a1ebd9ad98a4053cfba72b10d394a02367c5f265ffcc40af91547f70e212a35c

Sharing

Copy URL Twitter E-mail

General

Target

a1ebd9ad98a4053cfba72b10d394a02367c5f265ffcc40af91547f70e212a35c
Size

753KB
MD5

3fa29dc8325ab66e4c491ab7e94a0f52
SHA1

c35ccab5fae098ece76aacd4af26a548ad53a2e8
SHA256

a1ebd9ad98a4053cfba72b10d394a02367c5f265ffcc40af91547f70e212a35c
SHA512

14232f760ee06458baee3ed0a4d6e1da32f5e0aa1020a2a534ef1772177ddd2913f5b958c5c74768e882f5f295db31f60f461db72f301aebad92891197eb53d7
SSDEEP

12288:F9WgSMItBHPL7R2dyCREOMGebHJDOifXHWhyA9MXnvWTiek5IuLi9SYQideKqee:FbSMItBj7R2dyCefG8JmyA9U+Ti/dLi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a1ebd9ad98a4053cfba72b10d394a02367c5f265ffcc40af91547f70e212a35c

Files

a1ebd9ad98a4053cfba72b10d394a02367c5f265ffcc40af91547f70e212a35c
.exe windows:5 windows x86 arch:x86

7f533eb182628274aff4567e86c91f7f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

kernel32

DeleteFileW
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
TlsAlloc
GetSystemInfo
GetSystemTimes
Sleep
FindFirstFileA
FindNextFileA
FormatMessageA
GetModuleFileNameA
GetCurrentDirectoryA
WriteFile
SetFilePointer
SetFileAttributesA
DeleteFileA
CreateDirectoryA
RemoveDirectoryA
lstrcmpiA
lstrlenA
CopyFileA
GetFileAttributesA
CreateFileA
FileTimeToSystemTime
SystemTimeToFileTime
GetFileSizeEx
SetEndOfFile
GetProcAddress
GetModuleHandleA
GetCurrentProcess
GetLocalTime
lstrlenW
HeapAlloc
GetProcessHeap
HeapFree
LocalAlloc
LocalFree
GetVersionExA
GlobalFree
lstrcmpA
GetCurrentProcessId
MapViewOfFile
GetCurrentThread
OpenFileMappingA
UnmapViewOfFile
RaiseException
DecodePointer
InitializeCriticalSectionAndSpinCount
LoadResource
LockResource
SizeofResource
FindResourceW
FindResourceExW
HeapDestroy
HeapReAlloc
HeapSize
CreateToolhelp32Snapshot
Process32First
Process32Next
TlsSetValue
OpenProcess
GetWindowsDirectoryA
GlobalMemoryStatusEx
GetOEMCP
IsValidCodePage
FindFirstFileExA
FlushFileBuffers
GetFileAttributesExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
WriteConsoleW
SetStdHandle
GetACP
GetStdHandle
ExitThread
GetModuleHandleExW
ExitProcess
GetCommandLineW
GetCommandLineA
GetFileType
ReadConsoleW
GetConsoleMode
GetConsoleCP
SetFilePointerEx
RtlUnwind
LoadLibraryW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
TlsGetValue
SetFileAttributesW
FindClose
CreateFileW
GetFileInformationByHandle
FileTimeToLocalFileTime
WideCharToMultiByte
MultiByteToWideChar
FreeLibrary
GetCurrentThreadId
GetFileAttributesW
CreateDirectoryW
GetTickCount
ReadFile
CreateProcessA
GetStartupInfoA
CreatePipe
GetExitCodeProcess
GetLastError
SetEvent
CloseHandle
WaitForSingleObject
LeaveCriticalSection
CreateThread
EnterCriticalSection
ResetEvent
CreateEventA
DeleteCriticalSection
InitializeCriticalSection
GetEnvironmentStringsW
FreeEnvironmentStringsW
VirtualProtect
VirtualAlloc
GetVersionExW
LoadLibraryExW
GetModuleFileNameW
FreeLibraryAndExitThread
GetThreadTimes
OutputDebugStringW
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
InitializeSListHead
TerminateProcess
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
EncodePointer
GetModuleHandleW
GetSystemTimeAsFileTime
TlsFree
CreateEventW
SetLastError
QueryPerformanceCounter
TryEnterCriticalSection
SwitchToThread
WaitForSingleObjectEx
DuplicateHandle

user32

GetDlgCtrlID
EndPaint
PostQuitMessage
SetDlgItemTextA
GetDlgItem
SetFocus
wsprintfA
PeekMessageA
TranslateMessage
DispatchMessageA
MessageBoxA
GetDesktopWindow
MsgWaitForMultipleObjects
PostMessageA
RegisterWindowMessageA
SendMessageA
GetTopWindow
GetWindowThreadProcessId
GetWindow
LoadStringA
GetMessageA
LoadAcceleratorsA
TranslateAcceleratorA
FindWindowA
ShowWindow
LoadIconA
LoadCursorA
RegisterClassExA
DialogBoxParamA
GetSystemMetrics
GetDlgItemTextA
EnableWindow
CreateWindowExA
DestroyWindow
GetWindowRect
KillTimer
EndDialog
DefWindowProcA
SetTimer
SetWindowTextA
BeginPaint

gdi32

CreateFontA
SetTextColor
SetBkColor
DeleteObject
CreateSolidBrush

advapi32

CryptAcquireContextA
CryptCreateHash
CryptHashData
RegCreateKeyExA
GetUserNameA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
CryptGetHashParam
CryptReleaseContext
CryptDestroyHash

shell32

ShellExecuteExA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetSpecialFolderPathA
SHChangeNotify
SHFileOperationA

ole32

CoCreateInstance
CoUninitialize
CoTaskMemFree
CoInitialize

iphlpapi

GetTcpTable
GetAdaptersInfo

ws2_32

WSACleanup
gethostbyname
WSASocketA
WSAStartup
gethostname
recvfrom
sendto
recv
connect
inet_ntoa
socket
WSAGetLastError
closesocket
ntohs
setsockopt
inet_addr
htons
send

winhttp

WinHttpQueryDataAvailable
WinHttpCloseHandle
WinHttpConnect
WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpReadData
WinHttpOpen

Sections

.text
Size: 501KB - Virtual size: 501KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 151KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7f533eb182628274aff4567e86c91f7f

Headers

DLL Characteristics

File Characteristics

Imports

version

kernel32

user32

gdi32

advapi32

shell32

ole32

iphlpapi

ws2_32

winhttp

Sections

.text Size: 501KB - Virtual size: 501KB

.rdata Size: 151KB - Virtual size: 151KB

.data Size: 17KB - Virtual size: 32KB

.rsrc Size: 51KB - Virtual size: 50KB

.reloc Size: 30KB - Virtual size: 30KB

.text
Size: 501KB - Virtual size: 501KB

.rdata
Size: 151KB - Virtual size: 151KB

.data
Size: 17KB - Virtual size: 32KB

.rsrc
Size: 51KB - Virtual size: 50KB

.reloc
Size: 30KB - Virtual size: 30KB