023c43bddf22c655a179463a927a4a36

Sharing

Copy URL

Twitter E-mail

General

Target

023c43bddf22c655a179463a927a4a36
Size

62KB
MD5

023c43bddf22c655a179463a927a4a36
SHA1

40c45770e3d38a814dae3ad31fa4876dab3cd4cc
SHA256

565a771c2a420996d6b6e0329723f877993b8f0cf65e2752f844375272df67cb
SHA512

16363e94c6e3692f94e3eb373ae9ed2291d61fd7bf22ba339d21d493ce59ba4de51c6087b5227f92bd88ef7daee1ea263f42a44748cb8c9f9921a0d5d09f0c77
SSDEEP

1536:XeIY42OAeJ6i55BBPoaZDvG1PIQPAoebmVqpmWK:XtlvAeJ6i55/oeKwoebmMpmW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
023c43bddf22c655a179463a927a4a36

Files

023c43bddf22c655a179463a927a4a36
.exe windows:4 windows x86 arch:x86

009e1399ded23046be85761f60ec1fa5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_XcptFilter
_exit
_stricmp
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
_CxxThrowException
??0exception@@QAE@ABV0@@Z
_onexit
__dllonexit
_acmdln
_controlfp
vsprintf
fwrite
time
srand
rand
strrchr
sscanf
??1type_info@@UAE@XZ
free
_purecall
realloc
strncpy
strstr
exit
atoi
__CxxFrameHandler
??2@YAPAXI@Z
memmove
memcmp
memcpy
memset
atol
strlen
strcpy
strcat
fopen
fseek
fread
fclose
sprintf
??3@YAXPAX@Z

kernel32

GetStartupInfoA
GetModuleHandleA
GetLocalTime
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
CreateDirectoryA
MoveFileA
DeleteFileA
Sleep
MultiByteToWideChar
lstrcatA
lstrcpyA
lstrcpynA
GetLastError
GetCurrentThreadId
lstrlenA
Process32Next
Process32First
CreateToolhelp32Snapshot
CloseHandle
VirtualFreeEx
ReadProcessMemory
VirtualAllocEx
OpenProcess
WideCharToMultiByte
lstrlenW
ReleaseMutex
CreateMutexA
GetPrivateProfileIntA
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
FreeResource
GlobalFree
GlobalHandle
LockResource
LoadResource
FindResourceA
GlobalAlloc
GlobalUnlock
GlobalLock
InterlockedIncrement
InterlockedDecrement
lstrcmpA
FlushInstructionCache
GetCurrentProcess
GetSystemDirectoryA
GetPrivateProfileStringA
GetVersionExA

user32

wsprintfA
CreateWindowExA
RegisterWindowMessageA
GetClassInfoExA
RegisterClassExA
CreateDialogIndirectParamA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA
GetWindowLongA
GetParent
GetWindow
SystemParametersInfoA
GetClientRect
InvalidateRgn
SendMessageA
GetWindowThreadProcessId
GetWindowTextA
GetDesktopWindow
SetWindowPos
LoadCursorA
SetCursor
GetWindowDC
ReleaseDC
FindWindowExA
FindWindowA
DestroyWindow
GetDlgItem
RedrawWindow
SetTimer
SetCapture
ReleaseCapture
MapWindowPoints
CreateAcceleratorTableA
GetWindowRect
GetSysColor
DestroyIcon
LoadIconA
SetWindowRgn
MoveWindow
IsDialogMessageA
ShowWindow
PtInRect
GetCursorPos
GetClassNameA
IsWindow
BeginPaint
FillRect
EndPaint
CallWindowProcA
GetDC
GetFocus
IsChild
SetFocus
GetWindowTextLengthA
SetWindowTextA
KillTimer
SetWindowLongA
InvalidateRect

gdi32

SetMapMode
DeleteObject
CreatePolygonRgn
SetBkMode
BitBlt
GetPixel
TextOutA
CreateCompatibleDC
GetStockObject
SelectPalette
CreateFontA
GetDeviceCaps
CreateSolidBrush
GetObjectA
CreateCompatibleBitmap
SelectObject
SetBkColor
ExtTextOutA
SetBitmapDimensionEx
RealizePalette
GetTextExtentPoint32A
CreateDCA
SetTextColor
DeleteDC

urlmon

URLDownloadToFileA

advapi32

RegOpenKeyExA
RegCloseKey
RegOpenKeyA
RegQueryValueExA

shell32

Shell_NotifyIconA
ShellExecuteA

ole32

CoTaskMemFree
CLSIDFromString
OleUninitialize
StringFromCLSID
CoTaskMemAlloc
OleLockRunning
OleInitialize
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CoCreateInstance
CLSIDFromProgID

oleaut32

SysAllocString
VariantClear
OleCreateFontIndirect
SysStringLen
LoadRegTypeLi
SysAllocStringLen
SysFreeString

wininet

DeleteUrlCacheEntry
InternetOpenUrlA
InternetCloseHandle
InternetReadFile
InternetOpenA

qqplugin

?fnQQSysMsg@@YAPAUHWND__@@PBDH000@Z
?fnQQPopMsg@@YAPAUHWND__@@PBDH000W4tagQQ_VER@@0@Z

qqplughook

?fnUnInstallHook@@YAHXZ
?fnInstallHook@@YAHXZ

clickloaddrv

fnClickLoadDrv
KillSD

killkis

fnKillKIS

winmm

sndPlaySoundA

comctl32

InitCommonControlsEx

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

009e1399ded23046be85761f60ec1fa5

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

gdi32

urlmon

advapi32

shell32

ole32

oleaut32

wininet

qqplugin

qqplughook

clickloaddrv

killkis

winmm

comctl32

Sections

.text Size: 39KB - Virtual size: 39KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 3KB - Virtual size: 5KB

.rsrc Size: 9KB - Virtual size: 8KB

.text
Size: 39KB - Virtual size: 39KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 3KB - Virtual size: 5KB

.rsrc
Size: 9KB - Virtual size: 8KB