown
send
getsockopt
recv
recvfrom
sendto
bind

Exports

Exports

?Commit@CDlgPatternWeave@@IAEXXZ

Sections

__wibu00
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

__wibu01
Size: 751KB - Virtual size: 750KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

__wibu02
Size: 62KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6.2MB - Virtual size: 6.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

__wibu03
Size: 377KB - Virtual size: 377KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

__wibu04
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

__wibu05
Size: 53KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fb17b233dcba34b489f9ccd7dfe62c49

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

version

shell32

wsock32

Exports

Exports

Sections

__wibu00 Size: 4.1MB - Virtual size: 4.1MB

__wibu01 Size: 751KB - Virtual size: 750KB

__wibu02 Size: 62KB - Virtual size: 100KB

.rsrc Size: 6.2MB - Virtual size: 6.2MB

__wibu03 Size: 377KB - Virtual size: 377KB

__wibu04 Size: 1.2MB - Virtual size: 1.2MB

__wibu05 Size: 53KB - Virtual size: 56KB

__wibu00
Size: 4.1MB - Virtual size: 4.1MB

__wibu01
Size: 751KB - Virtual size: 750KB

__wibu02
Size: 62KB - Virtual size: 100KB

.rsrc
Size: 6.2MB - Virtual size: 6.2MB

__wibu03
Size: 377KB - Virtual size: 377KB

__wibu04
Size: 1.2MB - Virtual size: 1.2MB

__wibu05
Size: 53KB - Virtual size: 56KB