2a838d92124222fbef7429e324131eba

Sharing

Copy URL

Twitter E-mail

General

Target

2a838d92124222fbef7429e324131eba
Size

212KB
MD5

2a838d92124222fbef7429e324131eba
SHA1

7b4b5682b107b306e71ac45a06977883c659cc53
SHA256

44c8bd65e74bc5e11c7deea39abcf719c7b390c4cec2275fd895f9bc18320743
SHA512

d991be1c72b490c630d1c62112bc1ec7d3fb2176819113c117c44af6f8bc97ba71ed172758b52a88d7b14814c9e994512a2ea2d27faca4e58449c971c399a3d1
SSDEEP

6144:8ZdqqDLl00jGiJjM6Ow1A3f6fmBjFwdmIt+t:8Zgqnl00jN5p1Q6kgmG+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2a838d92124222fbef7429e324131eba

Files

2a838d92124222fbef7429e324131eba
.exe windows:5 windows x86 arch:x86

0e0629ac7a7fc25ebff00adc3e704acd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtectEx
VirtualAllocEx
FindClose
Process32FirstW
RemoveDirectoryW
QueryDosDeviceW
WaitForMultipleObjects
Process32NextW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
GetSystemTime
WriteProcessMemory
SetFileAttributesW
CreateThread
ExpandEnvironmentStringsW
GetModuleHandleA
CreateRemoteThread
ExitThread
GetLocalTime
CreateEventW
ResetEvent
GlobalLock
GlobalUnlock
OpenEventW
VirtualAlloc
GetCommandLineW
SetErrorMode
GetComputerNameW
GetVersionExW
GetFileAttributesExW
DuplicateHandle
GetCurrentProcessId
SetHandleInformation
CreatePipe
TerminateProcess
TlsGetValue
TlsSetValue
WTSGetActiveConsoleSessionId
GetNativeSystemInfo
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
GetThreadContext
SetThreadContext
GetProcessId
ReadProcessMemory
LoadLibraryW
VirtualFreeEx
WideCharToMultiByte
Thread32First
OpenProcess
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetProcessHeap
SetLastError
GetLastError
OpenMutexW
GetFileSizeEx
GetTempPathW
lstrlenW
MultiByteToWideChar
GetTimeZoneInformation
ReadFile
Thread32Next
lstrcpynW
HeapCreate
ExitProcess
HeapDestroy
VirtualFree
CreateDirectoryW
HeapFree
GetLogicalDriveStringsW
SetFilePointerEx
GetCurrentProcess
SystemTimeToFileTime
HeapAlloc
CreateProcessW
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
LoadLibraryA
FreeLibrary
lstrcmpiA
SetThreadPriority
lstrcmpiW
GetCurrentThread
CloseHandle
EnterCriticalSection
GetProcAddress
GetPrivateProfileIntW
FlushFileBuffers
CreateFileW
LeaveCriticalSection
InitializeCriticalSection
WriteFile
GetPrivateProfileStringW
GetModuleHandleW
GetUserDefaultUILanguage
GetModuleFileNameW
GetFileAttributesW
Sleep
GetTickCount
WaitForSingleObject
MoveFileExW
LocalFree
GetCurrentThreadId
SetEvent

user32

DefFrameProcW
RegisterClassA
ExitWindowsEx
GetKeyboardLayoutList
GetKeyboardState
GetClipboardData
ToUnicode
GetMessageA
GetWindowRect
GetMessageW
SetCapture
GetParent
GetWindowInfo
GetClassLongW
GetCapture
SetCursorPos
DefWindowProcW
SetWindowPos
IsWindow
ReleaseCapture
SendMessageW
MapWindowPoints
GetMessagePos
GetWindowThreadProcessId
IsRectEmpty
MessageBoxA
DefFrameProcA
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharLowerW
CharToOemW
CallWindowProcW
CallWindowProcA
RegisterClassW
DefMDIChildProcA
DefDlgProcA
GetSystemMetrics
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
GetSubMenu
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
GetMenuItemCount
HiliteMenuItem
EndMenu
GetShellWindow
FillRect
DrawEdge
IntersectRect
PostThreadMessageW
EqualRect
PrintWindow
GetUpdateRgn
EndPaint
RegisterClassExA
GetWindowDC
PeekMessageA
DefDlgProcW
GetDC
TranslateMessage
GetWindowLongW
OpenInputDesktop
BeginPaint
GetUpdateRect
RegisterClassExW
GetDCEx
DefWindowProcA
CharLowerA
PeekMessageW
ReleaseDC
CharUpperW
SetWindowLongW
SendMessageTimeoutW
GetWindow
DispatchMessageW
DrawIcon
GetIconInfo
GetCursorPos
CharLowerBuffA
MapVirtualKeyW
PostMessageW
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
DefMDIChildProcW
SwitchDesktop
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
OpenWindowStationW
GetAncestor

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
GetSecurityDescriptorSacl
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
RegOpenKeyExW
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
GetLengthSid
IsWellKnownSid
RegEnumKeyExW
RegCreateKeyW
RegQueryInfoKeyW
RegDeleteValueW
RegEnumValueW
CreateProcessAsUserA
InitiateSystemShutdownExW
RegEnumKeyW
EqualSid
ConvertSidToStringSidW

shlwapi

PathRemoveBackslashW
StrCmpNIW
PathIsURLW
StrStrIW
StrStrIA
PathQuoteSpacesW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveFileSpecW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathRenameExtensionW

shell32

ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

CoSetProxyBlanket
CoUninitialize
CLSIDFromString
StringFromGUID2
CoInitializeSecurity
CoInitialize
CoInitializeEx
CoCreateInstance

gdi32

DeleteObject
GetDIBits
GetDeviceCaps
CreateDIBSection
RestoreDC
SaveDC
CreateCompatibleDC
SetRectRgn
SelectObject
GdiFlush
DeleteDC
SetViewportOrgEx
CreateCompatibleBitmap

ws2_32

getsockname
select
getaddrinfo
recvfrom
getpeername
accept
listen
send
inet_addr
WSASend
gethostbyname
WSAEventSelect
WSAIoctl
connect
WSAAddressToStringW
sendto
recv
freeaddrinfo
WSASetLastError
socket
bind
setsockopt
shutdown
WSAGetLastError
WSAStartup
closesocket

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
PFXImportCertStore
CryptUnprotectData

wininet

InternetCrackUrlA
InternetReadFile
InternetSetOptionA
HttpOpenRequestA
InternetQueryOptionA
HttpEndRequestW
HttpEndRequestA
InternetSetFilePointer
HttpOpenRequestW
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
HttpAddRequestHeadersA
InternetSetStatusCallbackA
InternetQueryOptionW
InternetOpenA
InternetCloseHandle
HttpQueryInfoA
InternetConnectA
HttpSendRequestA

oleaut32

SysFreeString
VariantInit
SysAllocString
VariantClear

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetInfo

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

winmm

PlaySoundW
waveOutSetVolume
waveOutGetVolume
PlaySoundA

Sections

.text
Size: 199KB - Virtual size: 199KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0e0629ac7a7fc25ebff00adc3e704acd

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

version

winmm

Sections

.text Size: 199KB - Virtual size: 199KB

.data Size: 2KB - Virtual size: 10KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 199KB - Virtual size: 199KB

.data
Size: 2KB - Virtual size: 10KB

.reloc
Size: 8KB - Virtual size: 8KB