35eb247f323a25157d637007db0f235e00beec82cdcbfb8dc6bb499a64c64ad3

Sharing

Copy URL Twitter E-mail

General

Target

35eb247f323a25157d637007db0f235e00beec82cdcbfb8dc6bb499a64c64ad3
Size

2.2MB
MD5

ad93075e07bf063c4617f4c12aa3dd81
SHA1

20bfa99cdf3532c8a5a95b03ca04117b0975648a
SHA256

35eb247f323a25157d637007db0f235e00beec82cdcbfb8dc6bb499a64c64ad3
SHA512

6d457c40fd0db9562865073b7ec40f1379d03f1c2495390037998d5eb86fa545a71274677bb260451729c16fc138d4ed08143f154f80da05f6560d9d898012e2
SSDEEP

49152:37f6aNQNRrXnHnLtJM8TUHHpMfjCTXf3jfEOz:3DUrXYufjCT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
35eb247f323a25157d637007db0f235e00beec82cdcbfb8dc6bb499a64c64ad3

Files

35eb247f323a25157d637007db0f235e00beec82cdcbfb8dc6bb499a64c64ad3
.exe windows:5 windows x86

7235f884aa2644adc3a9a54f8c664532

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winhttp

WinHttpReadData
WinHttpOpenRequest
WinHttpOpen
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpSendRequest
WinHttpSetOption
WinHttpSetTimeouts
WinHttpReceiveResponse

advapi32

CryptGetUserKey
DeregisterEventSource
ReportEventW
RegisterEventSourceW
CryptEnumProvidersW
CryptGetProvParam
CryptAcquireContextW
CryptSignHashW
CryptSetHashParam
CryptGenRandom
RegCloseKey
RegOpenKeyExA
CryptExportKey
CryptDeriveKey
CryptReleaseContext
CryptSignHashA
CryptAcquireContextA
CryptImportKey
CryptEncrypt
CryptCreateHash
CryptDestroyKey
CryptVerifySignatureA
CryptDecrypt
CryptDestroyHash
RegQueryValueExA
CryptHashData

ws2_32

accept
WSACleanup
bind
listen
shutdown
recv
send
setsockopt
inet_ntop
connect
inet_addr
select
htons
socket
__WSAFDIsSet
closesocket
WSAGetLastError
gethostname
inet_ntoa
getpeername
gethostbyname
ntohl
htonl
sendto
recvfrom
WSAIoctl
WSASetLastError
getsockname
ioctlsocket
getsockopt
getaddrinfo
getnameinfo
ntohs
freeaddrinfo
WSAStartup

iphlpapi

GetAdaptersInfo

crypt32

CertOpenSystemStoreA
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertOpenStore
CryptAcquireCertificatePrivateKey
CertEnumCertificatesInStore
CertNameToStrA
CertGetCertificateContextProperty
CertGetIntendedKeyUsage
CertAddCertificateContextToStore
CertCompareCertificate
CertDuplicateCertificateContext

isec

isec_ke_client_hello
isec_ke_cmac
isec_global_cleanup
isec_ke_new
isec_ke_decrypt
isec_ke_client_key_exchange
isec_ke_encrypt
isec_ke_hmac
isec_ke_set_root_certificate
isec_global_init

msvcp120

?_Winerror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z

mfc120

ord5252
ord5261
ord14285
ord4037
ord4086
ord1123
ord11911
ord12776
ord2674
ord9319
ord4650
ord12472
ord12232
ord2514
ord13153
ord2798
ord7509
ord8237
ord11080
ord12389
ord5461
ord12598
ord9035
ord11095
ord10853
ord10805
ord3806
ord8919
ord6077
ord5493
ord2813
ord13616
ord13844
ord481
ord6985
ord7359
ord9138
ord6097
ord13539
ord8750
ord8758
ord11994
ord3126
ord10334
ord1144
ord511
ord7001
ord11403
ord11847
ord11103
ord7635
ord10946
ord2636
ord12671
ord4920
ord4921
ord4924
ord4922
ord4923
ord6177
ord3645
ord6973
ord3646
ord3634
ord3755
ord14281
ord8595
ord4425
ord5306
ord9254
ord3626
ord3765
ord3135
ord540
ord8973
ord1438
ord4184
ord3208
ord6707
ord9252
ord9135
ord13760
ord14351
ord11896
ord11989
ord3888
ord8017
ord12271
ord8182
ord3791
ord4203
ord4233
ord4199
ord4157
ord4127
ord4061
ord2580
ord7494
ord11405
ord8974
ord8829
ord2609
ord11939
ord2605
ord1439
ord13588
ord6157
ord13584
ord6145
ord13590
ord6161
ord5720
ord5704
ord13416
ord3314
ord3209
ord965
ord6708
ord1453
ord14320
ord1979
ord980
ord3903
ord4091
ord364
ord13665
ord1405
ord13742
ord925
ord14282
ord1071
ord13083
ord1166
ord3908
ord1451
ord13122
ord13113
ord13116
ord13747
ord979
ord7360
ord9013
ord9139
ord10234
ord11317
ord11899
ord9075
ord11920
ord4535
ord3792
ord11995
ord5253
ord11616
ord11621
ord9051
ord8054
ord1146
ord9188
ord8671
ord5834
ord11252
ord4443
ord2513
ord5817
ord13492
ord5818
ord13494
ord13485
ord5813
ord1741
ord12274
ord6008
ord4928
ord4933
ord4927
ord8240
ord3127
ord514
ord7002
ord1768
ord927
ord2209
ord12605
ord12064
ord7789
ord12759
ord4039
ord4100
ord9234
ord14366
ord7770
ord14368
ord12356
ord12355
ord2442
ord9977
ord9980
ord5241
ord8167
ord4407
ord7845
ord12677
ord12740
ord10264
ord12065
ord8229
ord7507
ord8311
ord950
ord6410
ord462
ord11991
ord9073
ord7350
ord10083
ord5646
ord366
ord1067
ord13053
ord1522
ord12577
ord14193
ord14187
ord8599
ord2944
ord6891
ord6484
ord3881
ord4826
ord2482
ord14151
ord4175
ord8587
ord2345
ord2177
ord324
ord1047
ord12697
ord4041
ord8308
ord12374
ord1687
ord1691
ord1688
ord3796
ord7882
ord4613
ord4690
ord7297
ord8614
ord13914
ord7667
ord8658
ord12840
ord14009
ord13335
ord6750
ord13714
ord6748
ord9303
ord11214
ord11285
ord10262
ord6465
ord3142
ord3823
ord14346
ord2709
ord1174
ord8969
ord3188
ord4798
ord4822
ord12901
ord13094
ord4519
ord6374
ord3100
ord4170
ord8585
ord2946
ord3821
ord1065
ord8966
ord6662
ord2157
ord8148
ord9344
ord9359
ord9349
ord9821
ord9825
ord9361
ord11567
ord10951
ord8849
ord10975
ord9881
ord9882
ord6744
ord9064
ord11941
ord11906
ord6367
ord3098
ord4167
ord1061
ord8964
ord6426
ord3124
ord1128
ord992
ord1465
ord6669
ord895
ord12162
ord14377
ord12219
ord14430
ord2339
ord6734
ord6839
ord997
ord4827
ord11986
ord3216
ord3321
ord3322
ord3890
ord11942
ord2638
ord5303
ord5814
ord13488
ord13908
ord2818
ord11538
ord6745
ord14367
ord7771
ord14369
ord3008
ord4442
ord9528
ord5672
ord4450
ord4893
ord4858
ord4851
ord4889
ord4916
ord4867
ord4900
ord4912
ord4875
ord4879
ord4883
ord4871
ord4904
ord4863
ord1731
ord1722
ord1726
ord1718
ord1706
ord12075
ord12077
ord13658
ord3217
ord9094
ord10831
ord11455
ord6844
ord12038
ord8803
ord14361
ord11756
ord3782
ord3787
ord11907
ord8977
ord11547
ord11546
ord5536
ord10121
ord10117
ord10119
ord10120
ord10118
ord1467
ord2717
ord8055
ord10088
ord3253
ord3256
ord13541
ord6098
ord7508
ord6007
ord2168
ord362
ord1063
ord6366
ord6443
ord4823
ord2478
ord3831
ord6363
ord6436
ord2199
ord6686
ord6625
ord6405
ord2476
ord13062
ord13559
ord12372
ord12392
ord450
ord12765
ord12679
ord12907
ord12899
ord12898
ord13090
ord13826
ord13479
ord13892
ord8720
ord13889
ord12831
ord13904
ord13900
ord12834
ord5101
ord8652
ord8208
ord4597
ord4119
ord1103
ord12882
ord3798
ord2346
ord887
ord1384
ord2341
ord7010
ord3128
ord3293
ord6118
ord13550
ord1157
ord8968
ord2256
ord2334
ord2297
ord14372
ord4825
ord4164
ord9047
ord8064
ord5293
ord7565
ord7575
ord7574
ord5119
ord5295
ord5139
ord5409
ord9186
ord5643
ord5433
ord5136
ord4969
ord5005
ord2950
ord12734
ord8204
ord4272
ord1524
ord500
ord11782
ord5765
ord12165
ord494
ord5396
ord12596
ord6432
ord5398
ord5006
ord316
ord300
ord310
ord1041
ord1521
ord4612
ord8600
ord2963
ord305
ord5801

msvcr120

calloc
strerror
__sys_nerr
_stat64
strpbrk
strtoll
_getpid
_lseeki64
_fstat64
setvbuf
_beginthreadex
_lock
_unlock
strcmp
_strnicmp
strspn
qsort
fgets
feof
_fileno
_setmode
strerror_s
raise
_exit
_vsnwprintf
wcsstr
strrchr
isgraph
getenv
memcpy
memset
_CxxThrowException
strchr
ferror
fopen_s
fputc
strftime
_vsnprintf
_localtime64_s
abort
fflush
fclose
fseek
ftell
fwrite
fopen
_vsnprintf_s
div
printf
_errno
sprintf_s
_mbscmp
strtoul
ldiv
_mbschr
strtol
_mbsnbcpy
_mbspbrk
memcpy_s
memmove_s
strncpy
_time64
srand
rand
sscanf
atoi
memchr
_snprintf
sprintf
_strdup
fprintf
__iob_func
isxdigit
islower
realloc
toupper
iscntrl
__isascii
signal
fputs
_stricmp
_gmtime64
strcspn
_mbsrchr
_wfopen
isupper
_purecall
isdigit
isalpha
__CxxFrameHandler3
_unlink
_access
_read
_write
_close
_open
_stat64i32
setbuf
_fstat64i32
_setmbcp
isprint
tolower
ispunct
isalnum
isblank
strstr
malloc
isspace
free
strncmp
memmove
fread
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
_except1
_except_handler4_common
_commode
_fmode
_acmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_ismbblead
_cexit
exit
__set_app_type
__getmainargs
_amsg_exit
__crtGetShowWindowMode
_XcptFilter
?terminate@@YAXXZ
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
??1type_info@@UAE@XZ
_onexit
__dllonexit
_calloc_crt

kernel32

SetEvent
CreateEventA
CloseHandle
CreateThread
GetCurrentProcessId
WaitForSingleObject
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
CopyFileA
CreateFileA
GetWindowsDirectoryA
InitializeCriticalSection
GetModuleHandleA
DeviceIoControl
SetUnhandledExceptionFilter
GetCurrentProcess
GetProcAddress
GlobalUnlock
GlobalAlloc
GetTickCount
GlobalLock
MultiByteToWideChar
InterlockedDecrement
DeleteFileA
DeleteCriticalSection
DecodePointer
GetLocalTime
EnterCriticalSection
OutputDebugStringW
lstrlenA
FindNextFileW
FindFirstFileW
FindClose
GetLastError
CreateDirectoryA
GetFileAttributesA
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetModuleFileNameA
GetCurrentThreadId
ResetEvent
WideCharToMultiByte
GetComputerNameA
SetFilePointer
WriteFile
InterlockedIncrement
FileTimeToSystemTime
FileTimeToLocalFileTime
FreeLibrary
lstrcpynA
Sleep
LocalFree
GetModuleHandleExW
InterlockedCompareExchange
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedExchangeAdd
FormatMessageW
GetModuleHandleW
GetVersion
GetFileType
GetStdHandle
DeleteFiber
SwitchToFiber
CreateFiber
LoadLibraryW
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
QueryPerformanceCounter
GlobalMemoryStatus
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetEnvironmentVariableW
SetLastError
SystemTimeToFileTime
GetSystemTime
FormatMessageA
InitializeCriticalSectionEx
SleepEx
VerSetConditionMask
GetSystemDirectoryA
VerifyVersionInfoA
MoveFileExA
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
WaitForSingleObjectEx
EncodePointer
IsDebuggerPresent
IsProcessorFeaturePresent

user32

InvalidateRect
InflateRect
GetCapture
DrawTextExA
PtInRect
SetRectEmpty
SendMessageA
GrayStringA
GetClientRect
GetClipCursor
LoadCursorW
GetParent
DrawTextA
SetCapture
FillRect
GetWindowRect
ScreenToClient
SetWindowRgn
InvertRect
SetCursor
ClientToScreen
IsRectEmpty
CopyRect
DrawFrameControl
SetClipboardData
UpdateWindow
LoadImageA
IsWindowVisible
OpenClipboard
EqualRect
PostMessageA
ShowScrollBar
IsWindow
EmptyClipboard
ReleaseDC
GetWindowLongA
SetRect
GetWindowTextA
OffsetRect
DrawFocusRect
GetDC
GetDoubleClickTime
DrawEdge
SetFocus
WindowFromPoint
GetFocus
GetKeyState
KillTimer
IsChild
SetTimer
CloseClipboard
MessageBoxA
ModifyMenuA
LoadBitmapW
LoadMenuW
SetMenuItemBitmaps
GetSubMenu
LoadIconW
RedrawWindow
PeekMessageA
RegisterWindowMessageA
LoadMenuA
SetForegroundWindow
TrackPopupMenu
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
GetActiveWindow
GetForegroundWindow
DefWindowProcA
GetSysColor
TabbedTextOutA
GetCursorPos
GetClassInfoA
ClipCursor
ReleaseCapture
GetSystemMetrics
EnableWindow
LoadCursorA
IntersectRect

gdi32

SelectObject
DeleteObject
GetCharWidthA
GetDeviceCaps
CreateHalftonePalette
RealizePalette
GetBkColor
GetDIBColorTable
GetTextMetricsA
CreatePolygonRgn
BitBlt
GetTextExtentPoint32A
CreateFontIndirectA
GetCurrentObject
CreateCompatibleDC
CombineRgn
CreateCompatibleBitmap
PtVisible
CreateRectRgn
Escape
RectVisible
GetObjectA
GetStockObject
ExtTextOutA
CreateSolidBrush
TextOutA
CreatePalette

shell32

ShellExecuteA
Shell_NotifyIconA

comctl32

ImageList_ReplaceIcon
ImageList_GetImageInfo

oleaut32

SysAllocString
VariantClear
SysFreeString

wldap32

ord143
ord46
ord211
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord217

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 438KB - Virtual size: 437KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 297KB - Virtual size: 296KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7235f884aa2644adc3a9a54f8c664532

Headers

DLL Characteristics

File Characteristics

Imports

winhttp

advapi32

ws2_32

iphlpapi

crypt32

isec

msvcp120

mfc120

msvcr120

kernel32

user32

gdi32

shell32

comctl32

oleaut32

wldap32

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 438KB - Virtual size: 437KB

.data Size: 38KB - Virtual size: 63KB

.rsrc Size: 297KB - Virtual size: 296KB

.reloc Size: 85KB - Virtual size: 84KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 438KB - Virtual size: 437KB

.data
Size: 38KB - Virtual size: 63KB

.rsrc
Size: 297KB - Virtual size: 296KB

.reloc
Size: 85KB - Virtual size: 84KB