c4d110bed15a0d60938e26b0a299a83bc59b5a6e0c807c0952b694e628165881

Sharing

Copy URL Twitter E-mail

General

Target

c4d110bed15a0d60938e26b0a299a83bc59b5a6e0c807c0952b694e628165881
Size

692KB
MD5

f23618b86a5b8a78255e2d5e701110b4
SHA1

0fadddbd48e13f7ae3297e05202ed4afa3aa7df2
SHA256

c4d110bed15a0d60938e26b0a299a83bc59b5a6e0c807c0952b694e628165881
SHA512

eb18d32077f876041c91eb4e29d4ffc02ac6bdf982e1dce0c799680c3f904a866e49b5430e9293123d326cb6f92ae1368e9576906d81835b9f2bbc988e6b1880
SSDEEP

12288:Zx72xT921LPe0K0CLB+QbdP8oo1gTM4rFQROnatk1Y7+hZiPsUYh:j7igzCLB+Qbd3OiM4BQXtke7ZPsUY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c4d110bed15a0d60938e26b0a299a83bc59b5a6e0c807c0952b694e628165881

Files

c4d110bed15a0d60938e26b0a299a83bc59b5a6e0c807c0952b694e628165881
.exe windows:6 windows x86 arch:x86

6ebc28cda2ff7ffcd77dc3d900b9a6a9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

gethostbyname
getpeername
socket
setsockopt
sendto
select
recvfrom
getsockopt
send
WSACloseEvent
WSACreateEvent
WSAGetLastError
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
ntohs
WSASetLastError
inet_ntop
WSACleanup
WSAIoctl
htons
inet_pton
__WSAFDIsSet
accept
bind
connect
getsockname
htonl
listen
recv
getaddrinfo
freeaddrinfo
ioctlsocket
closesocket
gethostname
WSAStartup

kernel32

HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
ReleaseMutex
WaitForSingleObject
Sleep
CreateThread
GetSystemTime
FindResourceExW
FreeLibrary
GetModuleFileNameA
GetModuleHandleW
LoadResource
LockResource
SizeofResource
FindResourceW
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
SystemTimeToFileTime
MultiByteToWideChar
WideCharToMultiByte
VirtualAlloc
VirtualFree
GetModuleHandleA
LoadLibraryA
GetTickCount
CreateMutexA
GetSystemInfo
GetVersionExW
GetComputerNameA
FindFirstFileExW
FindClose
GetFullPathNameW
GetCurrentDirectoryW
SetEndOfFile
SetStdHandle
GetTimeZoneInformation
FlushFileBuffers
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetConsoleOutputCP
HeapAlloc
GetConsoleMode
WriteFile
SetFilePointerEx
FreeLibraryAndExitThread
OutputDebugStringW
ReadFile
GetFileSize
CreateFileA
GetCommandLineW
LoadLibraryW
GetProcAddress
GetModuleFileNameW
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
GetFileAttributesExW
GetModuleHandleExW
ExitProcess
LoadLibraryExW
TlsFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLastError
SetUnhandledExceptionFilter
CloseHandle
CreateFileW
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetCPInfo
HeapDestroy
WriteConsoleW
DeleteFileW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
DecodePointer
ReadConsoleW
GetACP
IsValidCodePage
GetStringTypeW
EncodePointer
RaiseException
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
GetFileSizeEx
VerifyVersionInfoW
VerSetConditionMask
SleepEx
WaitForMultipleObjects
PeekNamedPipe
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExW
GetSystemDirectoryW
QueryPerformanceFrequency
QueryPerformanceCounter
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SetLastError
FormatMessageW
FindNextFileW

user32

IsIconic
BringWindowToTop
SetTimer
SetForegroundWindow
GetCursorPos
GetWindowLongW
IsWindowVisible
LoadIconW
DestroyIcon
wsprintfA
SetActiveWindow
GetParent
FindWindowExW
SetWindowPos
ShowWindow
PostMessageW
DispatchMessageW
TranslateMessage
GetMessageW
SetWindowLongW
wsprintfW

advapi32

CryptEncrypt
CryptImportKey
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash

shell32

ShellExecuteW
ShellExecuteExW
Shell_NotifyIconW

shlwapi

PathRemoveFileSpecW
PathRemoveFileSpecA

crypt32

CertCloseStore
CertOpenStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptStringToBinaryW
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringW
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertEnumCertificatesInStore

ldip

OpenVpn_GetDrvState
OpenVpn_IsNeedDisabledIface
OpenVpn_Stop
OpenVpn_Release
OpenVpn_Init
OpenVpn_Connect
OpenVpn_GetIfaceCount

iphlpapi

GetAdaptersInfo

bcrypt

BCryptGenRandom

Sections

.text
Size: 520KB - Virtual size: 519KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6ebc28cda2ff7ffcd77dc3d900b9a6a9

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

advapi32

shell32

shlwapi

crypt32

ldip

iphlpapi

bcrypt

Sections

.text Size: 520KB - Virtual size: 519KB

.rdata Size: 109KB - Virtual size: 109KB

.data Size: 4KB - Virtual size: 37KB

.rsrc Size: 35KB - Virtual size: 34KB

.reloc Size: 23KB - Virtual size: 22KB

.text
Size: 520KB - Virtual size: 519KB

.rdata
Size: 109KB - Virtual size: 109KB

.data
Size: 4KB - Virtual size: 37KB

.rsrc
Size: 35KB - Virtual size: 34KB

.reloc
Size: 23KB - Virtual size: 22KB