2fad9997e87c32bdba49826fd3444fbaedf5a85befeb518055c2d5fae3bfec48

Sharing

Copy URL Twitter E-mail

General

Target

2fad9997e87c32bdba49826fd3444fbaedf5a85befeb518055c2d5fae3bfec48
Size

2.4MB
MD5

902782120fad3b727bcaa7d699274618
SHA1

f1768dd23acbe5e6172636029eefdf8e675729ea
SHA256

2fad9997e87c32bdba49826fd3444fbaedf5a85befeb518055c2d5fae3bfec48
SHA512

82a906e7041c7e00a631177d285dde0443fe5d4eb528596631a12906c95559a0bd398ce145b4da6bf41bd764306be77070a708157103420fcf97ea9f64761f66
SSDEEP

49152:+zY0ubzYekCIP1E1C8tBPEABg2FUjwc+BTz7T8EErJ6sM13PDS4b:+/unun1EIaFcwX8G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2fad9997e87c32bdba49826fd3444fbaedf5a85befeb518055c2d5fae3bfec48

Files

2fad9997e87c32bdba49826fd3444fbaedf5a85befeb518055c2d5fae3bfec48
.exe windows:5 windows x86

30e1cb97b16ab404e646625dac373298

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptMsgClose
CryptDecodeObject
CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CertCloseStore
CryptQueryObject
CertFreeCertificateContext

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

Sleep
GetCurrentProcess
ExpandEnvironmentStringsW
GetVersion
GetDriveTypeW
GetCurrentThread
GetVolumeInformationW
GetDiskFreeSpaceW
GetLogicalDriveStringsW
InterlockedCompareExchange
FlushInstructionCache
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
GetThreadContext
SetThreadContext
SuspendThread
ResumeThread
SetLastError
WaitForMultipleObjects
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
ReadFile
SetEndOfFile
GetFileSize
GetComputerNameW
GetTickCount
GetProcessHeap
SetEvent
GetACP
GlobalMemoryStatusEx
InterlockedExchange
InterlockedExchangeAdd
lstrlenW
GetModuleHandleW
GetVersionExW
GetFileAttributesW
HeapAlloc
GlobalFree
GlobalAlloc
OpenProcess
HeapFree
DeleteFileW
lstrcpyW
LocalFree
lstrcmpA
LocalAlloc
CreateFileMappingW
FileTimeToLocalFileTime
FileTimeToSystemTime
EnumResourceNamesW
SizeofResource
WriteConsoleW
HeapSize
GetLocalTime
GetCurrentThreadId
CreateFileW
SetFilePointer
GetModuleFileNameW
WriteFile
FreeLibrary
GetProcAddress
GetWindowsDirectoryW
CreateDirectoryW
LoadLibraryW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCurrentProcessId
DeleteCriticalSection
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
MoveFileExW
CloseHandle
GetLastError
SetStdHandle
OutputDebugStringA
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
FlushFileBuffers
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
HeapReAlloc
SetConsoleCtrlHandler
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
CreateMutexW
WaitForSingleObject
FreeLibraryAndExitThread
ExitThread
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
GetFileType
GetStdHandle
WaitNamedPipeW
TransactNamedPipe
DuplicateHandle
SetNamedPipeHandleState
VirtualQueryEx
OpenThread
InterlockedIncrement
CreateSemaphoreW
CreateThread
TerminateThread
GetProcessId
InterlockedDecrement
ReleaseSemaphore
RtlCaptureContext
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
WritePrivateProfileSectionW
GetSystemDirectoryW
FindFirstFileW
FindNextFileW
DeviceIoControl
FindClose
CreateProcessW
QueryInformationJobObject
WriteProcessMemory
AssignProcessToJobObject
CreateJobObjectW
IsProcessInJob
GetModuleHandleA
VirtualAllocEx
CreateRemoteThread
TerminateJobObject
GetExitCodeProcess
GetLongPathNameW
GetShortPathNameW
GetFileAttributesExW
SearchPathW
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryA
LockResource
GetSystemInfo
LoadResource
FindResourceW
lstrcmpiW
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
ReleaseMutex
OpenMutexW
QueryDosDeviceW
LoadLibraryExW
OpenFileMappingW
UnmapViewOfFile
MapViewOfFile
OpenEventW
CreateEventW
ResetEvent
SetFileTime
GetFileTime
GetComputerNameExW
LocalFileTimeToFileTime
SystemTimeToFileTime
GetSystemTime
DosDateTimeToFileTime
FileTimeToDosDateTime
TerminateProcess
GetFullPathNameW
RemoveDirectoryW
GetTempPathW
SetFileAttributesW
GetCurrentDirectoryW
SetCurrentDirectoryW
CopyFileW
GetTempFileNameW
MoveFileW
lstrcatW
GetFileSizeEx
FormatMessageW
GetStringTypeW
EncodePointer
GetCPInfo
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
OutputDebugStringW

user32

GetDesktopWindow
GetParent
SetFocus
GetClassNameW
GetForegroundWindow
AttachThreadInput
WindowFromPoint
GetShellWindow
GetSystemMetrics
SetWindowPos
GetFocus
CreateIconFromResourceEx
PrivateExtractIconsW
GetWindowRect
DestroyIcon
LookupIconIdFromDirectoryEx
LoadImageW
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
GetWindowTextLengthW
GetDC
IsWindowVisible
EnumChildWindows
IsWindow
EnumDesktopWindows
GetActiveWindow
GetWindowThreadProcessId
UnregisterClassW
FindWindowW
SendMessageW
GetIconInfo
OpenDesktopW
CloseDesktop
GetWindowTextW
ReleaseDC

advapi32

LookupPrivilegeValueW
IsValidSid
GetTokenInformation
GetLengthSid
ConvertSidToStringSidW
FreeSid
OpenProcessToken
AllocateAndInitializeSid
EqualSid
ReportEventW
RegisterEventSourceW
DeregisterEventSource
SetEntriesInAclW
RegQueryValueExW
RegOpenKeyExW
SystemFunction036
CheckTokenMembership
RegCloseKey
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegDeleteValueW
RegEnumValueW
SetNamedSecurityInfoW
AdjustTokenPrivileges

shell32

SHGetFileInfoW
SHFileOperationW
SHGetMalloc
ExtractIconExW
SHGetDesktopFolder
SHGetFolderPathW
ShellExecuteW
SHChangeNotify
SHGetPathFromIDListW
ShellExecuteExW
SHGetSpecialFolderLocation
DuplicateIcon
SHGetSpecialFolderPathW
ord727

ole32

OleInitialize
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
OleUninitialize
CreateStreamOnHGlobal

oleaut32

SysFreeString
VariantClear
SysAllocString

shlwapi

SHDeleteKeyW
PathRemoveFileSpecW
PathFileExistsW

wininet

InternetGetConnectedState
InternetCheckConnectionW

iphlpapi

GetAdaptersInfo

imagehlp

ImageEnumerateCertificates
ImageRemoveCertificate

gdiplus

GdipGetImageHeight
GdipGetImageEncoders
GdipLoadImageFromFileICM
GdipCloneImage
GdipAlloc
GdipCreateBitmapFromStream
GdipLoadImageFromFile
GdiplusStartup
GdipGetImageWidth
GdipDisposeImage
GdipFree
GdipGetImageRawFormat
GdipGetImageEncodersSize
GdipCreateHICONFromBitmap
GdiplusShutdown
GdipCreateBitmapFromStreamICM
GdipSaveImageToFile

gdi32

DeleteDC
DeleteObject
CreateCompatibleDC
CreateFontIndirectW
GetObjectW
GetStockObject
GetTextExtentPointW
GetTextExtentExPointW
SelectObject
GetDIBits

Exports

Exports

CheckSignerInfo
ExportFunc01
ExportFunc02
IsNetConnect

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 394KB - Virtual size: 394KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

30e1cb97b16ab404e646625dac373298

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

version

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

iphlpapi

imagehlp

gdiplus

gdi32

Exports

Exports

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 394KB - Virtual size: 394KB

.data Size: 11KB - Virtual size: 19KB

.rsrc Size: 60KB - Virtual size: 60KB

.reloc Size: 86KB - Virtual size: 85KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 394KB - Virtual size: 394KB

.data
Size: 11KB - Virtual size: 19KB

.rsrc
Size: 60KB - Virtual size: 60KB

.reloc
Size: 86KB - Virtual size: 85KB