43e20dfc7a622466c0e567aa0a24c108

Sharing

Copy URL Twitter E-mail

General

Target

43e20dfc7a622466c0e567aa0a24c108
Size

286KB
MD5

43e20dfc7a622466c0e567aa0a24c108
SHA1

8f7a861838fc7426fc4831e180a7000bb3a3ffd7
SHA256

6ee273c2b0f8182285128bec2716a016e2f94f5a2063d054c465b736da3bcbb8
SHA512

60eec81f8534efede39a1d76da8abefa8e74ba54c1295b1dfcbe5b798d7fc25dce5eb6555b5b69cd7d972a05dc046ff482033d2b6e8144d73b7d7ce731ee0b03
SSDEEP

6144:9NK9TBtjtuCgSlaCHQqs69JhBF5ejXfxnEvipIxppKfERhINpCJIDHi+bT:9NK9TXoCQD69JhBFojXfBSYIYChhqHJf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
43e20dfc7a622466c0e567aa0a24c108

Files

43e20dfc7a622466c0e567aa0a24c108
.exe windows:5 windows x86 arch:x86

f9f53499d9174280e883ca5818169d83

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlUnwind
LdrGetDllHandle
NtQueryInformationProcess
LdrLoadDll

kernel32

GetFileInformationByHandle
SetFileAttributesW
ExpandEnvironmentStringsW
VirtualProtect
SetThreadPriority
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
ResumeThread
TlsGetValue
TlsSetValue
FindFirstFileW
FindClose
FindNextFileW
InterlockedIncrement
InterlockedDecrement
lstrcmpA
CreateRemoteThread
Process32FirstW
Process32NextW
GetDriveTypeW
GetLogicalDrives
UnregisterWait
RegisterWaitForSingleObject
SystemTimeToFileTime
GetTimeZoneInformation
GetLocalTime
GetSystemTime
ResetEvent
ReleaseMutex
WideCharToMultiByte
MultiByteToWideChar
GetThreadContext
SetThreadContext
VirtualQuery
GetCurrentProcess
InterlockedCompareExchange
FlushInstructionCache
VirtualAlloc
CreateMutexW
HeapReAlloc
GetProcessHeap
GlobalLock
GlobalUnlock
GetVolumeNameForVolumeMountPointW
TerminateThread
TryEnterCriticalSection
GetHandleInformation
lstrcpyA
TerminateProcess
GetExitCodeThread
DosDateTimeToFileTime
GetTempFileNameW
MoveFileExW
QueryPerformanceCounter
OpenMutexW
lstrcmpiA
VirtualFree
GetTempPathW
RemoveDirectoryW
FileTimeToDosDateTime
lstrcpynA
FileTimeToLocalFileTime
GetProcessId
GetSystemDefaultUILanguage
GetProcessTimes
lstrcmpW
GlobalMemoryStatusEx
GetUserDefaultUILanguage
GetDiskFreeSpaceExW
GetVolumeInformationW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObject
GetTickCount
GetNativeSystemInfo
GetModuleHandleW
GetVersionExW
GetProcAddress
ExitProcess
GetCommandLineW
SetErrorMode
GetComputerNameW
SetEvent
VirtualFreeEx
Sleep
GetModuleFileNameW
CreateEventW
WaitForMultipleObjects
lstrcmpiW
lstrcatW
OpenEventW
DuplicateHandle
CloseHandle
GetCurrentProcessId
LocalFree
WriteProcessMemory
GetCurrentThreadId
lstrlenA
FreeLibrary
CreateDirectoryW
SetFilePointer
OutputDebugStringA
LoadLibraryW
lstrlenW
WTSGetActiveConsoleSessionId
lstrcpyW
DeleteFileW
GetEnvironmentVariableW
CreateProcessW
GetCurrentThread
OpenProcess
Thread32First
Thread32Next
GetLastError
LoadLibraryA
CreateToolhelp32Snapshot
CreateThread
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
HeapAlloc
HeapFree
HeapDestroy
HeapCreate
SetLastError
TlsAlloc
TlsFree
IsBadReadPtr
VirtualAllocEx
SetEndOfFile
SetFilePointerEx
SetFileTime
WriteFile
GetFileAttributesW
ReadFile
CreateFileW
FlushFileBuffers
GetFileSizeEx
GetFileTime

user32

GetMessageA
GetUpdateRgn
GetMessageW
GetWindowDC
SetCapture
DefDlgProcW
OpenInputDesktop
BeginPaint
GetUpdateRect
GetDC
IsWindow
SendMessageTimeoutW
SetWindowPos
GetAncestor
GetWindowLongW
GetClassLongW
GetWindowInfo
GetParent
PostMessageW
GetWindowRect
GetShellWindow
PostThreadMessageW
SetWindowLongW
EndPaint
ToUnicode
GetKeyboardState
IntersectRect
DrawEdge
FillRect
RegisterWindowMessageW
SendMessageW
PrintWindow
EqualRect
GetClassNameW
GetWindow
GetLastInputInfo
GetSystemMetrics
GetMenuItemID
SetKeyboardState
GetSubMenu
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
GetMenuState
GetMenuItemCount
HiliteMenuItem
EndMenu
CharUpperW
CharLowerW
IsRectEmpty
GetWindowThreadProcessId
SystemParametersInfoW
GetCapture
TranslateMessage
SetCursorPos
GetClipboardData
PeekMessageW
GetDCEx
MsgWaitForMultipleObjects
DispatchMessageW
DrawIcon
GetIconInfo
PeekMessageA
ReleaseDC
DefWindowProcA
GetCursorPos
DefMDIChildProcW
SwitchDesktop
DefDlgProcA
DefMDIChildProcA
ReleaseCapture
CallWindowProcA
CallWindowProcW
DefWindowProcW
GetMessagePos
DefFrameProcW
CharToOemW
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
CharLowerA
GetTopWindow
LoadImageW
WindowFromPoint
MapWindowPoints
GetProcessWindowStation
OpenDesktopW
CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
OpenWindowStationW
ExitWindowsEx
MapVirtualKeyW
DefFrameProcA

advapi32

CryptReleaseContext
GetLengthSid
ConvertSidToStringSidW
EqualSid
OpenProcessToken
GetSidSubAuthority
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
CreateProcessAsUserW
LookupPrivilegeValueW
AdjustTokenPrivileges
InitiateSystemShutdownExW
CryptVerifySignatureW
CryptGetKeyParam
CryptImportKey
CryptDestroyKey
CryptDestroyHash
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CryptHashData
CryptCreateHash
IsWellKnownSid
CryptAcquireContextW
CryptGetHashParam
RegSetValueExW

shlwapi

PathGetDriveNumberW
ord14
PathUnquoteSpacesW
PathSkipRootW
StrChrA
StrCmpNA
StrChrW
StrCmpIW
StrRChrA
wvnsprintfA
wvnsprintfW
PathRenameExtensionW
PathAddExtensionW
PathIsDirectoryW
SHDeleteKeyW
SHDeleteValueW
PathAddBackslashW
PathFindExtensionW
PathMatchSpecW
StrCmpNW
PathQuoteSpacesW
PathRemoveBackslashW
PathIsURLW
PathFindFileNameW
StrCmpNIW
PathRemoveFileSpecW
StrCmpNIA
UrlUnescapeA
PathRemoveExtensionW

shell32

ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW

secur32

GetUserNameExW
EncryptMessage
DecryptMessage
DeleteSecurityContext

ole32

CoCreateInstance
StringFromGUID2
CoUninitialize
CLSIDFromString
CreateStreamOnHGlobal
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoTaskMemFree

gdi32

CreateDIBSection
GdiFlush
GetDIBits
CreateDCW
BitBlt
SetRectRgn
SaveDC
RestoreDC
GetDeviceCaps
DeleteDC
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
SetViewportOrgEx

ws2_32

WSAStartup
getaddrinfo
select
WSAGetLastError
shutdown
WSACleanup
recv
bind
connect
WSACloseEvent
getpeername
WSAIoctl
WSAAddressToStringW
recvfrom
WSAEnumNetworkEvents
WSAEventSelect
getsockname
setsockopt
sendto
WSACreateEvent
getsockopt
socket
freeaddrinfo
WSASetLastError
closesocket
send
listen
accept
WSASend
WSARecv
WSAStringToAddressW
WSAAddressToStringA
WSAGetOverlappedResult

crypt32

CertDeleteCertificateFromStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
PFXExportCertStoreEx
CryptUnprotectData
CertCloseStore
CertOpenSystemStoreW
PFXImportCertStore

wininet

InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
InternetConnectA
HttpQueryInfoA
InternetCrackUrlA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetUserGetInfo
NetUserEnum
NetApiBufferFree

iphlpapi

GetAdaptersAddresses

msvcrt

_except_handler3
_errno
memset
memcpy
memmove
strcmp
memcmp
_ultow
_purecall
strtoul
abs
_vsnwprintf
_vsnprintf
memchr

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Sections

.text
Size: 268KB - Virtual size: 268KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f9f53499d9174280e883ca5818169d83

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

iphlpapi

msvcrt

version

Sections

.text Size: 268KB - Virtual size: 268KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 15KB - Virtual size: 14KB

.text
Size: 268KB - Virtual size: 268KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 15KB - Virtual size: 14KB