a77c564070e4b4b38b747070197560013f948e5d9d8c5dc46c94f9fc289cfec8

Sharing

Copy URL Twitter E-mail

General

Target

a77c564070e4b4b38b747070197560013f948e5d9d8c5dc46c94f9fc289cfec8
Size

275KB
MD5

b02f59dc26a8cb0bec8f816fac303565
SHA1

0509c9951b0f10f953ea997a120486ef52f055d1
SHA256

a77c564070e4b4b38b747070197560013f948e5d9d8c5dc46c94f9fc289cfec8
SHA512

e89b71925e0afdc399d9e98d8336ff2c2d0204fec415304f1ee38001431e663a8563a74d0c82d49e5e796e212fd41f06da89164d7a2f8e279c14694f41257522
SSDEEP

6144:2mMKXoYIDWnPscYMSkgH35Llbpv3mE9BR:TMNYIWUcYMSkgH35JbpvX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a77c564070e4b4b38b747070197560013f948e5d9d8c5dc46c94f9fc289cfec8

Files

a77c564070e4b4b38b747070197560013f948e5d9d8c5dc46c94f9fc289cfec8
.exe windows:5 windows x86

d16e11c1ef25b3c0915fb101b01bfd35

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpyW
GetCommandLineW
LockResource
FindResourceExW
GetLongPathNameW
GetShortPathNameW
LoadLibraryW
SetCurrentDirectoryW
WideCharToMultiByte
WriteFile
CreateFileA
ReadFile
GetFileSize
CreateFileW
SetLastError
SystemTimeToFileTime
LoadLibraryExW
SetHandleInformation
GetStdHandle
GetCurrentProcess
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LoadLibraryA
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
FreeLibrary
SetEvent
InterlockedDecrement
InterlockedIncrement
CreateEventW
CreateThread
GetCurrentThreadId
Sleep
WaitForSingleObject
CloseHandle
GetModuleFileNameW
lstrcmpiW
GetModuleHandleW
GetProcAddress
GetLastError
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetLocalTime
lstrlenW
InitializeCriticalSectionAndSpinCount
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEndOfFile
SetFilePointer
SetStdHandle
GetModuleHandleA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStartupInfoA
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
ExitProcess
HeapCreate
VirtualAlloc
VirtualFree
GetCPInfo
LCMapStringW
LCMapStringA
GetStartupInfoW
EnterCriticalSection
LeaveCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedExchange
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetFileType
TerminateProcess
IsDebuggerPresent

user32

GetMessageW
DispatchMessageW
TranslateMessage
MessageBoxW
CharUpperW
CharNextW
LoadStringW
PostThreadMessageW

advapi32

ChangeServiceConfigW
ChangeServiceConfig2W
RegisterServiceCtrlHandlerW
RegEnumKeyExW
ControlService
DeleteService
CreateServiceW
SetServiceStatus
RegisterEventSourceW
ReportEventW
DeregisterEventSource
OpenSCManagerW
OpenServiceW
CloseServiceHandle
RegQueryInfoKeyW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
StartServiceCtrlDispatcherW

ole32

CoTaskMemAlloc
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemFree
CoInitializeSecurity
CoUninitialize
CoInitialize
StringFromGUID2
CoCreateInstance
CoTaskMemRealloc

oleaut32

RegisterTypeLi
SysStringLen
SysFreeString
SysAllocString
LoadTypeLi
UnRegisterTypeLi
VarUI4FromStr

ws2_32

socket
setsockopt
bind
listen
getsockname
closesocket
ioctlsocket
accept
recv
connect
sendto
recvfrom
ntohl
getsockopt
__WSAFDIsSet
getpeername
select
ntohs
inet_ntoa
htons
htonl
WSAStartup
send
WSAGetLastError

Sections

.text
Size: 212KB - Virtual size: 212KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d16e11c1ef25b3c0915fb101b01bfd35

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

ws2_32

Sections

.text Size: 212KB - Virtual size: 212KB

.rdata Size: 35KB - Virtual size: 35KB

.data Size: 7KB - Virtual size: 15KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 212KB - Virtual size: 212KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 7KB - Virtual size: 15KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 16KB - Virtual size: 15KB