53298957ba0588d4c6374d6e7d26e8ff9c7674b3dd6a34d2acd91dcf7d0a9c7e

Sharing

Copy URL Twitter E-mail

General

Target

53298957ba0588d4c6374d6e7d26e8ff9c7674b3dd6a34d2acd91dcf7d0a9c7e
Size

576KB
MD5

ecf259d6aa468a324fa36e6aa80ac1f3
SHA1

400485bce072147ec5bd4f5cab62727aa65283d6
SHA256

53298957ba0588d4c6374d6e7d26e8ff9c7674b3dd6a34d2acd91dcf7d0a9c7e
SHA512

148a8dc2ce4e59a192fced3aaecfbff9685ccac0a46957c1773413ca81b505cb44f858f0e3be2617511bc8506f470be9a3e2064a5614d2c69b8be09578a15e5d
SSDEEP

12288:ZD2M/TVdEn+bJq6JyGGY9Z1NcXysHsS1Pn3mL+G1jTdYxFktwo3fu5svvx6n:ZD2MJIvCsM0nujTdwYdu58vC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
53298957ba0588d4c6374d6e7d26e8ff9c7674b3dd6a34d2acd91dcf7d0a9c7e

Files

53298957ba0588d4c6374d6e7d26e8ff9c7674b3dd6a34d2acd91dcf7d0a9c7e
.exe windows:5 windows x86

f092f5447cefa2c04620499f2855cb7d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

iocptcp

TcpUninit
TcpInit
TcpDestroy
TcpGetLinkAddr

kernel32

SetUnhandledExceptionFilter
GetLocalTime
GetModuleHandleA
GetCurrentThreadId
GetCurrentProcessId
DeleteFileA
GetModuleFileNameW
FindFirstFileA
RemoveDirectoryA
FindClose
FindNextFileA
FindNextFileW
GetTickCount
SetEvent
lstrlenA
QueryDosDeviceA
lstrcatA
lstrcmpiA
GetProcAddress
SetFileAttributesA
lstrcpyA
WaitForSingleObject
WriteFile
ReadFile
CreateProcessA
CopyFileA
MoveFileA
ProcessIdToSessionId
LocalAlloc
LocalFree
WriteConsoleW
SetStdHandle
HeapReAlloc
FreeEnvironmentStringsW
GetPrivateProfileStringA
CloseHandle
CreateToolhelp32Snapshot
GetModuleFileNameA
Process32Next
GetLastError
GetLogicalDriveStringsA
TerminateProcess
CreateEventA
Sleep
OpenProcess
Process32First
GetCurrentProcess
DeleteFileW
GetEnvironmentStringsW
QueryPerformanceCounter
LoadLibraryW
VirtualProtect
VirtualFree
VirtualAlloc
GetVersionExW
UnregisterWaitEx
InitializeSListHead
ReleaseSemaphore
ReadConsoleW
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetFilePointerEx
GetFileType
GetStdHandle
GetProcessHeap
HeapSize
GetModuleHandleExW
ExitProcess
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
SetEndOfFile
GetTimeFormatW
GetDateFormatW
ExitThread
CreateSemaphoreW
GetStartupInfoW
WideCharToMultiByte
MultiByteToWideChar
CreateFileW
FindFirstFileExW
GetFileAttributesExW
AreFileApisANSI
DuplicateHandle
GetCurrentThread
GetExitCodeThread
GetSystemTimeAsFileTime
GetStringTypeW
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
IsDebuggerPresent
IsProcessorFeaturePresent
HeapFree
GetCPInfo
OutputDebugStringW
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
LoadLibraryExW
RaiseException
HeapAlloc
CreateTimerQueue
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
WaitForSingleObjectEx
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetModuleHandleW
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCommandLineA
RtlUnwind
CreateDirectoryW
SetEnvironmentVariableA
UnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW

user32

TranslateMessage
GetMessageA
DispatchMessageA
wsprintfA
PeekMessageA

advapi32

AllocateAndInitializeSid
FreeSid
CheckTokenMembership
DuplicateTokenEx
GetSecurityInfo
GetAce
SetSecurityDescriptorDacl
SetTokenInformation
InitializeSecurityDescriptor
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
CreateProcessAsUserA
OpenProcessToken

ws2_32

ntohl
gethostbyname
htonl

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

psapi

GetProcessImageFileNameA

wininet

InternetReadFile
InternetConnectA
InternetOpenA
HttpSendRequestA
InternetCloseHandle
InternetCrackUrlA
HttpAddRequestHeadersA
HttpOpenRequestA

shlwapi

PathFileExistsA

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

wtsapi32

WTSEnumerateSessionsA

Sections

.text
Size: 426KB - Virtual size: 425KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f092f5447cefa2c04620499f2855cb7d

Headers

DLL Characteristics

File Characteristics

Imports

iocptcp

kernel32

user32

advapi32

ws2_32

version

psapi

wininet

shlwapi

userenv

wtsapi32

Sections

.text Size: 426KB - Virtual size: 425KB

.rdata Size: 88KB - Virtual size: 87KB

.data Size: 20KB - Virtual size: 38KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 23KB - Virtual size: 23KB

.text
Size: 426KB - Virtual size: 425KB

.rdata
Size: 88KB - Virtual size: 87KB

.data
Size: 20KB - Virtual size: 38KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 23KB - Virtual size: 23KB