b3aeb7c7acde141f120cae1953d046f0bc1e8087f736bbd85bcffcaca21840b4

Sharing

Copy URL

Twitter E-mail

General

Target

b3aeb7c7acde141f120cae1953d046f0bc1e8087f736bbd85bcffcaca21840b4
Size

254KB
MD5

a380a382e53be94c11ebf96edcaadbfc
SHA1

ad97c69b66a4cec45f7aabe8cb7fa3447bf17a4c
SHA256

b3aeb7c7acde141f120cae1953d046f0bc1e8087f736bbd85bcffcaca21840b4
SHA512

ab0506ecd36f12d6c7c11a5c7ab84c528486bdd428cfde826fd27c8c57b33fd01f5b0c92f3f91d56dc74affb2ad89a9e3df0e1636140e1698ce0beb079935255
SSDEEP

3072:QLZIimHDyN4md00P3OhCsM0F/pstBaDqwONnct437Bl3N2US9+/:QLZbqsPIM0F/p/uwONct43j92UR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b3aeb7c7acde141f120cae1953d046f0bc1e8087f736bbd85bcffcaca21840b4

Files

b3aeb7c7acde141f120cae1953d046f0bc1e8087f736bbd85bcffcaca21840b4
.exe windows:6 windows x86

50389fdb9c68d70d3dd77ed3e1b89ff2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc140d

ord1512
ord4326
ord14046
ord3847
ord3967
ord3966
ord4586
ord13999
ord3217
ord15206
ord16538
ord7186
ord15975
ord9824
ord6208
ord13554
ord8244
ord15821
ord17052
ord9455
ord17054
ord3628
ord5380
ord11437
ord6986
ord5394
ord5928
ord5867
ord5852
ord5914
ord5959
ord5882
ord5937
ord5953
ord5894
ord5900
ord5906
ord5888
ord5943
ord5876
ord2027
ord2006
ord2020
ord1994
ord1972
ord14155
ord14159
ord16191
ord12187
ord12807
ord8405
ord4729
ord3086
ord5382
ord10692
ord17046
ord13785
ord4467
ord13963
ord10874
ord13563
ord13562
ord6798
ord12039
ord12035
ord12037
ord12038
ord12036
ord17243
ord9816
ord12005
ord3890
ord3893
ord3745
ord3744
ord4007
ord963
ord12225
ord13218
ord8232
ord10769
ord2925
ord5026
ord10947
ord3309
ord16040
ord7506
ord14006
ord12844
ord520
ord2581
ord10084
ord7898
ord493
ord14051
ord10973
ord2610
ord15010
ord14942
ord5490
ord9532
ord9960
ord6440
ord2884
ord14524
ord14523
ord17053
ord9454
ord17051
ord11139
ord4808
ord4747
ord15029
ord9476
ord2371
ord13838
ord13837
ord16915
ord14513
ord9535
ord17125
ord7684
ord17127
ord7686
ord17126
ord7685
ord16241
ord1090
ord8222
ord4483
ord7159
ord14129
ord9825
ord14147
ord14097
ord1240
ord1218
ord4749
ord6274
ord6678
ord6956
ord11091
ord6648
ord6959
ord6277
ord6506
ord6256
ord9208
ord9209
ord5752
ord9198
ord6504
ord9829
ord12000
ord4006
ord4884
ord10946
ord1171
ord15253
ord1655
ord1645
ord1653
ord9109
ord1141
ord322
ord1880
ord1638
ord8952
ord16803
ord8773
ord1036
ord1220
ord15626
ord10143
ord5142
ord3021
ord1599
ord10043
ord12821
ord14137
ord12131
ord3848
ord1646
ord2801

kernel32

GetLastError
SetLastError
RaiseException
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
HeapDestroy
OutputDebugStringW
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
VirtualQuery
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WideCharToMultiByte
IsDebuggerPresent
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
GetCurrentThreadId
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
OutputDebugStringA
GetStartupInfoA
CreateProcessA
WaitForSingleObject
DeviceIoControl
CreatePipe
CloseHandle
ReadFile
CreateFileA
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSectionEx
DecodePointer

user32

PostQuitMessage
GetSystemMetrics
UnregisterClassA
PeekMessageA

gdi32

DeleteDC

oleaut32

SysFreeString

gdiplus

GdiplusShutdown

msvcp140d

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z

iphlpapi

GetAdaptersInfo

vcruntime140d

__vcrt_GetModuleHandleW
__vcrt_GetModuleFileNameW
__std_type_info_destroy_list
_except_handler4_common
__current_exception_context
__current_exception
_CxxThrowException
__std_exception_destroy
__std_exception_copy
memmove
memcmp
memchr
__CxxFrameHandler3
memset
memcpy
__vcrt_LoadLibraryExW

ucrtbased

free
malloc
_CrtDbgReportW
_invalid_parameter
strcpy_s
strlen
__stdio_common_vsprintf_s
_CrtDbgReport
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
_seh_filter_exe
_set_app_type
__stdio_common_vsnprintf_s
_get_narrow_winmain_command_line
_initterm
_initterm_e
exit
_exit
_set_fmode
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
terminate
strcat_s
_controlfp_s
_wmakepath_s
_wsplitpath_s
_invalid_parameter_noinfo
_errno
_recalloc
__setusermatherr
__stdio_common_vswprintf_s
wcslen
wcscpy_s
_setmbcp
__stdio_common_vsprintf

Sections

.textbss
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 119KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 1024B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 265B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

50389fdb9c68d70d3dd77ed3e1b89ff2

Headers

DLL Characteristics

File Characteristics

Imports

mfc140d

kernel32

user32

gdi32

oleaut32

gdiplus

msvcp140d

iphlpapi

vcruntime140d

ucrtbased

Sections

.textbss Size: - Virtual size: 64KB

.text Size: 119KB - Virtual size: 118KB

.rdata Size: 33KB - Virtual size: 32KB

.data Size: 1KB - Virtual size: 17KB

.idata Size: 7KB - Virtual size: 6KB

.msvcjmc Size: 1024B - Virtual size: 720B

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 265B

.rsrc Size: 83KB - Virtual size: 82KB

.reloc Size: 7KB - Virtual size: 7KB

.textbss
Size: - Virtual size: 64KB

.text
Size: 119KB - Virtual size: 118KB

.rdata
Size: 33KB - Virtual size: 32KB

.data
Size: 1KB - Virtual size: 17KB

.idata
Size: 7KB - Virtual size: 6KB

.msvcjmc
Size: 1024B - Virtual size: 720B

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 265B

.rsrc
Size: 83KB - Virtual size: 82KB

.reloc
Size: 7KB - Virtual size: 7KB