4c45a275eb03fdbc4adebb3eb06e2fad

Sharing

Copy URL Twitter E-mail

General

Target

4c45a275eb03fdbc4adebb3eb06e2fad
Size

1.2MB
MD5

4c45a275eb03fdbc4adebb3eb06e2fad
SHA1

6c4553f9bca508e3b25a72b824a75293d6699e75
SHA256

e9281414b98bef16c8442b69128c4a697a6225f93bab781d649453cd04ec6e55
SHA512

bfa2f4241e32e9dfaf06a7b069139120a6ea1f14f0323e172432262a52163fea73a1bdbd9ebe77eb81a5f7a6c48640b7b28c0eaade7253d1efebb9a8d37914bd
SSDEEP

24576:9jBw8hcFGr6LqVJxcisjsh/9z2AzNbOfj9vcFGr6LqVJxcisjsh/9z2AzNbOfj9T:937x

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c45a275eb03fdbc4adebb3eb06e2fad

Files

4c45a275eb03fdbc4adebb3eb06e2fad
.exe windows:4 windows x86 arch:x86

9e1125ac63d2e747df42d7a16a030924

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

Shell_NotifyIconA
SHGetFolderPathA
ShellExecuteA

ws2_32

shutdown
WSAEnumProtocolsA
WSASetLastError
WSAEventSelect
htonl
connect
WSAAccept
WSAEnumNetworkEvents
WSASocketA
WSAWaitForMultipleEvents
ioctlsocket
inet_ntoa
gethostname
gethostbyname
getprotobyname
accept
WSAGetLastError
getpeername
WSAAddressToStringA
setsockopt
WSACloseEvent
send
select
recv
WSASetEvent
WSACleanup
WSAStartup
socket
closesocket
bind
listen
inet_addr
htons
WSACreateEvent

advapi32

AllocateAndInitializeSid
SetSecurityDescriptorDacl
RegEnumKeyA
GetUserNameA
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegEnumValueA
RegDeleteValueA
InitializeSecurityDescriptor
FreeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
MakeSelfRelativeSD

kernel32

GetProcessHeap
OutputDebugStringW
InterlockedCompareExchange
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetSystemTimeAsFileTime
LoadLibraryW
GetLastError
SetLastError
GetModuleFileNameW
OutputDebugStringA
GetCurrentThreadId
lstrlenA
ProcessIdToSessionId
GetCurrentProcessId
LocalFree
CompareStringA
LocalAlloc
GetModuleFileNameA
GetCurrentProcess
SetProcessWorkingSetSize
Sleep
CreateSemaphoreA
OpenSemaphoreA
CreateMutexA
CloseHandle
SetEvent
GetTickCount
WaitForSingleObject
ReleaseSemaphore
CreateThread
CreateEventA
LocalReAlloc
FormatMessageA
lstrcmpiA
RaiseException
FreeLibrary
CreateFileA
MultiByteToWideChar
LoadLibraryA
ReleaseMutex
UnmapViewOfFile
FlushViewOfFile
OpenMutexA
MapViewOfFile
CreateFileMappingA
lstrcmpA
InterlockedExchange
WideCharToMultiByte
lstrcpynA
IsDBCSLeadByte
lstrlenW
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
SetEndOfFile
WriteFile
ReadFile
SetFilePointer
GetFileSize
GetLocalTime
GetTempPathA
GetVersionExA
HeapAlloc
HeapFree
VirtualAlloc
GetSystemInfo
VirtualFree
ExitThread
InterlockedIncrement
SetThreadPriority
GetCurrentThread
ResumeThread
DebugBreak
ResetEvent
SetCommState
GetCommState
EscapeCommFunction
GetOverlappedResult
PurgeComm
GetCommModemStatus
ClearCommError
WaitCommEvent
SetCommMask
SetCommTimeouts
GetCommTimeouts
HeapCreate
HeapDestroy
IsBadWritePtr
DeviceIoControl

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

ole32

CLSIDFromString
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoInitializeEx

shlwapi

StrCpyNW
PathFindFileNameA

crypt32

CryptUnprotectData
CryptProtectData

setupapi

SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA

ceutil

CeSvcGetBinary
CeSvcSetBinary
CeSvcClose
CeSvcSetDword
CeSvcOpen
CeSvcGetDword
CeSvcGetString
CeSvcSetString

rapi

CeRapiInitEx
CeRapiUninit
CeRegCreateKeyEx
CeRegSetValueEx
CeRegCloseKey

tcp2udp

TCP2UDPStartup
TCP2UDPShutdown

msvcr80

_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
__dllonexit
_encode_pointer
_unlock
_except_handler4_common
_wcsnicmp
__setusermatherr
_adjust_fdiv
memcpy
_purecall
fopen
fputs
fflush
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_configthreadlocale
fclose
wcsncpy
_vsnwprintf_s
malloc
_mbsstr
_vsnprintf_s
??3@YAXPAX@Z
memmove
memset
??2@YAPAXI@Z
_stricmp
_mbscmp
_wcslwr
_mbsnbcpy
_mbsicmp
_mbsnbicmp
free
calloc
_recalloc
??_V@YAXPAX@Z
??_U@YAPAXI@Z
strchr

gdi32

CreateFontIndirectA
GetDeviceCaps
GetTextExtentPoint32A
SelectObject
GetObjectA
DeleteObject

user32

SetWindowLongA
SetDlgItemTextA
GetSystemMenu
CheckDlgButton
GetDlgItemTextA
LoadIconA
SendDlgItemMessageA
ShowWindow
SetFocus
IsDlgButtonChecked
EndDialog
SetWindowTextA
GetWindowRect
ScreenToClient
SetWindowPos
GetDlgItem
GetSystemMetrics
PostMessageA
SendMessageTimeoutA
IsWindow
DispatchMessageA
TranslateMessage
MsgWaitForMultipleObjects
SetCursor
PeekMessageA
LoadCursorA
DestroyMenu
TrackPopupMenu
SetForegroundWindow
GetLastActivePopup
GetCursorPos
EnableMenuItem
SetMenuDefaultItem
GetSubMenu
LoadMenuA
SetTimer
GetDoubleClickTime
KillTimer
DestroyWindow
RegisterClassA
CreateWindowExA
CreateDialogParamA
ReleaseDC
SystemParametersInfoA
GetDC
MessageBoxA
LoadStringA
LoadImageA
PostQuitMessage
GetClientRect
SendMessageA
IsWindowEnabled
MessageBeep
DefWindowProcA
RegisterWindowMessageA
DestroyIcon
FindWindowA
GetMessageA
DialogBoxParamA
EnableWindow
SetParent
IsWindowVisible
GetWindowLongA
GetParent

winmm

PlaySoundA

Sections

.text
Size: 188KB - Virtual size: 186KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9e1125ac63d2e747df42d7a16a030924

Headers

DLL Characteristics

File Characteristics

Imports

shell32

ws2_32

advapi32

kernel32

version

ole32

shlwapi

crypt32

setupapi

ceutil

rapi

tcp2udp

msvcr80

gdi32

user32

winmm

Sections

.text Size: 188KB - Virtual size: 186KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 1.0MB - Virtual size: 1.0MB

.text Size: 12KB - Virtual size: 9KB

.text
Size: 188KB - Virtual size: 186KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

.text
Size: 12KB - Virtual size: 9KB