efeec56ecba85233c223ed1198fa75c7

Sharing

Copy URL

Twitter E-mail

General

Target

efeec56ecba85233c223ed1198fa75c7
Size

5.2MB
MD5

efeec56ecba85233c223ed1198fa75c7
SHA1

c714a42107633c1eb501faa1ac7cea185d032a76
SHA256

214fff42b53366c42fa290d551a6e2900dda1e34822a409df1fcdc8c16bc41c0
SHA512

98cac999fde879e41879b1b83d119ea9f165dce9d2ccc201c448230e7e31576e2868f5133438c1620bb32599fe622ef5c7290c374623be8673aefd54068c209e
SSDEEP

98304:qX9fUlnLZFhtwBikE/E5ggkuuARgFoWwaJ0+t57MTeNBi2GwzQpVUHBw7foq:uXE/AWwwrg04UHy7foq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
efeec56ecba85233c223ed1198fa75c7

Files

efeec56ecba85233c223ed1198fa75c7
.exe windows:5 windows x86 arch:x86

87f4ff6f7a60e249f00c15a17f6cd399

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WideCharToMultiByte
GetModuleHandleW
CreateProcessW
ExitProcess
DeleteCriticalSection
GetProcAddress
DecodePointer
GetCurrentDirectoryW
FindResourceW
LoadResource
GetSystemInfo
RaiseException
CloseHandle
Process32FirstW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExA
GetFileAttributesExW
Process32NextW
GetLastError
Sleep
GetPrivateProfileStringW
MultiByteToWideChar
CreateToolhelp32Snapshot
OpenProcess
GetModuleHandleA
GetSystemDirectoryW
GetFileAttributesW
WaitForSingleObject
GetTempPathW
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
TerminateProcess
GetPrivateProfileIntW
GetCurrentProcess
WritePrivateProfileStringW
SetEndOfFile
GetFullPathNameW
SetStdHandle
HeapSize
GetProcessHeap
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleCP
ReadConsoleW
GetACP
WriteConsoleW
GetModuleFileNameA
SetConsoleMode
ReadConsoleInputA
GetConsoleMode
GetTimeZoneInformation
SetConsoleCtrlHandler
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
SetFilePointerEx
HeapFree
HeapReAlloc
HeapAlloc
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
InterlockedPushEntrySList
RtlUnwind
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
SetEvent
InitializeSListHead
VirtualQueryEx
SetThreadContext
VirtualFreeEx
CreateRemoteThread
ReadProcessMemory
SizeofResource
CreateDirectoryW
VirtualAllocEx
GetThreadContext
VirtualProtectEx
WriteProcessMemory
IsWow64Process
GetNativeSystemInfo
EnterCriticalSection
LeaveCriticalSection
SetLastError
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThread
VerifyVersionInfoA
LoadLibraryA
VerSetConditionMask
FreeLibrary
SleepEx
InitializeCriticalSection
FormatMessageA
ExpandEnvironmentStringsA
ReadFile
GetStdHandle
WaitForMultipleObjects
PeekNamedPipe
GetFileType
GetCurrentThreadId
GetVersion
FindNextFileA
FindClose
GetVersionExA
GetCurrentProcessId
GlobalMemoryStatus
FlushConsoleInputBuffer
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
IsDebuggerPresent
OutputDebugStringW
ResumeThread
LocalFree
CreateActCtxW
WriteFile
CreateFileW
DeleteFileW
GetTempFileNameW
CreateFileMappingW
ReleaseActCtx
ActivateActCtx
GetEnvironmentVariableW
DeactivateActCtx
Module32FirstW
GetWindowsDirectoryW
ResetEvent
QueueUserAPC
EncodeSystemPointer
DeviceIoControl
Thread32Next
Thread32First
CreateNamedPipeW
TerminateThread
CreateThread
SuspendThread
GetExitCodeThread
OpenThread

user32

MapWindowPoints
MessageBoxW
SetWindowPos
DestroyWindow
GetWindowRect
DefWindowProcW
GetMessageW
GetWindowLongW
CreateWindowExW
SendMessageW
GetSystemMetrics
SetWindowTextW
GetProcessWindowStation
GetWindowTextW
EnableWindow
InvalidateRect
UpdateWindow
PostQuitMessage
DrawTextW
GetClientRect
SetWindowLongW
SendMessageA
LoadCursorW
TranslateMessage
SetLayeredWindowAttributes
IsDlgButtonChecked
FillRect
IsDialogMessageW
RedrawWindow
DispatchMessageW
ShowWindow
RegisterClassExW
wsprintfW
FindWindowA
MessageBoxA
GetUserObjectInformationW
GetDesktopWindow

gdi32

SetBkMode
RoundRect
SetTextColor
DeleteDC
CreatePatternBrush
GetStockObject
CreateFontW
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
AddFontMemResourceEx
CreatePen
CreateSolidBrush
DeleteObject

advapi32

LookupPrivilegeValueW
RegEnumValueW
RegSetValueExW
RegOpenKeyW
RegQueryValueExW
RegCloseKey
AdjustTokenPrivileges
OpenProcessToken
OpenThreadToken
DeregisterEventSource
ReportEventA
RegisterEventSourceA
RegCreateKeyW
ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

ord680
ShellExecuteW
SHGetFolderPathW

wsock32

recv
send
setsockopt
htons
getsockopt
connect
ntohs
socket
getsockname
getpeername
WSAStartup
closesocket
bind
select
__WSAFDIsSet
inet_ntoa
sendto
recvfrom
listen
accept
htonl
ntohl
gethostname
shutdown
WSACleanup
WSASetLastError
WSAGetLastError

wldap32

ord35
ord301
ord22
ord32
ord46
ord26
ord27
ord30
ord200
ord79
ord33
ord41
ord60
ord143
ord50
ord211

ws2_32

WSAIoctl
freeaddrinfo
getaddrinfo

iphlpapi

GetAdaptersInfo

ole32

CoCreateInstance
CoUninitialize
CoInitialize

shlwapi

SHDeleteKeyW

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 379KB - Virtual size: 379KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.9MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 377KB - Virtual size: 377KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

87f4ff6f7a60e249f00c15a17f6cd399

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

wsock32

wldap32

ws2_32

iphlpapi

ole32

shlwapi

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 379KB - Virtual size: 379KB

.data Size: 2.9MB - Virtual size: 3.0MB

.rsrc Size: 377KB - Virtual size: 377KB

.reloc Size: 80KB - Virtual size: 79KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 379KB - Virtual size: 379KB

.data
Size: 2.9MB - Virtual size: 3.0MB

.rsrc
Size: 377KB - Virtual size: 377KB

.reloc
Size: 80KB - Virtual size: 79KB