b69033a9a3b9049d9c1d9ebdaeec1d92ebd8b8b35bfb1a8cf6bef90e040eabe2

Sharing

Copy URL Twitter E-mail

General

Target

b69033a9a3b9049d9c1d9ebdaeec1d92ebd8b8b35bfb1a8cf6bef90e040eabe2
Size

2.6MB
MD5

4cbd7f8a2308ac3a5214660ecad3dc7c
SHA1

449b0a5d47b606848b6e9e2233bac3e6205cd77d
SHA256

b69033a9a3b9049d9c1d9ebdaeec1d92ebd8b8b35bfb1a8cf6bef90e040eabe2
SHA512

aae71dde6e6aac895ce8ce5be8aae2bc7dbbbe6abe369dd15b13ab6a10d32431da80e0777f14e736239ed3dfa41940c60261f0bcfc9231d6e127f367f5b4791c
SSDEEP

49152:fgvxxnM+ytnOpGKyN/CcaW4AiyMgcPAqO4fnEBaWU7eph:fgvjPEOpGnN5P4otJqO8Eh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b69033a9a3b9049d9c1d9ebdaeec1d92ebd8b8b35bfb1a8cf6bef90e040eabe2

Files

b69033a9a3b9049d9c1d9ebdaeec1d92ebd8b8b35bfb1a8cf6bef90e040eabe2
.exe windows:6 windows x86 arch:x86

2e48d45a128edb3cd77afddfdae96f9b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

shlwapi

PathAppendW
PathRemoveFileSpecW

user32

MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation

kernel32

GetProcAddress
Sleep
GetLastError
DeleteFileW
GetFileSize
MoveFileW
CreateMutexA
ReleaseMutex
GetStdHandle
GetEnvironmentVariableW
GetFileType
GetModuleHandleW
InitializeCriticalSectionEx
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
LoadLibraryA
QueryPerformanceCounter
SetLastError
FormatMessageW
MoveFileExA
WaitForSingleObjectEx
CompareFileTime
GetSystemTimeAsFileTime
GetEnvironmentVariableA
PeekNamedPipe
LoadLibraryW
VerSetConditionMask
VerifyVersionInfoA
GetSystemTime
SystemTimeToFileTime
OpenProcess
WaitForSingleObject
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
GetCurrentProcessId
ConvertThreadToFiber
ConvertFiberToThread
FindFirstFileW
CreateFiber
DeleteFiber
SwitchToFiber
SetConsoleMode
ReadConsoleA
DecodePointer
HeapSize
GetTimeZoneInformation
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetProcessHeap
GetFullPathNameW
SetEndOfFile
SetStdHandle
GetFileAttributesExW
FlushFileBuffers
CloseHandle
MultiByteToWideChar
GetCurrentThreadId
CreateFileW
GetTickCount
WriteFile
ReadFile
WaitForMultipleObjects
GetStringTypeW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapReAlloc
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetACP
GetCommandLineW
GetCommandLineA
HeapFree
HeapAlloc
SetFilePointerEx
TryEnterCriticalSection
DuplicateHandle
GetCurrentProcess
GetCurrentThread
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
EncodePointer
GetThreadTimes
FreeLibraryAndExitThread
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RaiseException
RtlUnwind
SetEnvironmentVariableA
SetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
ExitProcess
GetModuleHandleExW
SetConsoleCtrlHandler
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread

ws2_32

setsockopt
ntohs
getsockopt
getsockname
getpeername
bind
WSAWaitForMultipleEvents
WSASetLastError
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
closesocket
send
socket
connect
recvfrom
recv
shutdown
getnameinfo
sendto
ioctlsocket
WSAGetLastError
WSACleanup
getaddrinfo
WSAStartup
htonl
htons
freeaddrinfo
WSAIoctl
__WSAFDIsSet
select
accept
listen
gethostname
ntohl

advapi32

CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
DeregisterEventSource
CryptCreateHash
ReportEventW
RegisterEventSourceW

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertOpenStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertGetIntendedKeyUsage
CertOpenSystemStoreA

wldap32

ord41
ord50
ord45
ord22
ord211
ord46
ord217
ord143
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord60

bcrypt

BCryptGenRandom

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 509KB - Virtual size: 509KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 35KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 147KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2e48d45a128edb3cd77afddfdae96f9b

Headers

DLL Characteristics

File Characteristics

Imports

version

shlwapi

user32

kernel32

ws2_32

advapi32

crypt32

wldap32

bcrypt

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 509KB - Virtual size: 509KB

.data Size: 35KB - Virtual size: 52KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 147KB - Virtual size: 148KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 509KB - Virtual size: 509KB

.data
Size: 35KB - Virtual size: 52KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 147KB - Virtual size: 148KB