b30000[.]a[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

b30000.a.exe
Size

3.7MB
MD5

876c972cc2f67e340167484ebe3efa13
SHA1

4c92b9fe7a88518099f77bc898355a9639f26109
SHA256

397204dbab320875fb52cffbc4be9980f86f28d837f3771d739ea860cefda688
SHA512

8ccd5cad30717e57a9a84f8948005dce2477e1c2ffc72c9bb2d6895f3cc78fcf1d9815bb2529059d47be14afd350bf5259e073966deec8b04b089314e4d0b148
SSDEEP

98304:6+zyz4IYrq8kHa0SqIXbgRYjOFzdSs5+clbm5dbiZ0+PX:PWzTYm8kHa0SxXbg6jOFHS5dbiG2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b30000.a.exe

Files

b30000.a.exe
.exe windows:6 windows x86 arch:x86

ec09e205fb1f6f140cf07d7b008f8bc4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineW
SetFileApisToOEM
GetProcessTimes
GetConsoleScreenBufferInfo
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
CompareFileTime
OpenEventW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetProcessAffinityMask
VirtualAlloc
VirtualFree
GetFileInformationByHandle
GetCurrentThreadId
MoveFileW
GetLogicalDriveStringsW
SetEndOfFile
LoadLibraryExW
SetEvent
ResetEvent
IsProcessorFeaturePresent
GetVersion
GlobalMemoryStatus
GetConsoleMode
SetConsoleMode
FileTimeToSystemTime
GetOEMCP
GetDiskFreeSpaceW
GetDriveTypeW
GetStdHandle
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
IsValidCodePage
FindFirstFileExW
GetFullPathNameW
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
SetStdHandle
GetTimeZoneInformation
GetConsoleOutputCP
ReadConsoleW
SetFilePointerEx
FreeLibraryAndExitThread
ExitThread
SystemTimeToTzSpecificLocalTime
GetFileAttributesExW
GetModuleHandleExW
RtlUnwind
GetModuleHandleA
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
VerSetConditionMask
SleepEx
GetEnvironmentVariableA
WaitForMultipleObjects
WaitForSingleObjectEx
MoveFileExW
SetLastError
FreeLibrary
VerifyVersionInfoW
GetFileType
PeekNamedPipe
GetSystemDirectoryW
QueryPerformanceFrequency
LeaveCriticalSection
EnterCriticalSection
QueryPerformanceCounter
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetACP
ExitProcess
SetFileTime
SetFilePointer
LocalFileTimeToFileTime
GetFileAttributesW
GetCurrentDirectoryW
InitializeCriticalSectionAndSpinCount
lstrcpyW
MulDiv
lstrcpynW
CreateMutexW
IsBadCodePtr
CreateEventW
FreeResource
FormatMessageW
K32GetDeviceDriverBaseNameA
K32EnumDeviceDrivers
OutputDebugStringW
SetFileAttributesW
GetTickCount
GetCurrentProcessId
GetLocalTime
GetSystemTime
SystemTimeToFileTime
LocalFree
lstrlenW
GetExitCodeProcess
GlobalUnlock
lstrcmpiW
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
GetFileSize
GlobalLock
GetCPInfo
GetProcAddress
SetCurrentDirectoryW
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
LoadResource
FindResourceExW
CreateThread
LoadLibraryW
GetSystemInfo
RaiseException
CloseHandle
HeapReAlloc
Process32FirstW
DeleteFileW
GlobalAlloc
LockResource
GetSystemDirectoryA
Process32NextW
GetLastError
GetDiskFreeSpaceA
Sleep
CreateToolhelp32Snapshot
HeapSize
OpenProcess
CreateFileW
WaitForSingleObject
FindClose
InitializeCriticalSectionEx
GetTempPathW
GetProcessId
GetModuleFileNameW
RemoveDirectoryW
TerminateProcess
DeviceIoControl
WriteFile
GetCurrentProcess
FindNextFileW
MultiByteToWideChar
HeapFree
GetFileSizeEx
FindFirstFileW
SizeofResource
ReadFile
CreateDirectoryW
WideCharToMultiByte
LoadLibraryA
GetProcAddress
GetLastError
FreeLibrary
InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleW
TerminateProcess
GetCurrentProcess
DeleteCriticalSection
LoadLibraryW
CreateEventW
CompareStringW
SetLastError
GetModuleHandleA
VirtualProtect
GetTickCount
EnterCriticalSection
LeaveCriticalSection
VirtualFree
VirtualAlloc
WriteProcessMemory
CreateToolhelp32Snapshot
GetCurrentProcessId
GetCurrentThreadId
Thread32First
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
GetSystemInfo
LoadResource
MultiByteToWideChar
WideCharToMultiByte
FindResourceExW
FindResourceExA
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
HeapAlloc
HeapFree
HeapDestroy
HeapCreate
GetSystemTime
GetLocalTime
SystemTimeToFileTime
CompareFileTime
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameA
RaiseException
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
RtlUnwind
HeapSize
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
VirtualQuery
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetActiveWindow
IsWindowVisible
IsRectEmpty
UpdateWindow
LoadImageW
GetWindow
GetPropW
SetPropW
GetClassInfoExW
RegisterClassW
CallWindowProcW
DispatchMessageW
TranslateMessage
GetMessageW
UnionRect
InflateRect
ScreenToClient
GetWindowRgn
UpdateLayeredWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
GetKeyState
EqualRect
ReleaseDC
GetDC
SetCapture
ReleaseCapture
KillTimer
GetUpdateRect
GetCursorPos
GetSysColor
CharPrevW
SetRect
CreateAcceleratorTableW
InvalidateRgn
GetCaretBlinkTime
CreatePopupMenu
DestroyMenu
EnableMenuItem
AppendMenuW
wsprintfW
CharLowerW
CharLowerA
GetClassNameW
EnumWindows
TrackPopupMenu
CreateCaret
HideCaret
ShowCaret
GetCaretPos
CharUpperW
CharPrevExA
GetWindowTextW
ClientToScreen
GetGUIThreadInfo
IsWindowEnabled
SendMessageW
PostMessageW
MonitorFromPoint
GetWindowTextLengthW
PostQuitMessage
SetTimer
ShowWindow
MessageBoxW
IsZoomed
MoveWindow
GetWindowRect
FindWindowA
LoadIconW
wsprintfA
DrawTextA
IntersectRect
CharNextW
GetMonitorInfoW
MonitorFromWindow
GetKeyboardLayout
DefWindowProcW
IsWindow
SetWindowPos
SetFocus
GetKeyNameTextW
MapVirtualKeyExW
EnableWindow
DrawTextW
BeginPaint
EndPaint
InvalidateRect
SetWindowTextW
GetClientRect
SetCursor
SetCaretPos
FillRect
LoadCursorW
GetFocus
GetParent
OffsetRect
PtInRect
IsIconic
SetForegroundWindow
SetWindowRgn
MapWindowPoints
GetWindowLongW
SetWindowLongW
MessageBoxW
CharUpperBuffW

gdi32

TextOutW
MoveToEx
GetObjectA
ExtSelectClipRgn
SelectClipRgn
GetTextExtentPointA
SelectObject
SetBkColor
SetBkMode
SetTextColor
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
GetBitmapBits
RestoreDC
SaveDC
SetBitmapBits
StretchBlt
SetStretchBltMode
GetObjectW
GdiFlush
GetTextExtentPoint32W
CreateRoundRectRgn
GetDeviceCaps
CreateRectRgn
DeleteDC
PtInRegion
CreateDIBSection
BitBlt
CreateDIBitmap
CreateFontIndirectW
CreatePen
GetStockObject
AddFontMemResourceEx
RemoveFontMemResourceEx
Rectangle
CloseEnhMetaFile
CreateEnhMetaFileW
GetEnhMetaFileHeader
GetTextMetricsW
SetWindowOrgEx
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
CreatePatternBrush
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
GetDIBits
PlayEnhMetaFile
LineTo

advapi32

GetTokenInformation
GetUserNameW
ConvertSidToStringSidW
RegOpenKeyExW
SetFileSecurityW
GetFileSecurityW
CryptEncrypt
CryptImportKey
CryptDestroyKey
RegQueryValueExW
RegEnumKeyExA
CreateServiceW
DeleteService
ControlService
StartServiceW
CloseServiceHandle
OpenSCManagerW
OpenServiceW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExA
SetEntriesInAclW
RegFlushKey
SetSecurityInfo
RegEnumValueW
GetSecurityInfo
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
RegDeleteKeyW
AllocateAndInitializeSid
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
OpenProcessToken
FreeSid
CheckTokenMembership

shell32

SHChangeNotify
SHCreateItemFromParsingName
SHGetFolderPathW
DragQueryFileW
ord190
ShellExecuteW
SHGetSpecialFolderPathW
ShellExecuteExW

ole32

OleLockRunning
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
DoDragDrop
CoInitialize
ReleaseStgMedium
OleDuplicateData
CoUninitialize
CoInitializeEx
CoCreateInstance

oleaut32

VariantCopy
SysAllocStringLen
SysStringLen
VariantClear
VariantInit
SysFreeString
SysAllocString

shlwapi

PathRemoveExtensionW
PathFileExistsW

propsys

PSGetPropertyKeyFromName

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW
WTSQuerySessionInformationW

bcrypt

BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptCreateHash
BCryptGenRandom
BCryptOpenAlgorithmProvider

crypt32

CryptBinaryToStringW

wldap32

ord133
ord79
ord142
ord301
ord127
ord27
ord26
ord117
ord41
ord208
ord216
ord14
ord46
ord219
ord145
ord147
ord167

ws2_32

inet_addr
WSAEventSelect
WSAStartup
ntohs
WSAWaitForMultipleEvents
recvfrom
ioctlsocket
getpeername
freeaddrinfo
getaddrinfo
recv
listen
htonl
getsockname
connect
bind
accept
select
__WSAFDIsSet
WSAIoctl
setsockopt
WSASetLastError
WSAGetLastError
closesocket
WSAResetEvent
WSACreateEvent
send
getsockopt
gethostname
gethostbyname
WSACleanup
socket
ntohl
sendto
htons
WSAEnumNetworkEvents
WSACloseEvent

iphlpapi

GetAdaptersAddresses
GetAdaptersInfo

comctl32

_TrackMouseEvent
ord17
InitCommonControlsEx

gdiplus

GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipCreateHBITMAPFromBitmap
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipSetPenMode
GdipDeletePen
GdipCreateBitmapFromScan0
GdipFillRectangleI
GdipDeleteBrush
GdipCloneBrush
GdipAddPathArc
GdipAddPathLine
GdipDeletePath
GdipCreatePath
GdipFree
GdipAlloc
GdiplusShutdown
GdiplusStartup
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipDrawImageRectI
GdipDeleteGraphics
GdipCreateFromHDC
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipFillPath
GdipDrawRectangleI
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipBitmapUnlockBits
GdipCreateSolidFill
GdipBitmapLockBits
GdipCreatePen1
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipDrawPath

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 308KB - Virtual size: 308KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fwp0
Size: 672KB - Virtual size: 672KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fwp1
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 528KB - Virtual size: 528KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec09e205fb1f6f140cf07d7b008f8bc4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

propsys

wtsapi32

bcrypt

crypt32

wldap32

ws2_32

iphlpapi

comctl32

gdiplus

imm32

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 308KB - Virtual size: 308KB

.data Size: 56KB - Virtual size: 56KB

.fwp0 Size: 672KB - Virtual size: 672KB

.fwp1 Size: 68KB - Virtual size: 68KB

.reloc Size: 92KB - Virtual size: 92KB

.rsrc Size: 528KB - Virtual size: 528KB

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 308KB - Virtual size: 308KB

.data
Size: 56KB - Virtual size: 56KB

.fwp0
Size: 672KB - Virtual size: 672KB

.fwp1
Size: 68KB - Virtual size: 68KB

.reloc
Size: 92KB - Virtual size: 92KB

.rsrc
Size: 528KB - Virtual size: 528KB