36532aece31af39232d405aee5195829

Sharing

Copy URL Twitter E-mail

General

Target

36532aece31af39232d405aee5195829
Size

1.3MB
MD5

36532aece31af39232d405aee5195829
SHA1

10823fb2380e6c1aae71a0d6b15c5a8539207a2a
SHA256

8dfc3b464ecc28bd7df1c373b14e1465155fccc66bd795ac043fc053da784918
SHA512

e3d1cae22778145aba0d3c2c2e6e5d58888996d9a0ea11855870216b688592549e21ead3b3b97146f61bb6cd955ba96422d1ee43b7ff7af8747978ab0e247c3b
SSDEEP

24576:eEPIz7mSfGOs5dLuqNDYALPk91JFV2xP+LIirRx+kclEp:TPIXxsDuWPk9rfU+LImx+kcl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36532aece31af39232d405aee5195829

Files

36532aece31af39232d405aee5195829
.exe windows:4 windows x86 arch:x86

138c6e733708b6d08a284f66acb764d6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThread
GetCommandLineA
LoadLibraryExA
GetCurrentProcess
IsDBCSLeadByte
lstrcatA
GetSystemDirectoryA
OpenEventA
lstrcmpiA
SizeofResource
FindResourceA
LoadResource
lstrcpyA
GetModuleFileNameA
GetShortPathNameA
FreeLibrary
LoadLibraryA
GetProcAddress
GetLocalTime
GetModuleHandleA
GetLastError
GetVersionExA
GetTickCount
lstrlenA
WideCharToMultiByte
lstrcpynA
lstrlenW
GetCurrentThreadId
MultiByteToWideChar
ResetEvent
EnterCriticalSection
CloseHandle
WaitForMultipleObjects
WaitForSingleObject
CreateEventA
CreateThread
DeleteCriticalSection
LeaveCriticalSection
InterlockedDecrement
SetEvent
InitializeCriticalSection
InterlockedIncrement
DeleteFileA
GetTempPathA
Sleep
FlushFileBuffers
WriteFile
CompareStringW
ExitProcess
GetStringTypeW
GetStringTypeA
CompareStringA
LCMapStringA
SetStdHandle
LCMapStringW
GetStdHandle
SetHandleCount
GetFileType
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
GetOEMCP
FreeEnvironmentStringsA
GetCPInfo
IsBadWritePtr
GetACP
LocalFree
FormatMessageA
HeapSize
TerminateProcess
SetEnvironmentVariableA
SetEndOfFile
ReadFile
IsBadCodePtr
IsBadReadPtr
GetVersion
GetStartupInfoA
HeapFree
HeapReAlloc
HeapAlloc
RaiseException
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
SetUnhandledExceptionFilter
TlsGetValue
SetLastError
CreateDirectoryA
GetFullPathNameA
GetTimeZoneInformation
GetSystemTime
GetSystemInfo
GetUserDefaultLCID
OpenFile
RtlUnwind
CompareFileTime
DeviceIoControl
ExpandEnvironmentStringsA
WinExec
GetWindowsDirectoryA
GetFileAttributesA
GetFileSize
GetFileTime
SetFilePointer
CreateFileA
TlsAlloc
TlsSetValue
DefineDosDeviceA
QueryDosDeviceA
InterlockedExchange

user32

CloseDesktop
KillTimer
SetProcessWindowStation
SetThreadDesktop
OpenDesktopA
GetProcessWindowStation
OpenWindowStationA
GetThreadDesktop
CreateWindowExA
GetDesktopWindow
PostThreadMessageA
DispatchMessageA
RegisterClassExA
CharNextA
DefWindowProcA
GetMessageA
MessageBoxA
MsgWaitForMultipleObjects
LoadStringA
SetTimer
PeekMessageA
wsprintfA
CloseWindowStation

advapi32

StartServiceA
QueryServiceStatus
CloseServiceHandle
RegQueryInfoKeyA
RegSetValueExA
RegEnumValueA
RegOpenKeyExA
RegCloseKey
RegEnumKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
OpenSCManagerA
ControlService
OpenServiceA
DeregisterEventSource
ReportEventA
RegQueryValueExA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegisterEventSourceA
InitializeSecurityDescriptor
CopySid
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
GetLengthSid
OpenThreadToken
GetTokenInformation
OpenProcessToken
DeleteService
StartServiceCtrlDispatcherA
CreateServiceA

ole32

StringFromGUID2
CoInitialize
CoRevokeClassObject
CoRegisterClassObject
CoSuspendClassObjects
CoMarshalInterThreadInterfaceInStream
CoInitializeEx
CoGetInterfaceAndReleaseStream
CoUninitialize
CoTaskMemRealloc
CoResumeClassObjects
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoInitializeSecurity

oleaut32

LoadTypeLi
RegisterTypeLi
SysAllocString
SysStringLen
VarUI4FromStr
SysFreeString
SysAllocStringLen
VariantClear

setupapi

SetupDiSetClassInstallParamsA
SetupDiGetClassDevsA
SetupDiOpenDevRegKey
SetupDiCallClassInstaller
SetupDiGetDeviceInstanceIdA
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList

wsock32

htonl
htons

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

Sections

.text
Size: 848KB - Virtual size: 844KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 100KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tc
Size: 196KB - Virtual size: 196KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

138c6e733708b6d08a284f66acb764d6

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

setupapi

wsock32

version

Sections

.text Size: 848KB - Virtual size: 844KB

.rdata Size: 80KB - Virtual size: 79KB

.data Size: 100KB - Virtual size: 108KB

.rsrc Size: 60KB - Virtual size: 57KB

.tc Size: 196KB - Virtual size: 196KB

.text
Size: 848KB - Virtual size: 844KB

.rdata
Size: 80KB - Virtual size: 79KB

.data
Size: 100KB - Virtual size: 108KB

.rsrc
Size: 60KB - Virtual size: 57KB

.tc
Size: 196KB - Virtual size: 196KB