4edda83e9ae33573ebb2d59162533be15b62f67c8c3c8f34d64976ba469d239f

Sharing

Copy URL Twitter E-mail

General

Target

4edda83e9ae33573ebb2d59162533be15b62f67c8c3c8f34d64976ba469d239f
Size

1.9MB
MD5

8ad7626d1edded419009318e5f9c4321
SHA1

37597bdbe0c6c49dfeacdbd362755af1a1c7c8ad
SHA256

4edda83e9ae33573ebb2d59162533be15b62f67c8c3c8f34d64976ba469d239f
SHA512

c9ef91ca03f33322c5fb917e78ccaee9cbadc8c37c6b94e13fe413eb42327d892ae1af370cbf53d59e11444f0da8f9dbcee6a033aad989e0ba77d818b7130ff2
SSDEEP

49152:+V6wMoAXtdju27eOuNf2Lrg7Nr+cPWItHjMBeM:+AoAXtE27WNf2LE7Nr+hIZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4edda83e9ae33573ebb2d59162533be15b62f67c8c3c8f34d64976ba469d239f

Files

4edda83e9ae33573ebb2d59162533be15b62f67c8c3c8f34d64976ba469d239f
.exe windows:6 windows x86 arch:x86

16edf679ed4100544a971155e2c781d8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CryptDecodeObject

ws2_32

shutdown
gethostbyname
WSAStartup
inet_ntoa
closesocket
WSAGetLastError
socket
recv
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSASetLastError
WSAIoctl
WSACleanup
__WSAFDIsSet
select
accept
htonl
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
ioctlsocket
gethostname
send
getservbyname

kernel32

GetDriveTypeW
MoveFileExW
OutputDebugStringA
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
GetVersionExW
DeviceIoControl
CreateFileA
WriteFile
CreateFileW
OutputDebugStringW
GetSystemDirectoryA
DeleteFileW
GetProcAddress
GetModuleHandleW
SetLastError
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
SleepEx
VerSetConditionMask
QueryPerformanceFrequency
FreeLibrary
LoadLibraryW
VerifyVersionInfoW
Sleep
QueryPerformanceCounter
GetTickCount
WaitForSingleObjectEx
ExpandEnvironmentStringsA
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
FlushConsoleInputBuffer
GetCurrentThreadId
GetModuleHandleA
GetCurrentProcessId
LoadLibraryA
GlobalMemoryStatus
GetSystemTime
SystemTimeToFileTime
EncodePointer
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
ReadConsoleInputW
SetConsoleMode
SetEndOfFile
FlushFileBuffers
GetFileSizeEx
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetFullPathNameW
GetCurrentDirectoryW
GetSystemDirectoryW
GetFileAttributesW
GetModuleFileNameW
lstrcpyW
GetStdHandle
DeleteCriticalSection
LocalFree
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
LoadResource
FindResourceExW
RaiseException
CloseHandle
HeapReAlloc
Process32FirstW
LockResource
Process32NextW
GetLastError
CreateToolhelp32Snapshot
HeapSize
OpenProcess
lstrcmpA
LocalAlloc
InitializeCriticalSectionEx
TerminateProcess
lstrcpynW
HeapFree
LCMapStringEx
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
GetConsoleOutputCP
ResetEvent
CreateEventW
ReadConsoleW
GetConsoleMode
GetConsoleCP
SetConsoleCtrlHandler
SetFilePointerEx
SizeofResource
FreeLibraryAndExitThread
ExitThread
CreateThread
GetProcessHeap
GetModuleHandleExW
ExitProcess
FindNextFileW
FindFirstFileExW
FindClose
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetFileAttributesExW
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter

user32

wsprintfW
GetUserObjectInformationW
GetProcessWindowStation
GetMessageW
MessageBoxW
DefWindowProcW
GetWindowRect
DestroyWindow
SetWindowPos
CreateWindowExW
GetSystemMetrics
RegisterClassExW
LoadAcceleratorsW
GetWindowTextW
EndPaint
BeginPaint
UpdateWindow
PostQuitMessage
LoadCursorW
LoadIconW
TranslateMessage
TranslateAcceleratorW
MessageBoxA
DispatchMessageW
ShowWindow
LoadStringW

gdi32

CreateFontW
DeleteObject

advapi32

CryptGetUserKey
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
DeregisterEventSource
RegisterEventSourceA
ReportEventA
CryptEnumProvidersA
CryptSignHashA
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
RegQueryValueExW
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextA

shell32

SHFileOperationW
ShellExecuteW
ord165

shlwapi

PathRemoveFileSpecW

wldap32

ord208
ord41
ord117
ord301
ord147
ord14
ord79
ord26
ord142
ord46
ord167
ord127
ord27
ord216
ord219
ord133
ord145

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 386KB - Virtual size: 385KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 45KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

16edf679ed4100544a971155e2c781d8

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

ws2_32

kernel32

user32

gdi32

advapi32

shell32

shlwapi

wldap32

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 386KB - Virtual size: 385KB

.data Size: 45KB - Virtual size: 60KB

.rsrc Size: 35KB - Virtual size: 34KB

.reloc Size: 68KB - Virtual size: 68KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 386KB - Virtual size: 385KB

.data
Size: 45KB - Virtual size: 60KB

.rsrc
Size: 35KB - Virtual size: 34KB

.reloc
Size: 68KB - Virtual size: 68KB