29c175475fe88cc16394952fbc97f8570d14fa3912a89d271d6e508155a456b8

Sharing

Copy URL Twitter E-mail

General

Target

29c175475fe88cc16394952fbc97f8570d14fa3912a89d271d6e508155a456b8
Size

144KB
MD5

05447807dfb81ebb69118fa6482ebd4f
SHA1

705042e97702f1aacaf9d41979e819602085152d
SHA256

29c175475fe88cc16394952fbc97f8570d14fa3912a89d271d6e508155a456b8
SHA512

c0119b932ff04ae1383ac2f7f583a43cf1e5317e1653f9b7ea4267637877ebe3d0db157e6d1f363053aef9c27dd92b0791ece9bb4782f706fa5bc13477eb9d64
SSDEEP

768:Flf6+Gf0PTltwgHkf+llGXo/etD2/1K6X2VypdOLWNktUHoiYY7oYbtaCwcTqYI4:z6+ZwgHkg/eN20bypGuID8cZcTqYH/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29c175475fe88cc16394952fbc97f8570d14fa3912a89d271d6e508155a456b8

Files

29c175475fe88cc16394952fbc97f8570d14fa3912a89d271d6e508155a456b8
.exe windows:4 windows x86 arch:x86

b9302e9dfe106215ea8c61d2ca8657d8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsA

mfc42

ord4622
ord4424
ord3738
ord561
ord815
ord2514
ord1232
ord2621
ord1134
ord641
ord656
ord825
ord1168
ord540
ord800
ord5265
ord4376
ord4853
ord4998
ord6052
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5280
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord4627
ord4425
ord3597
ord324
ord4234
ord2302
ord6215
ord3797
ord537
ord860
ord4287
ord4299
ord4160
ord4710
ord6199
ord535
ord3874
ord4080
ord3499
ord2515
ord5572
ord2915
ord538
ord355
ord755
ord470
ord1768
ord1175
ord4220
ord2584
ord3654
ord3663
ord2438
ord2863
ord1644
ord1146
ord2864
ord2379
ord6055
ord1776
ord5290
ord3402
ord3610
ord567
ord640
ord2414
ord2405
ord323
ord613
ord2450
ord289
ord6663
ord922
ord6648
ord6662
ord823
ord2764
ord924
ord1200
ord1158
ord3571
ord1576
ord1641
ord1640
ord5785
ord4396
ord3574
ord609
ord4275
ord4284
ord2859
ord5981
ord5875
ord5788
ord5787
ord3693
ord3573
ord2575
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord2725
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord4673
ord858
ord3626

msvcrt

_except_handler3
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_initterm
__getmainargs
_acmdln
_setmbcp
_adjust_fdiv
_controlfp
_XcptFilter
_exit
_onexit
exit
__dllonexit
_mbscmp
_iob
__CxxFrameHandler
strcpy
memset
strcat
_splitpath
fprintf

kernel32

GetShortPathNameA
GetWindowsDirectoryA
WinExec
OutputDebugStringA
GetLogicalDrives
GetModuleHandleA
GetStartupInfoA
GetCurrentProcess
GetLastError
GetProcAddress
LoadLibraryA
GetVersionExA
GetModuleFileNameA
GetPrivateProfileStringA
WritePrivateProfileStringA
LocalFree
WriteFile
GetStdHandle
GetDriveTypeA
SetSystemPowerState
FormatMessageA

user32

AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
ShowWindow
keybd_event
MapVirtualKeyA
FindWindowExA
LoadBitmapA
SystemParametersInfoA
GetWindowLongA
ReleaseCapture
PtInRect
CopyRect
InvalidateRect
SetCapture
GetFocus
LoadIconA
EnableWindow
GetParent
GetCapture
GetClientRect
IsIconic
GetSystemMenu
SendMessageA
LoadMenuA
InsertMenuA
GetSubMenu
AppendMenuA
DrawIcon
RegisterWindowMessageA
BringWindowToTop
SetForegroundWindow
ExitWindowsEx
LockWorkStation
GetSystemMetrics
GetCursorPos
FindWindowA
GetClassInfoA
TrackPopupMenu
GetSysColor

gdi32

RoundRect
CreateSolidBrush
CreatePen
BitBlt
CreateCompatibleDC
GetTextExtentPoint32A

advapi32

RegCloseKey
RegQueryValueExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA

shell32

Shell_NotifyIconA
ShellExecuteA
ShellExecuteExA
SHGetSpecialFolderLocation
SHGetMalloc

winmm

mixerOpen
mixerGetNumDevs
mixerSetControlDetails
mixerGetControlDetailsA
mixerClose
mixerGetLineInfoA
mixerGetLineControlsA
mciSendCommandA
mixerGetDevCapsA

msimg32

TransparentBlt

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b9302e9dfe106215ea8c61d2ca8657d8

Headers

File Characteristics

Imports

shlwapi

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

winmm

msimg32

Sections

.text Size: 28KB - Virtual size: 25KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 68KB - Virtual size: 68KB

.text
Size: 28KB - Virtual size: 25KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 68KB - Virtual size: 68KB