7a0b5db09162e445ad8579c0aa38e84964011605bd5022fdc6afab87deae0532

Sharing

Copy URL Twitter E-mail

General

Target

7a0b5db09162e445ad8579c0aa38e84964011605bd5022fdc6afab87deae0532
Size

781KB
MD5

6346646c85bfab84f43b16f7f1bd5125
SHA1

ac4e8b63dc370c54621da389cd90a112388904bc
SHA256

7a0b5db09162e445ad8579c0aa38e84964011605bd5022fdc6afab87deae0532
SHA512

1d264fab81ca80638ed9d1a576a16273a2f1054850e60febf3a9cf54db5f5bc9e5e2cd9eb0b4f770eb92032a148b82d97dd039ca46b45b51ac29af669e327317
SSDEEP

24576:+exIBn/xZBERL4118Buqrt5TI6QPDYuR4t:qZZBQVvuKt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7a0b5db09162e445ad8579c0aa38e84964011605bd5022fdc6afab87deae0532

Files

7a0b5db09162e445ad8579c0aa38e84964011605bd5022fdc6afab87deae0532
.exe windows:6 windows x86 arch:x86

a18138d1541c2a4b30ab25102332298a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

shlwapi

PathFileExistsA

ws2_32

freeaddrinfo
getaddrinfo
__WSAFDIsSet
ioctlsocket
ntohl
WSAIoctl
WSASetLastError
setsockopt
getsockopt
WSACleanup
ntohs
inet_ntoa
htonl
accept
bind
closesocket
gethostbyname
select
listen
getpeername
getsockname
gethostbyaddr
send
socket
connect
recvfrom
recv
htons
sendto
WSAGetLastError
WSAStartup
gethostname

advapi32

CryptAcquireContextA
CryptGenRandom
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptReleaseContext
CryptGetHashParam

crypt32

CertFindExtension
CertAddCertificateContextToStore
CryptQueryObject
PFXImportCertStore
CertCreateCertificateChainEngine
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertGetNameStringA
CryptDecodeObjectEx
CryptStringToBinaryA

wldap32

ord217
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord143
ord26
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord27

normaliz

IdnToAscii

kernel32

CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileAttributesExW
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
GetModuleFileNameW
ExitProcess
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
CreateFileW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
GetSystemTimeAsFileTime
GetTimeZoneInformation
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineW
GetEnvironmentStringsW
GetCurrentProcessId
FreeEnvironmentStringsW
SetEnvironmentVariableW
DeleteFileW
SetEndOfFile
FormatMessageA
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SizeofResource
HeapFree
SetLastError
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
OpenFile
lstrlenA
GetCurrentThreadId
lstrcatA
HeapSize
Sleep
GetLastError
CreateFileA
LockResource
DeleteFileA
lstrcpyA
HeapReAlloc
CloseHandle
RaiseException
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
DecodePointer
HeapDestroy
GetFileSize
DeleteCriticalSection
GetProcessHeap
WideCharToMultiByte
CreateDirectoryA
GetModuleFileNameA
FindFirstFileA
TerminateProcess
FindNextFileA
FindClose
CreateMutexA
lstrcmpA
OpenProcess
SetCurrentDirectoryA
GetCommandLineA
MultiByteToWideChar
LoadLibraryA
GetVersionExA
SetFileAttributesA
GetProcAddress
RemoveDirectoryA
FreeLibrary
LocalFree
WriteConsoleW
ReadFile
WriteFile
SetFileTime
SetFilePointer
GetCurrentDirectoryA
LocalFileTimeToFileTime
GetFileAttributesA
SystemTimeToFileTime
OutputDebugStringA
GetEnvironmentVariableA
InitializeCriticalSectionEx
SleepEx
VerSetConditionMask
QueryPerformanceFrequency
GetSystemDirectoryA
GetModuleHandleA
VerifyVersionInfoA
QueryPerformanceCounter
GetTickCount
MoveFileExA
WaitForSingleObjectEx
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
GetFileSizeEx
GetModuleHandleW
CreateEventW
ResetEvent
SetEvent
GetCPInfo
GetStringTypeW
LCMapStringEx
OutputDebugStringW
IsDebuggerPresent
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
GetCurrentProcess
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer

user32

UnregisterClassA
SendMessageA
GetWindow
GetWindowRect
SetWindowPos
MonitorFromWindow
MapWindowPoints
GetWindowLongA
SetWindowTextA
GetMonitorInfoA
GetClientRect
GetDlgItem
GetParent
EndDialog
DialogBoxParamA
wsprintfA
GetActiveWindow
MessageBoxA
SetWindowLongA

shell32

ShellExecuteExA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

winmm

timeGetTime

Sections

.text
Size: 563KB - Virtual size: 563KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a18138d1541c2a4b30ab25102332298a

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

ws2_32

advapi32

crypt32

wldap32

normaliz

kernel32

user32

shell32

version

winmm

Sections

.text Size: 563KB - Virtual size: 563KB

.rdata Size: 127KB - Virtual size: 126KB

.data Size: 9KB - Virtual size: 18KB

.rsrc Size: 54KB - Virtual size: 54KB

.reloc Size: 26KB - Virtual size: 25KB

.text
Size: 563KB - Virtual size: 563KB

.rdata
Size: 127KB - Virtual size: 126KB

.data
Size: 9KB - Virtual size: 18KB

.rsrc
Size: 54KB - Virtual size: 54KB

.reloc
Size: 26KB - Virtual size: 25KB