1e12ce72e06af6fb8175338621154fb8

Sharing

Copy URL Twitter E-mail

General

Target

1e12ce72e06af6fb8175338621154fb8
Size

384KB
MD5

1e12ce72e06af6fb8175338621154fb8
SHA1

163948c3734bc1955ad9b37a2e848a23d75f017d
SHA256

07ee911b731f076221eb1ae290d80defcdd257c6cc6964a69107d2bc144fa630
SHA512

4c246ad9339c001ad2e1e971b1bf1f29508e01d357363184489cffbbc5993914ff1d2a56cf666f5f4a315a4e26042bf5e2a4f99aa4e9bf5433565dc0f64f2ac1
SSDEEP

6144:AerzHznjfwF+x62fQ2uKOkbgeT0o8rpNsXAogywhZKObOH0BiRF:AerzTnjFwbi6iv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1e12ce72e06af6fb8175338621154fb8

Files

1e12ce72e06af6fb8175338621154fb8
.exe windows:1 windows x86 arch:x86

8b3e0de80d744bd8297b911ce1a79f58

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

advapi32

ChangeServiceConfigA
CloseServiceHandle
ControlService
CreateServiceA
DeleteService
OpenSCManagerA
OpenServiceA
QueryServiceStatus
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceA
StartServiceCtrlDispatcherA

c60ascx

ASCII

c60dosx

DOS

c60netx

NetCloseCallBackWindow
NetDebugTrace
NetErrorStr
NetFreeUniqueEvent
NetGetUniqueEvent
NetGet_NetCriticalSection
NetOptions
NetPing
NetSimpleClose
NetSimpleGetServerConnections
NetSimpleOpen
NetSimpleReceive
NETSIMPLERESETCLIENTIDLETIMEOUT
NetSimpleSend
NetSimpleSSLGetRemoteCerticate
NetSimpleSSLSwitchToSSL

c60runx

AttachThreadToClarion
Cla$ACCEPTED
Cla$ADDqueue
Cla$ADDqueuekey
Cla$AssignLong2RefUfo
Cla$AssignReal2RefUfo
Cla$AssignRefUfo
Cla$BEEP
Cla$BindG
Cla$CLEAR
Cla$CLEARqueue
Cla$clearstr
Cla$ClearUfo
Cla$CLOCK
Cla$CLOSEwindow
Cla$code
Cla$COMMAND
Cla$COMMIT
Cla$comparestr
Cla$DecAdd
Cla$DecDistinct
Cla$DecDistinctR
Cla$DecDivide
Cla$DecMul
Cla$DELETEqueue
Cla$DELETEREG
Cla$DISABLE
Cla$DISPLAY
Cla$DISPOSEqueue
Cla$DISPOSEref
Cla$DISPOSEvref
Cla$Dlongpower
Cla$DPopLong
Cla$DPopReal
Cla$DPushLong
Cla$DPushULong
Cla$DStack2Stack
Cla$duplicate
Cla$ENABLE
Cla$EndEventLoop
Cla$ERRORCODE
Cla$EVENT
Cla$FIELD
Cla$FILEERRORCODE
Cla$FILEERRORMSG
Cla$FileExists
Cla$FILE_ADDf
Cla$FILE_ADDfu
Cla$FILE_BUILDf
Cla$FILE_BYTES
CLA$FILE_CALLBACK
Cla$FILE_CLEAR
Cla$FILE_CLOSE
Cla$FILE_CREATE
Cla$FILE_DELETE
CLA$FILE_DESTROY
Cla$FILE_DUPLICATEk
CLA$FILE_FREESTATE
Cla$FILE_GETfk
Cla$FILE_GETfl
Cla$FILE_GETNULLS
CLA$FILE_GETSTATE
Cla$FILE_GET_PROPERTY
Cla$FILE_NAME
Cla$FILE_NEXT
Cla$FILE_NOMEMO
Cla$FILE_OPEN
Cla$FILE_POSITIONf
Cla$FILE_POSITIONk
Cla$FILE_PREV
Cla$FILE_PUTf
Cla$FILE_REGETf
Cla$FILE_REGETk
Cla$FILE_REMOVE
Cla$FILE_RESETf
Cla$FILE_RESETk
CLA$FILE_RESTORESTATE
Cla$FILE_SEND
Cla$FILE_SETf
Cla$FILE_SETk
Cla$FILE_SETkk
Cla$FILE_SETNULLS
Cla$FILE_SET_PROPERTY
Cla$FILE_WATCH
Cla$FOCUS
Cla$FREEqueue
Cla$FREEqueuea
Cla$freestr
Cla$FreeUfo
Cla$freewindow
Cla$GETINI
Cla$GetPropS
Cla$GETqueuekey
Cla$GETqueueptr
Cla$GETREG
Cla$Group2Ufo
Cla$HALT
Cla$HIDE
Cla$init
Cla$INSTANCE
Cla$IsUfoString
Cla$KEYCODE
Cla$KEY_GET_PROPERTY
Cla$LOGOUT
Cla$LONGPATH
Cla$longtostr
Cla$Mem2Ufo
Cla$MessageBox
Cla$NewCriticalSection
Cla$NewMemB
Cla$NewMemT
Cla$NewMemZ
Cla$NewProcessMutex
Cla$NEWqueue
Cla$NOTIFICATION
Cla$OPENowned
Cla$OPENwindow
Cla$POINTERqueue
Cla$PopAString
Cla$PopBind
Cla$PopCString
Cla$PopReal
Cla$PopString
Cla$PopTemp
Cla$POST
Cla$PushAString
Cla$PushBind
Cla$PushCString
Cla$PushLong
Cla$PushPictLong
Cla$PushReal
Cla$PushString
Cla$PushUfo
Cla$PUTINI
Cla$PUTqueue
Cla$PUTREG
Cla$pwopen
Cla$RANDOM
Cla$realdistinct
Cla$RECORDSqueue
Cla$RefAssignAny
Cla$RenameFile
Cla$ROLLBACK
Cla$RUN
Cla$SELECT
Cla$SETCURSOR
Cla$SETKEYCODE
Cla$SETPATH
Cla$SetPropS
Cla$SetPropV
Cla$SORTqueuekey
Cla$Stack2DStack
Cla$Stack2Ufo
Cla$StackCLIP
Cla$StackCompareN
Cla$StackCompareNEQ
Cla$StackCompareR
Cla$StackConcat
Cla$StackConcatR
Cla$StackDEFORMAT
Cla$StackErrstr
Cla$StackHeap
Cla$StackINSTRING
Cla$StackLen
Cla$StackLOWER
Cla$STACKpop
Cla$StackRotate
Cla$StackSUB
Cla$StackUPPER
Cla$StartEventLoop
Cla$StashBP
Cla$STOP
Cla$storecstr
Cla$storestr
Cla$THREAD
Cla$THREAD_FILE
Cla$TODAY
Cla$Ufo2Real
Cla$Ufodistinct
Cla$UNHIDE
Cla$UNREGISTEREVENT
Cla$WHAT
Cla$YEAR
THR$GetInstance
Wsl$CloseDown
_exit
_free
_longjmp
_malloc
_mkdir
_setjmp
__sysinit
__sysstart

c60tpsx

TOPSPEED

kernel32

CloseHandle
FormatMessageA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetPriorityClass
GetProcAddress
GetThreadPriority
GetTickCount
GetVersionExA
LoadLibraryA
OpenProcess
OutputDebugStringA
SetPriorityClass
SetThreadPriority
Sleep

shell32

ShellExecuteA

user32

EnumThreadWindows
SystemParametersInfoA

we60x

ds_SetEndSessionHandler
ds_SetOkToEndSessionHandler
ds_SetService
ds_VisibleOnDesktop
ds_WTSCallBack
WinAlert

Sections

.text
Size: 163KB - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 77KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cwtls
Size: 2KB - Virtual size: 340KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 99KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8b3e0de80d744bd8297b911ce1a79f58

Headers

File Characteristics

Imports

advapi32

c60ascx

c60dosx

c60netx

c60runx

c60tpsx

kernel32

shell32

user32

we60x

Sections

.text Size: 163KB - Virtual size: 162KB

.data Size: 77KB - Virtual size: 89KB

.cwtls Size: 2KB - Virtual size: 340KB

.idata Size: 8KB - Virtual size: 7KB

.rsrc Size: 33KB - Virtual size: 33KB

.reloc Size: 99KB - Virtual size: 100KB

.text
Size: 163KB - Virtual size: 162KB

.data
Size: 77KB - Virtual size: 89KB

.cwtls
Size: 2KB - Virtual size: 340KB

.idata
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 99KB - Virtual size: 100KB