4cc5b3ae900b580c2c8d4fd8e9d17f27

Sharing

Copy URL Twitter E-mail

General

Target

4cc5b3ae900b580c2c8d4fd8e9d17f27
Size

137KB
MD5

4cc5b3ae900b580c2c8d4fd8e9d17f27
SHA1

b926c2c7131621c8a08febf552ae1a9b46bb72dd
SHA256

55df1b6b53be42ae06d5d27993a794f38087d4b3d8eb9cae1a467113dda29e54
SHA512

497d265b68fcd7a92c6cdd9ab93cfc0daa1da129597f3c0084723f2038f8a6f27021aa8a635da6f65d5b3e4c910f5a1d763e445d60aa561ad640c8cd3ad998d8
SSDEEP

3072:3xBXnPTG0lo3Bwol2RpLhBQR5xqp6f6c6tDO00i8r5Mef+0xBnBO3:3xVzoSolkpfQR5xqMf6cykZFMs+0g

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4cc5b3ae900b580c2c8d4fd8e9d17f27

Files

4cc5b3ae900b580c2c8d4fd8e9d17f27
.exe .ps1 windows:5 windows x86 arch:x86 polyglot

2c8e252fe27666696d66ea4811287478

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

WmiSetSingleItemW
NotifyBootConfigStatus
AddAccessDeniedObjectAce
GetAuditedPermissionsFromAclA
WmiDevInstToInstanceNameA
ElfOpenEventLogA
ConvertSidToStringSidA
CryptEnumProviderTypesW
CreateServiceA
SystemFunction023
LsaICLookupNames
LsaOpenPolicy
SetKernelObjectSecurity
MD5Update
CloseEventLog
AccessCheckAndAuditAlarmA
I_ScSendTSMessage
SystemFunction004
AllocateLocallyUniqueId
CredDeleteA
LsaEnumerateTrustedDomains
ObjectDeleteAuditAlarmA
DeleteService
CredWriteA

rasman

RasmanUninitialize
RasRpcGetCountryInfo
RasBundleGetStatisticsEx
RasPortListen
RasRpcGetErrorString
RasRpcGetDevConfig
RasInitializeNoWait
RasRpcGetSystemDirectory
RasPortEnumProtocols
RasPortGetProtocolCompression
RasProtocolEnum
RasPortSetInfo
RasGetCalledIdInfo
RasSetConnectionParams
RasSendCreds

wininet

InternetGetConnectedStateExA
DeleteUrlCacheGroup
GopherGetAttributeW
InternetTimeToSystemTimeW
FindNextUrlCacheGroup
GetUrlCacheConfigInfoW
GetUrlCacheEntryInfoExW
FtpCreateDirectoryW
HttpSendRequestExA
SetUrlCacheConfigInfoA
HttpAddRequestHeadersW
InternetSetFilePointer
CreateUrlCacheContainerA
SetUrlCacheConfigInfoW
InternetGetCookieExW
FindNextUrlCacheEntryExW
GetUrlCacheEntryInfoA
FindNextUrlCacheEntryA
InternetOpenUrlW

kernel32

InterlockedPushEntrySList
GetVolumeInformationW
InitializeCriticalSectionAndSpinCount
SetThreadPriority
WriteConsoleInputVDMA
UpdateResourceW
LoadLibraryA
ClearCommBreak
ExitProcess
GetConsoleCursorMode
OpenProcess
Module32Next
GetLocaleInfoW
GlobalFindAtomW
GetNextVDMCommand
FindNextFileW
GetEnvironmentStringsW
ReadFile
IsValidCodePage
GlobalDeleteAtom
DefineDosDeviceW
VirtualAlloc
VirtualLock
GetFirmwareEnvironmentVariableW
GetProcessShutdownParameters
VerifyVersionInfoA
CreateMemoryResourceNotification

hid

HidP_SetUsages
HidP_MaxUsageListLength
HidP_GetCaps
HidP_GetUsageValue
HidD_SetConfiguration
HidD_Hello
HidP_SetScaledUsageValue
HidP_GetButtonCaps
HidD_SetFeature
HidP_GetUsagesEx
HidD_GetAttributes
HidD_GetProductString
HidP_UnsetUsages
HidP_MaxDataListLength
HidD_GetPreparsedData
HidP_GetExtendedAttributes
HidD_GetIndexedString

ntdll

NtOpenFile
ZwAllocateLocallyUniqueId
NtSetDefaultLocale
RtlIpv4AddressToStringA
RtlCopySid
ZwImpersonateThread
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle
RtlCompareUnicodeString
_alldiv
RtlCaptureStackBackTrace
RtlSetIoCompletionCallback
towlower
DbgUserBreakPoint
RtlGetSaclSecurityDescriptor
_wtoi64
RtlQuerySecurityObject
ZwSetUuidSeed
ZwMakeTemporaryObject
ZwCreateMutant
NtSetDebugFilterState
RtlAbsoluteToSelfRelativeSD

Sections

.text
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2c8e252fe27666696d66ea4811287478

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

rasman

wininet

kernel32

hid

ntdll

Sections

.text Size: 117KB - Virtual size: 116KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 1KB - Virtual size: 154KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 236B

.text
Size: 117KB - Virtual size: 116KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 1KB - Virtual size: 154KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 236B