692e20df40f9127020cd4e476bcb7d78

Sharing

Copy URL Twitter E-mail

General

Target

692e20df40f9127020cd4e476bcb7d78
Size

424KB
MD5

692e20df40f9127020cd4e476bcb7d78
SHA1

5f0024d6aa6cf05e800aadbaf0a65ebab5050ff9
SHA256

5a7bc1095d6565927992404ab79a57991b3fa8738f0d6c27c4eba4bd7aa3aeab
SHA512

754ac5977a8cd53c4bdf759a0e7a31798f5f8dce05851e7c36eefc53425ded07641a4e8837fce4ac018b3b3be775d8a695be040c824e46f2d4ea3d5a308517e7
SSDEEP

6144:XE6JGnBYwjO5AZA0OQMbgPyQlTgALXqo1jmUZxL6xQGQgg3:bJGnBiAZAYMcPPZNLXqs76PG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
692e20df40f9127020cd4e476bcb7d78

Files

692e20df40f9127020cd4e476bcb7d78
.exe windows:4 windows x86 arch:x86

3edda5fa84bc5401ea1dbae1da2c9626

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

hprbutil

?SetIntegerValue@CHPRBIniHandler@@QAEHPBD0H@Z
?GetIntegerValue@CHPRBIniHandler@@QAEHPBD0H@Z
?SetDwordValue@CHPRBReg@@QAEJPBDK0@Z
?GetStringValue@CHPRBReg@@QAEJPBDPADPAK0@Z
?GetDwordValue@CHPRBReg@@QAEJPBDPAK0@Z
?GetStringValue@CHPRBIniHandler@@QAEJPBD00AAPAD@Z
??0CHPRBReg@@QAE@XZ
??0CHPRBIniHandler@@QAE@XZ
??1CHPRBIniHandler@@UAE@XZ

wininet

InternetGetConnectedState

mfc80

ord2646
ord2540
ord2862
ord2714
ord4307
ord2835
ord2731
ord2537
ord5200
ord1599
ord1655
ord1656
ord1964
ord5175
ord1362
ord4967
ord3345
ord6277
ord3802
ord6279
ord1522
ord2172
ord2178
ord2405
ord2387
ord2385
ord2408
ord2413
ord2394
ord2410
ord934
ord930
ord932
ord928
ord923
ord5960
ord1600
ord4282
ord4722
ord3403
ord5203
ord4185
ord6275
ord5073
ord1908
ord5152
ord4244
ord1401
ord3946
ord1617
ord1620
ord5912
ord6724
ord1551
ord1670
ord1671
ord2020
ord4890
ord4735
ord4212
ord5182
ord605
ord3641
ord762
ord3255
ord1181
ord5320
ord1084
ord2371
ord3683
ord4467
ord4469
ord4473
ord593
ord427
ord334
ord664
ord757
ord765
ord6090
ord5225
ord5119
ord959
ord547
ord4031
ord5975
ord1054
ord763
ord6286
ord566
ord3333
ord4261
ord4481
ord2838
ord5566
ord5213
ord5230
ord4568
ord3948
ord5226
ord5224
ord2931
ord1920
ord3832
ord5382
ord6219
ord5102
ord1010
ord3806
ord5583
ord2018
ord2063
ord4326
ord6276
ord3801
ord6278
ord4014
ord4038
ord5331
ord6297
ord686
ord3169
ord2942
ord2849
ord1950
ord2058
ord3909
ord5947
ord3906
ord3114
ord5944
ord5571
ord3399
ord2718
ord4114
ord4117
ord6066
ord3759
ord2653
ord5802
ord4124
ord6064
ord6089
ord3988
ord2163
ord5831
ord5832
ord2146
ord1312
ord1320
ord5315
ord6720
ord1091
ord6754
ord2250
ord314
ord2253
ord2252
ord2430
ord2815
ord1123
ord454
ord3450
ord3645
ord368
ord4264
ord4482
ord6043
ord5934
ord2768
ord3040
ord4222
ord1922
ord4739
ord4852
ord4257
ord5495
ord2742
ord5412
ord1379
ord5592
ord5156
ord2051
ord2016
ord6238
ord2621
ord2614
ord4566
ord616
ord4705
ord781
ord304
ord907
ord4457
ord1609
ord1735
ord6722
ord5160
ord5141
ord6103
ord1628
ord1629
ord3919
ord3602
ord2533
ord5166
ord4129
ord4587
ord4104
ord4200
ord2803
ord2036
ord1489
ord2902
ord299
ord6703
ord6118
ord3244
ord2094
ord4100
ord1955
ord1283
ord1308
ord2176
ord5403
ord2475
ord297
ord2938
ord1024
ord6144
ord5563
ord3997
ord4885
ord648
ord4273
ord2717
ord1360
ord3344
ord5206
ord5151
ord1402
ord5914
ord6764
ord3974
ord4860
ord4863
ord4379
ord4384
ord4381
ord4399
ord4401
ord4386
ord4776
ord4178
ord4171
ord4980
ord4781
ord4204
ord4790
ord4443
ord4444
ord3740
ord4914
ord1207
ord4520
ord4920
ord4559
ord5049
ord4439
ord4368
ord4501
ord4846
ord4970
ord4480
ord4516
ord4673
ord4948
ord4794
ord4287
ord4376
ord4377
ord4963
ord4796
ord4710
ord4805
ord5053
ord4964
ord4649
ord4946
ord4507
ord4961
ord4674
ord4131
ord1302
ord2008
ord4132
ord2419
ord2420
ord2418
ord2417
ord2272
ord631
ord2891
ord2288
ord2280
ord386
ord3650
ord4470
ord2141
ord410
ord2566
ord4364
ord3466
ord742
ord635
ord562
ord553
ord395
ord4265
ord4277
ord1306
ord2173
ord5205
ord5148
ord3945
ord5915
ord6725
ord1557
ord4019
ord2424
ord2425
ord2992
ord5356
ord943
ord4904
ord2939
ord4135
ord4309
ord5012
ord5009
ord2615
ord1913
ord2246
ord751
ord5165
ord4250
ord4041
ord5859
ord4299
ord6065
ord6281
ord6283
ord6063
ord3758
ord3648
ord3552
ord718
ord3132
ord516
ord4720
ord5211
ord4736
ord4213
ord4190
ord4844
ord4617
ord4797
ord5070
ord5072
ord5071
ord6747
ord3667
ord4580
ord4867
ord3553
ord721
ord980
ord1509
ord528
ord4272
ord1521
ord4280
ord5212
ord1582
ord4583
ord1327
ord3668
ord658
ord1979
ord572
ord3230
ord2958
ord5214
ord4238
ord2092
ord3879
ord3875
ord1290
ord2657
ord5873
ord2403
ord2415
ord2392
ord2396
ord2398
ord2400
ord2390
ord5233
ord5235
ord1613
ord1612
ord6719
ord1727
ord300
ord4529
ord4971
ord2421
ord1614
ord1230
ord3718
ord3719
ord3709
ord2644
ord3949
ord4486
ord4262
ord3182
ord354
ord2662
ord5807
ord2322
ord4035
ord2248
ord1191
ord870
ord784
ord3934
ord1482
ord911
ord2131
ord266
ord265
ord1187
ord1185
ord310
ord876
ord578
ord4067
ord764
ord3477
ord4519

msvcr80

__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_amsg_exit
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_encode_pointer
_unlock
_except_handler4_common
wcslen
setlocale
atoi
strftime
_mbsnbcmp
_mbscmp
_mbsstr
_mbschr
_time64
_localtime64_s
memcpy
_resetstkoflw
_recalloc
calloc
sprintf
wcscpy_s
free
malloc
_mbsrchr
memset
memcpy_s
__CxxFrameHandler3
strtol
_CxxThrowException
_setmbcp

kernel32

InterlockedExchange
GetVersionExA
GetThreadLocale
GetACP
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
WideCharToMultiByte
GetLastError
GetVersion
FreeLibrary
CloseHandle
CreateProcessA
GetModuleFileNameA
LocalFree
FormatMessageA
LoadLibraryA
lstrlenW
CompareStringA
CompareStringW
lstrcmpiA
lstrcmpiW
lstrlenA
GetEnvironmentVariableA
GetEnvironmentVariableW
GetStringTypeExA
GetStringTypeExW
InterlockedDecrement
GetExitCodeProcess
WaitForSingleObject
GetLocaleInfoA
Sleep
InterlockedCompareExchange
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
MultiByteToWideChar

user32

GetSystemMetrics
SetMenu
GetWindowRect
EnumChildWindows
GetClientRect
SetForegroundWindow
PostMessageA
GetMenuItemID
GetMenuItemCount
AppendMenuA
CreatePopupMenu
CreateMenu
CharUpperW
CharUpperA
CharLowerW
CharLowerA
EnableWindow
UpdateWindow
GetMenu
RemoveMenu
MessageBoxA
SendMessageA

shell32

ShellExecuteA
ShellExecuteExA

ole32

CoTaskMemAlloc
CoCreateInstance

oleaut32

SafeArrayCreateVector
SafeArrayAccessData
VarBstrFromDate
VarUdateFromDate
SafeArrayDestroy
VariantChangeType
VariantCopy
VariantInit
SysStringByteLen
SysAllocStringByteLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocString
SysAllocStringLen
VarBstrCat
SysFreeString
SysStringLen
GetErrorInfo
SetErrorInfo
CreateErrorInfo
SafeArrayUnaccessData
VariantClear

Sections

.text
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tc
Size: 204KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3edda5fa84bc5401ea1dbae1da2c9626

Headers

File Characteristics

Imports

hprbutil

wininet

mfc80

msvcr80

kernel32

user32

shell32

ole32

oleaut32

Sections

.text Size: 120KB - Virtual size: 119KB

.rdata Size: 48KB - Virtual size: 47KB

.data Size: 4KB - Virtual size: 3KB

.idata Size: 12KB - Virtual size: 9KB

.rsrc Size: 32KB - Virtual size: 30KB

.tc Size: 204KB - Virtual size: 204KB

.text
Size: 120KB - Virtual size: 119KB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 4KB - Virtual size: 3KB

.idata
Size: 12KB - Virtual size: 9KB

.rsrc
Size: 32KB - Virtual size: 30KB

.tc
Size: 204KB - Virtual size: 204KB