b50564aeee23d91ff1b55517dfebc4e8aaf66caf1a7c393f7dbc3692d27c1868

Sharing

Copy URL Twitter E-mail

General

Target

b50564aeee23d91ff1b55517dfebc4e8aaf66caf1a7c393f7dbc3692d27c1868
Size

1016KB
MD5

ace24723489661866c2c497aca715dce
SHA1

ebbb66682aa2044e631a2390b6ab912beca05c1e
SHA256

b50564aeee23d91ff1b55517dfebc4e8aaf66caf1a7c393f7dbc3692d27c1868
SHA512

3cad29cadf2e963ed3e10f4c218264e24f66345ea0515c9bca3f8995a6e7c9da7baa646bc2c68fb0cb770c3296d956b47e2580a550eef4f5d3ec9c4f94d34bac
SSDEEP

24576:EHrNtIbBv0AKyuq9KtuQAC5IGR+wCMuBeD:ELNuyuuIGRWMuc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b50564aeee23d91ff1b55517dfebc4e8aaf66caf1a7c393f7dbc3692d27c1868

Files

b50564aeee23d91ff1b55517dfebc4e8aaf66caf1a7c393f7dbc3692d27c1868
.exe windows:4 windows x86

dfba465b2917aa39de2052659922661a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord2756
ord2574
ord4396
ord3365
ord3635
ord693
ord4238
ord3991
ord3281
ord3728
ord810
ord4266
ord2755
ord6919
ord4124
ord2567
ord4390
ord3569
ord609
ord927
ord5679
ord6921
ord6920
ord4667
ord4269
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord2717
ord4074
ord4692
ord5303
ord5285
ord5710
ord4616
ord3733
ord815
ord561
ord804
ord6433
ord2613
ord1131
ord781
ord3087
ord2579
ord4400
ord3389
ord3724
ord355
ord1165
ord6211
ord2078
ord6777
ord1197
ord4155
ord2858
ord755
ord470
ord3605
ord656
ord4270
ord3871
ord3393
ord686
ord384
ord2400
ord3298
ord3282
ord6004
ord3995
ord940
ord2857
ord2088
ord3909
ord6868
ord925
ord6879
ord6896
ord5977
ord861
ord2362
ord6330
ord942
ord6918
ord4273
ord922
ord2813
ord547
ord668
ord6640
ord1972
ord3176
ord4053
ord2773
ord2762
ord356
ord6771
ord2634
ord551
ord6865
ord3703
ord3084
ord2859
ord538
ord941
ord2507
ord3494
ord4219
ord354
ord5180
ord6381
ord1971
ord665
ord6003
ord539
ord535
ord4272
ord2606
ord823
ord858
ord2371
ord4294
ord3296
ord2910
ord3658
ord1637
ord6266
ord2430
ord3649
ord2576
ord4215
ord4704
ord540
ord2810
ord3993
ord6898
ord6195
ord800
ord4229
ord2294
ord825
ord324
ord567
ord641
ord795
ord3716
ord4418
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord3397
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5286
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1768
ord4073
ord6051
ord3592
ord4419
ord5276
ord1767
ord6048
ord2506
ord4992
ord4847
ord4370
ord1143
ord5261
ord1569

msvcrt

__dllonexit
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
_onexit
_XcptFilter
_exit
strncmp
sprintf
strchr
strncpy
wcstok
_wfopen
fclose
fwprintf
?terminate@@YAXXZ
_controlfp
exit
_purecall
__CxxFrameHandler
free
swscanf
wcscmp
_wcsicmp
wcslen
malloc
_except_handler3
_snwprintf
wcscpy
wcsncmp
_wcsnicmp
wcsrchr
_wtoi
wcsncat
rand
srand
wcsstr
wcschr
wcscat
swprintf
wcsncpy
memmove
isprint
towupper
sscanf
fwrite

kernel32

LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CloseHandle
GetWindowsDirectoryW
LocalAlloc
GlobalLock
GlobalUnlock
GetModuleHandleW
GetProcAddress
VirtualProtect
GetCurrentProcessId
WaitForSingleObject
DuplicateHandle
OpenProcess
MultiByteToWideChar
UnmapViewOfFile
EnterCriticalSection
CreateFileMappingW
FlushFileBuffers
CreateEventW
ResetEvent
SetEvent
QueryDosDeviceW
GetLogicalDrives
MoveFileExW
GetVersion
RemoveDirectoryW
TerminateThread
WideCharToMultiByte
IsBadReadPtr
LoadLibraryW
FreeLibrary
GetStartupInfoW
GetLastError
ReadFile
GetFileSize
CreateFileW
GetLongPathNameW
ExpandEnvironmentStringsW
Sleep
GetSystemDirectoryW
GetProfileStringW
GetPrivateProfileStringW
GetCurrentProcess
GetTickCount
GetModuleFileNameW
CreateThread
GetUserDefaultLangID
DeviceIoControl
DeleteFileW
WriteFile
SetFileAttributesW
GetFileAttributesW
LockResource
LoadResource
SizeofResource
FindResourceW
GetDriveTypeW
Process32NextW
MapViewOfFileEx
CreateToolhelp32Snapshot
Process32FirstW

user32

LoadImageW
DestroyIcon
GetFocus
UnhookWindowsHookEx
ScreenToClient
IsIconic
GetSystemMetrics
DrawIcon
GetSystemMenu
LoadIconW
IsWindowVisible
OpenClipboard
EmptyClipboard
SetClipboardData
MessageBoxW
GetWindowThreadProcessId
GetWindowTextW
EnumWindows
DestroyWindow
PostMessageW
EnableWindow
IsWindow
GetClientRect
CreatePopupMenu
AppendMenuW
wsprintfW
CloseClipboard
SendMessageW
GetCursorPos
EnableMenuItem
ShowWindow

advapi32

OpenProcessToken
CloseServiceHandle
QueryServiceConfig2W
QueryServiceConfigW
RegDeleteValueW
RegQueryValueExW
RegOpenKeyExW
RegEnumValueW
RegCreateKeyW
RegSetValueExW
RegDeleteKeyW
CreateServiceW
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges
StartServiceW
ControlService
DeleteService
QueryServiceStatus
OpenSCManagerW
EnumServicesStatusW
OpenServiceW

shell32

ShellExecuteExW
SHGetFileInfoW
StrStrIW
ShellExecuteW
SHGetSpecialFolderPathW

comctl32

ImageList_SetBkColor
ImageList_Remove
ImageList_ReplaceIcon
ImageList_GetImageCount

ole32

StringFromGUID2
CoInitializeEx
CoCreateInstance

msvcp60

??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ

shlwapi

PathFileExistsW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

ws2_32

inet_ntoa
ntohs

Sections

.text
Size: 302KB - Virtual size: 302KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 559KB - Virtual size: 559KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dfba465b2917aa39de2052659922661a

Headers

File Characteristics

Imports

mfc42u

msvcrt

kernel32

user32

advapi32

shell32

comctl32

ole32

msvcp60

shlwapi

version

ws2_32

Sections

.text Size: 302KB - Virtual size: 302KB

.rdata Size: 51KB - Virtual size: 51KB

.data Size: 103KB - Virtual size: 103KB

.rsrc Size: 559KB - Virtual size: 559KB

.text
Size: 302KB - Virtual size: 302KB

.rdata
Size: 51KB - Virtual size: 51KB

.data
Size: 103KB - Virtual size: 103KB

.rsrc
Size: 559KB - Virtual size: 559KB