f9a4a15086cce89f73d44ae98c18e0802f8660e5d9b6338879a125be5682ccf9

Sharing

Copy URL Twitter E-mail

General

Target

f9a4a15086cce89f73d44ae98c18e0802f8660e5d9b6338879a125be5682ccf9
Size

220KB
MD5

9bcdba4d1df842284370fe5ada8a8409
SHA1

4adcacc54a671ec003752bf8aa5382a3cd4195ea
SHA256

f9a4a15086cce89f73d44ae98c18e0802f8660e5d9b6338879a125be5682ccf9
SHA512

eb014c6f44f21d6a2eb8b944c3176093619562969219676b1b8e0f49f1d19d3fa320bce9deb0470f0660e8ad9df38b0d57e5463214b0a810839a44c807012a03
SSDEEP

3072:UIA6TB83akGOmnvRNUdvRNU6O6TDIF80IIgMEmunEOIed0tr:66Tm3alnvfUdvfU6O6T8V4q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9a4a15086cce89f73d44ae98c18e0802f8660e5d9b6338879a125be5682ccf9

Files

f9a4a15086cce89f73d44ae98c18e0802f8660e5d9b6338879a125be5682ccf9
.exe windows:4 windows x86 arch:x86

a00cf413b690b7b875f850ef677ae4f1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc80

ord2714
ord4307
ord2835
ord2731
ord2537
ord5566
ord5213
ord5230
ord4568
ord3948
ord5226
ord5224
ord2931
ord1920
ord3832
ord5382
ord6219
ord5102
ord1010
ord3806
ord5583
ord2018
ord2063
ord4326
ord6276
ord3801
ord6278
ord4014
ord4038
ord3255
ord4486
ord2862
ord1599
ord1655
ord1656
ord1964
ord5175
ord1362
ord4967
ord3345
ord6277
ord3802
ord6279
ord1522
ord2172
ord2178
ord2405
ord2387
ord2385
ord2403
ord2415
ord2392
ord2408
ord2413
ord2396
ord2398
ord2400
ord2394
ord2410
ord2390
ord934
ord930
ord932
ord928
ord923
ord5233
ord5235
ord5960
ord1600
ord4282
ord4722
ord3403
ord4185
ord5073
ord1908
ord5152
ord4244
ord1402
ord3946
ord1617
ord1620
ord5915
ord6725
ord784
ord2657
ord4104
ord5807
ord2662
ord354
ord1063
ord1084
ord1794
ord3641
ord4580
ord1903
ord501
ord709
ord4749
ord347
ord602
ord1279
ord5727
ord6037
ord1966
ord4394
ord2654
ord4035
ord3952
ord3454
ord1188
ord3182
ord4262
ord5200
ord5203
ord6275
ord1401
ord5912
ord6724
ord1551
ord1670
ord1671
ord4890
ord4735
ord4212
ord5182
ord1482
ord2838
ord3584
ord562
ord751
ord3677
ord1651
ord2160
ord1962
ord5161
ord4966
ord2402
ord5202
ord6269
ord5145
ord1351
ord1345
ord4991
ord1352
ord2039
ord2077
ord2081
ord1912
ord3987
ord5355
ord3929
ord4198
ord6014
ord1595
ord2875
ord762
ord385
ord630
ord3056
ord3088
ord3684
ord572
ord563
ord3163
ord5214
ord2372
ord3691
ord1009
ord1948
ord4353
ord2368
ord1280
ord4888
ord3762
ord908
ord2468
ord5403
ord6703
ord299
ord1489
ord3997
ord4108
ord2272
ord2271
ord1486
ord2451
ord865
ord1793
ord1792
ord6236
ord1308
ord1123
ord2322
ord2176
ord907
ord3430
ord591
ord6065
ord6282
ord5924
ord6090
ord4125
ord4041
ord2021
ord2477
ord5738
ord5737
ord2899
ord2131
ord1117
ord1058
ord2055
ord2164
ord4234
ord1547
ord2089
ord4098
ord1483
ord1931
ord911
ord2867
ord754
ord416
ord651
ord3680
ord1930
ord1564
ord6754
ord6752
ord2370
ord2878
ord5868
ord2346
ord262
ord1580
ord3328
ord4100
ord2094
ord3244
ord1283
ord1955
ord1207
ord2540
ord2646
ord2533
ord3718
ord3719
ord3709
ord2644
ord3949
ord4481
ord4261
ord3333
ord1425
ord753
ord3204
ord3210
ord1934
ord620
ord5613
ord758
ord567
ord3401
ord3989
ord5731
ord2264
ord2075
ord6144
ord5833
ord1198
ord313
ord5331
ord6297
ord5320
ord1181
ord6286
ord6067
ord3761
ord2248
ord605
ord2020
ord6306
ord3110
ord5975
ord757
ord566
ord3683
ord4541
ord781
ord310
ord1092
ord1185
ord1187
ord297
ord578
ord304
ord266
ord265
ord764

msvcr80

__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
__dllonexit
_encode_pointer
_unlock
__CxxFrameHandler3
_controlfp_s
_mbslen
memmove_s
mbstowcs_s
_mbstok_s
strcpy_s
memset
memcpy_s
rand
_setmbcp
_strupr
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
?terminate@@YAXXZ
_except_handler4_common
fopen
fclose
sprintf
memcpy
srand
_time64
fprintf
vsprintf
fopen_s

kernel32

InterlockedExchange
GetLastError
GetLocaleInfoA
GetCurrentDirectoryA
SetLastError
GetModuleHandleA
lstrcpyA
InterlockedCompareExchange
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
WideCharToMultiByte
GetFileSize
CloseHandle
OpenFile
CreateDirectoryA
CopyFileA
GetLocalTime
FreeLibrary
Sleep
LoadLibraryA
GetACP
GetThreadLocale
GetVersionExA
GetProcAddress

user32

CreatePopupMenu
GetMenuItemCount
GetMenuDefaultItem
GetFocus
InvalidateRect
MessageBeep
GetAsyncKeyState
GetParent
GetWindowTextA
DrawEdge
DrawIcon
IsWindowEnabled
DestroyMenu
ScreenToClient
DestroyIcon
CopyRect
IsIconic
SendMessageA
LoadIconA
GetDlgCtrlID
EnableWindow
GetClientRect
PtInRect
SetWindowPos
GetCursorPos
GetKeyState
SetTimer
OffsetRect
KillTimer
InflateRect
GetSysColor
GetWindowRect
RedrawWindow
IsWindow
GetSystemMetrics

gdi32

CreateSolidBrush
GetObjectA
GetStockObject
CreateFontIndirectA

advapi32

RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegCloseKey

shell32

SHGetDesktopFolder
SHGetFileInfoA
SHGetMalloc
ExtractIconA
SHBrowseForFolderA
SHGetPathFromIDListA

comctl32

ImageList_GetImageInfo
ImageList_GetIcon

msvcp80

??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z

Sections

.text
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 140KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a00cf413b690b7b875f850ef677ae4f1

Headers

File Characteristics

Imports

mfc80

msvcr80

kernel32

user32

gdi32

advapi32

shell32

comctl32

msvcp80

Sections

.text Size: 52KB - Virtual size: 49KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 140KB - Virtual size: 137KB

.text
Size: 52KB - Virtual size: 49KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 140KB - Virtual size: 137KB