5c76171b7baee9c1b81b22fa876937f6

Sharing

Copy URL Twitter E-mail

General

Target

5c76171b7baee9c1b81b22fa876937f6
Size

143KB
MD5

5c76171b7baee9c1b81b22fa876937f6
SHA1

7a84f827df4d82b8f35f4d9704fa3511c0adeeaf
SHA256

7fae7d3539ad3a780bd27cc7f956468dd617e5ef497909a9452bf589e3b8c320
SHA512

f27c073651c5c5277a9a44649fb420ac34d9d4417025615139cfa2f5de3a75b462b0e1bdd6c20e1d004fb8c7fff68dda7f5d8d7b5fa2bd4c05d0f8452e69db0c
SSDEEP

3072:enMa44b6QrTt9B2eTh1NX5v9VpR4peaEAT5I01g:enMa4o6IHBTXB98pd/5I0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5c76171b7baee9c1b81b22fa876937f6

Files

5c76171b7baee9c1b81b22fa876937f6
.dll windows:4 windows x86 arch:x86

a1e823ff122c41530f36e2339e7c06b1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

InterlockedExchange
MoveFileExA
GetWindowsDirectoryA
GetTickCount
GetModuleHandleA
OutputDebugStringA
HeapAlloc
GetProcessHeap
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
CreateToolhelp32Snapshot
PeekNamedPipe
WaitForMultipleObjects
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
OpenEventA
SetErrorMode
CreateMutexA
SetUnhandledExceptionFilter
GetCurrentThreadId
ExitProcess
FreeConsole
LocalSize
lstrcmpiA
RaiseException
Process32First
Process32Next
GetShortPathNameA
DeviceIoControl
GetLocalTime
GetSystemDirectoryA
InitializeCriticalSection
SetLastError
GetModuleFileNameA
MoveFileA
WriteFile
SetFilePointer
ReadFile
CreateFileA
GetFileSize
RemoveDirectoryA
LocalAlloc
FindFirstFileA
LocalReAlloc
FindNextFileA
LocalFree
FindClose
GetLogicalDriveStringsA
GetVolumeInformationA
GetDiskFreeSpaceExA
CreateProcessA
CreateDirectoryA
GetLastError
DeleteFileA
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
WideCharToMultiByte
MultiByteToWideChar
lstrcatA
ExpandEnvironmentStringsA
GetPrivateProfileSectionNamesA
lstrlenA
OpenProcess
GetFileAttributesA
Sleep
CancelIo
lstrcpyA
CreateEventA
ResetEvent
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
FreeLibrary
CreateThread
ResumeThread
SetEvent
WaitForSingleObject
LoadLibraryA
GetProcAddress
TerminateThread
CloseHandle
TerminateProcess

user32

SendMessageA
SystemParametersInfoA
keybd_event
MapVirtualKeyA
mouse_event
SetCapture
WindowFromPoint
BlockInput
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
GetSystemMetrics
SetRect
SetCursorPos
GetDesktopWindow
ReleaseDC
LoadCursorA
GetCursorInfo
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
PostThreadMessageA
GetInputState
MoveWindow
GetWindowRect
ShowWindow
FindWindowA
GetWindowThreadProcessId
IsWindowVisible
CloseDesktop
SetThreadDesktop
IsWindow
CloseWindow
CreateWindowExA
DispatchMessageA
EnumWindows
GetKeyState
GetAsyncKeyState
DestroyCursor
GetForegroundWindow
GetWindowTextA
GetCursorPos
ExitWindowsEx
TranslateMessage
GetMessageA
wsprintfA
CharNextA
GetDC
MessageBoxA
PostMessageA
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop

gdi32

CreateCompatibleBitmap
GetDIBits
BitBlt
DeleteDC
SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteObject

advapi32

RegCloseKey
GetTokenInformation
LookupAccountSidA
SetServiceStatus
RegisterServiceCtrlHandlerA
LookupPrivilegeValueA
DuplicateTokenEx
SetTokenInformation
AdjustTokenPrivileges
OpenProcessToken
IsValidSid
LookupAccountNameA
LsaClose
LsaRetrievePrivateData
LsaOpenPolicy
LsaFreeMemory
RegQueryValueA
RegOpenKeyExA
CloseServiceHandle
DeleteService
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegSetValueExA
RegCreateKeyA
SetNamedSecurityInfoA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
SetEntriesInAclA
RegQueryValueExA
RegOpenKeyA
RegCreateKeyExA
CloseEventLog
ClearEventLogA
OpenEventLogA
ChangeServiceConfigA
FreeSid
RegSetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
CreateProcessAsUserA

shell32

SHGetFileInfoA
SHGetSpecialFolderPathA
ShellExecuteA

shlwapi

SHDeleteKeyA

msvcrt

_strnicmp
_itoa
_mbsupr
_stricmp
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
calloc
_beginthreadex
wcstombs
realloc
strncat
_snprintf
sprintf
puts
_strcmpi
wcscpy
_errno
strchr
strncpy
strncmp
atoi
_mbsstr
_mbsrchr
strcat
strrchr
malloc
free
strcmp
_except_handler3
strcpy
_CxxThrowException
memcmp
strstr
strlen
_ftol
ceil
memmove
__CxxFrameHandler
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
memset

winmm

waveOutOpen
waveInGetNumDevs
waveOutPrepareHeader
waveInOpen
waveInPrepareHeader
waveInAddBuffer
waveInStart
waveOutWrite
waveInUnprepareHeader
waveOutGetNumDevs

ws2_32

recv
ntohs
socket
gethostbyname
htons
closesocket
select
send
gethostname
connect
setsockopt
WSAIoctl
WSACleanup
WSAStartup
ioctlsocket
__WSAFDIsSet
recvfrom
inet_addr
getsockname
bind
getpeername
sendto
listen
accept
inet_ntoa

userenv

GetProfilesDirectoryA
CreateEnvironmentBlock
GetUserProfileDirectoryA

msvcp60

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ

netapi32

NetLocalGroupAddMembers
NetUserAdd

wininet

InternetOpenUrlA
InternetCloseHandle
InternetOpenA
InternetReadFile

msvfw32

ICOpen
ICSeqCompressFrameEnd
ICSeqCompressFrame
ICSeqCompressFrameStart
ICSendMessage
ICClose
ICCompressorFree

wtsapi32

WTSFreeMemory
WTSQueryUserToken
WTSQuerySessionInformationA

psapi

EnumProcessModules
GetModuleFileNameExA

Exports

Exports

aaaaa
bbbbb
ccccc
hi
start

Sections

.text
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a1e823ff122c41530f36e2339e7c06b1

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

shlwapi

msvcrt

winmm

ws2_32

userenv

msvcp60

netapi32

wininet

msvfw32

wtsapi32

psapi

Exports

Exports

Sections

.text Size: 135KB - Virtual size: 134KB

.rsrc Size: 1024B - Virtual size: 784B

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 135KB - Virtual size: 134KB

.rsrc
Size: 1024B - Virtual size: 784B

.reloc
Size: 6KB - Virtual size: 6KB