120fc2473d58e5d0ca27b8fd1141c04c

Sharing

Copy URL Twitter E-mail

General

Target

120fc2473d58e5d0ca27b8fd1141c04c
Size

2.2MB
MD5

120fc2473d58e5d0ca27b8fd1141c04c
SHA1

59a5c05559573e9521887064b0dc73d9bb1b2cd0
SHA256

dbe332f73afa57ce5952a40ab3461402d097077263d64f006dce813f3b9eacf5
SHA512

d65c24809a2add5857b62f560c71300eb779ee3a10427def6deb81957db90c4bc00d72ebd7efb2e75ea55cd7493f31701cd0fd73ec46474f2600e9187590a4ae
SSDEEP

49152:bgBVEIgPkirQEOfqvX9OeoVJTSRb6YgcwnC1s1428e:bg8dsirygopVJTSRE1C1s1HJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
120fc2473d58e5d0ca27b8fd1141c04c

Files

120fc2473d58e5d0ca27b8fd1141c04c
.exe windows:5 windows x86 arch:x86

f3f836ef4a4cddb43a120f447da6f89e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateMutexA
CreateToolhelp32Snapshot
GetVersionExA
CloseHandle
GetTempPathA
LocalFree
WriteProcessMemory
DeleteFileA
CreateThread
CompareStringW
CompareStringA
GetProcessHeap
SetEndOfFile
CreateFileW
GetLocaleInfoW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSectionAndSpinCount
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetModuleHandleA
GetStringTypeW
GetStringTypeA
VirtualAllocEx
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
SetFilePointer
IsValidCodePage
GetOEMCP
GetACP
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
FlushFileBuffers
GetConsoleMode
GetModuleFileNameA
MoveFileA
LocalAlloc
Process32Next
LoadLibraryA
GetPrivateProfileStringA
GetUserDefaultLCID
GetTempFileNameA
CopyFileA
GetProcAddress
GetLastError
FindFirstFileA
CreateDirectoryA
SetThreadPriority
ReadFile
TerminateProcess
SizeofResource
Sleep
GetPrivateProfileIntA
OpenProcess
GetSystemWow64DirectoryA
WriteFile
GetWindowsDirectoryA
SetFileTime
CreateRemoteThread
FormatMessageA
GetCurrentThread
WaitForSingleObject
Process32First
GetCurrentProcess
GetConsoleCP
HeapReAlloc
VirtualAlloc
VirtualFree
SetEnvironmentVariableA
HeapCreate
HeapAlloc
GetTimeZoneInformation
GetFileType
LoadResource
FindResourceA
CreateFileA
GetCurrentProcessId
ExitProcess
GetStdHandle
SetHandleCount
LCMapStringW
LCMapStringA
RaiseException
RtlUnwind
GetCPInfo
GetStartupInfoA
GetCommandLineA
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapFree
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte

user32

LoadCursorA
FindWindowA
DestroyMenu
UpdateWindow
SetWindowTextA
InsertMenuA
GetSystemMetrics
ReleaseCapture
SystemParametersInfoA
MoveWindow
LoadIconA
DispatchMessageA
IsWindow
GetDC
BeginPaint
SetFocus
SendMessageA
AppendMenuA
GetActiveWindow
CreatePopupMenu
ShowWindow
GetCursorPos
GetDesktopWindow
DefWindowProcA
ReleaseDC
CreateWindowExA
InvalidateRect
GetWindowPlacement
TranslateMessage
SetForegroundWindow
SetCapture
TrackPopupMenu
RegisterClassExA
GetWindowRect
GetMessageA
DestroyWindow
MessageBoxA
LoadBitmapA
ClientToScreen
EndPaint
IsDialogMessageA

gdi32

CreateFontA
AddFontResourceExA
SetBkMode
DeleteObject
GetStockObject
CreateSolidBrush
SetTextColor

advapi32

InitializeAcl
OpenThreadToken
SetSecurityDescriptorGroup
AccessCheck
RegCloseKey
AdjustTokenPrivileges
GetLengthSid
IsValidSecurityDescriptor
FreeSid
AddAccessAllowedAce
SetSecurityDescriptorOwner
AllocateAndInitializeSid
OpenProcessToken
RegOpenKeyExA
RegCreateKeyExA
LookupPrivilegeValueA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
DuplicateToken
RegQueryValueExA
RegSetValueExA

shell32

Shell_NotifyIconA
ShellExecuteA

wininet

FtpGetFileSize
DeleteUrlCacheEntry
FtpOpenFileA
InternetConnectA
InternetCloseHandle
InternetOpenA
InternetReadFile

comctl32

InitCommonControlsEx
ImageList_ReplaceIcon
ImageList_Add
ImageList_Create

ws2_32

closesocket
socket
recv
setsockopt
gethostbyname
inet_addr
WSAStartup
inet_ntoa
connect
htons
send

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

winmm

timeGetTime

psapi

GetModuleFileNameExA

gdiplus

GdiplusShutdown
GdipFree
GdipGetImageHeight
GdipDeleteGraphics
GdiplusStartup
GdipGetImageWidth
GdipCloneImage
GdipCreateFromHDC
GdipDisposeImage
GdipAlloc
GdipLoadImageFromFile
GdipDrawImageRectI

Sections

.text
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f3f836ef4a4cddb43a120f447da6f89e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

wininet

comctl32

ws2_32

version

winmm

psapi

gdiplus

Sections

.text Size: 167KB - Virtual size: 166KB

.rdata Size: 37KB - Virtual size: 36KB

.data Size: 6KB - Virtual size: 14KB

.rsrc Size: 2.0MB - Virtual size: 2.0MB

.text
Size: 167KB - Virtual size: 166KB

.rdata
Size: 37KB - Virtual size: 36KB

.data
Size: 6KB - Virtual size: 14KB

.rsrc
Size: 2.0MB - Virtual size: 2.0MB