27ea5812396063215aa7ebb39efe0169

Sharing

Copy URL Twitter E-mail

General

Target

27ea5812396063215aa7ebb39efe0169
Size

1.3MB
MD5

27ea5812396063215aa7ebb39efe0169
SHA1

8bd14bc5ac590a23541fcfffc48b66d43c844bb6
SHA256

7d70aa57db88cfc7982fbb28610fd7bf3819d5bc5323de6f1bab04a48e2fe04b
SHA512

5f63fd0ae1ff83b5f3968863d725a5a9b7f47f75ccdbb8555deeb8f4ec2bce92d8ae7e6bab468126ab76690950ba2a6de2ea643e24d0171c64a07a57f8bc3ae6
SSDEEP

24576:rBtXloDf0+sxCgUqHLH8XZofLf6JD9+9TUwP:rBtXloDf0nxCsLQZBQTU2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27ea5812396063215aa7ebb39efe0169

Files

27ea5812396063215aa7ebb39efe0169
.exe windows:5 windows x86 arch:x86

3a38dc993688439332343be156b9f573

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedExchange
OutputDebugStringW
LoadLibraryA
GetFileAttributesA
FindClose
FindFirstFileA
_lwrite
_lclose
_llseek
_lopen
_lcreat
_lread
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempFileNameA
GetTempPathA
FreeLibrary
OpenProcess
GetCurrentProcess
ProcessIdToSessionId
Process32Next
Process32First
CreateToolhelp32Snapshot
GetVersionExA
TerminateProcess
GetExitCodeProcess
Module32Next
GetLongPathNameA
Module32First
MoveFileExA
DeleteFileA
WritePrivateProfileStringA
GetPrivateProfileStringA
VirtualAlloc
VirtualFree
ExitThread
CreateThread
TerminateThread
GetLastError
GlobalMemoryStatus
GetComputerNameA
GetVolumeInformationA
CreateProcessA
LocalFree
LocalAlloc
lstrlenA
FindNextFileA
FileTimeToSystemTime
FileTimeToLocalFileTime
CopyFileA
SetFileTime
GetFileTime
CreateFileA
SetFileAttributesA
MultiByteToWideChar
DeviceIoControl
GetDriveTypeA
GetLogicalDrives
FindNextVolumeA
FindVolumeClose
FindFirstVolumeA
FlushFileBuffers
GetDiskFreeSpaceA
SetFilePointer
GetVolumeInformationW
GetDriveTypeW
SetVolumeLabelA
GlobalMemoryStatusEx
QueryDosDeviceA
GetSystemInfo
CreateDirectoryA
RemoveDirectoryA
GetSystemTimeAsFileTime
RaiseException
RtlUnwind
GetModuleFileNameW
WriteConsoleW
GetFileType
GetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
HeapValidate
IsBadReadPtr
TlsGetValue
GetModuleHandleW
TlsAlloc
TlsSetValue
GetCurrentThreadId
TlsFree
SetLastError
DebugBreak
WideCharToMultiByte
FatalAppExitA
ExitProcess
SetConsoleCtrlHandler
LoadLibraryW
GetConsoleCP
GetConsoleMode
SetHandleCount
ReadFile
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
QueryPerformanceCounter
GetCurrentProcessId
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
LCMapStringA
LCMapStringW
GetProcessHeap
VirtualQuery
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
SetEndOfFile
GetTimeZoneInformation
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetCurrentThread
GetThreadPriority
SetThreadPriority
InterlockedDecrement
TryEnterCriticalSection
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
InitializeCriticalSection
GetModuleHandleA
GetProcAddress
OutputDebugStringA
DeleteCriticalSection
GetLocalTime
GetTickCount
GetModuleFileNameA
WinExec
Sleep
WaitForSingleObject
SetEvent
CloseHandle
WriteFile
CreateEventA

user32

CharLowerA
RegisterDeviceNotificationA
PostMessageA
SendMessageA
UnregisterDeviceNotification
MessageBoxA
wsprintfA
wsprintfW

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

psapi

EnumProcesses
GetDeviceDriverBaseNameA
EnumDeviceDrivers

ws2_32

inet_ntoa

advapi32

RegSetValueExA
RegEnumValueA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegRestoreKeyA
RegOpenKeyA
RegSaveKeyA
RegOpenKeyExA
RegCloseKey
GetUserNameA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
DuplicateTokenEx
CreateProcessAsUserA
RegDeleteValueA
SetServiceStatus
RegisterServiceCtrlHandlerExA
StartServiceCtrlDispatcherA
LookupAccountSidA
GetTokenInformation
RegQueryValueExA
QueryServiceStatus
ChangeServiceConfigA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
QueryServiceConfigA
ControlService
StartServiceA
OpenServiceA
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetSpecialFolderLocation
SHGetMalloc
SHChangeNotify

ole32

CoCreateInstance
CoInitialize
CoUninitialize

Sections

.textbss
Size: - Virtual size: 516KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3a38dc993688439332343be156b9f573

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

iphlpapi

version

psapi

ws2_32

advapi32

shell32

ole32

Sections

.textbss Size: - Virtual size: 516KB

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 192KB - Virtual size: 192KB

.data Size: 8KB - Virtual size: 28KB

.idata Size: 8KB - Virtual size: 7KB

.rsrc Size: 7KB - Virtual size: 7KB

.reloc Size: 40KB - Virtual size: 40KB

.textbss
Size: - Virtual size: 516KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 192KB - Virtual size: 192KB

.data
Size: 8KB - Virtual size: 28KB

.idata
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 7KB - Virtual size: 7KB

.reloc
Size: 40KB - Virtual size: 40KB