9964734036ead9e21e7279d94d46de6a5e2b02c0b03d9144009cbc9a705f1869

Sharing

Copy URL

Twitter E-mail

General

Target

9964734036ead9e21e7279d94d46de6a5e2b02c0b03d9144009cbc9a705f1869
Size

425KB
MD5

c2ba8658f197c1f78e5acf6199acd69b
SHA1

a4e6cb28dadea4f39a6f58c0b9d6fbe45fd36c0a
SHA256

9964734036ead9e21e7279d94d46de6a5e2b02c0b03d9144009cbc9a705f1869
SHA512

48dfc6e156200ccc5c9912b75168a82fc25c1204b2468b76b6768aab382ba7dc4695a6fad6d7541c7f5edc818a831af39171e9d9d63065f21ecdad532855ae76
SSDEEP

12288:e21ZW3h80ka43kyVUoPDzvX7/EvsHqzsPfOcp:31QX439VUG4csMf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9964734036ead9e21e7279d94d46de6a5e2b02c0b03d9144009cbc9a705f1869

Files

9964734036ead9e21e7279d94d46de6a5e2b02c0b03d9144009cbc9a705f1869
.exe windows:6 windows x86

9115c4b04c1e963ef0242482a8a0ca4f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
RaiseException
LoadLibraryW
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
DecodePointer
HeapDestroy
GetProcAddress
DeleteCriticalSection
GetProcessHeap
GetModuleHandleW
FreeLibrary
CreateMutexW
Sleep
GetLongPathNameW
TerminateProcess
K32GetModuleFileNameExW
OpenProcess
K32EnumProcesses
GetCurrentProcessId
GetExitCodeProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
WideCharToMultiByte
WritePrivateProfileStringW
HeapReAlloc
GetTempPathW
GetFileAttributesW
SetFileAttributesW
GetWindowsDirectoryW
MoveFileExW
CopyFileW
MoveFileW
DeleteFileW
LockResource
SetEvent
GetLastError
CreateEventW
HeapSize
WaitForSingleObject
InitializeCriticalSectionEx
GetModuleFileNameW
lstrcpynW
lstrlenW
GetCurrentProcess
HeapFree
SizeofResource
SetEndOfFile
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetFilePointerEx
ReadConsoleW
ReadFile
GetConsoleMode
RemoveDirectoryW
GetStartupInfoW
IsDebuggerPresent
OutputDebugStringW
TryEnterCriticalSection
GetCurrentThreadId
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
EncodePointer
MultiByteToWideChar
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
GetSystemWindowsDirectoryW
GetVersionExW
FreeResource
LoadLibraryExW
CreateFileW
DeviceIoControl
lstrcmpA
lstrcmpiA
GetSystemDirectoryW
CreateFileA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
WaitForSingleObjectEx
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
RtlUnwind
ExitThread
GetModuleHandleExW
ExitProcess
GetStdHandle
WriteFile
GetACP
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP

user32

PeekMessageW
GetMessageW
PostThreadMessageW

advapi32

RegOpenKeyExW
GetTokenInformation
RegOpenKeyExA
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegCloseKey
RegQueryValueExA
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegEnumKeyExA

shell32

ShellExecuteExW
SHGetSpecialFolderPathW
ord165
SHFileOperationW

ole32

CoCreateGuid

oleaut32

SysStringLen
SysFreeString
SysAllocStringLen

shlwapi

PathAppendW
PathRemoveFileSpecW
SHSetValueA
StrStrIW
PathFileExistsW
PathCombineW
StrStrIA
StrTrimA
StrCmpNIW
SHGetValueA
StrCmpIW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

wininet

InternetGetConnectedState

urlmon

URLDownloadToFileW
URLDownloadToCacheFileW

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 308KB - Virtual size: 307KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9115c4b04c1e963ef0242482a8a0ca4f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

wininet

urlmon

iphlpapi

Sections

.text Size: 308KB - Virtual size: 307KB

.rdata Size: 88KB - Virtual size: 88KB

.data Size: 9KB - Virtual size: 23KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 17KB - Virtual size: 16KB

.text
Size: 308KB - Virtual size: 307KB

.rdata
Size: 88KB - Virtual size: 88KB

.data
Size: 9KB - Virtual size: 23KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 17KB - Virtual size: 16KB