5d85f6dfc193ea8298d199e778aed573

Sharing

Copy URL Twitter E-mail

General

Target

5d85f6dfc193ea8298d199e778aed573
Size

260KB
MD5

5d85f6dfc193ea8298d199e778aed573
SHA1

9251b750241513c59568d67518bbb93f39314553
SHA256

3e9e48d42f5d6e71aa71066d42abd212e6afcabc2b1f8602025660089ee22758
SHA512

9129045390c2244d3e103253924f382b06a3ffff6768362523771d93b1697de3b3e09b185a1c3c998acd58d22cb3d5fda938cf716edb09bfa96a1f7e98f4f1b5
SSDEEP

6144:zAPTOCuq51JsmiQFF0kJNOlsh2IiobuUnGsf8AD:zoB7BsHQz8JmG0D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d85f6dfc193ea8298d199e778aed573

Files

5d85f6dfc193ea8298d199e778aed573
.exe windows:4 windows x86 arch:x86

f982bf68faea31fb085b9351d99b9619

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord823
ord825

msvcrt

free
_beginthread

atl

ord21
ord18
ord22
ord15
ord16
ord44
ord43
ord32
ord58
ord23

kernel32

GetVersionExW
SetEvent
WaitForSingleObject
IsBadReadPtr
GetNumberFormatW
GetLocaleInfoW
GetCurrentProcess
InitializeCriticalSection
lstrlenW
GetModuleFileNameW
lstrcpyW
GetShortPathNameW
GetModuleHandleW
lstrcmpiW
GetWindowsDirectoryW
GlobalAlloc
GetModuleHandleA
GetLastError
LoadLibraryW
LoadLibraryA
ExpandEnvironmentStringsW
lstrcmpW
GetCurrentThread
lstrcatW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
SetUnhandledExceptionFilter
MultiByteToWideChar
lstrlenA
LocalFree
GetProcessHeap
CreateEventW
GetProcAddress

user32

SetWindowTextW
SetFocus
SendMessageW
SetDlgItemTextW
DialogBoxParamW
SendDlgItemMessageW
wsprintfW
MessageBeep
ShowWindow
GetDlgItemInt
EndDialog
SetDlgItemInt
LoadImageW
SetCursor
LoadCursorW
ShowCursor
IsWindow
PeekMessageW
SetWindowLongW
PostMessageW
EnableWindow
GetDlgItemTextW
LoadBitmapW
IsDlgButtonChecked
LoadIconW
MessageBoxW
WinHelpW
GetSystemMetrics

advapi32

LookupPrivilegeValueW
OpenThreadToken
AdjustTokenPrivileges
ImpersonateSelf
RegOpenKeyW
RegQueryValueExW
GetUserNameW
LookupAccountNameW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
GetTokenInformation
RegDeleteKeyW
RegCloseKey
RegCreateKeyExW

oleaut32

SafeArrayGetLBound
SafeArrayGetElement
SysAllocStringByteLen
VariantChangeType
SafeArrayGetUBound
SysStringByteLen
VariantClear
VariantInit
SysStringLen
SysAllocString
SysFreeString

ole32

CoCreateInstance
CoInitialize
StringFromCLSID

gdi32

GetTextExtentPointW
DeleteObject

shell32

ShellExecuteW

shlwapi

StrFormatByteSizeW

samlib

SamCloseHandle
SamFreeMemory
SamGetGroupsForUser
SamSetMemberAttributesOfGroup
SamiSetDSRMPasswordOWF
SamCreateGroupInDomain
SamGetAliasMembership
SamEnumerateUsersInDomain
SamGetDisplayEnumerationIndex

Sections

.text
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Fq
Size: 2KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.SBYeOU
Size: 110KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.MDnc
Size: 2KB - Virtual size: 279KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.oFOQE
Size: 3KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.QHZGU
Size: 3KB - Virtual size: 211KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 5KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.kUM
Size: 107KB - Virtual size: 189KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f982bf68faea31fb085b9351d99b9619

Headers

File Characteristics

Imports

mfc42u

msvcrt

atl

kernel32

user32

advapi32

oleaut32

ole32

gdi32

shell32

shlwapi

samlib

Sections

.text Size: 14KB - Virtual size: 16KB

.Fq Size: 2KB - Virtual size: 45KB

.SBYeOU Size: 110KB - Virtual size: 192KB

.MDnc Size: 2KB - Virtual size: 279KB

.oFOQE Size: 3KB - Virtual size: 363KB

.rdata Size: 3KB - Virtual size: 5KB

.QHZGU Size: 3KB - Virtual size: 211KB

.data Size: 5KB - Virtual size: 268KB

.kUM Size: 107KB - Virtual size: 189KB

.rsrc Size: 7KB - Virtual size: 7KB

.text
Size: 14KB - Virtual size: 16KB

.Fq
Size: 2KB - Virtual size: 45KB

.SBYeOU
Size: 110KB - Virtual size: 192KB

.MDnc
Size: 2KB - Virtual size: 279KB

.oFOQE
Size: 3KB - Virtual size: 363KB

.rdata
Size: 3KB - Virtual size: 5KB

.QHZGU
Size: 3KB - Virtual size: 211KB

.data
Size: 5KB - Virtual size: 268KB

.kUM
Size: 107KB - Virtual size: 189KB

.rsrc
Size: 7KB - Virtual size: 7KB