5115980a005b4ae788f1a87aa8387d6bc02b84c800e52fbc60fbff321510332d

Sharing

Copy URL Twitter E-mail

General

Target

5115980a005b4ae788f1a87aa8387d6bc02b84c800e52fbc60fbff321510332d
Size

306KB
MD5

de9c1a6d06ccd79deea622eb2b8fbff7
SHA1

3436b1a41374b9b147e0eed8c0d22c8270495504
SHA256

5115980a005b4ae788f1a87aa8387d6bc02b84c800e52fbc60fbff321510332d
SHA512

80877369321bce4486161739c21ad7459dd288087f82c2910db653ad08d8a384ca16ce176077cc457886e095ef0cf4ddbe5264b36323c5dd4a1bfcd117a83f11
SSDEEP

3072:vke868SGxz75jr0TZfM2/IQnkTWm6G0IZeMvvTmUhT4Z9UuxZW9sDhnIfqO:z89171r0T9nW10ICZPPW9s9nV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5115980a005b4ae788f1a87aa8387d6bc02b84c800e52fbc60fbff321510332d

Files

5115980a005b4ae788f1a87aa8387d6bc02b84c800e52fbc60fbff321510332d
.exe windows:5 windows x86 arch:x86

bd276205e7ddee1b8bbe8be81302c7e3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc140u

ord12219
ord12251
ord10433
ord8217
ord4589
ord12247
ord12239
ord5918
ord3852
ord6349
ord14668
ord6350
ord14669
ord6348
ord14667
ord8000
ord12531
ord14466
ord11983
ord11982
ord2034
ord7941
ord12947
ord4090
ord4152
ord9398
ord14595
ord7922
ord14589
ord12542
ord12541
ord2486
ord5357
ord8324
ord12865
ord11015
ord8470
ord8360
ord3872
ord2993
ord8744
ord4222
ord3147
ord9128
ord6497
ord2246
ord3833
ord8464
ord890
ord1391
ord11038
ord4477
ord6973
ord4886
ord6533
ord4219
ord3145
ord9126
ord6490
ord1066
ord6549
ord1133
ord4360
ord7447
ord7481
ord7820
ord14507
ord5074
ord14405
ord290
ord11396
ord4092
ord3404
ord3403
ord3164
ord6218
ord13752
ord2760
ord9139
ord12173
ord9235
ord9210
ord14377
ord4885
ord2526
ord2215
ord3932
ord6607
ord4227
ord12928
ord13337
ord10250
ord5850
ord13656
ord8067
ord5422
ord14137
ord2990
ord8062
ord10472
ord7495
ord3697
ord1113
ord6489
ord1070
ord3882
ord4815
ord2304
ord1111
ord1180
ord1002
ord6589
ord9209
ord10255
ord8219
ord5409
ord7712
ord7723
ord7722
ord5984
ord5228
ord5411
ord5252
ord5790
ord5525
ord9350
ord5760
ord5549
ord5249
ord12168
ord3265
ord3371
ord3372
ord3941
ord12124
ord2682
ord5935
ord13703
ord11717
ord6877
ord14596
ord7923
ord14590
ord3055
ord4494
ord9693
ord4502
ord4988
ord4927
ord4912
ord4974
ord5019
ord4942
ord4997
ord5013
ord4954
ord4960
ord4966
ord4948
ord5003
ord4936
ord1777
ord1756
ord1770
ord1744
ord1722
ord12258
ord12262
ord13878
ord3266
ord9256
ord11002
ord6978
ord12220
ord8965
ord14588
ord11936
ord3838
ord12089
ord8746
ord5763
ord9132
ord11726
ord11725
ord5652
ord5173
ord6860
ord10288
ord10284
ord10286
ord10287
ord10285
ord14785
ord2761
ord8210
ord3302
ord3305
ord13756
ord6220
ord4225
ord13911
ord8757
ord285
ord5921
ord7313
ord13442
ord952
ord3009
ord280
ord2205
ord2458
ord7997
ord2307
ord14320
ord1472
ord995
ord7653
ord10379
ord14234
ord8070
ord1454
ord6842
ord6117
ord9138
ord3260
ord1525
ord3366
ord4239
ord8182
ord14597
ord14131
ord8817
ord1446
ord6834
ord6129
ord9135
ord3257
ord4236
ord287
ord1653
ord4323
ord5884
ord1692
ord12559
ord5109
ord1689
ord265
ord6966
ord266
ord12921
ord8756
ord12884
ord4664
ord1523
ord12763
ord2385
ord2389
ord6566
ord12131
ord3846
ord286
ord9040
ord462
ord7109
ord2996
ord1511
ord1045
ord296
ord1663
ord2409
ord8386
ord1513

kernel32

CreateDirectoryW
GetCurrentThreadId
GetCurrentProcessId
CreateFileW
OutputDebugStringW
MultiByteToWideChar
GetACP
InitializeCriticalSectionAndSpinCount
GetProcAddress
DeleteCriticalSection
LoadLibraryW
WideCharToMultiByte
CreateMutexW
InitializeCriticalSection
SetCurrentDirectoryW
SetUnhandledExceptionFilter
GetLastError
FormatMessageW
GetLocalTime
GetModuleFileNameW
LeaveCriticalSection
LocalFree
WritePrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileStringW
IsDebuggerPresent
FreeLibrary
CloseHandle
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
ReadFile
GetModuleHandleW
GetCurrentProcess
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW

user32

GetParent
SetForegroundWindow
SetTimer
EnableMenuItem
ModifyMenuW
IsIconic
PostMessageW
AppendMenuW
GetSystemMenu
LoadIconW
FindWindowW
AdjustWindowRect
CopyRect
GetDC
GetWindowRect
GetSystemMetrics
EnableWindow
GetClientRect
SendMessageW
LoadMenuW
GetSubMenu
KillTimer
GetCursorPos
DrawIcon

gdi32

GetTextExtentExPointW

advapi32

RegQueryValueExW
ControlService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
CloseServiceHandle
RegOpenKeyExW
StartServiceW
RegCloseKey
RegSetValueExW

shell32

SHGetMalloc
SHGetPathFromIDListW
SHBrowseForFolderW
Shell_NotifyIconW

comctl32

InitCommonControlsEx

shlwapi

PathIsDirectoryW

oleaut32

VariantClear
SysAllocString
SysStringLen
SysAllocStringByteLen
SysFreeString

msvcp140

?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ

dbghelp

MakeSureDirectoryPathExists

vcruntime140

memmove
wcschr
wcsstr
_purecall
memset
__CxxFrameHandler3
__vcrt_InitializeCriticalSectionEx
_except_handler4_common
_CxxThrowException
memcpy
memcmp

api-ms-win-crt-runtime-l1-1-0

_initialize_wide_environment
_controlfp_s
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_exit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_invalid_parameter_noinfo_noreturn
_configure_wide_argv
_set_app_type
_seh_filter_exe
_errno
_invalid_parameter_noinfo

api-ms-win-crt-convert-l1-1-0

wcstol
_wtoi

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode
malloc
calloc
_recalloc

api-ms-win-crt-stdio-l1-1-0

_wfopen
__p__commode
fflush
fclose
fwrite
fread
ftell
fseek
_set_fmode
__stdio_common_vswprintf
__stdio_common_vsnwprintf_s

api-ms-win-crt-filesystem-l1-1-0

_waccess
_waccess_s

api-ms-win-crt-string-l1-1-0

wcsncpy
wcscpy_s
wcsncmp

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 205KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bd276205e7ddee1b8bbe8be81302c7e3

Headers

DLL Characteristics

File Characteristics

Imports

mfc140u

kernel32

user32

gdi32

advapi32

shell32

comctl32

shlwapi

oleaut32

msvcp140

dbghelp

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 205KB - Virtual size: 204KB

.rdata Size: 69KB - Virtual size: 68KB

.data Size: 2KB - Virtual size: 4KB

.gfids Size: 512B - Virtual size: 72B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 12KB - Virtual size: 12KB

.reloc Size: 15KB - Virtual size: 14KB

.text
Size: 205KB - Virtual size: 204KB

.rdata
Size: 69KB - Virtual size: 68KB

.data
Size: 2KB - Virtual size: 4KB

.gfids
Size: 512B - Virtual size: 72B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 12KB - Virtual size: 12KB

.reloc
Size: 15KB - Virtual size: 14KB