2f7b4b9a5c3502f169ce3794494c2def

Sharing

Copy URL

Twitter E-mail

General

Target

2f7b4b9a5c3502f169ce3794494c2def
Size

168KB
MD5

2f7b4b9a5c3502f169ce3794494c2def
SHA1

4c7e3564d1a80bc9e88025187cea74a3e20086d8
SHA256

e632687a5084694cedc662b944246e1bc7f4d60501e837e3f9e690bf2a60e6dc
SHA512

d9cc86794f78404c0d7eeb62e8e06d4075de05235f204d5ff332afe1c0126fb4a3d0358dcf29e3ba461805f7077d552626e80f44bbdeca689a2feceaafc42f4a
SSDEEP

3072:loQ28vrGOmeb7bmI6Cuuzhs55y4FrCWjr0Zv43MpNS:eevCOmo79jhs559F9jr0Zv43x

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f7b4b9a5c3502f169ce3794494c2def

Files

2f7b4b9a5c3502f169ce3794494c2def
.exe windows:5 windows x86 arch:x86

3893eb55f1fbff971e6a297fb0fb3fea

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

credui

CredUIInitControls
CredUIParseUserNameW

kernel32

VirtualAlloc
GetLastError

dnsapi

DnsNameCompareEx_W

apphelp

SetPermLayers

ole32

CoMarshalInterThreadInterfaceInStream
ReleaseStgMedium
CoTaskMemAlloc
CoCreateInstance
CoGetCallContext
CoGetInterfaceAndReleaseStream
StringFromIID
CoTaskMemFree

cryptui

CryptUIDlgSelectCertificateW
CryptUIDlgViewCertificateW

gdi32

SetBkColor
SetTextColor
CreateFontIndirectW
GetDeviceCaps
CreateBitmap
ClearBitmapAttributes
CreatePatternBrush
GetTextExtentPoint32W

crypt32

CertEnumCertificatesInStore
CertDuplicateStore
CryptQueryObject
CertFreeCertificateContext
CertOpenStore
CertGetNameStringW
CertGetCertificateContextProperty
CertCloseStore
CertEnumSystemStore
CertSaveStore
CertControlStore
CryptFindOIDInfo
CertAddCertificateContextToStore
CertFindCertificateInStore
CertDeleteCertificateFromStore
CertGetEnhancedKeyUsage
CertDuplicateCertificateContext
CryptDecodeObject

ntdll

RtlSubAuthoritySid
RtlInitUnicodeString
RtlSubAuthorityCountSid
NtQuerySystemTime
RtlNtStatusToDosError
RtlIdentifierAuthoritySid

dsprop

ADsPropGetInitInfo
ADsPropCreateNotifyObj
FindSheet
ADsPropSetHwndWithTitle
ADsPropSetHwnd
ADsPropSendErrorMessage
ADsPropShowErrorDialog

shlwapi

PathIsUNCServerShareW
PathAppendW

shell32

SHGetFolderPathW

Sections

.text
Size: 512B - Virtual size: 404B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3893eb55f1fbff971e6a297fb0fb3fea

Headers

DLL Characteristics

File Characteristics

Imports

credui

kernel32

dnsapi

apphelp

ole32

cryptui

gdi32

crypt32

ntdll

dsprop

shlwapi

shell32

Sections

.text Size: 512B - Virtual size: 404B

.data Size: 18KB - Virtual size: 3.5MB

.rsrc Size: 104KB - Virtual size: 104KB

.idata Size: 2KB - Virtual size: 2KB

.rdata Size: 41KB - Virtual size: 40KB

.reloc Size: 512B - Virtual size: 28B

.text
Size: 512B - Virtual size: 404B

.data
Size: 18KB - Virtual size: 3.5MB

.rsrc
Size: 104KB - Virtual size: 104KB

.idata
Size: 2KB - Virtual size: 2KB

.rdata
Size: 41KB - Virtual size: 40KB

.reloc
Size: 512B - Virtual size: 28B