f619daaf7e72bfe6c23b300cf0794e558d6f0799a2163a3c7f955174026acf33

Sharing

Copy URL Twitter E-mail

General

Target

f619daaf7e72bfe6c23b300cf0794e558d6f0799a2163a3c7f955174026acf33
Size

2.4MB
MD5

75c5d945b8de41918f5ed777f24f134f
SHA1

75f46563599e50904df0a576b10ad43b60766cc3
SHA256

f619daaf7e72bfe6c23b300cf0794e558d6f0799a2163a3c7f955174026acf33
SHA512

d9b9db234965de4863bd709f0f892bc5d01dc36f7b057bb11221630cce329af55b2f0d6d05d5e6ccb65c1673e958f69e298495f5e34d1da51ae84d6a2a1eb4c3
SSDEEP

49152:kVZ9G+EdD/nJm3WDX991rguYkr97E0kyUmIO/Gt9Z:iG+M/Y3WDX991rgK9uyUmIWq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f619daaf7e72bfe6c23b300cf0794e558d6f0799a2163a3c7f955174026acf33

Files

f619daaf7e72bfe6c23b300cf0794e558d6f0799a2163a3c7f955174026acf33
.exe windows:4 windows x86

ca06cacd252fe6ad3a7df719fc249232

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
SetLastError
SystemTimeToTzSpecificLocalTime
ProcessIdToSessionId
FormatMessageW
LoadLibraryW
GetCurrentProcess
GetModuleHandleW
GetProcAddress
FreeLibrary
OpenProcess
GetTimeZoneInformation
GetTickCount
GetComputerNameW
LocalAlloc
GetFileAttributesW
GetEnvironmentVariableW
GetModuleFileNameW
SetEnvironmentVariableW
CompareFileTime
FileTimeToSystemTime
SystemTimeToFileTime
GetLocalTime
LoadLibraryA
CreateSemaphoreA
ReleaseSemaphore
GetVersionExA
GetSystemTime
GetACP
FormatMessageA
GetOEMCP
GetFullPathNameW
GetCurrentDirectoryA
GetCurrentDirectoryW
DeleteFileW
CreateFileW
SetFileAttributesW
MoveFileW
SetFilePointer
CreateThread
GetFileTime
ReadFile
WriteFile
WaitForSingleObject
GetCommandLineW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetEvent
WaitForMultipleObjects
Sleep
GetCurrentProcessId
GetLastError
Process32NextW
OpenEventW
CloseHandle
Process32FirstW
CreateToolhelp32Snapshot
LocalFree
GetFileSize

shell32

ord4
ord155
CommandLineToArgvW
ord2

msvcp80

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IPB_W@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?uncaught_exception@std@@YA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_N@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
?at@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?setf@ios_base@std@@QAEHHH@Z

log4cxx

?put@MDC@log4cxx@@SAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
??6WideMessageBuffer@helpers@log4cxx@@QAEAAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@I@Z
?str@MessageBuffer@helpers@log4cxx@@QAEABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAVWideMessageBuffer@23@@Z
?getError@Level@log4cxx@@SA?AV?$ObjectPtrT@VLevel@log4cxx@@@helpers@2@XZ
?getRootLogger@Logger@log4cxx@@SA?AV?$ObjectPtrT@VLogger@log4cxx@@@helpers@2@XZ
??6MessageBuffer@helpers@log4cxx@@QAEAAVWideMessageBuffer@12@PB_W@Z
??1File@log4cxx@@QAE@XZ
??6WideMessageBuffer@helpers@log4cxx@@QAEAAV012@PB_W@Z
??6WideMessageBuffer@helpers@log4cxx@@QAEAAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@K@Z
??0File@log4cxx@@QAE@PB_W@Z
?str@MessageBuffer@helpers@log4cxx@@QAEABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_ostream@_WU?$char_traits@_W@std@@@5@@Z
?configure@PropertyConfigurator@log4cxx@@SAXABVFile@2@@Z
?forcedLog@Logger@log4cxx@@QBEXABV?$ObjectPtrT@VLevel@log4cxx@@@helpers@2@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABVLocationInfo@spi@2@@Z
?isErrorEnabled@Logger@log4cxx@@QBE_NXZ
??6CharMessageBuffer@helpers@log4cxx@@QAEAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@K@Z
??0?$ObjectPtrT@VLogger@log4cxx@@@helpers@log4cxx@@QAE@XZ
??1?$ObjectPtrT@VLogger@log4cxx@@@helpers@log4cxx@@UAE@XZ
?str@MessageBuffer@helpers@log4cxx@@QAEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_ostream@DU?$char_traits@D@std@@@5@@Z
??4?$ObjectPtrT@VLogger@log4cxx@@@helpers@log4cxx@@QAEAAV012@ABV012@@Z
??1?$ObjectPtrT@VLevel@log4cxx@@@helpers@log4cxx@@UAE@XZ
?getInfo@Level@log4cxx@@SA?AV?$ObjectPtrT@VLevel@log4cxx@@@helpers@2@XZ
?isInfoEnabled@Logger@log4cxx@@QBE_NXZ
?getTrace@Level@log4cxx@@SA?AV?$ObjectPtrT@VLevel@log4cxx@@@helpers@2@XZ
?isWarnEnabled@Logger@log4cxx@@QBE_NXZ
?str@MessageBuffer@helpers@log4cxx@@QAEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVCharMessageBuffer@23@@Z
??0LocationInfo@spi@log4cxx@@QAE@QBD0H@Z
??6WideMessageBuffer@helpers@log4cxx@@QAEAAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@H@Z
??BCharMessageBuffer@helpers@log4cxx@@QAEAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@XZ
?forcedLog@Logger@log4cxx@@QBEXABV?$ObjectPtrT@VLevel@log4cxx@@@helpers@2@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVLocationInfo@spi@2@@Z
??1MessageBuffer@helpers@log4cxx@@QAE@XZ
??0MessageBuffer@helpers@log4cxx@@QAE@XZ
?isTraceEnabled@Logger@log4cxx@@QBE_NXZ
?getDebug@Level@log4cxx@@SA?AV?$ObjectPtrT@VLevel@log4cxx@@@helpers@2@XZ
?isDebugEnabled@Logger@log4cxx@@QBE_NXZ
?getLogger@Logger@log4cxx@@SA?AV?$ObjectPtrT@VLogger@log4cxx@@@helpers@2@QBD@Z
?getWarn@Level@log4cxx@@SA?AV?$ObjectPtrT@VLevel@log4cxx@@@helpers@2@XZ
??6WideMessageBuffer@helpers@log4cxx@@QAEAAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@J@Z
??6CharMessageBuffer@helpers@log4cxx@@QAEAAV012@PBD@Z
??6WideMessageBuffer@helpers@log4cxx@@QAEAAV012@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??BWideMessageBuffer@helpers@log4cxx@@QAEAAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@XZ
??6WideMessageBuffer@helpers@log4cxx@@QAEAAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@_N@Z
??6MessageBuffer@helpers@log4cxx@@QAEAAVWideMessageBuffer@12@PA_W@Z
??6WideMessageBuffer@helpers@log4cxx@@QAEAAV012@PA_W@Z
??_7?$ObjectPtrT@VLogger@log4cxx@@@helpers@log4cxx@@6B@
??0ObjectPtrBase@helpers@log4cxx@@QAE@XZ
??6WideMessageBuffer@helpers@log4cxx@@QAEAAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@P6AAAVios_base@4@AAV54@@Z@Z
??6MessageBuffer@helpers@log4cxx@@QAEAAVCharMessageBuffer@12@PBD@Z

rpcrt4

RpcServerUseProtseqEpW
RpcServerListen
RpcMgmtStopServerListening
RpcServerUnregisterIf
NdrServerCall2
RpcServerRegisterIf2

msvcr80

_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_except_handler4_common
_crt_debugger_hook
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
tolower
_endthreadex
_vscwprintf
vswprintf_s
_purecall
toupper
_CxxThrowException
_time64
_localtime64_s
memset
memcpy_s
_strnicmp
__CxxFrameHandler3
wcscpy_s
free
malloc
??0exception@std@@QAE@XZ
_invalid_parameter_noinfo
_beginthreadex
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??_V@YAXPAX@Z
_ultow_s
??3@YAXPAX@Z
??2@YAPAXI@Z
_wcsicmp
wcstol
fwrite
ferror
_fseeki64
_telli64
fseek
_fileno
isalnum
towupper
towlower
_atoi64
fread
fprintf
fclose
srand
fopen_s
_stricmp
strchr
strstr
wcsstr
memchr
memcpy
memmove
strncmp
_mktime64
_tzset
_dupenv_s
atoi
_filelengthi64
fflush

ws2_32

WSAStartup
inet_ntoa
socket
shutdown
bind
getsockname
closesocket
select
__WSAFDIsSet
htons
inet_addr
ntohs
WSAIoctl
ioctlsocket
setsockopt
getsockopt
recv
send
gethostbyname
connect
WSAGetLastError

user32

PostThreadMessageW
PostQuitMessage
DefWindowProcW
SetWindowLongW
GetMessageW
GetWindowLongW
UpdateWindow
TranslateMessage
DispatchMessageW
RegisterClassExW
CreateWindowExW
ShowWindow

advapi32

CryptCreateHash
RegQueryValueExA
CryptExportKey
CryptDestroyKey
CryptGenRandom
CryptReleaseContext
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyHash
CryptSignHashA
CryptAcquireContextW
CryptAcquireContextA
RegOpenKeyExA
DuplicateTokenEx
OpenProcessToken
ImpersonateLoggedOnUser
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceConfigW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

ole32

CoUninitialize
CoInitializeEx
CoTaskMemFree

oleaut32

VariantInit
VariantTimeToSystemTime
VariantClear

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 720KB - Virtual size: 717KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ca06cacd252fe6ad3a7df719fc249232

Headers

File Characteristics

Imports

kernel32

shell32

msvcp80

log4cxx

rpcrt4

msvcr80

ws2_32

user32

advapi32

ole32

oleaut32

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 720KB - Virtual size: 717KB

.data Size: 64KB - Virtual size: 75KB

.rsrc Size: 8KB - Virtual size: 4KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 720KB - Virtual size: 717KB

.data
Size: 64KB - Virtual size: 75KB

.rsrc
Size: 8KB - Virtual size: 4KB