636e7d1f14aaabfccd190b52a2c14c50_exe32[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

636e7d1f14aaabfccd190b52a2c14c50_exe32.exe
Size

1.4MB
MD5

636e7d1f14aaabfccd190b52a2c14c50
SHA1

dca3f2b2dfca91b951fdc5fd36cae1caff1b085e
SHA256

b70342c5c8c980691e93d0dfee5561b4c8598755ce6701a24b1ed9fb64cb46b2
SHA512

fa3ab9ad22098044daae6aed5d76b17ff176030feda6e64694e2b2d6b81ca3681f4d781d2d7bacd3fc012178a7367716f1263bafac62a1f5db19d370fa5d8a01
SSDEEP

24576:f8z+w6rXIiDTrNcanKetNjJocKZEKZZYAWnCEzYeEUZanLWm8FzXZRZ1eehMc4LB:fFn/S0NTiWnRYswnL0zXZb15Mn8YZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
636e7d1f14aaabfccd190b52a2c14c50_exe32.exe

Files

636e7d1f14aaabfccd190b52a2c14c50_exe32.exe
.exe windows:5 windows x86

80063e2d1ed99e43658c5cac159801b5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetEvent
GetTickCount
GetCurrentThread
GetSystemTimeAsFileTime
InitializeCriticalSection
GetProcessTimes
TlsSetValue
WideCharToMultiByte
LoadLibraryW
Sleep
CreateEventA
LeaveCriticalSection
GetFileAttributesW
CreateProcessA
TerminateProcess
MultiByteToWideChar
SetThreadPriority
RaiseException
GetLastError
GetLongPathNameW
SetLastError
GetProcAddress
EnterCriticalSection
FindClose
CreateFileMappingA
IsWow64Process
GetSystemInfo
CreateMutexA
FindNextFileW
GetFileAttributesExW
QueryPerformanceFrequency
DeleteCriticalSection
GetCurrentThreadId
DuplicateHandle
ReleaseMutex
TlsAlloc
CloseHandle
GetVersion
DeleteFileW
GetThreadTimes
TlsFree
WaitForSingleObject
FormatMessageA
FreeConsole
GetConsoleWindow
SetConsoleTitleA
AttachConsole
GetModuleFileNameA
GetModuleHandleA
GetCurrentProcessId
DecodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
EncodePointer
GetStartupInfoW
HeapSetInformation
InterlockedExchange
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
LoadLibraryExA
DeleteFileA
AreFileApisANSI
GetSystemTime
LocalFree
GetTempPathA
GetVersionExA
OutputDebugStringA
GetDiskFreeSpaceA
CreateFileMappingW
LoadLibraryA
GetDiskFreeSpaceW
LockFileEx
HeapSize
GetTempPathW
FlushFileBuffers
CreateFileW
ReadFile
HeapValidate
HeapCreate
GetFileAttributesA
HeapDestroy
GetVersionExW
SetHandleInformation
QueryPerformanceCounter
CreateDirectoryW
GetCurrentProcess
InterlockedDecrement
InterlockedIncrement
FreeLibrary
UnmapViewOfFile
MapViewOfFile
FindFirstFileW
AllocConsole
GetFullPathNameA
FormatMessageW
WriteFile
GetProcessHeap
UnlockFileEx
OutputDebugStringW
WaitForSingleObjectEx
LockFile
FlushViewOfFile
UnlockFile
InterlockedCompareExchange
HeapFree
SystemTimeToFileTime
HeapAlloc
SetEndOfFile
TryEnterCriticalSection
SetFilePointer
HeapCompact
CreateMutexW
GetFileSize
HeapReAlloc
GetFullPathNameW
CreateFileA
IsProcessorFeaturePresent

user32

DestroyMenu
GetDlgItemTextA
SetDlgItemTextA
AppendMenuA
DialogBoxIndirectParamA
DestroyWindow
GetMessageA
PostQuitMessage
TrackPopupMenu
SetForegroundWindow
LoadIconA
SetFocus
SendMessageA
RegisterWindowMessageA
TranslateMessage
GetWindowTextA
MessageBoxA
CreateWindowExA
GetDlgItem
EndDialog
DefWindowProcA
GetCursorPos
CheckDlgButton
ShowWindow
CreatePopupMenu
IsDlgButtonChecked
EnableWindow
PostMessageA
DispatchMessageA
SetWindowTextA
LoadImageA
RegisterClassA

comdlg32

GetSaveFileNameA
GetOpenFileNameA

advapi32

SetServiceStatus
CreateServiceA
RegisterServiceCtrlHandlerA
ChangeServiceConfig2A
DeleteService
StartServiceCtrlDispatcherA
CloseServiceHandle
OpenServiceA
OpenSCManagerA

shell32

ShellExecuteA
SHGetPathFromIDListA
Shell_NotifyIconA
SHBrowseForFolderA

ws2_32

getnameinfo
listen
getsockopt
accept
send
closesocket
__WSAFDIsSet
freeaddrinfo
socket
bind
recv
WSACleanup
setsockopt
shutdown
getsockname
ntohs
htons
WSAGetLastError
ioctlsocket
connect
WSAStartup
ntohl
htonl
getaddrinfo
select

msvcr100

rand
_CIsinh
_CIcosh
_CItanh
_CIlog10
_setjmp3
_CIpow
_CIacos
setbuf
fputc
rename
sprintf
_lseeki64
_gmtime64
sscanf
isgraph
memmove
strncmp
_mkgmtime64
isspace
free
_strtoui64
qsort
_pclose
malloc
strerror
_strtoi64
strstr
__iob_func
_access
strchr
memchr
fflush
atoi
_wfopen
_pipe
_popen
_errno
fgetc
strtol
remove
isalnum
tolower
isprint
_beginthreadex
fgets
printf
_read
fopen
_rmdir
_CIasin
fprintf
_vsnprintf
isdigit
strftime
_fileno
ferror
iscntrl
fwrite
strrchr
toupper
strspn
_get_osfhandle
strcspn
realloc
wcscmp
strtoul
_localtime64
puts
atof
getenv
fclose
isxdigit
_difftime64
_time64
_stat64i32
_close
_fdopen
strncat
__argv
signal
_snprintf
isalpha
_fullpath
freopen
_getcwd
wcstombs
atol
exit
__argc
feof
getc
_locking
_stat64
_findnext64i32
_findclose
_mkdir
_utime64
_chdir
_findfirst64i32
_setmode
ftell
fseek
strcoll
frexp
abort
longjmp
strtod
ldexp
strpbrk
localeconv
_localtime64_s
_msize
_endthreadex
rand_s
ceil
modf
fread
srand
_HUGE
ispunct
isupper
islower
fscanf
tmpfile
_ftelli64
ungetc
_fseeki64
setvbuf
clearerr
_mktime64
tmpnam
system
clock
setlocale
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_invoke_watson
_controlfp_s
_CIatan
_CIcos
_CIexp
floor
_CIlog
_CIsin
_CIsqrt
_CItan
_CIatan2
_CIfmod
memset
memcpy

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

80063e2d1ed99e43658c5cac159801b5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

comdlg32

advapi32

shell32

ws2_32

msvcr100

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 109KB - Virtual size: 109KB

.data Size: 5KB - Virtual size: 10KB

.rsrc Size: 15KB - Virtual size: 15KB

.reloc Size: 44KB - Virtual size: 43KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 109KB - Virtual size: 109KB

.data
Size: 5KB - Virtual size: 10KB

.rsrc
Size: 15KB - Virtual size: 15KB

.reloc
Size: 44KB - Virtual size: 43KB