a4ab1364d3d5004fa73848fb1855f4d7dab697fd544ebc9c7a824c2ea84b289b

Sharing

Copy URL

Twitter E-mail

General

Target

a4ab1364d3d5004fa73848fb1855f4d7dab697fd544ebc9c7a824c2ea84b289b
Size

1.1MB
MD5

4db162c9da1c2f23fffb86eb266fc89b
SHA1

0b3b0424d1d9538da6b4177a29511836f067b012
SHA256

a4ab1364d3d5004fa73848fb1855f4d7dab697fd544ebc9c7a824c2ea84b289b
SHA512

b9848a6b78751c4af254479d37171d3594c18430e8093d9254a90e69f735fe0d41496cd537df66e108c08dca8ab59871235e64e73c70545b62a2de1b09068ef5
SSDEEP

24576:cLHjVIiOX1gPgZB8EASaiwfgFA1kaP61oFWvkCSrrdwQWP61oFWvkCSrrdwQ7W1:mJIiQ1XRASIfP8oFWvkCSrrdw3P8oFW9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4ab1364d3d5004fa73848fb1855f4d7dab697fd544ebc9c7a824c2ea84b289b

Files

a4ab1364d3d5004fa73848fb1855f4d7dab697fd544ebc9c7a824c2ea84b289b
.exe windows:6 windows x86

8c43d31b583cfefed751ac1cbcdbfd0b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapSize
WriteConsoleW
GetFullPathNameW
GetCurrentDirectoryW
GetStdHandle
GetLastError
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
CreateProcessA
GetModuleFileNameA
GetConsoleScreenBufferInfo
SetConsoleScreenBufferSize
AllocConsole
GetProcessHeap
FindNextFileA
FindFirstFileExA
FindClose
GetTimeZoneInformation
HeapReAlloc
SetEndOfFile
GetFileAttributesA
FormatMessageW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
MultiByteToWideChar
GetStringTypeW
CloseHandle
DuplicateHandle
WaitForSingleObjectEx
Sleep
GetCurrentProcess
SwitchToThread
GetCurrentThread
GetExitCodeThread
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
QueryPerformanceCounter
QueryPerformanceFrequency
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
TerminateProcess
GetCurrentProcessId
InitializeSListHead
InitializeCriticalSectionEx
SleepEx
GetSystemDirectoryW
FreeLibrary
LoadLibraryW
MoveFileExW
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
VerSetConditionMask
VerifyVersionInfoW
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RaiseException
RtlUnwind
SetStdHandle
ExitThread
GetModuleHandleExW
ExitProcess
WriteFile
GetACP
GetFileAttributesExW
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetFilePointerEx
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadConsoleW
DeleteFileW

user32

EnableWindow
SetWindowTextW
LoadIconW
LoadCursorW
GetParent
FillRect
MapWindowPoints
MessageBoxW
GetWindowRect
GetClientRect
EndPaint
BeginPaint
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
PostQuitMessage
DefWindowProcW
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
SetWindowTextA
SetWindowLongA
GetWindowLongA
MessageBoxIndirectA
SendMessageA

gdi32

SetTextColor
SetBkMode
GetStockObject
DeleteObject
CreateSolidBrush
SetBrushOrgEx

shell32

SHCreateDirectoryExA
ShellExecuteW

gdiplus

GdiplusShutdown
GdiplusStartup

comctl32

InitCommonControlsEx

advapi32

CryptHashData
CryptEncrypt
CryptAcquireContextW
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptImportKey
CryptDestroyHash
CryptDestroyKey

ws2_32

ntohs
setsockopt
socket
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
ioctlsocket
gethostname
getsockopt
getsockname
getpeername
connect
bind
recv
closesocket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
htons
WSAGetLastError

wldap32

ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord117
ord41
ord208
ord147
ord216
ord14
ord46
ord219
ord145
ord301

Sections

.text
Size: 611KB - Virtual size: 611KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 362KB - Virtual size: 361KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8c43d31b583cfefed751ac1cbcdbfd0b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

gdiplus

comctl32

advapi32

ws2_32

wldap32

Sections

.text Size: 611KB - Virtual size: 611KB

.rdata Size: 131KB - Virtual size: 130KB

.data Size: 10KB - Virtual size: 14KB

.rsrc Size: 362KB - Virtual size: 361KB

.reloc Size: 29KB - Virtual size: 28KB

.text
Size: 611KB - Virtual size: 611KB

.rdata
Size: 131KB - Virtual size: 130KB

.data
Size: 10KB - Virtual size: 14KB

.rsrc
Size: 362KB - Virtual size: 361KB

.reloc
Size: 29KB - Virtual size: 28KB