1f24c7ead5ad845823d9e5e8396cf45b

Sharing

Copy URL Twitter E-mail

General

Target

1f24c7ead5ad845823d9e5e8396cf45b
Size

328KB
MD5

1f24c7ead5ad845823d9e5e8396cf45b
SHA1

a1ef2841704b895d63d2c3a38e186ec2e66f806d
SHA256

bdb2086e66b78a672d355a9a7ee542510e6e3b5d6b70d4864220299913b045bf
SHA512

1dac9586db164f589c1ad68753bb09b7eab42ff3d785a896bb5b53e6578398a5d6092bd6d90fcd5ef5db790a2bd5cb9902559bcf5d321755759e39f33103bb7f
SSDEEP

6144:6rzQ62aZ7h+VOSy/p1Kc1/GfGx8oX6hCPHvEtIMRiPp:6lfL+VOlPKcBGf2//omPp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1f24c7ead5ad845823d9e5e8396cf45b

Files

1f24c7ead5ad845823d9e5e8396cf45b
.exe windows:5 windows x86 arch:x86

3a6a8c8b082713d065aaf2c59ca69461

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoTaskMemAlloc
CoCreateInstanceEx
CoSetProxyBlanket
CoTaskMemFree
StringFromCLSID
CoUninitialize
CoInitialize
CoCreateInstance

cryptui

CryptUIDlgSelectCA
CryptUIDlgFreeCAContext

netapi32

DsGetDcNameW
DsRoleGetPrimaryDomainInformation
NetShareGetInfo
DsRoleFreeMemory
NetShareAdd
NetShareDel
NetApiBufferFree

rpcrt4

RpcMgmtInqServerPrincNameW
NdrOleAllocate
RpcStringFreeW
IUnknown_AddRef_Proxy
RpcNetworkIsProtseqValidW
NdrDllCanUnloadNow
NdrClientCall2
RpcBindingFree
NdrDllGetClassObject
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
RpcEpResolveBinding
NdrDllRegisterProxy
NdrDllUnregisterProxy
CStdStubBuffer_AddRef
CStdStubBuffer_CountRefs
RpcCancelThreadEx
NdrCStdStubBuffer_Release
CStdStubBuffer_Connect
CStdStubBuffer_QueryInterface
NdrOleFree
RpcBindingSetAuthInfoW
IUnknown_Release_Proxy
IUnknown_QueryInterface_Proxy
RpcBindingFromStringBindingW
RpcStringBindingComposeW
CStdStubBuffer_DebugServerQueryInterface

msvcrt

wcsncpy
_errno
_iob
_wcsicmp
wcsrchr
strcspn
isupper
_wtol
vfwprintf
wcstol
wcstoul
_initterm
getenv
wcsstr
wcscmp
free
ftell
isxdigit
_adjust_fdiv
wcslen
swprintf
malloc
wcscat
fopen
wcstok
__isascii
fprintf
fflush
wcschr
fclose
_snprintf
fwprintf
_wtoi
swscanf
fseek
_snwprintf
strncmp
_wcsnicmp
memmove
isdigit
fputs
sprintf
strchr
wcscpy
_vsnprintf
atoi
_except_handler3

user32

LoadStringW
wsprintfW
GetDesktopWindow

advapi32

RegQueryValueExW
RegEnumKeyExW
GetSecurityDescriptorLength
RegCreateKeyW
CryptGenRandom
RegOpenCurrentUser
MakeSelfRelativeSD
CryptAcquireContextA
RegConnectRegistryW
LsaClose
AccessCheckByType
CopySid
RegDeleteValueW
GetLengthSid
RegCreateKeyExW
MakeAbsoluteSD
RegCloseKey
DuplicateToken
LsaOpenPolicy
RegDeleteKeyW
OpenProcessToken
RegOpenKeyW
AllocateAndInitializeSid
RegQueryInfoKeyW
CryptReleaseContext
RegOpenKeyExW
LsaNtStatusToWinError
LsaFreeMemory
FreeSid
EqualSid
SetSecurityDescriptorOwner
RegSetValueExW
RegEnumValueW
LsaQueryInformationPolicy
OpenThreadToken
GetTokenInformation
IsValidSecurityDescriptor

kernel32

GetCurrentThreadId
WaitForSingleObject
WriteConsoleW
LoadLibraryW
lstrcmpiW
FileTimeToLocalFileTime
InterlockedIncrement
GetVersionExW
UnhandledExceptionFilter
RegisterWaitForSingleObject
WideCharToMultiByte
CloseHandle
GetModuleFileNameW
SetUnhandledExceptionFilter
MultiByteToWideChar
TerminateProcess
GetConsoleOutputCP
GetFileSize
FormatMessageW
GetModuleHandleW
InitializeCriticalSection
GetTickCount
GetLastError
GetSystemTime
lstrcmpW
GetDateFormatW
QueryPerformanceCounter
SetLastError
GetCurrentProcessId
GetTimeFormatW
DebugBreak
DeleteCriticalSection
GetComputerNameW
GetSystemTimeAsFileTime
GetComputerNameExW
LocalReAlloc
GetCurrentThread
CreateFileW
GetACP
DuplicateHandle
GetSystemDirectoryW
InterlockedDecrement
LocalFree
FreeLibrary
GetProcAddress
GetFileType
GetEnvironmentVariableA
GetStdHandle
CreateEventW
FileTimeToSystemTime
GetWindowsDirectoryA
EnterCriticalSection
CompareFileTime
LeaveCriticalSection
CreateThread
SystemTimeToFileTime
OutputDebugStringA
LocalAlloc
Sleep
IsDebuggerPresent
GetExitCodeThread
GetEnvironmentVariableW
ReadFile
lstrlenW
UnregisterWait
DisableThreadLibraryCalls
WriteFile
GetCurrentProcess

ntdll

qsort
NtAllocateVirtualMemory
strlen

crypt32

CertCreateCertificateContext
CryptHashCertificate
CertGetNameStringW
CryptMsgOpenToDecode
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CryptMsgClose
CertFindCertificateInStore
CertFreeCertificateChain
CryptMsgUpdate
CryptEncodeObject
CryptSignMessage
CryptMsgEncodeAndSignCTL
CertDeleteCTLFromStore
CertFreeCertificateContext
CertFindExtension
CertStrToNameW
CertCloseStore
CertVerifyCertificateChainPolicy
CertNameToStrW
CertOpenStore
CertAddEncodedCTLToStore
CryptFindOIDInfo
CertFindCTLInStore
CryptMsgGetParam
CryptDecodeObjectEx
CertGetCertificateChain
CryptDecodeObject
CryptEncodeObjectEx

secur32

FreeContextBuffer
QueryCredentialsAttributesW
AcceptSecurityContext
AcquireCredentialsHandleW
DeleteSecurityContext
InitializeSecurityContextW
FreeCredentialsHandle
QuerySecurityContextToken
EnumerateSecurityPackagesW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 163KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3a6a8c8b082713d065aaf2c59ca69461

Headers

DLL Characteristics

File Characteristics

Imports

ole32

cryptui

netapi32

rpcrt4

msvcrt

user32

advapi32

kernel32

ntdll

crypt32

secur32

Sections

.text Size: 26KB - Virtual size: 25KB

.rdata Size: 163KB - Virtual size: 162KB

.rsrc Size: 98KB - Virtual size: 97KB

.data Size: 40KB - Virtual size: 1.4MB

.tls Size: 512B - Virtual size: 4KB

.text
Size: 26KB - Virtual size: 25KB

.rdata
Size: 163KB - Virtual size: 162KB

.rsrc
Size: 98KB - Virtual size: 97KB

.data
Size: 40KB - Virtual size: 1.4MB

.tls
Size: 512B - Virtual size: 4KB