4ce04df9b64c11c1aa0ed741479e562d

Sharing

Copy URL Twitter E-mail

General

Target

4ce04df9b64c11c1aa0ed741479e562d
Size

3.1MB
MD5

4ce04df9b64c11c1aa0ed741479e562d
SHA1

7dc00a087f7071518ab8f443b2040869d27033c5
SHA256

f0b3aec3e91ed94565f3f05153f7ebd53973e91a1f3f8cc02297acd55c88cdc8
SHA512

a0a184b257e8947478ad3255137929436eb1633360c86dd1e9edcec65692f99570e1f341847000f4d946f8b66b26654eadd2d0e9aa9541f467e07943544562e9
SSDEEP

98304:AgylX0QjLrpPhOiae6VN4EfLtigD/Wm3r0:Ajb1j5sZJigD+m3r0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ce04df9b64c11c1aa0ed741479e562d

Files

4ce04df9b64c11c1aa0ed741479e562d
.exe windows:4 windows x86 arch:x86

d27005fc1fede44c4f151232aa1944a4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msimg32

TransparentBlt

shell32

SHCreateDirectoryExW
CommandLineToArgvW
SHFileOperationW
SHBrowseForFolderW
SHGetSpecialFolderPathW
Shell_NotifyIconW
ShellExecuteW
SHGetPathFromIDListW
SHGetSpecialFolderLocation

msi

ord32
ord159
ord118
ord8
ord92
ord160
ord195
ord137
ord169
ord141
ord70
ord88

advapi32

QueryServiceStatus
RegOpenKeyExW
StartServiceW
OpenServiceW
ChangeServiceConfigW
OpenSCManagerW
RegCreateKeyW
CloseServiceHandle
RegSetValueExW
RegDeleteValueW
RegEnumKeyW
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey

shlwapi

PathFileExistsW
PathStripToRootW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

ws2_32

htons
closesocket
connect
WSAStartup
socket
recv
htonl
send
inet_addr
WSACleanup

kernel32

GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetUserDefaultLCID
GetLocaleInfoA
GetStartupInfoA
GetFileType
SetHandleCount
FlushFileBuffers
GetStdHandle
HeapCreate
HeapDestroy
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetConsoleMode
GetConsoleCP
ExitProcess
GetStringTypeW
FormatMessageW
LocalFree
GetLastError
CloseHandle
EnterCriticalSection
FindFirstFileW
CreateMutexW
GetCurrentDirectoryW
GetFileAttributesW
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
SetFileAttributesW
GetSystemDirectoryW
GetVersionExW
LeaveCriticalSection
CreateProcessW
GetModuleFileNameW
VirtualFree
VirtualAlloc
ReadFile
CreateFileW
MultiByteToWideChar
LockResource
FreeResource
GetDriveTypeW
FindResourceW
LoadResource
CreateDirectoryW
WriteFile
EnumSystemLocalesA
GlobalAlloc
GlobalLock
GlobalUnlock
CreateThread
Sleep
FindClose
GetPrivateProfileIntW
GetDiskFreeSpaceExW
FreeEnvironmentStringsA
FindNextFileW
FreeLibrary
GetPrivateProfileStringW
LoadLibraryW
MoveFileExW
GetProcAddress
RemoveDirectoryW
DeleteFileW
WritePrivateProfileStringW
CopyFileW
GetWindowsDirectoryW
MoveFileW
QueryPerformanceCounter
QueryPerformanceFrequency
IsBadWritePtr
IsBadReadPtr
RemoveDirectoryA
WaitForSingleObject
Process32NextW
lstrcmpiW
TerminateProcess
DeleteFileA
OpenProcess
lstrcatA
GetACP
lstrcmpW
Process32FirstW
CreateToolhelp32Snapshot
GetCommandLineW
GetModuleHandleW
GetTickCount
GetSystemTimeAsFileTime
GetProcessTimes
GetCurrentProcessId
SetFilePointer
LoadLibraryA
GetCurrentProcess
GetModuleFileNameA
GetModuleHandleA
RaiseException
InterlockedIncrement
InterlockedDecrement
GlobalFree
GetStringTypeA
GetCPInfo
LCMapStringW
LCMapStringA
RtlUnwind
GetStartupInfoW
GetProcessHeap
GetVersionExA
HeapSize
HeapReAlloc
IsDebuggerPresent
IsValidLocale
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapAlloc
HeapFree
InterlockedExchange
InterlockedCompareExchange
WideCharToMultiByte
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
CreateFileA
SetEndOfFile
GetThreadLocale
SizeofResource
LocalAlloc

user32

ExitWindowsEx
GetClassInfoExW
DefWindowProcW
GetDesktopWindow
RegisterClassExW
CharNextW
GetKeyboardLayoutList
EnumWindows
PtInRect
GetCursorPos
GetWindowDC
ReleaseDC
IsWindowVisible
LoadCursorW
SetWindowLongW
BringWindowToTop
GetWindowThreadProcessId
LoadBitmapW
OffsetRect
SetWindowPos
DestroyWindow
SetDlgItemTextW
TrackMouseEvent
GetDC
CallNextHookEx
GetClassNameW
SetWindowsHookExW
MapVirtualKeyW
UnhookWindowsHookEx
SetCursor
SetWindowRgn
GetParent
PostMessageW
GetClientRect
DrawTextW
GetWindowLongW
GetWindowRect
CreateDialogParamW
GetDlgItem
SetWindowTextW
GetWindowTextW
ShowWindow
TranslateAcceleratorW
GetMessageW
SendMessageW
TranslateMessage
DispatchMessageW
LoadAcceleratorsW
EndDialog
MessageBoxW
DialogBoxParamW
DestroyIcon
ReleaseCapture
KillTimer
InvalidateRect
SetTimer
UpdateWindow
IsWindow
GetFocus
GetDlgItemTextW
GetKeyState
DrawIconEx
CreateWindowExW
SetFocus
SetClassLongW
PostQuitMessage
GetWindow
LoadImageW
GetActiveWindow
GetDlgCtrlID
EnableWindow

gdi32

CreateFontW
CreateCompatibleDC
CreateRoundRectRgn
SetBkColor
GetObjectW
BitBlt
SelectObject
DeleteDC
CreateCompatibleBitmap
GetStockObject
DeleteObject
GetTextExtentExPointW
SetTextColor
SetBkMode

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
StringFromCLSID
CreateStreamOnHGlobal

oleaut32

SysStringLen
SysAllocString
SysFreeString

imm32

ImmGetDescriptionW

Sections

.text
Size: 292KB - Virtual size: 291KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33.9MB - Virtual size: 33.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d27005fc1fede44c4f151232aa1944a4

Headers

File Characteristics

Imports

msimg32

shell32

msi

advapi32

shlwapi

version

ws2_32

kernel32

user32

gdi32

ole32

oleaut32

imm32

Sections

.text Size: 292KB - Virtual size: 291KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 12KB - Virtual size: 49KB

.rsrc Size: 33.9MB - Virtual size: 33.9MB

.text
Size: 292KB - Virtual size: 291KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 12KB - Virtual size: 49KB

.rsrc
Size: 33.9MB - Virtual size: 33.9MB