7d5542759df1889ad433cc24ad5836308071dbd43e9db92af13d23d14a0815d8

Sharing

Copy URL Twitter E-mail

General

Target

7d5542759df1889ad433cc24ad5836308071dbd43e9db92af13d23d14a0815d8
Size

564KB
MD5

db84d5b340393a1e9005f02db103ebaa
SHA1

b28f071b3b337c94b26531688b41167e1e7a29d5
SHA256

7d5542759df1889ad433cc24ad5836308071dbd43e9db92af13d23d14a0815d8
SHA512

c2b6198c1d12d6dc40366a31f1e0149271d50755aa511ae3b8561f244bf542d105758b709590b1724309b8dc0a8350847fae0aa6fa7cdf333f643a498054e5a1
SSDEEP

6144:cOtoccs7bUvhNbz5XbkZ+/paqaqpblD3wTW7Xe4Ohp6u9urP7omhoYkWyECbt:ch27behNF6+/2qpbh3wTWr8hUkQsW1O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7d5542759df1889ad433cc24ad5836308071dbd43e9db92af13d23d14a0815d8

Files

7d5542759df1889ad433cc24ad5836308071dbd43e9db92af13d23d14a0815d8
.exe windows:4 windows x86 arch:x86

bed38b65dc943663f2877580f1e54535

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wmvert

wm_CreateWindowFromTemplate
wm_NotifySys
wm_MsgBox
wm_BOr
wm_Right
wm_Len
wm_InStrRev
wm_PostMessage
wm_pstr
wm_ToInt
wm_Left
wm_GetCmdLine
wm_RpSubText
wm_InStr
wm_Split
wm_Destroy
wm_Run
wm_pbin
wm_GotoInternet
wm_Str
wm_GetTickCount
wm_Sleep
wm_Kill
wm_GetRunPath
wm_UpdateWindow

kernel32

lstrcmpA
GlobalUnlock
GlobalLock
GetModuleHandleA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetCurrentThreadId
lstrcatA
GetVersion
TlsAlloc
GlobalFree
GlobalHandle
GlobalReAlloc
GlobalAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
GlobalFlags
GetProcessVersion
GetCPInfo
GetOEMCP
GetStartupInfoA
GetCommandLineA
ExitProcess
RtlUnwind
RaiseException
GetSystemTime
GetLocalTime
GetACP
SetStdHandle
GetFileType
HeapSize
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
LCMapStringA
LCMapStringW
VirtualAlloc
IsBadWritePtr
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetModuleFileNameA
lstrcmpiA
GetProcAddress
FlushFileBuffers
SetFilePointer
WriteFile
GetCurrentProcess
LoadLibraryA
LocalAlloc
lstrcpyA
lstrcpynA
GetLastError
LocalFree
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
InterlockedDecrement
InterlockedIncrement
FreeLibrary
TerminateThread
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateThread
CloseHandle
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
GetTickCount
Sleep
SetLastError
GetTimeZoneInformation

user32

GrayStringA
IsWindowEnabled
GetNextDlgTabItem
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
LoadStringA
GetClassNameA
PtInRect
PostQuitMessage
LoadCursorA
GetSysColorBrush
DestroyMenu
ReleaseDC
GetDC
ClientToScreen
LoadIconA
MapWindowPoints
GetSysColor
GetFocus
SetFocus
AdjustWindowRectEx
GetClientRect
CopyRect
DrawTextA
GetTopWindow
MessageBoxA
GetParent
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetDlgItem
GetDlgCtrlID
GetKeyState
DestroyWindow
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
GetWindow
GetWindowLongA
SetWindowLongA
SetWindowPos
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindowTextA
GetSystemMetrics
EnableWindow
TabbedTextOutA
PeekMessageA
DispatchMessageA
PostMessageA
SetWindowTextA
SendMessageA

gdi32

SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteObject
GetDeviceCaps
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
CreateBitmap
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
GetObjectA
SetBkColor
SetTextColor
GetClipBox

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

comctl32

ord17

wsock32

WSAStartup
WSACleanup
select
closesocket
recv
send

wininet

InternetCloseHandle
InternetOpenA
InternetConnectA
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetSetOptionA

rasapi32

RasHangUpA
RasGetConnectStatusA

Sections

.text
Size: 100KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 420KB - Virtual size: 480KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bed38b65dc943663f2877580f1e54535

Headers

File Characteristics

Imports

wmvert

kernel32

user32

gdi32

winspool.drv

comctl32

wsock32

wininet

rasapi32

Sections

.text Size: 100KB - Virtual size: 97KB

.rdata Size: 20KB - Virtual size: 17KB

.data Size: 420KB - Virtual size: 480KB

.rsrc Size: 20KB - Virtual size: 19KB

.text
Size: 100KB - Virtual size: 97KB

.rdata
Size: 20KB - Virtual size: 17KB

.data
Size: 420KB - Virtual size: 480KB

.rsrc
Size: 20KB - Virtual size: 19KB