0225af06c6671923c6d706025efd129556e15c776c88bb6187b0c8261019e564

Sharing

Copy URL Twitter E-mail

General

Target

0225af06c6671923c6d706025efd129556e15c776c88bb6187b0c8261019e564
Size

1.1MB
MD5

00281bd4463a3aefc8b77cf67ce5c94d
SHA1

7c153b321ca50734003aa0fffd6cbfdd1d0d6f79
SHA256

0225af06c6671923c6d706025efd129556e15c776c88bb6187b0c8261019e564
SHA512

bcf58da3ea4624732fca69bdb427ee2510b0335c162cf763878252117ccfd1bf8d11332c3b2511ab6941c117ad06edd51ce9b089a2937c2aff3dd62f44d15a47
SSDEEP

12288:GWxXwHxYig+YG/wBnNcft9W8Wx1TrHEX9slpis0oNcupg5PPWRsd4UwGsd4Ue:GSAHg+YGuE9WjZHEX9ypihoNcuCP4uT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0225af06c6671923c6d706025efd129556e15c776c88bb6187b0c8261019e564

Files

0225af06c6671923c6d706025efd129556e15c776c88bb6187b0c8261019e564
.exe windows:4 windows x86

854c6504fedacc1c0122bf49fc9875e4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

ws2_32

send
WSAAsyncGetHostByName
bind
htonl
socket
WSAAsyncSelect
recv
inet_addr
htons
gethostbyname
WSAGetLastError
WSASetLastError
inet_ntoa
closesocket
ntohs
connect
getpeername
getsockname
shutdown
listen
accept
ioctlsocket
getsockopt
setsockopt
WSACleanup
WSAStartup
WSACancelAsyncRequest

mfc42

ord323
ord2860
ord4133
ord4297
ord5788
ord472
ord6654
ord283
ord6270
ord2864
ord1168
ord1641
ord1146
ord5053
ord4160
ord1871
ord6307
ord521
ord3584
ord543
ord803
ord3721
ord3619
ord4407
ord809
ord795
ord2614
ord556
ord1929
ord1088
ord2122
ord5981
ord6215
ord4299
ord3797
ord6880
ord5572
ord926
ord755
ord470
ord2405
ord5873
ord5785
ord1640
ord1979
ord5442
ord3318
ord665
ord5186
ord354
ord6385
ord3138
ord5265
ord4998
ord2514
ord6052
ord1775
ord4425
ord3597
ord3398
ord3733
ord810
ord641
ord324
ord2302
ord4234
ord5278
ord3495
ord3813
ord5280
ord4710
ord1233
ord2086
ord4853
ord6334
ord4376
ord2645
ord6172
ord5789
ord816
ord562
ord5787
ord1816
ord326
ord1949
ord818
ord2152
ord3810
ord1175
ord2863
ord920
ord6458
ord4284
ord1567
ord268
ord2827
ord2817
ord656
ord1199
ord613
ord2463
ord6662
ord2763
ord5794
ord289
ord4317
ord1651
ord2370
ord5953
ord3097
ord4224
ord2642
ord3092
ord1133
ord3811
ord6877
ord1771
ord6366
ord2413
ord2024
ord4219
ord2581
ord4401
ord3639
ord692
ord542
ord802
ord1768
ord2777
ord3803
ord6905
ord2301
ord2652
ord1669
ord5601
ord3698
ord765
ord3610
ord2289
ord925
ord6673
ord6453
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord815
ord561
ord2621
ord2725
ord923
ord940
ord6876
ord5856
ord551
ord2582
ord4402
ord3370
ord3640
ord693
ord1085
ord4243
ord2453
ord2862
ord1642
ord2558
ord6696
ord2096
ord3996
ord6930
ord6928
ord2765
ord3293
ord3910
ord668
ord3181
ord3178
ord4058
ord2781
ord2770
ord356
ord6170
ord6762
ord3301
ord4204
ord616
ord3408
ord3227
ord5875
ord3425
ord3880
ord832
ord3337
ord1945
ord4589
ord4588
ord4899
ord4370
ord4892
ord5076
ord4341
ord4349
ord4723
ord4890
ord4531
ord4545
ord4543
ord4526
ord4529
ord4524
ord4964
ord4961
ord4108
ord5240
ord3748
ord1726
ord5260
ord4432
ord813
ord560
ord4273
ord6068
ord6000
ord2117
ord529
ord2100
ord4464
ord6197
ord6069
ord6283
ord4538
ord6929
ord5148
ord547
ord4671
ord1842
ord4242
ord2723
ord2390
ord3059
ord5100
ord5103
ord4303
ord3350
ord5012
ord975
ord5472
ord3403
ord2879
ord2878
ord4151
ord4077
ord5237
ord2649
ord1665
ord4427
ord796
ord674
ord366
ord2455
ord5910
ord2975
ord6120
ord3566
ord5871
ord6067
ord3288
ord2116
ord6379
ord2108
ord3294
ord2011
ord4457
ord6612
ord2252
ord5252
ord1232
ord5030
ord3482
ord5949
ord4413
ord2753
ord2408
ord4499
ord3870
ord5282
ord5054
ord3499
ord2515
ord355
ord4436
ord6605
ord6565
ord6619
ord6491
ord2087
ord4287
ord6625
ord554
ord5885
ord5882
ord1576
ord3521
ord4337
ord2841
ord2448
ord3903
ord2044
ord2107
ord812
ord3989
ord5862
ord559
ord5450
ord5834
ord6394
ord663
ord348
ord3582
ord2358
ord1152
ord3790
ord2362
ord2363
ord2516
ord361
ord2294
ord6508
ord711
ord413
ord603
ord5461
ord273
ord2754
ord2299
ord1969
ord2784
ord6569
ord2740
ord6404
ord5643
ord6567
ord5609
ord2801
ord6008
ord4000
ord3287
ord3303
ord4125
ord3177
ord1158
ord2149
ord3914
ord3296
ord793
ord3719
ord2820
ord6741
ord6640
ord6232
ord6230
ord6148
ord2568
ord6268
ord6271
ord3225
ord3257
ord3912
ord2544
ord2543
ord2511
ord978
ord1731
ord5851
ord2398
ord2418
ord6224
ord6226
ord2429
ord2250
ord4732
ord4541
ord5477
ord2259
ord4836
ord4440
ord3720
ord527
ord794
ord3481
ord4264
ord2884
ord3708
ord781
ord6134
ord3763
ord4132
ord4131
ord6136
ord4130
ord3876
ord6438
ord2824
ord3706
ord5781
ord3573
ord6154
ord2530
ord4364
ord4056
ord5471
ord4121
ord2389
ord5082
ord1709
ord1712
ord6053
ord5234
ord6369
ord5279
ord5248
ord2444
ord3598
ord642
ord327
ord4235
ord6194
ord4333
ord4475
ord640
ord2078
ord2414
ord2438
ord3663
ord3626
ord384
ord1644
ord609
ord686
ord3574
ord4396
ord3571
ord3654
ord2584
ord4220
ord2575
ord5683
ord941
ord939
ord2818
ord924
ord922
ord4277
ord4202
ord2764
ord6663
ord4129
ord4278
ord2915
ord823
ord1083
ord6784
ord2859
ord4123
ord2567
ord6705
ord537
ord5710
ord1200
ord860
ord858
ord2379
ord6199
ord3874
ord535
ord4275
ord773
ord567
ord540
ord541
ord501
ord6502
ord800
ord801

msvcrt

__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
?terminate@@YAXXZ
_onexit
__dllonexit
??1type_info@@UAE@XZ
_ismbcalpha
realloc
_mbsicoll
sscanf
gmtime
strncmp
_strlwr
wcscpy
rand
printf
_atoi64
atol
__set_app_type
srand
atof
__p___argc
__p___argv
_stricmp
rename
free
_strdup
strrchr
atoi
strstr
vsprintf
_except_handler3
_mbsrchr
_ftol
_mbsnbcpy
wcsrchr
_wcsicmp
memmove
_mbsnbcmp
sprintf
_mbsncmp
_mbschr
_mbsstr
_purecall
time
_controlfp
_itoa
_setmbcp
__CxxFrameHandler
_mbscmp
_mbsicmp
strncpy

kernel32

GetProcessWorkingSetSize
GetModuleHandleA
GetSystemInfo
CreateFileA
CloseHandle
GetLastError
SetUnhandledExceptionFilter
GetModuleFileNameA
GetVersion
GetVersionExA
lstrcmpiA
GetProcAddress
lstrcatA
lstrlenA
WinExec
lstrcpyA
GetWindowsDirectoryA
GlobalMemoryStatus
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcess
FlushInstructionCache
SetCurrentDirectoryA
GetTimeFormatA
GetDateFormatA
CreateProcessA
DeleteFileA
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
WaitForSingleObject
IsBadWritePtr
Beep
SetFileTime
SystemTimeToFileTime
GetTimeZoneInformation
SetFilePointer
CreateDirectoryA
GetTempPathA
GlobalUnlock
GlobalLock
FileTimeToSystemTime
DeviceIoControl
GetLogicalDriveStringsA
FindClose
FindNextFileA
FindFirstFileA
GetDiskFreeSpaceExA
GetProfileIntA
WriteProfileStringA
SetThreadPriority
ResumeThread
SetEvent
GetFileSize
WaitForMultipleObjects
HeapFree
HeapAlloc
GetProcessHeap
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
GetStartupInfoA
FormatMessageA
VirtualQuery
GetCurrentThread
LocalFree
WideCharToMultiByte
lstrlenW
IsBadStringPtrA
WriteFile
GetCurrentProcessId
GetCurrentThreadId
SetLastError
MultiByteToWideChar
GlobalAlloc
Sleep
GetPrivateProfileIntA
LoadLibraryA
CreateThread
WritePrivateProfileStringA

user32

KillTimer
RedrawWindow
IsWindowVisible
GetWindowDC
PostMessageA
GetClassNameA
IsChild
GetFocus
RegisterWindowMessageA
SetCapture
LoadIconA
SetMenuDefaultItem
GetSubMenu
LoadMenuA
GetMenuItemID
TrackPopupMenu
SetForegroundWindow
GetCursorPos
SystemParametersInfoA
SetParent
MessageBoxA
CreateWindowExA
RegisterClassExA
DefWindowProcA
DestroyWindow
MapDialogRect
PeekMessageA
DestroyIcon
wsprintfA
EnableMenuItem
ScreenToClient
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
SetMenuItemInfoA
SetTimer
GetMenuItemInfoA
GetMenuItemCount
GetMenu
GetClassInfoA
SetMenu
DestroyMenu
DrawTextA
UnionRect
GetDesktopWindow
SetFocus
PostThreadMessageA
TranslateMessage
DispatchMessageA
GetMessageA
PostQuitMessage
EqualRect
GetDlgCtrlID
HideCaret
MapWindowPoints
CallWindowProcA
IsWindow
GetPropA
SetWindowLongA
RemovePropA
SetPropA
InsertMenuA
RemoveMenu
AppendMenuA
PtInRect
LoadBitmapA
ClientToScreen
WindowFromPoint
InvalidateRect
GetWindowRect
FillRect
DrawFrameControl
FrameRect
DrawStateA
MessageBeep
LoadCursorA
CopyIcon
GetParent
SetCursor
CreateMenu
ReleaseCapture
DrawEdge
CopyRect
GetWindowLongA
DrawFocusRect
OffsetRect
CreatePopupMenu
EnableWindow
DrawIcon
UpdateWindow
GetDC
GetClientRect
InflateRect
GetSysColor
ReleaseDC
SendMessageA
GetKeyState
GetSystemMetrics

gdi32

SetBkColor
CreateBrushIndirect
CreateRectRgn
GetTextAlign
ExtTextOutA
SetTextColor
GetDeviceCaps
DeleteObject
Rectangle
SelectObject
PatBlt
CreateFontA
CreateBitmap
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
GetTextExtentPoint32A
CreateFontIndirectA
GetCurrentObject
GetObjectA
SetPixel
GetStockObject
SetTextAlign

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegCreateKeyA
RegDeleteKeyA
RegEnumKeyA
RegSetValueExA
RegCreateKeyExA
RegEnumKeyExA
RegQueryValueA

shell32

FindExecutableA
SHFileOperationA
ShellExecuteExA
DragQueryFileA
DragFinish
SHGetPathFromIDListA
SHGetFileInfoA
SHGetSpecialFolderLocation
SHGetDesktopFolder
ShellExecuteA
Shell_NotifyIconA
SHGetMalloc
SHBrowseForFolderA

comctl32

ImageList_ReplaceIcon
ImageList_SetBkColor
_TrackMouseEvent
ImageList_DragShowNolock
ImageList_AddMasked
ImageList_Draw
ImageList_GetImageInfo
ImageList_DragEnter
ImageList_BeginDrag
ImageList_DragMove
ImageList_EndDrag
ImageList_DragLeave

msvcp60

??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ

shlwapi

PathFindExtensionA
PathFindFileNameA
PathAddBackslashA
PathRemoveFileSpecA
PathFileExistsA
PathIsRootA

Sections

.text
Size: 764KB - Virtual size: 764KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

854c6504fedacc1c0122bf49fc9875e4

Headers

File Characteristics

Imports

version

ws2_32

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

msvcp60

shlwapi

Sections

.text Size: 764KB - Virtual size: 764KB

.rdata Size: 124KB - Virtual size: 124KB

.data Size: 28KB - Virtual size: 31KB

.rsrc Size: 180KB - Virtual size: 180KB

.text
Size: 764KB - Virtual size: 764KB

.rdata
Size: 124KB - Virtual size: 124KB

.data
Size: 28KB - Virtual size: 31KB

.rsrc
Size: 180KB - Virtual size: 180KB