f9f2936835cc7d4f2ada84787ecb7671

Sharing

Copy URL Twitter E-mail

General

Target

f9f2936835cc7d4f2ada84787ecb7671
Size

108KB
MD5

f9f2936835cc7d4f2ada84787ecb7671
SHA1

523d0b7427d28ac1f672da36910e47157020f9df
SHA256

118733a7f4780e5d89bd7bb9422f088b5fc97dc0572706127516f55df00e24d2
SHA512

015e7a1ed602e89c3fb17a64e75ae6a2ae29c601883190f3b95ad3dce889464eb9a0650255235332e01b14e00fe2fab20b1a6a4e02c9e2cd87bd8a0ddce97fe8
SSDEEP

3072:d2bU58rHTdMd7pzMxykdEfrEMz28baMXsKqSQBhObeEn:eUKrmK8YzSqOqEn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9f2936835cc7d4f2ada84787ecb7671

Files

f9f2936835cc7d4f2ada84787ecb7671
.exe windows:4 windows x86 arch:x86

2c66f4984d0b5b18cd52ebdb461827bd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr80

_onexit
_invoke_watson
__dllonexit
_strrev
_controlfp_s
_strnicmp
_lock
_decode_pointer
_unlock
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_except_handler4_common
calloc
_beginthreadex
atoi
strncat
srand
rand
_time64
strrchr
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
sprintf
free
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
malloc
strchr
memmove
ceil
strstr
memcpy
??3@YAXPAX@Z
_CxxThrowException
__CxxFrameHandler3
??2@YAPAXI@Z
memset

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
Sleep
LoadLibraryA
WaitForSingleObject
SetEvent
GetProcAddress
CreateEventA
CloseHandle
TerminateThread
CreateThread
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
VirtualAlloc
LeaveCriticalSection
EnterCriticalSection
lstrcpyA
InterlockedExchange
CancelIo
ResetEvent
lstrlenA
lstrcatA
GetVersionExA
GetLastError
CreateDirectoryA
GetFileAttributesA
GetVolumeInformationA
GetLogicalDriveStringsA
FindClose
LocalFree
FindNextFileA
LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
GetFileSize
CreateFileA
WriteFile
SetFilePointer
MoveFileA
ReadFile
DeleteFileA
GetModuleFileNameA
CreateProcessA
GetCurrentProcess
ExitThread
GetTickCount
Process32Next
Process32First
ExitProcess
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
PeekNamedPipe
WaitForMultipleObjects
GetStartupInfoA
CreatePipe
GlobalMemoryStatus
GetSystemInfo
OpenEventA
SetErrorMode
LocalSize
lstrcmpiA
GetCurrentThreadId
InterlockedCompareExchange

user32

SetProcessWindowStation
GetCursorPos
SetRect
GetDesktopWindow
GetDC
ReleaseDC
GetCursorInfo
SendMessageA
SystemParametersInfoA
GetSystemMetrics
OpenWindowStationA
GetUserObjectInformationA
EmptyClipboard
SetClipboardData
CloseClipboard
SetCursorPos
SetCapture
MapVirtualKeyA
DestroyCursor
LoadCursorA
GetForegroundWindow
GetProcessWindowStation
ExitWindowsEx
GetWindowThreadProcessId
IsWindowVisible
CloseDesktop
EnumWindows
SetThreadDesktop
GetClipboardData
OpenInputDesktop
GetThreadDesktop
OpenDesktopA
PostMessageA
IsWindow
CreateWindowExA
CloseWindow
WindowFromPoint
OpenClipboard
wsprintfA
CharNextA
MessageBoxA
GetWindowTextA

gdi32

GetDIBits
CreateCompatibleBitmap
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteDC
DeleteObject

advapi32

RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegSetValueExA
RegQueryValueA
RegOpenKeyExA
CloseEventLog
ClearEventLogA
OpenEventLogA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

shell32

SHGetFileInfoA
ShellExecuteA

ws2_32

WSAStartup
getsockname
WSAGetLastError
htonl
gethostname
inet_ntoa
WSASocketA
inet_addr
sendto
socket
htons
connect
WSAIoctl
setsockopt
send
closesocket
recv
select
gethostbyname

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

wininet

InternetCloseHandle
InternetOpenUrlA
InternetOpenA

msvfw32

ICSeqCompressFrameStart
ICOpen
ICSeqCompressFrame
ICClose
ICCompressorFree
ICSeqCompressFrameEnd
ICSendMessage

psapi

GetModuleFileNameExA
EnumProcessModules

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

JJHN
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

caoni
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2c66f4984d0b5b18cd52ebdb461827bd

Headers

File Characteristics

Imports

msvcr80

kernel32

user32

gdi32

advapi32

shell32

ws2_32

msvcp80

wininet

msvfw32

psapi

Sections

.text Size: 60KB - Virtual size: 59KB

JJHN Size: 4KB - Virtual size: 2KB

caoni Size: 12KB - Virtual size: 8KB

.rdata Size: 16KB - Virtual size: 14KB

.data Size: 8KB - Virtual size: 13KB

.rsrc Size: 4KB - Virtual size: 428B

.text
Size: 60KB - Virtual size: 59KB

JJHN
Size: 4KB - Virtual size: 2KB

caoni
Size: 12KB - Virtual size: 8KB

.rdata
Size: 16KB - Virtual size: 14KB

.data
Size: 8KB - Virtual size: 13KB

.rsrc
Size: 4KB - Virtual size: 428B