8d3b76cb0993a836125288e2dbc7de1e23c040f43ae881faa6f14c6487b2d2f4

Sharing

Copy URL Twitter E-mail

General

Target

8d3b76cb0993a836125288e2dbc7de1e23c040f43ae881faa6f14c6487b2d2f4
Size

1.1MB
MD5

cc24c0ec368d1220524f0bb22b4e7d45
SHA1

d3b93739a33d70a2662ee9aca74a952b48052706
SHA256

8d3b76cb0993a836125288e2dbc7de1e23c040f43ae881faa6f14c6487b2d2f4
SHA512

c7f73d528bce945e08aaa25be9ca816ca137091256c02cfbe5d450efc86a17e3015cfef74a864801fe9f9fc785b44c574d51e6a9207686f1f1224629153ca968
SSDEEP

24576:Op1no1ZAqNB/cfgClwKdNXTjDkOgDzNT32bjL8ER9:fAqNCIQNXTjDkOgDzNTc8ER9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8d3b76cb0993a836125288e2dbc7de1e23c040f43ae881faa6f14c6487b2d2f4

Files

8d3b76cb0993a836125288e2dbc7de1e23c040f43ae881faa6f14c6487b2d2f4
.exe windows:5 windows x86 arch:x86

4184216106bacebcc882f9e4d1d66e16

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetSetOptionW
InternetQueryOptionW
InternetCrackUrlW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

kernel32

LoadLibraryW
ExitProcess
CreateFileA
GetCurrentDirectoryW
SetLastError
GetModuleHandleW
FindClose
FindFirstFileW
FindNextFileW
DecodePointer
InterlockedIncrement
InterlockedDecrement
VirtualProtect
RaiseException
GetCurrentThreadId
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
IsBadWritePtr
MulDiv
TerminateProcess
GetProcAddress
WaitForSingleObject
Sleep
CreateProcessW
OutputDebugStringW
RemoveDirectoryW
DeleteFileW
CopyFileW
WideCharToMultiByte
FreeLibrary
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
LeaveCriticalSection
EnterCriticalSection
GetTickCount
MultiByteToWideChar
CreateFileW
OutputDebugStringA
GetCommandLineW
GetModuleFileNameW
CloseHandle
ReadFile
WriteFile
GetFileSize
DebugBreak
LocalFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
CreateThread

user32

ShowWindow
FindWindowW
SetWindowPos
SetRect
EnumChildWindows
AppendMenuW
EnableMenuItem
CheckMenuItem
TranslateAcceleratorW
GetKeyState
IsWindow
UnregisterClassW
PostThreadMessageW
LoadIconW
IsRectEmpty
GetCursorPos
AdjustWindowRectEx
SetTimer
SetPropW
SetForegroundWindow
UpdateWindow
InsertMenuItemW
TrackPopupMenu
CreatePopupMenu
EnableWindow
RegisterClassW
CallWindowProcW
PostMessageW
SendMessageW
GetWindowLongW
GetWindowRect
UpdateLayeredWindow
ReleaseDC
GetDC
MessageBoxA
LoadCursorW
GetParent
SetWindowLongW
KillTimer
MessageBoxW
BeginPaint
EndPaint
SetWindowTextW
GetClientRect
GetPropW
CreateWindowExW
RegisterClassExW
PostQuitMessage
DefWindowProcW
DispatchMessageW
TranslateMessage
GetMessageW
wsprintfW

gdi32

CreateSolidBrush
DeleteObject
Rectangle
SelectObject
SetBkColor
CreatePen
TextOutW
BitBlt
CreateCompatibleDC
CreateDIBSection
CreateCompatibleBitmap
DeleteDC
GetDeviceCaps
EnumFontFamiliesExW
SetTextColor
CreateFontW

advapi32

RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey

shell32

CommandLineToArgvW

ole32

CoInitialize
OleLockRunning
OleSetContainedObject
OleCreate
OleUninitialize
OleInitialize
StgCreateDocfile

oleaut32

CreateErrorInfo
GetErrorInfo
VariantChangeType
SetErrorInfo
VariantClear
VariantInit
SysFreeString
SysAllocString

msvcp140d

?_W_Getdays@_Locinfo@std@@QBEPBGXZ
?_Getmonths@_Locinfo@std@@QBEPBDXZ
?_Getdays@_Locinfo@std@@QBEPBDXZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_W_Getmonths@_Locinfo@std@@QBEPBGXZ
?c_str@?$_Yarn@D@std@@QBEPBDXZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
_Wcsxfrm
_Wcscoll
_Mbrtowc
?_Xbad_alloc@std@@YAXXZ
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?id@?$collate@_W@std@@2V0locale@2@A
?id@?$ctype@_W@std@@2V0locale@2@A
??2_Crt_new_delete@std@@SAPAXI@Z
??3_Crt_new_delete@std@@SAXPAX@Z
??Bid@locale@std@@QAEIXZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?is@?$ctype@_W@std@@QBE_NF_W@Z
?tolower@?$ctype@_W@std@@QBE_W_W@Z
?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ

shlwapi

PathFileExistsW
wnsprintfW
PathRemoveFileSpecW
PathFileExistsA
PathStripPathW
PathAppendW

vcruntime140d

_purecall
memchr
memcmp
__std_exception_copy
__std_exception_destroy
_except_handler4_common
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_LoadLibraryExW
__std_type_info_destroy_list
wcschr
memcpy
memmove
memset
strstr
wcsstr
_CxxThrowException
strchr
__CxxFrameHandler3

ucrtbased

fputwc
__stdio_common_vfwprintf
fputc
__stdio_common_vfprintf
wcscmp
wcsncmp
strncmp
wcscat
__stdio_common_vswprintf
realloc
_calloc_dbg
_CrtDbgReportW
__stdio_common_vsnwprintf_s
atof
strcpy
isdigit
_free_dbg
_malloc_dbg
_callnewh
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
strcpy_s
strcat_s
_seh_filter_exe
_set_app_type
__setusermatherr
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
_set_fmode
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
terminate
_wmakepath_s
_wsplitpath_s
_controlfp_s
_invalid_parameter_noinfo
_errno
_recalloc
__acrt_iob_func
getenv
_wgetenv
_wcsicmp
wcscpy_s
wcscat_s
_beginthreadex
_CrtDbgReport
__stdio_common_vsprintf_s
fwrite
fseek
fread
fclose
fopen_s
__stdio_common_vswprintf_s
_wfopen
rand
malloc
free
strlen
strcmp
wcslen
wcsncpy_s
_invalid_parameter
ftell

Sections

.textbss
Size: - Virtual size: 395KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 861KB - Virtual size: 861KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 163KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 1024B - Virtual size: 995B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4184216106bacebcc882f9e4d1d66e16

Headers

DLL Characteristics

File Characteristics

Imports

wininet

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcp140d

shlwapi

vcruntime140d

ucrtbased

Sections

.textbss Size: - Virtual size: 395KB

.text Size: 861KB - Virtual size: 861KB

.rdata Size: 163KB - Virtual size: 163KB

.data Size: 3KB - Virtual size: 15KB

.idata Size: 10KB - Virtual size: 10KB

.msvcjmc Size: 1024B - Virtual size: 995B

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 260B

.rsrc Size: 85KB - Virtual size: 84KB

.reloc Size: 40KB - Virtual size: 40KB

.textbss
Size: - Virtual size: 395KB

.text
Size: 861KB - Virtual size: 861KB

.rdata
Size: 163KB - Virtual size: 163KB

.data
Size: 3KB - Virtual size: 15KB

.idata
Size: 10KB - Virtual size: 10KB

.msvcjmc
Size: 1024B - Virtual size: 995B

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 260B

.rsrc
Size: 85KB - Virtual size: 84KB

.reloc
Size: 40KB - Virtual size: 40KB