52d97947c437423fcc93cea57ed29feb

Sharing

Copy URL Twitter E-mail

General

Target

52d97947c437423fcc93cea57ed29feb
Size

255KB
MD5

52d97947c437423fcc93cea57ed29feb
SHA1

b04db3276da09c42dfbf36e917aca3a2e0590a73
SHA256

26c614dad159a39e27914190b1fb338d61418bd7777f5e7d5c5c45d9c40f1641
SHA512

389198a82584cce6f920e563a9bfecf38386d4330e3c4c9483ebb208b241eb57212a7d6ce2aba5568c7324558b47f62875ab7d247a187e55b740a32773389870
SSDEEP

6144:FnuK3T6NfDQflOj/JePXpUUaEKEBaVPL034GeHe+Ibfj:BuCT6CtO9kXphKma5LQvSEbfj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
52d97947c437423fcc93cea57ed29feb

Files

52d97947c437423fcc93cea57ed29feb
.exe windows:4 windows x86 arch:x86

c72c0d83619208e10ed532b188af55aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msi

ord113

kernel32

SetFilePointer
LocalFree
LocalAlloc
HeapAlloc
GetProcessHeap
HeapFree
CreateMutexW
CreateFileMappingW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
ExpandEnvironmentStringsW
ReadFile
GlobalMemoryStatus
GetCommandLineW
WriteFile
EnterCriticalSection
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
VirtualQuery
ReleaseMutex
GetShortPathNameW
GetSystemTime
GetCurrentThreadId
GetSystemDirectoryW
ReadProcessMemory
Module32FirstW
Module32NextW
HeapReAlloc
HeapDestroy
GetLocalTime
CreateProcessW
LeaveCriticalSection
TryEnterCriticalSection
CreateThread
DeleteCriticalSection
OpenMutexW
FindResourceExW
WideCharToMultiByte
FindResourceW
LoadResource
LockResource
SizeofResource
FindNextFileW
FindClose
CreateDirectoryW
FindFirstFileW
FreeLibrary
GetSystemTimeAsFileTime
CreateFileW
OpenEventW
ResetEvent
MoveFileExW
WaitForMultipleObjects
CopyFileW
OpenProcess
Process32NextW
ProcessIdToSessionId
Process32FirstW
CreateToolhelp32Snapshot
GetModuleHandleW
DeleteFileW
SetLastError
WaitForSingleObject
CloseHandle
CreateEventW
SetUnhandledExceptionFilter
HeapSize
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
RaiseException
IsDebuggerPresent
SetErrorMode
VirtualAlloc

advapi32

ChangeServiceConfig2W
CreateServiceW
ControlService
CloseServiceHandle
StartServiceW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
CryptGenRandom
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteValueW
RegSetValueExW
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
RegCreateKeyExW
SetNamedSecurityInfoW
AddAce
AddAccessAllowedAce
InitializeAcl
GetLengthSid
GetAclInformation
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
GetAce
GetNamedSecurityInfoW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
FreeSid
GetUserNameW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CreateProcessAsUserW
AdjustTokenPrivileges
SetTokenInformation
LookupPrivilegeValueW
DuplicateTokenEx
OpenProcessToken
SetServiceStatus
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
RegEnumKeyW

shell32

SHGetFolderPathW
SHCreateDirectoryExW

shlwapi

PathRemoveBlanksW
PathFileExistsW
PathUnquoteSpacesW
PathAppendW
PathFindFileNameW
PathIsUNCServerShareW
SHDeleteKeyW
PathFileExistsA
PathRemoveExtensionW
PathRemoveFileSpecW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

psapi

EnumProcesses
EnumProcessModules
GetModuleFileNameExW

query

FsCiShutdown
LoadIFilter
SetCatalogState
?CoTaskAllocator@@3VCCoTaskAllocator@@A
LoadBinaryFilter
EndCacheTransaction
CiSvcMain

stclient

DllCanUnloadNow

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.SI
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.g
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MC
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.yutLcD
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Vi
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 213KB - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.YOES
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c72c0d83619208e10ed532b188af55aa

Headers

DLL Characteristics

File Characteristics

Imports

msi

kernel32

advapi32

shell32

shlwapi

userenv

version

psapi

query

stclient

Sections

.text Size: 16KB - Virtual size: 16KB

.SI Size: 2KB - Virtual size: 1KB

.g Size: 1KB - Virtual size: 1KB

.MC Size: 2KB - Virtual size: 2KB

.rdata Size: 5KB - Virtual size: 4KB

.yutLcD Size: 1KB - Virtual size: 2KB

.Vi Size: 1KB - Virtual size: 2KB

.data Size: 213KB - Virtual size: 256KB

.YOES Size: 2KB - Virtual size: 3KB

.rsrc Size: 9KB - Virtual size: 9KB

.text
Size: 16KB - Virtual size: 16KB

.SI
Size: 2KB - Virtual size: 1KB

.g
Size: 1KB - Virtual size: 1KB

.MC
Size: 2KB - Virtual size: 2KB

.rdata
Size: 5KB - Virtual size: 4KB

.yutLcD
Size: 1KB - Virtual size: 2KB

.Vi
Size: 1KB - Virtual size: 2KB

.data
Size: 213KB - Virtual size: 256KB

.YOES
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 9KB - Virtual size: 9KB