1d781226c4fb2504923f0c907ab4f124

Sharing

Copy URL Twitter E-mail

General

Target

1d781226c4fb2504923f0c907ab4f124
Size

152KB
MD5

1d781226c4fb2504923f0c907ab4f124
SHA1

2768a6606322b5f2b7f7682a448dd67de60d0583
SHA256

d3af2b631d70ab46b1dd0a0b51a6f1e729852c5d81938adfa6e3d72581c7d824
SHA512

25312e3b8e40794db54f7c2458c99013a737372b4ca457152fe899c07a9405bcbc2e2f8a67700f3b6765b62b7c408cbc00764c0291040cd8d7e3d265c56c9afc
SSDEEP

3072:h5cHInde+q51wunMcWY5GNwHlwoamytCpeEnJwdVnpl/B:h5Rde+q51hGIwfmytbl5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1d781226c4fb2504923f0c907ab4f124

Files

1d781226c4fb2504923f0c907ab4f124
.exe windows:5 windows x86 arch:x86

5f385213d88777004c44f9795d9ce0f7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadFile
GetTimeZoneInformation
CreateFileW
MultiByteToWideChar
SetThreadPriority
FlushFileBuffers
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
SetLastError
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
FindClose
LoadLibraryA
SetNamedPipeHandleState
WaitForMultipleObjects
lstrcmpiW
FindNextFileW
CreateToolhelp32Snapshot
GetFileTime
GetCurrentThreadId
ReleaseMutex
GetDiskFreeSpaceExW
CloseHandle
FileTimeToLocalFileTime
DeleteFileW
GetFileInformationByHandle
LocalFree
SetFileAttributesW
GetComputerNameW
Thread32Next
GetLogicalDrives
ExitThread
CreateTimerQueueTimer
GetCommandLineA
CopyFileW
GetModuleFileNameW
Process32FirstW
Process32NextW
SetEvent
GetExitCodeProcess
GetUserDefaultUILanguage
MapViewOfFile
CreateFileMappingW
GetModuleHandleA
OpenFileMappingW
lstrcmpiA
GetPrivateProfileStringW
GetPrivateProfileIntW
GetThreadPriority
ConnectNamedPipe
CreateNamedPipeW
GetProcessTimes
DisconnectNamedPipe
lstrcatW
lstrcpyW
lstrcpyA
GlobalLock
GlobalUnlock
ResetEvent
MoveFileExW
CreateDirectoryW
HeapFree
SetFilePointerEx
HeapCreate
HeapDestroy
GetVersionExW
ReadProcessMemory
Sleep
VirtualFreeEx
WideCharToMultiByte
Thread32First
OpenProcess
WriteFile
WaitNamedPipeW
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualFree
GetCurrentThread
ExpandEnvironmentStringsW
GetTickCount
SystemTimeToFileTime
HeapAlloc
CreateProcessW
FreeLibrary
SetEndOfFile
GetDriveTypeW
GetNativeSystemInfo
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
WriteProcessMemory
GetCurrentProcessId
TlsAlloc
CreateEventW
GetProcAddress
TlsSetValue
GetModuleHandleW
SetErrorMode
TlsGetValue
SetThreadContext
GetThreadContext
ExitProcess
GetSystemTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateThread
WaitForSingleObject

user32

CreateDesktopW
GetWindow
IsWindowVisible
SendMessageTimeoutW
ShowWindow
DefWindowProcA
ReleaseDC
GetDC
GetClassLongW
BeginPaint
FindWindowW
WindowFromPoint
DestroyWindow
GetParent
PostMessageW
GetTopWindow
RegisterWindowMessageW
EndPaint
GetCursorPos
GetIconInfo
DrawIcon
GetWindowThreadProcessId
CharLowerBuffA
OpenWindowStationA
GetForegroundWindow
MapVirtualKeyW
GetWindowInfo
ExitWindowsEx
OpenDesktopA
ToUnicode
GetClipboardData
CharLowerW
DispatchMessageW
DefWindowProcW
GetKeyboardState
TranslateMessage
PeekMessageW
SetTimer
SetProcessWindowStation
GetMessageW
GetThreadDesktop
UnregisterClassW
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
GetWindowLongW
MsgWaitForMultipleObjects
OpenWindowStationW
GetUserObjectInformationW
GetSystemMetrics
RegisterClassW
CreateWindowExW
SetThreadDesktop
SetWindowLongW
CharUpperW
LoadCursorW

advapi32

CryptGetHashParam
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
OpenThreadToken
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
RegSetValueExA
RegCreateKeyExA
RegDeleteValueW
RegEnumKeyExW
GetUserNameW
LookupAccountSidW
DuplicateTokenEx
CryptAcquireContextW
GetSidSubAuthority
OpenProcessToken
GetSidSubAuthorityCount

shlwapi

SHDeleteKeyA
StrStrIW
StrStrIA
StrCmpNIA
wnsprintfA
StrStrW
wnsprintfW
wvnsprintfA
PathMatchSpecW
StrCmpNIW
PathGetDriveNumberW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
wvnsprintfW
PathBuildRootW
PathCombineW

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW

secur32

GetUserNameExW

psapi

GetModuleFileNameExW

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

GetDeviceCaps
BitBlt
DeleteDC
CreateDIBSection
GetDIBits
GdiFlush
DeleteObject
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC

ws2_32

listen
send
closesocket
WSASetLastError
freeaddrinfo
socket
bind
recv
WSASend
WSAIoctl
getpeername
connect
WSAAddressToStringW
WSAStartup
recvfrom
getaddrinfo
select
WSAGetLastError
getsockname
shutdown
setsockopt
sendto
accept

crypt32

CertEnumCertificatesInStore
PFXExportCertStoreEx
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
PFXImportCertStore
CertDuplicateCertificateContext

wininet

HttpAddRequestHeadersA
InternetGetCookieA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetOpenUrlA
FindCloseUrlCache
FindFirstUrlCacheEntryW
FindNextUrlCacheEntryW
DeleteUrlCacheEntryW
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
HttpQueryInfoA
InternetConnectA
InternetCrackUrlA

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

mpr

WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum

Sections

.text
Size: 108KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.data1
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5f385213d88777004c44f9795d9ce0f7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

psapi

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

mpr

Sections

.text Size: 108KB - Virtual size: 106KB

.data Size: 28KB - Virtual size: 26KB

.reloc Size: 8KB - Virtual size: 5KB

.data1 Size: 4KB - Virtual size: 3KB

.text
Size: 108KB - Virtual size: 106KB

.data
Size: 28KB - Virtual size: 26KB

.reloc
Size: 8KB - Virtual size: 5KB

.data1
Size: 4KB - Virtual size: 3KB