6d2ffc58ef12ff9202dca813374fded7

Sharing

Copy URL

Twitter E-mail

General

Target

6d2ffc58ef12ff9202dca813374fded7
Size

283KB
MD5

6d2ffc58ef12ff9202dca813374fded7
SHA1

d5461f2443d50abb450c6251e27d43b6d88ce1d8
SHA256

7eb5144c45a824a81a1baac9725521e3944accd335b6f248154e0dc1f8018ca7
SHA512

e9218c7fba5fd94e4cd73d789af27b81c9aac2d47cd05c5d2f55d3bb5aaa71afe145d4a69f1b17c0efa5049cf736e0dede0b8410b122082238ddc204cd902cc6
SSDEEP

6144:mr0etiKFEI+tI29XKxjp58BKTsQhsugUPjP7c/7NmD2Qx:mr/B++29XKxjp58BKA5U7AK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6d2ffc58ef12ff9202dca813374fded7

Files

6d2ffc58ef12ff9202dca813374fded7
.exe windows:5 windows x86 arch:x86

1b94892e37d72e774f6cd347451ccd86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

shell32

SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc

comctl32

PropertySheetW

setupapi

SetupCloseInfFile
SetupIterateCabinetA
SetupInitDefaultQueueCallbackEx
SetupInstallFromInfSectionA
SetupDefaultQueueCallbackW
SetupCopyErrorA
SetupPromptForDiskA
SetupFindNextLine
SetupGetFieldCount
SetupGetLineTextA
SetupFindFirstLineA
SetupGetStringFieldA
SetupGetLineByIndexA
SetupGetLineCountA
SetupTerminateFileLog
SetupQueryFileLogA
SetupInitializeFileLogA
SetupSetDirectoryIdA
SetupOpenInfFileA
SetupScanFileQueueA
SetupGetIntField
SetupInstallFilesFromInfSectionA
SetupQueueCopyA
SetupGetSourceInfoA
SetupGetSourceFileLocationA
SetupGetTargetPathA
SetupCloseFileQueue
SetupCommitFileQueueA
SetupOpenFileQueue
SetupDecompressOrCopyFileA
SetupDefaultQueueCallbackA

user32

LoadStringW
MessageBoxA
PostQuitMessage
DestroyWindow
SendMessageA
SetDlgItemTextA
ShowWindow
EnableWindow
GetDlgItem
DispatchMessageA
TranslateMessage
GetMessageA
CreateDialogParamA
SetForegroundWindow
PostThreadMessageA
SendDlgItemMessageA
SetWindowTextW
GetWindowTextA
EnumChildWindows
SetWindowLongA
PostMessageA
SetDlgItemTextW
GetWindowLongA
LoadBitmapA
IsDlgButtonChecked
MessageBoxW
CheckDlgButton
ReleaseDC
GetDC
SystemParametersInfoA
SetWindowTextA
EndDialog
DialogBoxParamA
GetDesktopWindow
SetFocus
wvsprintfW
LoadStringA

shlwapi

StrStrIA

ntdll

NtQuerySystemTime
strrchr
_stricmp
RtlUnwind
strncat
_aulldiv
_snprintf
wcscat
vsprintf
memmove
strncmp
RtlUnicodeStringToAnsiString
_strupr
_alldiv
strtoul
strstr
_allmul
memchr
sprintf
RtlTimeToTimeFields
_strnicmp
wcslen
swprintf
wcscpy
_itoa
_strlwr
_strcmpi
strncpy
_chkstk
NtClose
NtAdjustPrivilegesToken
NtOpenProcessToken
NtShutdownSystem
NtQueryInformationProcess
RtlCharToInteger
strchr

mpr

WNetGetUniversalNameA
WNetGetUserA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

ole32

CoInitialize
CoCreateInstance

winspool.drv

GetPrinterDriverDirectoryA

msvcrt

_initterm
__getmainargs
_acmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
isdigit
atoi
strcspn
ctime
__setusermatherr
_tempnam
remove
_lseek
_close
_write
_read
_open
_errno
_wcsdup
_strdup
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
calloc
getenv
malloc
rename
free

advapi32

QueryServiceStatus
EnumDependentServicesA
InitializeAcl
AddAccessAllowedAce
SetFileSecurityA
GetFileSecurityA
GetServiceDisplayNameA
RegOpenKeyA
RegDeleteValueA
OpenSCManagerA
OpenServiceA
StartServiceA
ControlService
CloseServiceHandle
AllocateAndInitializeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
FreeSid
RegSetKeySecurity
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSaveKeyA
RegQueryInfoKeyA
SetFileSecurityW
GetAclInformation
AddAce
CopySid
GetLengthSid
SetSecurityInfo
GetSecurityDescriptorDacl
SetSecurityDescriptorControl
GetSecurityInfo
AdjustTokenPrivileges
RegUnLoadKeyA
RegLoadKeyA
OpenProcessToken
DeregisterEventSource
ReportEventA
RegisterEventSourceA
GetTokenInformation
SetNamedSecurityInfoA
GetNamedSecurityInfoA
InitiateSystemShutdownA
RegQueryValueExW
RegOpenKeyExW
RegFlushKey

kernel32

LocalFileTimeToFileTime
SetFileTime
GetFileInformationByHandle
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetModuleHandleA
ExitThread
FormatMessageW
ReadFile
GetTickCount
CreateEventA
CreateThread
SetThreadPriority
WaitForSingleObject
SetEvent
RemoveDirectoryA
EnterCriticalSection
LeaveCriticalSection
DosDateTimeToFileTime
GetFileAttributesExA
SetFilePointer
WriteFile
VirtualFree
DeviceIoControl
GetPrivateProfileStringA
GetDiskFreeSpaceA
SetFileAttributesA
GetSystemDirectoryA
GetModuleFileNameA
VirtualAlloc
InitializeCriticalSection
GetVersionExA
lstrcmpiA
LocalAlloc
LocalFree
CreateFileA
GetFileSize
GetEnvironmentVariableA
CreateMutexA
GetWindowsDirectoryA
GetVolumeInformationW
GetWindowsDirectoryW
CreateFileMappingA
MapViewOfFile
Sleep
GetThreadLocale
GetLocaleInfoA
GetFullPathNameA
GetDriveTypeA
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
MultiByteToWideChar
UnmapViewOfFile
CloseHandle
LoadLibraryA
GetProcAddress
ExpandEnvironmentStringsA
FormatMessageA
SetLastError
GetFileAttributesA
GetLastError
CreateDirectoryA
GetSystemDirectoryW
GetComputerNameA
ReleaseSemaphore
InterlockedDecrement
GetCurrentThread
GetExitCodeThread
SetEndOfFile
CreateSemaphoreA
FlushViewOfFile
GetFileTime
GetExitCodeProcess
CreateProcessA
FlushFileBuffers
MoveFileExA
LoadResource
FindResourceA
MapViewOfFileEx
WideCharToMultiByte
SetEnvironmentVariableA
OpenEventA
WriteProcessMemory
VirtualAllocEx
CreateRemoteThread
OpenProcess
LoadLibraryW
lstrcmpiW
GetDriveTypeW
lstrcpynW
lstrcpyW
SearchPathW
ExpandEnvironmentStringsW
GetVersionExW
GetStartupInfoA
ExitProcess
TerminateThread
SetCurrentDirectoryA
GetSystemInfo
MoveFileA
GetTempFileNameA
lstrlenA
GetTempPathA
GetCurrentProcess
FreeLibrary
GetDiskFreeSpaceExA
CopyFileA

gdi32

CreateCompatibleDC
DeleteObject
GetDeviceCaps
SelectObject
SetLayout
StretchBlt
BitBlt
CreateFontIndirectA
GetDIBits

psapi

GetModuleFileNameExA

Sections

.text
Size: 181KB - Virtual size: 181KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 103KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1b94892e37d72e774f6cd347451ccd86

Headers

DLL Characteristics

File Characteristics

Imports

shell32

comctl32

setupapi

user32

shlwapi

ntdll

mpr

version

ole32

winspool.drv

msvcrt

advapi32

kernel32

gdi32

psapi

Sections

.text Size: 181KB - Virtual size: 181KB

.data Size: 1KB - Virtual size: 172KB

.rsrc Size: 103KB - Virtual size: 124KB

.text
Size: 181KB - Virtual size: 181KB

.data
Size: 1KB - Virtual size: 172KB

.rsrc
Size: 103KB - Virtual size: 124KB