30e1cf5d3a93c9a1bdc50f6b6fa66e21

Sharing

Copy URL Twitter E-mail

General

Target

30e1cf5d3a93c9a1bdc50f6b6fa66e21
Size

1.1MB
MD5

30e1cf5d3a93c9a1bdc50f6b6fa66e21
SHA1

c51bc058376a4d48a4816453d7aeeb642516378e
SHA256

e31c0dd130353a89ce5804692bcac1fc79ee7e0396346445769ff0bb7e797638
SHA512

a2b6c13bb5460ad68d33f4398ea16be01d49337a82b94e54bcb0eaf8033c42d21795ea3af999ef95a8133c21493dcaf0e38bf5d9bbafc4b0f342c9ffd9d6cb4a
SSDEEP

24576:fY1vscoKQmVq0vWOGarlgx8ivYM39TlozEoe:ABzdqSTlgxRvdTlozEoe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
30e1cf5d3a93c9a1bdc50f6b6fa66e21

Files

30e1cf5d3a93c9a1bdc50f6b6fa66e21
.exe windows:5 windows x86 arch:x86

1717ccb2bfe06bb66e0790fff6ad95b4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

getservbyname
__WSAFDIsSet
socket
getsockopt
WSASetLastError
ioctlsocket
select
send
recv
htons
gethostbyname
getprotobyname
WSAStartup
bind
inet_ntoa
sendto
recvfrom
shutdown
ntohs
inet_addr
connect
WSAGetLastError
closesocket
WSACleanup

winhttp

WinHttpSendRequest
WinHttpCloseHandle
WinHttpConnect
WinHttpCrackUrl
WinHttpOpenRequest
WinHttpOpen
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpSetStatusCallback
WinHttpReceiveResponse

version

VerQueryValueA

urlmon

CoInternetGetSession

kernel32

FindResourceA
FindResourceExA
WideCharToMultiByte
RaiseException
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
WaitForSingleObject
SetEvent
CreateEventA
SetThreadPriority
MultiByteToWideChar
lstrlenW
EnterCriticalSection
LeaveCriticalSection
GetLastError
InterlockedIncrement
InterlockedDecrement
lstrlenA
lstrcmpiA
IsDBCSLeadByte
FreeLibrary
LoadLibraryExA
GetModuleHandleA
GetModuleFileNameA
TerminateProcess
OpenProcess
GetCurrentProcessId
DeleteFileA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetFileAttributesExA
Sleep
FindClose
FindNextFileA
FindFirstFileA
GetWindowsDirectoryA
MoveFileExA
GetFileAttributesA
TryEnterCriticalSection
GetVersionExA
GetCurrentProcess
GetTickCount
ResetEvent
HeapFree
GetProcessHeap
FlushInstructionCache
GetCurrentThreadId
SetLastError
lstrcmpA
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalReAlloc
GetConsoleMode
GetConsoleCP
SetHandleCount
HeapCreate
GetStdHandle
WriteFile
IsValidCodePage
GetOEMCP
GetCPInfo
GetDateFormatA
GetTimeFormatA
LoadResource
SetStdHandle
RemoveDirectoryA
GetFileType
PeekNamedPipe
GetTimeZoneInformation
GetStartupInfoA
GetCommandLineA
SetEnvironmentVariableA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualProtect
CreateThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
GetSystemTimeAsFileTime
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapAlloc
HeapDestroy
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GlobalFree
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
FindNextFileW
ResumeThread
TlsFree
TlsAlloc
DuplicateHandle
GetProcessAffinityMask
GetThreadPriority
WaitForMultipleObjects
InterlockedExchangeAdd
TlsSetValue
GetCurrentThread
TlsGetValue
SetThreadContext
GetThreadContext
GetFileInformationByHandle
CreateFileA
LockResource
SizeofResource
FlushFileBuffers
ReadFile
SetFilePointer
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetEndOfFile
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
CreateFileW
WriteConsoleW
CompareStringA
CompareStringW
MoveFileA
WritePrivateProfileStringA
SetFileAttributesA
GetShortPathNameA
FindFirstFileW
GetFullPathNameA
LoadLibraryA
GetProcAddress
HeapCompact
CreateDirectoryA
ExitProcess

user32

SetTimer
KillTimer
MessageBoxA
SendMessageA
PostQuitMessage
ExitWindowsEx
UnregisterClassA
SetWindowLongA
GetWindowLongA
PostMessageA
LoadMenuA
DestroyMenu
SetMenuDefaultItem
GetMonitorInfoA
MonitorFromPoint
TrackPopupMenu
GetSubMenu
GetCursorPos
LoadImageA
DefWindowProcA
SetForegroundWindow
CallWindowProcA
CharNextA
GetSystemMetrics
CharLowerA
CreateWindowExA
SetWindowTextA
MoveWindow
GetWindowRect
GetClientRect
SetFocus
GetParent
IsWindow
GetClassInfoExA
ShowWindow
RegisterWindowMessageA
InvalidateRgn
GetWindowTextLengthA
GetWindowTextA
IsWindowEnabled
EnableWindow
CreateAcceleratorTableA
GetFocus
GetWindow
DestroyAcceleratorTable
BeginPaint
EndPaint
FillRect
ReleaseCapture
GetClassNameA
GetDlgItem
IsChild
SetCapture
RedrawWindow
LoadCursorA
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
SetWindowPos
GetSysColor
RegisterClassExA
GetDesktopWindow
DestroyWindow
GetMessageA
TranslateMessage
DispatchMessageA
SetLayeredWindowAttributes

gdi32

BitBlt
GetStockObject
GetObjectA
CreateSolidBrush
GetDeviceCaps
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject

advapi32

RegQueryValueExA
RegDeleteKeyA
RegEnumKeyA
RegEnumValueA
RegFlushKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA

shell32

Shell_NotifyIconA
ShellExecuteExW

ole32

CoInitializeSecurity
CoGetClassObject
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoSetProxyBlanket
CoUninitialize
CoInitialize
OleLockRunning
StringFromGUID2
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID

oleaut32

VariantInit
OleCreateFontIndirect
GetErrorInfo
SysStringByteLen
LoadTypeLi
SysFreeString
SysAllocString
LoadRegTypeLi
VariantClear
VarUI4FromStr
VariantCopy
VariantChangeType
SysAllocStringLen
SysStringLen
VarBstrCat

iphlpapi

GetNetworkParams

shlwapi

StrRChrA
StrStrA
StrToIntExA

Sections

.text
Size: 690KB - Virtual size: 690KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 412KB - Virtual size: 411KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1717ccb2bfe06bb66e0790fff6ad95b4

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

winhttp

version

urlmon

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

iphlpapi

shlwapi

Sections

.text Size: 690KB - Virtual size: 690KB

.rdata Size: 412KB - Virtual size: 411KB

.data Size: 47KB - Virtual size: 66KB

.rsrc Size: 7KB - Virtual size: 6KB

.text
Size: 690KB - Virtual size: 690KB

.rdata
Size: 412KB - Virtual size: 411KB

.data
Size: 47KB - Virtual size: 66KB

.rsrc
Size: 7KB - Virtual size: 6KB