151619f4ce85c3dd9631099e3686600e

Sharing

Copy URL Twitter E-mail

General

Target

151619f4ce85c3dd9631099e3686600e
Size

19.0MB
MD5

151619f4ce85c3dd9631099e3686600e
SHA1

19691abf4f20489287c9c54bb575ac66c3502b2e
SHA256

5bffea0abb0bb5d5d9a5e15054137596c5c0d278387cd93902ba4ce05b9c333d
SHA512

55a359af5536081ec84fc72b3d092634cadc25b6ad6ee36334e13921ece2110c752fd773cfa1c01608480b73d068af79594479f85cdb34d15a5eecf480f60e6e
SSDEEP

393216:YbfsuH+cYtsuvRJrjANbfA5a2ShWP/YpzGq03pb495Zqymx3cMRrc3ck89:YWcYmkJrMJfx2SgP/YApy0Xs+rcskU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
151619f4ce85c3dd9631099e3686600e

Files

151619f4ce85c3dd9631099e3686600e
.exe windows:5 windows x86 arch:x86

e416601731d54ae3f3ef0fb7b305f4be

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msimg32

AlphaBlend

kernel32

LockResource
SizeofResource
Sleep
GetTickCount
GetModuleHandleW
OutputDebugStringW
LoadResource
FindResourceW
GetCommandLineW
ExitThread
FlushFileBuffers
GetProcessHeap
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetCurrentDirectoryA
GetFullPathNameA
SetStdHandle
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
HeapSize
HeapCreate
GetStartupInfoA
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
LCMapStringW
LCMapStringA
GetCPInfo
RaiseException
FindFirstFileA
GetDriveTypeA
GetUserDefaultLangID
GetVersionExW
LoadLibraryW
GetProcAddress
FreeLibrary
GetCurrentProcess
GetCurrentThread
GetLastError
LocalAlloc
CloseHandle
LocalFree
FreeResource
FindResourceExW
LoadLibraryExW
SetLastError
GetDiskFreeSpaceW
CreateFileW
GetCurrentProcessId
InterlockedIncrement
LoadLibraryA
GetCurrentThreadId
CreateThread
WaitForSingleObject
InterlockedDecrement
OutputDebugStringA
IsDebuggerPresent
SetUnhandledExceptionFilter
lstrcpynA
VirtualQuery
GetModuleFileNameA
CreateToolhelp32Snapshot
Thread32First
Thread32Next
OpenThread
SuspendThread
GetThreadContext
ResumeThread
IsBadWritePtr
GetLocalTime
WriteFile
GetVersion
GetExitCodeProcess
TerminateProcess
CreateDirectoryW
GetFileAttributesW
CreateProcessW
GetModuleFileNameW
FindFirstFileW
FindClose
GetComputerNameW
IsBadReadPtr
GetModuleHandleA
VirtualFree
VirtualAlloc
Module32FirstW
Module32NextW
FormatMessageA
CreateFileA
ReadFile
GetFileSizeEx
GetFileSize
GetFileAttributesExW
SetCurrentDirectoryW
GetCurrentDirectoryW
FindNextFileW
GetFullPathNameW
GetShortPathNameW
GetDiskFreeSpaceExW
SetFilePointer
MoveFileW
RemoveDirectoryW
SetEndOfFile
SetFileTime
SetFileAttributesW
DeleteFileW
GetSystemInfo
WideCharToMultiByte
InterlockedCompareExchange
CreateEventW
SetEvent
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
MultiByteToWideChar
SetThreadPriority
GetThreadPriority
SetThreadAffinityMask
TlsAlloc
TlsSetValue
TlsGetValue
TlsFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
QueryPerformanceFrequency
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
GetVersionExA
IsBadStringPtrA
Process32First
Process32Next
Module32First
Module32Next
SleepEx
PeekNamedPipe
WaitForMultipleObjects
GetFileType
GetStdHandle
ExpandEnvironmentStringsA
InterlockedExchange
UnhandledExceptionFilter
ExitProcess
GetStartupInfoW
HeapFree
HeapAlloc
RtlUnwind
HeapReAlloc
GetFileInformationByHandle

user32

PostQuitMessage
DispatchMessageW
DefWindowProcW
UpdateWindow
SendMessageW
GetSystemMetrics
MessageBoxW
AdjustWindowRectEx
CreateWindowExW
GetSysColorBrush
ShowWindow
GetSysColor
SetWindowLongW
EndPaint
PeekMessageW
SystemParametersInfoW
GetWindowLongW
InvalidateRect
LoadIconW
RegisterClassExW
TranslateMessage
EnumWindows
GetWindowThreadProcessId
GetDC
BeginPaint
ReleaseDC
PostMessageW
GetClientRect
LoadCursorW
DrawTextW
FillRect
DestroyWindow

gdi32

CreateDIBSection
CreateSolidBrush
GetStockObject
GetObjectW
CreateFontW
SetDCPenColor
Rectangle
CreateCompatibleDC
SelectObject
SetBkMode
SetBkColor
SetDCBrushColor
CreateFontIndirectW
DeleteDC
SetTextColor

shell32

SHGetFolderPathW
ShellExecuteExW
SHBrowseForFolderW
SHGetMalloc
ShellExecuteW
SHGetPathFromIDListW
CommandLineToArgvW

comctl32

InitCommonControlsEx

ws2_32

setsockopt
htons
connect
bind
listen
closesocket
getsockopt
ioctlsocket
select
__WSAFDIsSet
WSAGetLastError
WSASetLastError
recv
send
socket
gethostname
WSACleanup
getpeername
ntohs
getsockname
WSAStartup
getaddrinfo
sendto
recvfrom
accept
freeaddrinfo

wininet

InternetReadFileExA
HttpQueryInfoA
HttpOpenRequestA
InternetCrackUrlA
InternetSetOptionA
HttpSendRequestA
InternetConnectA
InternetSetStatusCallbackA
InternetOpenA
InternetCloseHandle
InternetSetCookieW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

advapi32

OpenProcessToken
OpenThreadToken
AccessCheck
DuplicateToken
GetUserNameW
RegOpenKeyExA
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetFileSecurityW
GetFileSecurityW
RegQueryValueExW
MapGenericMask

oleaut32

VariantClear

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 244KB - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 116KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e416601731d54ae3f3ef0fb7b305f4be

Headers

DLL Characteristics

File Characteristics

Imports

msimg32

kernel32

user32

gdi32

shell32

comctl32

ws2_32

wininet

version

advapi32

oleaut32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 244KB - Virtual size: 244KB

.data Size: 116KB - Virtual size: 169KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 153KB - Virtual size: 153KB

.reloc Size: 59KB - Virtual size: 59KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 244KB - Virtual size: 244KB

.data
Size: 116KB - Virtual size: 169KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 153KB - Virtual size: 153KB

.reloc
Size: 59KB - Virtual size: 59KB