87732706a5aa2f185016f1e874f8cc5545bd7f9c77e9d8a6a54bfa41aa2aaa54

Sharing

Copy URL Twitter E-mail

General

Target

87732706a5aa2f185016f1e874f8cc5545bd7f9c77e9d8a6a54bfa41aa2aaa54
Size

425KB
MD5

2940dee66d02fdf71c73c98a73af72ea
SHA1

f193d8644f710298174f6e23000183e898f432e8
SHA256

87732706a5aa2f185016f1e874f8cc5545bd7f9c77e9d8a6a54bfa41aa2aaa54
SHA512

3481e5942c77850a894ca5f1f069371e552cb4725e634f450aad3d5fe8ad7c830b7e3c2bee3d37d144b72f92029d3aff91d702b63981563a1e1c067efbbde72e
SSDEEP

12288:R2HZW3hc0E6Y3YyGUoGjTvX7/kpsnTgMPescG:4HQ3Y3BGU7Ya8se

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
87732706a5aa2f185016f1e874f8cc5545bd7f9c77e9d8a6a54bfa41aa2aaa54

Files

87732706a5aa2f185016f1e874f8cc5545bd7f9c77e9d8a6a54bfa41aa2aaa54
.exe windows:6 windows x86

9115c4b04c1e963ef0242482a8a0ca4f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
RaiseException
LoadLibraryW
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
DecodePointer
HeapDestroy
GetProcAddress
DeleteCriticalSection
GetProcessHeap
GetModuleHandleW
FreeLibrary
CreateMutexW
Sleep
GetLongPathNameW
TerminateProcess
K32GetModuleFileNameExW
OpenProcess
K32EnumProcesses
GetCurrentProcessId
GetExitCodeProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
WideCharToMultiByte
WritePrivateProfileStringW
HeapReAlloc
GetTempPathW
GetFileAttributesW
SetFileAttributesW
GetWindowsDirectoryW
MoveFileExW
CopyFileW
MoveFileW
DeleteFileW
LockResource
SetEvent
GetLastError
CreateEventW
HeapSize
WaitForSingleObject
InitializeCriticalSectionEx
GetModuleFileNameW
lstrcpynW
lstrlenW
GetCurrentProcess
HeapFree
SizeofResource
SetEndOfFile
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetFilePointerEx
ReadConsoleW
ReadFile
GetConsoleMode
RemoveDirectoryW
GetStartupInfoW
IsDebuggerPresent
OutputDebugStringW
TryEnterCriticalSection
GetCurrentThreadId
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
EncodePointer
MultiByteToWideChar
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
GetSystemWindowsDirectoryW
GetVersionExW
FreeResource
LoadLibraryExW
CreateFileW
DeviceIoControl
lstrcmpA
lstrcmpiA
GetSystemDirectoryW
CreateFileA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
WaitForSingleObjectEx
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
RtlUnwind
ExitThread
GetModuleHandleExW
ExitProcess
GetStdHandle
WriteFile
GetACP
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP

user32

PeekMessageW
GetMessageW
PostThreadMessageW

advapi32

RegOpenKeyExW
GetTokenInformation
RegOpenKeyExA
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegCloseKey
RegQueryValueExA
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegEnumKeyExA

shell32

ShellExecuteExW
SHGetSpecialFolderPathW
ord165
SHFileOperationW

ole32

CoCreateGuid

oleaut32

SysStringLen
SysFreeString
SysAllocStringLen

shlwapi

PathAppendW
PathRemoveFileSpecW
SHSetValueA
StrStrIW
PathFileExistsW
PathCombineW
StrStrIA
StrTrimA
StrCmpNIW
SHGetValueA
StrCmpIW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

wininet

InternetGetConnectedState

urlmon

URLDownloadToFileW
URLDownloadToCacheFileW

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 308KB - Virtual size: 307KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9115c4b04c1e963ef0242482a8a0ca4f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

wininet

urlmon

iphlpapi

Sections

.text Size: 308KB - Virtual size: 307KB

.rdata Size: 88KB - Virtual size: 88KB

.data Size: 9KB - Virtual size: 23KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 17KB - Virtual size: 16KB

.text
Size: 308KB - Virtual size: 307KB

.rdata
Size: 88KB - Virtual size: 88KB

.data
Size: 9KB - Virtual size: 23KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 17KB - Virtual size: 16KB