a80b7883ab606bce405583401d68304d4f29e89e3fe60bccb4de78d423bfd12c

Sharing

Copy URL Twitter E-mail

General

Target

a80b7883ab606bce405583401d68304d4f29e89e3fe60bccb4de78d423bfd12c
Size

325KB
MD5

0a442d80db7197d0f0f943ed61a69706
SHA1

63cf797842264f901fe94a542aa0b36df1b1f385
SHA256

a80b7883ab606bce405583401d68304d4f29e89e3fe60bccb4de78d423bfd12c
SHA512

5be35d1eceb42d026cc6e35a9e8d5f865646cf7dd5722bfddd1e7d0c22ec976ca3272725c768c1577ca1755dce3b333c75b7f7dc06af7180f0991d9a39289888
SSDEEP

6144:zeucHeX5iVuyA9K/lWC3z7IdMuF3l3+0Jutz:zeM4Yy+8dg33Jwz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a80b7883ab606bce405583401d68304d4f29e89e3fe60bccb4de78d423bfd12c

Files

a80b7883ab606bce405583401d68304d4f29e89e3fe60bccb4de78d423bfd12c
.exe windows:5 windows x86 arch:x86

94b9738be77131138a59038e8f1257b1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
lstrcmpW
MulDiv
GlobalLock
GlobalUnlock
OutputDebugStringA
SetLastError
lstrlenA
GetCurrentProcessId
TerminateProcess
lstrlenW
LoadLibraryW
GetModuleFileNameA
GetLongPathNameA
GetFullPathNameA
LoadLibraryA
FlushInstructionCache
GetCurrentThreadId
GetSystemTimeAsFileTime
QueryPerformanceCounter
EncodePointer
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
InterlockedPushEntrySList
FreeLibrary
InitializeSListHead
GetProcessHeap
HeapFree
HeapAlloc
OutputDebugStringW
IsDebuggerPresent
GetLongPathNameW
Sleep
InterlockedCompareExchange
CloseHandle
WinExec
lstrcatW
lstrcpynW
CreateProcessW
LoadLibraryExW
lstrcmpiW
GetModuleFileNameW
DecodePointer
InterlockedDecrement
InterlockedIncrement
GetModuleHandleW
GetProcAddress
FindResourceW
SizeofResource
LoadResource
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
WideCharToMultiByte
MultiByteToWideChar
InterlockedPopEntrySList
GlobalAlloc

user32

FindWindowExW
PostQuitMessage
MessageBoxW
GetMessageW
DispatchMessageW
TranslateMessage
SetTimer
LoadAcceleratorsW
KillTimer
TranslateAcceleratorW
EndPaint
CreateAcceleratorTableW
ReleaseCapture
DefWindowProcW
RegisterWindowMessageW
CallWindowProcW
CharNextW
UnregisterClassW
SetWindowLongW
GetWindowLongW
CreateWindowExW
DestroyWindow
SendMessageW
SetForegroundWindow
AllowSetForegroundWindow
WindowFromPoint
GetCursorPos
IsRectEmpty
FindWindowW
GetWindowThreadProcessId
IsWindowVisible
ShowWindow
GetWindowRect
BringWindowToTop
IsIconic
PostMessageW
GetDC
ReleaseDC
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
MoveWindow
SetWindowPos
GetClientRect
ClientToScreen
InvalidateRect
ScreenToClient
GetDesktopWindow
FillRect
GetFocus
DestroyAcceleratorTable
GetSysColor
RegisterClassExW
LoadCursorW
GetClassInfoExW
GetClassNameW
IsWindow
GetDlgItem
GetParent
IsChild
GetWindow
SetFocus
SetCapture
RedrawWindow
InvalidateRgn
BeginPaint

gdi32

GetObjectW
GetStockObject
DeleteDC
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
CreateSolidBrush
DeleteObject
GetDeviceCaps
SelectObject

advapi32

RegQueryValueW
RegQueryValueExW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW

ole32

OleInitialize
OleUninitialize
CoGetClassObject
CLSIDFromProgID
CreateStreamOnHGlobal
CLSIDFromString
CoInitialize
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoTaskMemRealloc
CoTaskMemAlloc
OleLockRunning

oleaut32

LoadTypeLi
SysFreeString
SysAllocString
SysStringLen
VariantInit
VariantClear
VarUI4FromStr
LoadRegTypeLi
OleCreateFontIndirect
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen

msvcp120

?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ

shlwapi

PathIsRelativeW
PathRemoveFileSpecW
PathAddBackslashW
PathAppendW
PathCanonicalizeW

msvcr120

_wcsnicmp
_CxxThrowException
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
_except_handler4_common
_commode
_fmode
_wcmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__crtGetShowWindowMode
_XcptFilter
__CxxFrameHandler3
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
??1type_info@@UAE@XZ
memset
wcscpy_s
_vsnwprintf_s
memcpy
??8type_info@@QBE_NABV0@@Z
_wtol
iswspace
wcschr
strncpy_s
??3@YAXPAX@Z
malloc
free
memcpy_s
wcsncpy_s
_wcslwr_s
??_V@YAXPAX@Z
wcsstr
??2@YAPAXI@Z
_recalloc
swprintf_s
memmove
?terminate@@YAXXZ
_purecall
calloc
_wtoi64

winmm

timeGetTime

ws2_32

htons
htonl
ntohl

shell32

ShellExecuteW

Sections

.text
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 9KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 86KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

94b9738be77131138a59038e8f1257b1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

msvcp120

shlwapi

msvcr120

winmm

ws2_32

shell32

Sections

.text Size: 138KB - Virtual size: 137KB

.rdata Size: 31KB - Virtual size: 31KB

.data Size: 9KB - Virtual size: 11KB

.rsrc Size: 49KB - Virtual size: 48KB

.reloc Size: 86KB - Virtual size: 88KB

.text
Size: 138KB - Virtual size: 137KB

.rdata
Size: 31KB - Virtual size: 31KB

.data
Size: 9KB - Virtual size: 11KB

.rsrc
Size: 49KB - Virtual size: 48KB

.reloc
Size: 86KB - Virtual size: 88KB