0dd6384302ae3e234c3ac1ce1d0f0748

Sharing

Copy URL Twitter E-mail

General

Target

0dd6384302ae3e234c3ac1ce1d0f0748
Size

276KB
MD5

0dd6384302ae3e234c3ac1ce1d0f0748
SHA1

cd7a4995608c0e2e445487380659db7e9d52d78b
SHA256

c1b292703ded63a1ebbf0f42ce1e5479665187f12f89ed0cfba4b075c210eeb7
SHA512

96c3b58c747c22c1fcbd52b7b903cdccec00b83a7df693308a7b28de09884ee98dfc11e6d75c90d37776b026f9e8be8ec0fab2d99a22d9399e41da072f42cd5f
SSDEEP

6144:2qx2KhIIqAtP9SurQbGO6/Ij/SEaQtWfCq9CYtOQv94vALn9:waFj0bH6/IzSAWxv944

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0dd6384302ae3e234c3ac1ce1d0f0748

Files

0dd6384302ae3e234c3ac1ce1d0f0748
.exe windows:4 windows x86 arch:x86

5ef256c93591b7583b6718414aa08391

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

DetectAutoProxyUrl
HttpSendRequestW
DeleteUrlCacheContainerW
FtpGetCurrentDirectoryA
ResumeSuspendedDownload
InternetSetDialState
SetUrlCacheEntryGroupW
SetUrlCacheGroupAttributeW
FtpRemoveDirectoryA
GetUrlCacheEntryInfoExW
GopherGetAttributeA
DeleteUrlCacheEntryA
GetUrlCacheEntryInfoW

user32

TileChildWindows
CloseWindow
IsCharAlphaA
ChangeDisplaySettingsExA
DefWindowProcW
LoadCursorA
MessageBoxIndirectA
SendNotifyMessageW
IsWindowEnabled
GetMenuItemID
GetClassInfoExA
OemToCharA
TranslateMessage
SetWindowTextA
VkKeyScanW
GetThreadDesktop
CreateCaret
MonitorFromWindow

advapi32

CryptSetProvParam
CryptGetDefaultProviderA
RegRestoreKeyA
RegRestoreKeyW
RegDeleteKeyW
CryptSignHashA
RegDeleteValueW
RegCreateKeyExA
RegQueryMultipleValuesW
LookupPrivilegeDisplayNameW
StartServiceW
CryptSetProviderW
RegEnumValueW
CryptAcquireContextW

comdlg32

GetSaveFileNameA
PrintDlgW
ChooseColorW
PrintDlgA
PageSetupDlgW
ChooseColorA
GetFileTitleW
GetOpenFileNameA
ChooseFontA
LoadAlterBitmap
ReplaceTextA
PageSetupDlgA

kernel32

FreeEnvironmentStringsA
HeapDestroy
ReadConsoleInputW
GetSystemTimeAsFileTime
GetModuleFileNameA
TerminateProcess
GetPrivateProfileSectionNamesA
VirtualFree
ExitProcess
GetCPInfo
GetCommandLineW
WriteFile
GetVersionExW
GetProcAddress
SetFilePointer
TlsSetValue
LoadLibraryA
VirtualQuery
GetModuleFileNameW
IsBadWritePtr
RtlUnwind
HeapCreate
HeapReAlloc
VirtualAlloc
GetACP
SetLastError
FreeEnvironmentStringsW
GetStartupInfoA
GetCurrentThreadId
GetCommandLineA
CreateNamedPipeW
EnterCriticalSection
GetEnvironmentStringsW
ReadConsoleOutputW
GetFileType
GetPrivateProfileSectionA
GetStartupInfoW
CreateMailslotA
InitializeCriticalSection
DeleteCriticalSection
GetTempFileNameA
TlsFree
SetConsoleCursorInfo
GetCurrentThread
GetCurrentProcessId
InterlockedExchange
GetTickCount
GetExitCodeProcess
GetAtomNameA
GetLastError
GetSystemTimeAdjustment
lstrcmpiW
GetStdHandle
HeapAlloc
GetConsoleTitleA
MultiByteToWideChar
GetVersion
TlsGetValue
GetModuleHandleA
SetHandleCount
FindNextChangeNotification
GetSystemDefaultLangID
HeapFree
GetEnvironmentStrings
GetCurrentProcess
EnumTimeFormatsW
QueryPerformanceCounter
TlsAlloc
GetVolumeInformationW
SetCriticalSectionSpinCount
LeaveCriticalSection
UnhandledExceptionFilter

Sections

.text
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5ef256c93591b7583b6718414aa08391

Headers

File Characteristics

Imports

wininet

user32

advapi32

comdlg32

kernel32

Sections

.text Size: 161KB - Virtual size: 161KB

.data Size: 108KB - Virtual size: 108KB

.rsrc Size: 5KB - Virtual size: 4KB

.text
Size: 161KB - Virtual size: 161KB

.data
Size: 108KB - Virtual size: 108KB

.rsrc
Size: 5KB - Virtual size: 4KB