aebccd598965c3d7b57a21f28021e2ea14387bd9c2dd17d55b54fff3f4286e46

Sharing

Copy URL

Twitter E-mail

General

Target

aebccd598965c3d7b57a21f28021e2ea14387bd9c2dd17d55b54fff3f4286e46
Size

5.2MB
MD5

ef3e6c285c6bf3ce9f2e06d91f4ed4b6
SHA1

7f7064be95539c85298057bb6948aaec84b3ecc8
SHA256

aebccd598965c3d7b57a21f28021e2ea14387bd9c2dd17d55b54fff3f4286e46
SHA512

9e17fa23f2e42c677a4023a8e0e1477e02649141274ab9600f8b7e94736297cd790412d000bfe07d431c8d837b20f41cddfab8e566c41984de1ea1bd7c2a10da
SSDEEP

98304:e2sg3DZKnu5t4yr4+biMVFnXw+m1CKv10kBOojseVR228:Ps+DZK+yP4iMnw+5AcGXS2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aebccd598965c3d7b57a21f28021e2ea14387bd9c2dd17d55b54fff3f4286e46

Files

aebccd598965c3d7b57a21f28021e2ea14387bd9c2dd17d55b54fff3f4286e46
.exe windows:4 windows x86

f55f8410dabf12284594f5eb9795ae4e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Thread32Next
CreateDirectoryA
CreateFileA
FindClose
FindFirstFileA
FindNextFileA
GetFileSizeEx
RemoveDirectoryA
SetEndOfFile
SetFilePointer
WriteFile
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetProcessTimes
SwitchToThread
GetTickCount
MapViewOfFileEx
UnmapViewOfFile
GetProcAddress
LocalFree
FormatMessageA
CreateSemaphoreA
CreateFileMappingA
OpenProcess
GetSystemTimeAsFileTime
FormatMessageW
WideCharToMultiByte
FindFirstFileW
FindNextFileW
GetModuleHandleW
GetEnvironmentVariableW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
DeleteFileW
FlushFileBuffers
GetFileAttributesW
GetFileInformationByHandle
GetFileTime
GetFullPathNameW
RemoveDirectoryW
SetFilePointerEx
SetFileTime
DeviceIoControl
GetWindowsDirectoryW
CreateDirectoryExW
AreFileApisANSI
MultiByteToWideChar
FreeLibrary
LoadLibraryA
GetEnvironmentVariableA
SetCurrentDirectoryA
GetFileAttributesA
GetFullPathNameA
GetSystemTime
FileTimeToSystemTime
GetTimeZoneInformation
GetExitCodeProcess
CreateProcessA
GetStdHandle
GetConsoleMode
ExitThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
DeleteFileA
IsWow64Process
GetProfileStringA
ReadFile
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
GetDriveTypeW
GetFileType
Thread32First
SystemTimeToTzSpecificLocalTime
GetCPInfo
CreateThread
FreeLibraryAndExitThread
RaiseException
GetConsoleCP
InitializeCriticalSectionAndSpinCount
TlsSetValue
LoadLibraryExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
GetStringTypeW
HeapReAlloc
HeapSize
IsValidCodePage
GetOEMCP
ReadConsoleW
GetModuleFileNameW
WriteConsoleW
EncodePointer
DecodePointer
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
LocalAlloc
MapViewOfFile
OpenFileMappingA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileSectionA
WritePrivateProfileSectionA
SetEvent
ResetEvent
CreateEventA
OpenEventA
WaitForMultipleObjects
ProcessIdToSessionId
IsBadWritePtr
OpenSemaphoreA
FlushInstructionCache
GetVersion
LockFile
UnlockFile
IsBadStringPtrA
IsBadStringPtrW
GetDriveTypeA
GetLogicalDrives
GetOverlappedResult
CreateEventW
EnumSystemFirmwareTables
GetSystemFirmwareTable
OpenMutexA
GetCommandLineA
FindFirstFileExW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
InitializeSListHead
CompareStringEx
GetLocaleInfoEx
LCMapStringEx
WaitForSingleObjectEx
TryEnterCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
CreateToolhelp32Snapshot
TlsFree
TlsGetValue
TlsAlloc
OpenThread
CloseHandle
GlobalFree
GlobalAlloc
GetTickCount64
Process32Next
Process32First
Sleep
GetModuleHandleExA
IsBadReadPtr
GetComputerNameA
GetNativeSystemInfo
GetSystemWindowsDirectoryA
GetWindowsDirectoryA
GetSystemDirectoryA
GetSystemInfo
SetLastError
GetModuleHandleA
GetModuleFileNameA
VirtualQuery
VirtualProtect
GetVersionExA
SetPriorityClass
SetThreadPriority
GetCurrentThread
TerminateProcess
HeapFree
GetCurrentDirectoryA
SetConsoleCtrlHandler
GetACP
SystemTimeToFileTime
GetLocalTime
GetTempPathA
GetDiskFreeSpaceA
GetUserDefaultUILanguage
GetExitCodeThread
GetCurrentThreadId
DuplicateHandle
SetThreadContext
GetStartupInfoW
GetCurrentProcessId
GetCurrentProcess
GetProcessHeap
HeapAlloc
PeekNamedPipe
HeapCreate
GetCommandLineW

user32

GetSystemMenu
AppendMenuA
LoadStringA
wsprintfA
GetSystemMetrics
MessageBoxW
CharLowerBuffA
DrawMenuBar
MessageBoxA
CharUpperBuffA
TranslateMessage
EnumDisplayDevicesA
DispatchMessageA
PeekMessageA
CallMsgFilterA

shell32

ShellExecuteExA

advapi32

SetSecurityDescriptorDacl
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
QueryServiceStatusEx
StartServiceA
QueryServiceStatus
QueryServiceConfigA
OpenServiceA
OpenSCManagerA
CloseServiceHandle
RegFlushKey
RegDeleteKeyA
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegSetValueExA
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegCreateKeyExA
GetSecurityDescriptorSacl
GetUserNameA
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetSecurityDescriptorSacl
InitializeSecurityDescriptor

psapi

GetModuleFileNameExA

powrprof

PowerReadFriendlyName

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

ws2_32

sendto
recvfrom
inet_addr
bind
getpeername
WSAGetLastError
socket
gethostbyaddr
setsockopt
send
select
recv
getsockopt
ioctlsocket
connect
closesocket
accept
__WSAFDIsSet
inet_ntoa
htons
WSACleanup
WSAStartup
freeaddrinfo
getaddrinfo
gethostname
gethostbyname
shutdown

winhttp

WinHttpGetProxyForUrl
WinHttpCloseHandle
WinHttpOpen
WinHttpGetDefaultProxyConfiguration
WinHttpGetIEProxyConfigForCurrentUser

crypt32

CryptMsgGetParam
CryptMsgClose
CertCloseStore
CryptQueryObject
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringA
CertGetNameStringW

wintrust

WinVerifyTrust

Sections

__wibu00
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

__wibu01
Size: 460KB - Virtual size: 457KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

__wibu02
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 128KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

__wibu03
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

__wibu04
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

__wibu05
Size: 100KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

__wibu06
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f55f8410dabf12284594f5eb9795ae4e

Headers

File Characteristics

Imports

kernel32

user32

shell32

advapi32

psapi

powrprof

version

ws2_32

winhttp

crypt32

wintrust

Sections

__wibu00 Size: 2.5MB - Virtual size: 2.5MB

__wibu01 Size: 460KB - Virtual size: 457KB

__wibu02 Size: 20KB - Virtual size: 17KB

.rsrc Size: 128KB - Virtual size: 125KB

__wibu03 Size: 1.9MB - Virtual size: 1.9MB

__wibu04 Size: 12KB - Virtual size: 12KB

__wibu05 Size: 100KB - Virtual size: 112KB

__wibu06 Size: 72KB - Virtual size: 72KB

__wibu00
Size: 2.5MB - Virtual size: 2.5MB

__wibu01
Size: 460KB - Virtual size: 457KB

__wibu02
Size: 20KB - Virtual size: 17KB

.rsrc
Size: 128KB - Virtual size: 125KB

__wibu03
Size: 1.9MB - Virtual size: 1.9MB

__wibu04
Size: 12KB - Virtual size: 12KB

__wibu05
Size: 100KB - Virtual size: 112KB

__wibu06
Size: 72KB - Virtual size: 72KB