eb43acde9a05962ab8b96c78eb9ed284773becaab842fce9ad145cc79437aa03

Sharing

Copy URL

Twitter E-mail

General

Target

eb43acde9a05962ab8b96c78eb9ed284773becaab842fce9ad145cc79437aa03
Size

1.2MB
MD5

fc275c80801c7153a3161e8879aef984
SHA1

1e7bc7c94f618a7e617d8285d463abc6a599b85e
SHA256

eb43acde9a05962ab8b96c78eb9ed284773becaab842fce9ad145cc79437aa03
SHA512

a3547340c8258a689807d323b658511c7e3ad73a2440f99d2b1ac47b059e28629cb5a66118c29c8cc3c29ee864b9c874a86b9577e0d730ca5ed5a91140929e54
SSDEEP

12288:UDW2PZhPOzzJDznN7dTIlZq2ESOo45pnqH59izUPdxt7rEDWKjXhJQ1J87F5Fk63:yWEZhPSl7eFEZqZkQqQ1uB5BS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb43acde9a05962ab8b96c78eb9ed284773becaab842fce9ad145cc79437aa03

Files

eb43acde9a05962ab8b96c78eb9ed284773becaab842fce9ad145cc79437aa03
.exe windows:6 windows x86

0564c67f51b0303e2d04241254e64256

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

utilities

?STraceW@SOUI@@YAXPB_WZZ

soui

??0SWindow@SOUI@@QAE@XZ

ws2_32

ntohs

iphlpapi

GetAdaptersAddresses

setupapi

SetupDiGetClassDevsW

user32

wsprintfW

comdlg32

GetOpenFileNameW

advapi32

RegCloseKey

shell32

ShellExecuteW

ole32

OleInitialize

oleaut32

SystemTimeToVariantTime

getopt

optind

libcrypto-3

SHA384

libcurl

curl_formadd

libssl-3

SSL_new

libxml2

xmlFree

zip

zip_add

zlib1

gzeof

msvcp140

?_Xout_of_range@std@@YAXPBD@Z

shlwapi

StrCpyNW

gdiplus

GdipFree

version

VerQueryValueA

wininet

DeleteUrlCacheEntryW

urlmon

URLDownloadToFileW

vcruntime140

wcschr

api-ms-win-crt-string-l1-1-0

strtok

api-ms-win-crt-stdio-l1-1-0

feof

api-ms-win-crt-filesystem-l1-1-0

_mkdir

api-ms-win-crt-runtime-l1-1-0

exit

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-multibyte-l1-1-0

_mbsstr

api-ms-win-crt-math-l1-1-0

fmin

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

afc_client_free
afc_client_new
afc_client_new_with_service_client
afc_client_start_service
afc_dictionary_free
afc_file_close
afc_file_lock
afc_file_open
afc_file_read
afc_file_seek
afc_file_tell
afc_file_truncate
afc_file_write
afc_get_device_info
afc_get_device_info_key
afc_get_file_info
afc_make_directory
afc_make_link
afc_read_directory
afc_remove_path
afc_remove_path_and_contents
afc_rename_path
afc_set_file_time
afc_truncate
buffer_read_from_filename
buffer_write_to_filename
cfprintf
collection_add
collection_copy
collection_count
collection_free
collection_init
collection_remove
cond_destroy
cond_init
cond_signal
cond_wait
cond_wait_timeout
cprintf
cvfprintf
diagnostics_relay_client_free
diagnostics_relay_client_new
diagnostics_relay_client_start_service
diagnostics_relay_goodbye
diagnostics_relay_query_ioregistry_entry
diagnostics_relay_query_ioregistry_plane
diagnostics_relay_query_mobilegestalt
diagnostics_relay_request_diagnostics
diagnostics_relay_restart
diagnostics_relay_shutdown
diagnostics_relay_sleep
dirname_must_free
generate_uuid
idevice_activation_drm_handshake_request_new
idevice_activation_request_free
idevice_activation_request_get_field
idevice_activation_request_get_fields
idevice_activation_request_get_url
idevice_activation_request_new
idevice_activation_request_new_from_lockdownd
idevice_activation_request_set_field
idevice_activation_request_set_fields
idevice_activation_request_set_fields_from_response
idevice_activation_request_set_url
idevice_activation_response_field_requires_input
idevice_activation_response_field_secure_input
idevice_activation_response_free
idevice_activation_response_get_activation_record
idevice_activation_response_get_description
idevice_activation_response_get_field
idevice_activation_response_get_fields
idevice_activation_response_get_headers
idevice_activation_response_get_label
idevice_activation_response_get_placeholder
idevice_activation_response_get_title
idevice_activation_response_has_errors
idevice_activation_response_is_activation_acknowledged
idevice_activation_response_is_authentication_required
idevice_activation_response_new
idevice_activation_response_new_from_html
idevice_activation_response_to_buffer
idevice_activation_send_request
idevice_activation_set_debug_level
idevice_connect
idevice_connection_disable_bypass_ssl
idevice_connection_disable_ssl
idevice_connection_enable_ssl
idevice_connection_get_fd
idevice_connection_receive
idevice_connection_receive_timeout
idevice_connection_send
idevice_device_list_extended_free
idevice_device_list_free
idevice_disconnect
idevice_event_subscribe
idevice_event_unsubscribe
idevice_events_subscribe
idevice_events_unsubscribe
idevice_free
idevice_get_device_list
idevice_get_device_list_extended
idevice_get_handle
idevice_get_udid
idevice_new
idevice_new_with_options
idevice_set_debug_level
instproxy_archive
instproxy_browse
instproxy_browse_with_callback
instproxy_check_capabilities_match
instproxy_client_free
instproxy_client_get_path_for_bundle_identifier
instproxy_client_new
instproxy_client_options_add
instproxy_client_options_free
instproxy_client_options_new
instproxy_client_options_set_return_attributes
instproxy_client_start_service
instproxy_command_get_name
instproxy_install
instproxy_lookup
instproxy_lookup_archives
instproxy_remove_archive
instproxy_restore
instproxy_status_get_current_list
instproxy_status_get_error
instproxy_status_get_name
instproxy_status_get_percent_complete
instproxy_uninstall
instproxy_upgrade
libusbmuxd_set_debug_level
libusbmuxd_set_use_inotify
lockdownd_activate
lockdownd_client_free
lockdownd_client_new
lockdownd_client_new_with_handshake
lockdownd_client_set_label
lockdownd_data_classes_free
lockdownd_deactivate
lockdownd_enter_recovery
lockdownd_get_device_name
lockdownd_get_device_udid
lockdownd_get_sync_data_classes
lockdownd_get_value
lockdownd_goodbye
lockdownd_pair
lockdownd_pair_with_options
lockdownd_query_type
lockdownd_receive
lockdownd_remove_value
lockdownd_send
lockdownd_service_descriptor_free
lockdownd_set_value
lockdownd_start_service
lockdownd_start_service_with_escrow_bag
lockdownd_start_session
lockdownd_stop_session
lockdownd_strerror
lockdownd_unpair
lockdownd_validate_pair
mobileactivation_activate
mobileactivation_activate_with_session
mobileactivation_client_free
mobileactivation_client_new
mobileactivation_client_start_service
mobileactivation_create_activation_info
mobileactivation_create_activation_info_with_session
mobileactivation_create_activation_session_info
mobileactivation_deactivate
mobileactivation_get_activation_state
mobilebackup2_client_free
mobilebackup2_client_new
mobilebackup2_client_start_service
mobilebackup2_receive_message
mobilebackup2_receive_raw
mobilebackup2_send_message
mobilebackup2_send_raw
mobilebackup2_send_request
mobilebackup2_send_status_response
mobilebackup2_version_exchange
mutex_destroy
mutex_init
mutex_lock
mutex_unlock
np_client_free
np_client_new
np_client_start_service
np_observe_notification
np_observe_notifications
np_post_notification
np_set_notify_callback
pair_record_get_host_id
preboard_client_free
preboard_client_new
preboard_client_start_service
preboard_commit_stashbag
preboard_create_stashbag
preboard_receive
preboard_receive_with_timeout
preboard_send
property_list_service_client_free
property_list_service_client_new
property_list_service_disable_ssl
property_list_service_enable_ssl
property_list_service_get_service_client
property_list_service_receive_plist
property_list_service_receive_plist_with_timeout
property_list_service_send_binary_plist
property_list_service_send_xml_plist
restored_client_free
restored_client_new
restored_client_set_label
restored_get_value
restored_goodbye
restored_query_type
restored_query_value
restored_reboot
restored_receive
restored_send
restored_start_restore
sbservices_client_free
sbservices_client_new
sbservices_client_start_service
sbservices_get_home_screen_wallpaper_pngdata
sbservices_get_icon_pngdata
sbservices_get_icon_state
sbservices_get_interface_orientation
sbservices_set_icon_state
service_client_factory_start_service
service_client_free
service_client_new
service_disable_bypass_ssl
service_disable_ssl
service_enable_ssl
service_get_connection
service_receive
service_receive_with_timeout
service_send
string_append
string_build_path
string_concat
string_format_size
string_toupper
term_colors_init
term_colors_set_enabled
thread_alive
thread_cancel
thread_detach
thread_free
thread_join
thread_new
thread_once
usbmuxd_connect
usbmuxd_delete_pair_record
usbmuxd_device_list_free
usbmuxd_disconnect
usbmuxd_events_subscribe
usbmuxd_events_unsubscribe
usbmuxd_get_device
usbmuxd_get_device_by_udid
usbmuxd_get_device_list
usbmuxd_read_buid
usbmuxd_read_pair_record
usbmuxd_recv
usbmuxd_recv_timeout
usbmuxd_save_pair_record
usbmuxd_save_pair_record_with_device_id
usbmuxd_send
usbmuxd_subscribe
usbmuxd_unsubscribe
userpref_get_paired_udids
userpref_read_pair_record
userpref_read_system_buid

Sections

.MPRESS1
Size: 272KB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 971KB - Virtual size: 970KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0564c67f51b0303e2d04241254e64256

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

utilities

soui

ws2_32

iphlpapi

setupapi

user32

comdlg32

advapi32

shell32

ole32

oleaut32

getopt

libcrypto-3

libcurl

libssl-3

libxml2

zip

zlib1

msvcp140

shlwapi

gdiplus

version

wininet

urlmon

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.MPRESS1 Size: 272KB - Virtual size: 2.4MB

.MPRESS2 Size: 15KB - Virtual size: 14KB

.rsrc Size: 971KB - Virtual size: 970KB

.MPRESS1
Size: 272KB - Virtual size: 2.4MB

.MPRESS2
Size: 15KB - Virtual size: 14KB

.rsrc
Size: 971KB - Virtual size: 970KB