4816aabee71877c73920dc3ec2d022c840adb43eae703cb7c5f1b11f8d60a0d2

Sharing

Copy URL Twitter E-mail

General

Target

4816aabee71877c73920dc3ec2d022c840adb43eae703cb7c5f1b11f8d60a0d2
Size

4.8MB
MD5

f1832515bacbbe0087c6f47dc0abd3ba
SHA1

7d0c9dad59a9b600ea7b262814211f2c5f726353
SHA256

4816aabee71877c73920dc3ec2d022c840adb43eae703cb7c5f1b11f8d60a0d2
SHA512

cc3a88c9bcdaf6d953aa41786df5669dbeea1d86c28951ee2c673adc534726ae561e561624ad4612521863c9fecbcea90572947f5b5e3819aafa39eeae55a263
SSDEEP

49152:HyHSblCgkNNwiTMkLKqEtZ9XPHBZgvKTj/oyidKz+MZs3mU8gqoILWyHAU41wX:HyHSblCbNNwVksVPHBZgSTjog

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4816aabee71877c73920dc3ec2d022c840adb43eae703cb7c5f1b11f8d60a0d2

Files

4816aabee71877c73920dc3ec2d022c840adb43eae703cb7c5f1b11f8d60a0d2
.exe windows:6 windows x86 arch:x86

810d4727c82276e05a98d72926f18d38

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
FreeResource
LockResource
LoadResource
FindResourceW
LoadLibraryW
GetProcAddress
FreeLibrary
SetLastError
GetCommandLineW
FindNextFileW
FindClose
MultiByteToWideChar
GlobalFlags
GetSystemInfo
GetCurrentDirectoryW
SetCurrentDirectoryW
GetModuleHandleW
WideCharToMultiByte
VirtualQuery
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
ResetEvent
GetSystemTimeAsFileTime
OpenFileMappingW
UnmapViewOfFile
CreateFileMappingW
GlobalReAlloc
WriteConsoleW
HeapSize
FlushFileBuffers
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
LCMapStringW
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
GetFileType
SetFilePointerEx
DecodePointer
GetStdHandle
GetCommandLineA
GetModuleHandleExW
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
RaiseException
RtlUnwind
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
MulDiv
GlobalUnlock
GlobalLock
GlobalFree
SizeofResource
GlobalAlloc
LeaveCriticalSection
CreateFileW
GetLastError
ReadFile
WriteFile
IsDebuggerPresent
CreateEventW
SetThreadPriority
SetEvent
GetModuleFileNameW
CreateToolhelp32Snapshot
GetTempPathW
WritePrivateProfileStringW
GetPrivateProfileStringW
Sleep
ExitProcess
TryEnterCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
DeleteFileW
SetWaitableTimer
CreateWaitableTimerW
CreateThread
SetPriorityClass
GetCurrentProcess
GlobalSize
TerminateProcess
OpenProcess
GetCurrentProcessId
CloseHandle
Process32NextW
Process32FirstW
MapViewOfFile
SetEndOfFile

user32

keybd_event
GetWindowThreadProcessId
MonitorFromWindow
wsprintfW
GetCursorInfo
OpenClipboard
CloseClipboard
EmptyClipboard
EnumWindows
SetClipboardData
SystemParametersInfoW
GetWindowDC
ReleaseDC
GetPropW
MsgWaitForMultipleObjects
mouse_event
PeekMessageW
TranslateMessage
DispatchMessageW
GetForegroundWindow
GetWindowRect
LoadIconW
DestroyIcon
DestroyCursor
GetDC
GetFocus
GetActiveWindow
GetDesktopWindow
MessageBoxW
IsWindow
SetFocus
GetMessageW
GetSystemMetrics
LoadImageW
GetParent
EnumDisplaySettingsW
GetWindowLongW
SendMessageW
LoadStringW
LoadCursorW

gdi32

GetDIBits
GetSystemPaletteEntries
GetStockObject
CreatePalette
GetObjectW
SetStretchBltMode
GetDeviceCaps
DeleteDC
BitBlt
CreateDIBSection
CreateCompatibleDC
DeleteObject
RealizePalette
StretchBlt
SetDIBColorTable
CreateCompatibleBitmap
SelectPalette
SelectObject

advapi32

RegCreateKeyW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegSetValueExW

shell32

SHGetSpecialFolderPathW

ole32

CoInitializeEx
CreateStreamOnHGlobal
CoUninitialize

comctl32

ImageList_AddMasked
ImageList_Create
ImageList_Destroy

hpsocket_u

HP_Destroy_TcpPullClient
HP_Create_TcpPullClient

hid

HidD_GetHidGuid
HidD_SetFeature
HidD_GetFeature

psapi

EnumProcesses

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW

ws2_32

WSACleanup

gdiplus

GdipGetImageHeight
GdipGetImagePaletteSize
GdipCloneImage
GdipBitmapUnlockBits
GdipCreateBitmapFromStream
GdipAlloc
GdipDrawImageRectI
GdipDisposeImage
GdiplusStartup
GdipFree
GdipBitmapLockBits
GdipGetImageGraphicsContext
GdipGetImagePalette
GdipDeleteGraphics
GdipGetImageWidth
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdiplusShutdown
GdipGetImagePixelFormat
GdipSetCompositingMode

Sections

.text
Size: 689KB - Virtual size: 688KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 498KB - Virtual size: 497KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

810d4727c82276e05a98d72926f18d38

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

comctl32

hpsocket_u

hid

psapi

setupapi

ws2_32

gdiplus

Sections

.text Size: 689KB - Virtual size: 688KB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 12KB - Virtual size: 68KB

.vmp0 Size: 498KB - Virtual size: 497KB

.reloc Size: 61KB - Virtual size: 61KB

.rsrc Size: 1.8MB - Virtual size: 1.8MB

.text
Size: 689KB - Virtual size: 688KB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 12KB - Virtual size: 68KB

.vmp0
Size: 498KB - Virtual size: 497KB

.reloc
Size: 61KB - Virtual size: 61KB

.rsrc
Size: 1.8MB - Virtual size: 1.8MB