29920be88599f162404a9b5a23b3d8e9

Sharing

Copy URL Twitter E-mail

General

Target

29920be88599f162404a9b5a23b3d8e9
Size

55KB
MD5

29920be88599f162404a9b5a23b3d8e9
SHA1

174557dee9fee94834af544f245812c9c8ffaa45
SHA256

23ada92fce379e7effaa757358a454fdf182bf61af292b6e50dd6097cd02f80d
SHA512

6f1dcc7a8be0b19f318137db13ed67f3a81745c790a3f9592200fc95f88f428b3b041414d98d8b8c7d52bc79ff79b7436c4e63ab12d674f929c6661efb4ac1ce
SSDEEP

1536:ULVDC3QY1QvaGBxfQWVnsCJlojVQHDYXNk57Jy:IRC3QY1gaG9VnsVOgNk5M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29920be88599f162404a9b5a23b3d8e9

Files

29920be88599f162404a9b5a23b3d8e9
.exe windows:5 windows x86 arch:x86

794facc3c6d8ee79b74f03e089df70eb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtAddBootEntry
RtlUnwind
qsort
isupper
RtlpWaitForCriticalSection
RtlIpv6StringToAddressW
ZwQueryPortInformationProcess
RtlUnicodeStringToInteger
RtlCreateEnvironment
ZwCreatePagingFile
RtlIpv4StringToAddressW
RtlCreateUnicodeString
RtlFormatCurrentUserKeyPath
ZwQueryDirectoryObject
RtlGetGroupSecurityDescriptor
RtlGetCallersAddress
RtlConvertExclusiveToShared
ZwRestoreKey
NtFindAtom
RtlDelete
RtlAnsiStringToUnicodeString
RtlQueryHeapInformation
RtlUnlockBootStatusData
NtWriteVirtualMemory
RtlIdentifierAuthoritySid
_wtol
RtlCreateUnicodeStringFromAsciiz
ZwInitializeRegistry

kernel32

lstrcpynA
GetWindowsDirectoryA
SetSystemPowerState
MoveFileExA
GetConsoleKeyboardLayoutNameA
WritePrivateProfileStringA
VerifyVersionInfoA
FreeConsole
SwitchToThread
SetPriorityClass
GetFileType
VDMOperationStarted
lstrcmpW
OpenMutexA
ResetEvent
GetNumaAvailableMemoryNode
GetTapeParameters
LZOpenFileA
BindIoCompletionCallback
DnsHostnameToComputerNameW
CopyLZFile
HeapCreate
GetOEMCP
Thread32Next
GetSystemInfo
ReplaceFileW
LoadLibraryW
SetLastError
BaseUpdateAppcompatCache
EnumerateLocalComputerNamesW
GetProcAddress

schannel

UnsealMessage
AcquireCredentialsHandleW
SslCrackCertificate
MakeSignature
QuerySecurityPackageInfoA
InitializeSecurityContextW
AcceptSecurityContext
SslLoadCertificate
RevertSecurityContext
SealMessage
SslFreeCertificate
SpUserModeInitialize
InitSecurityInterfaceA
QueryContextAttributesA
ApplyControlToken
SslGenerateRandomBits
FreeContextBuffer
EnumerateSecurityPackagesA
SpLsaModeInitialize

sqlunirl

_GetFileAttributes_@4
_CreateIC_@16
__lopen_@8
_GetCurrentDirectory_@8
_CreateScalableFontResource_@16
_GetUserName@8
_OpenWindowStation_@12
_PostMessage@16
_VerQueryValue_@16
_SHBrowseForFolder_@4
_WritePrivateProfileSection_@12
_CreateWindowEx@48
_LoadBitmap@8
_GetDlgItemText@16
_LookupPrivilegeName_@16
_LookupAccountSid_@28
_RegUnLoadKey_@8
_GetModuleFileName@12
_WriteProfileSection_@8

mmcbase

?GetFacility@SC@mmcerror@@ABE?AW4facility_type@12@XZ
??1CEventBuffer@@QAE@XZ
?MMCErrorBox@@YGHIVSC@mmcerror@@I@Z
?FatalError@SC@mmcerror@@QBEXXZ
?FormatErrorString@@YGXPBGVSC@mmcerror@@IPAGH@Z
?MMCErrorBox@@YGHVSC@mmcerror@@I@Z
?GetErrorMessage@SC@mmcerror@@QBEXIPAG@Z
?SetMainThreadID@SC@mmcerror@@SGXK@Z
?Release@CMMCStrongReferences@@SGKXZ
?GetHinst@SC@mmcerror@@SGPAUHINSTANCE__@@XZ
??4SC@mmcerror@@QAEAAV01@ABV01@@Z
?FromWin32@SC@mmcerror@@QAEAAV12@J@Z
?MMCErrorBox@@YGHPBGVSC@mmcerror@@I@Z
?ScEmitOrPostpone@CEventBuffer@@QAE?AVSC@mmcerror@@PAUIDispatch@@JPAVCComVariant@ATL@@H@Z
??9SC@mmcerror@@QBE_NJ@Z

mtxex

SafeRef
MTSCreateActivity
GetObjectContext

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

794facc3c6d8ee79b74f03e089df70eb

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

schannel

sqlunirl

mmcbase

mtxex

Sections

.text Size: 30KB - Virtual size: 29KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 2KB - Virtual size: 1KB

.rsrc Size: 17KB - Virtual size: 16KB

.text
Size: 30KB - Virtual size: 29KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 17KB - Virtual size: 16KB