987a3e7e98fa850217a19d285fdf8d6eab9655f8e584dea1197d6b83d11bc8e0

Sharing

Copy URL Twitter E-mail

General

Target

987a3e7e98fa850217a19d285fdf8d6eab9655f8e584dea1197d6b83d11bc8e0
Size

3.3MB
MD5

18ddefb7a06f0d8cd3517a87d6654d89
SHA1

dca4a10cde99068bd3c40fb4dbb080e8c58a484d
SHA256

987a3e7e98fa850217a19d285fdf8d6eab9655f8e584dea1197d6b83d11bc8e0
SHA512

064a6001055addb0a8193d364ffe068e0f7e5e6fbd2db0adae99d740ad1d00fea429e835efd098edb1a76a8517b5748c85fa3343cf434ff198673b2e7953bf57
SSDEEP

49152:s3KKcoN1RdVI4TJvXq9uw9GqEopPpjLR7zzJaq4CUhQLFCPPjL3n45:yRdVI4lvXq9uwRJLR7ZaqDvMPjL3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
987a3e7e98fa850217a19d285fdf8d6eab9655f8e584dea1197d6b83d11bc8e0

Files

987a3e7e98fa850217a19d285fdf8d6eab9655f8e584dea1197d6b83d11bc8e0
.exe windows:6 windows x86

cebf7665d8d37ab63b83c46f15626940

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

getsockopt
send
accept
recv
getsockname
socket
shutdown
connect
ioctlsocket
htons
select
setsockopt
gethostbyname
WSAStartup
WSACleanup
WSAGetLastError
WSARecv
WSASend
WSASocketA
__WSAFDIsSet
ntohs
ntohl
listen
inet_ntoa
inet_addr
bind
htonl
closesocket

icuuc38

ucnv_fromUChars_3_8
ucnv_getMaxCharSize_3_8
ucnv_close_3_8
ucnv_open_3_8
?getStringEx@ResourceBundle@icu_3_8@@QBE?AVUnicodeString@2@PBDAAW4UErrorCode@@@Z
?getNext@ResourceBundle@icu_3_8@@QAE?AV12@AAW4UErrorCode@@@Z
?getKey@ResourceBundle@icu_3_8@@QBEPBDXZ
?resetIterator@ResourceBundle@icu_3_8@@QAEXXZ
?hasNext@ResourceBundle@icu_3_8@@QBECXZ
??2UMemory@icu_3_8@@SAPAXI@Z
??_UUMemory@icu_3_8@@SAPAXI@Z
??3UMemory@icu_3_8@@SAXPAX@Z
??_VUMemory@icu_3_8@@SAXPAX@Z
?getTerminatedBuffer@UnicodeString@icu_3_8@@QAEPB_WXZ
??0UnicodeString@icu_3_8@@QAE@XZ
?getEnglish@Locale@icu_3_8@@SAABV12@XZ
??0Locale@icu_3_8@@QAE@PBD000@Z
??1Locale@icu_3_8@@UAE@XZ
?setDefault@Locale@icu_3_8@@SAXABV12@AAW4UErrorCode@@@Z
??0ResourceBundle@icu_3_8@@QAE@PBDABVLocale@1@AAW4UErrorCode@@@Z
??1ResourceBundle@icu_3_8@@UAE@XZ
?getString@ResourceBundle@icu_3_8@@QBE?AVUnicodeString@2@AAW4UErrorCode@@@Z
??0UnicodeString@icu_3_8@@QAE@PBD0@Z
??1UnicodeString@icu_3_8@@UAE@XZ
?getDynamicClassID@ResourceBundle@icu_3_8@@UBEPAXXZ

lua51

luaL_loadstring
lua_pcall
lua_call
lua_getfield
lua_gettop
lua_pushnumber
lua_tolstring
lua_tonumber
lua_type
lua_insert
lua_settop
lua_isnumber
lua_isstring
lua_toboolean
lua_touserdata
lua_tothread
lua_topointer
lua_pushstring
lua_pushcclosure
lua_pushboolean
lua_settable
luaL_loadfile
lua_isuserdata
lua_close
luaL_openlibs
lua_pushlightuserdata
luaL_newstate

libcrypto-1_1

OPENSSL_init_crypto
ERR_print_errors_fp

libssl-1_1

SSL_read
SSL_accept
SSL_write
SSL_free
OPENSSL_init_ssl
TLS_client_method
TLS_server_method
SSL_connect
SSL_CTX_set_client_hello_cb
SSL_new
SSL_CTX_check_private_key
SSL_CTX_use_certificate_file
SSL_CTX_use_PrivateKey_file
SSL_set_fd
SSL_CTX_new

kernel32

FindFirstFileExW
GetFileAttributesExW
DeleteFileW
FreeEnvironmentStringsW
GetEnvironmentStringsW
ReadConsoleW
SetFilePointerEx
GetFileType
FlushFileBuffers
GetOEMCP
GetACP
IsValidCodePage
GetModuleFileNameW
GetConsoleMode
GetConsoleCP
WriteFile
HeapSize
LoadLibraryExW
ExitThread
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
CreateSemaphoreW
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
CreateEventW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
FatalAppExitA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetCommandLineA
SetConsoleCtrlHandler
ReadFile
AreFileApisANSI
GetModuleHandleExW
ExitProcess
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetLocalTime
OutputDebugStringA
CloseHandle
GetLastError
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
Sleep
CreateThread
SetThreadPriority
FindNextFileW
WaitForMultipleObjects
TryEnterCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount
lstrcmpiA
SetConsoleTextAttribute
InitializeCriticalSection
GetStdHandle
GetEnvironmentVariableA
GetCurrentDirectoryA
SetLastError
GetCurrentThread
SuspendThread
ResumeThread
GetThreadContext
GetVersionExA
ReadProcessMemory
FreeLibrary
GetModuleFileNameA
GetProcAddress
LoadLibraryA
GetCurrentProcessId
WinExec
GetModuleHandleA
SetConsoleTitleA
GetConsoleWindow
ReleaseSemaphore
WaitForSingleObject
GetCurrentProcess
GetProcessAffinityMask
SetThreadAffinityMask
CreateSemaphoreA
GetCurrentThreadId
TerminateThread
MoveFileA
HeapAlloc
HeapFree
GetProcessHeap
SetConsoleScreenBufferSize
AllocConsole
WriteConsoleA
CreateFileA
DuplicateHandle
RaiseException
SwitchToThread
lstrcpynA
lstrlenA
IsBadReadPtr
IsBadWritePtr
GetPrivateProfileIntA
GetPrivateProfileStringA
lstrcmpA
lstrcpyA
GetFileAttributesA
SetFileAttributesA
IsDebuggerPresent
RtlUnwind
GetThreadPriority
GetStringTypeW
MultiByteToWideChar
DecodePointer
EncodePointer
WideCharToMultiByte
HeapReAlloc
CreateDirectoryW
SetStdHandle
WriteConsoleW
OutputDebugStringW
CreateFileW
SetEndOfFile
SetEnvironmentVariableA
GetDriveTypeW
GetFullPathNameA
SetCurrentDirectoryW
GetCurrentDirectoryW
GetSystemInfo

user32

InvalidateRect
SetWindowTextA
GetWindowTextA
GetClientRect
GetWindowRect
GetCursorPos
FillRect
TranslateMessage
DispatchMessageA
PeekMessageA
GetSystemMenu
EnableMenuItem
GetDlgItem
CreateDialogParamA
SetWindowPos
ShowWindow
EndPaint
BeginPaint
SetDlgItemTextA
PostQuitMessage
SendMessageA
MessageBoxA

gdi32

DeleteObject
LineTo
Rectangle
SelectObject
SetBkMode
SetPixel
SetTextColor
MoveToEx
TextOutA
CreateSolidBrush

odbc32

ord13
ord72
ord41
ord51
ord75
ord39
ord19
ord36
ord12
ord29
ord9
ord7
ord18
ord24
ord4
ord11
ord31
ord16

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

iphlpapi

GetAdaptersInfo

winmm

timeGetTime

icuin38

?setInt64@Formattable@icu_3_8@@QAEX_J@Z
??0Formattable@icu_3_8@@QAE@XZ
??1Formattable@icu_3_8@@UAE@XZ
?setDouble@Formattable@icu_3_8@@QAEXN@Z
?setLong@Formattable@icu_3_8@@QAEXH@Z
??_7FieldPosition@icu_3_8@@6B@
?setDate@Formattable@icu_3_8@@QAEXN@Z
?setString@Formattable@icu_3_8@@QAEXABVUnicodeString@2@@Z
??1FieldPosition@icu_3_8@@UAE@XZ
??0MessageFormat@icu_3_8@@QAE@ABVUnicodeString@1@AAW4UErrorCode@@@Z
??1MessageFormat@icu_3_8@@UAE@XZ
?format@MessageFormat@icu_3_8@@QBEAAVUnicodeString@2@PBVFormattable@2@HAAV32@AAVFieldPosition@2@AAW4UErrorCode@@@Z
?getDynamicClassID@Formattable@icu_3_8@@UBEPAXXZ

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 559KB - Virtual size: 559KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cebf7665d8d37ab63b83c46f15626940

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

icuuc38

lua51

libcrypto-1_1

libssl-1_1

kernel32

user32

gdi32

odbc32

version

iphlpapi

winmm

icuin38

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 559KB - Virtual size: 559KB

.data Size: 21KB - Virtual size: 1.6MB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 130KB - Virtual size: 130KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 559KB - Virtual size: 559KB

.data
Size: 21KB - Virtual size: 1.6MB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 130KB - Virtual size: 130KB