fe584fac176ded9565e21f0931fe894a

Sharing

Copy URL

Twitter E-mail

General

Target

fe584fac176ded9565e21f0931fe894a
Size

1.7MB
MD5

fe584fac176ded9565e21f0931fe894a
SHA1

18d046480b0ce1dfa967414c7a229a2598e044be
SHA256

c1b43a6078945d3d84aebe885c4f4d64d77e097bfbfb260cc668e490d67d4eed
SHA512

baa16e92633ccfae534a6769119bf9f74379ecd298d94101955a2b8757ba57a2b21083f93e9a062fdb43db489ef0640c02b1d0eb8d1801eea13cfa4f5773822e
SSDEEP

24576:LWS0q3GwefsjkZv8aVoN7iHcwL1kdi71KeYXIkcc4X1z9vAacnbVh:LWS0q3Goqv36NjbiLwpWt94p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fe584fac176ded9565e21f0931fe894a

Files

fe584fac176ded9565e21f0931fe894a
.exe windows:4 windows x86 arch:x86

815e42db800c71a8b3f9eef5798e8202

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

SystemTimeToFileTime
GetUserDefaultLCID
GetModuleHandleA
FormatMessageA
GetComputerNameW
TlsGetValue
FindNextFileA
CompareStringW
CompareStringA
FreeLibraryAndExitThread
FileTimeToSystemTime
lstrlenA
DeleteCriticalSection
DeleteFileA
WriteFile
OutputDebugStringA
GetCurrentProcess
CreateFileA
OpenMutexA
WaitForMultipleObjectsEx
GetSystemTime
CloseHandle
GetTickCount
lstrcmpA
ReadFile
GetACP
TlsAlloc
FormatMessageW
GetTimeFormatW
CompareFileTime
InterlockedDecrement
FreeLibrary
GetCurrentThread
GetFileAttributesW
CreateThread
GetTimeFormatA
WaitForSingleObjectEx
SetFileAttributesA
OpenMutexW
LoadLibraryExA
CreateDirectoryA
GetEnvironmentVariableA
GetFileAttributesA
InterlockedIncrement
UnhandledExceptionFilter
ExpandEnvironmentStringsW
GetCurrentProcessId
InitializeCriticalSection
InterlockedCompareExchange
TerminateProcess
GetLastError
OpenEventA
TlsSetValue
FindFirstFileW
GetDateFormatA
LocalReAlloc
DeleteFileW
PulseEvent
GetTempPathA
CreateMutexA
lstrcpyA
CreateFileW
GetTempFileNameA
Sleep
GetVersionExA
WaitForSingleObject
SetEvent
LocalSize
WideCharToMultiByte
TlsFree
InterlockedExchange
lstrlenW
GetLocalTime
SetLastError
CreateDirectoryW
GetModuleFileNameA
GetProcAddress
lstrcatA
CreateEventA
GetCurrentThreadId
FindCloseChangeNotification
FindNextChangeNotification
FindFirstChangeNotificationW
GetFileSize
GetDateFormatW
LoadLibraryA
SetFilePointer
LocalFree
FileTimeToLocalFileTime
QueryPerformanceCounter
LocalAlloc
FindFirstFileA
GetComputerNameA
UnmapViewOfFile
DelayLoadFailureHook
ExitThread
OpenFileMappingW
EnterCriticalSection
GetFileAttributesExW
SetFileAttributesW
FindFirstChangeNotificationA
SetUnhandledExceptionFilter
FindNextFileW
FindClose
ReleaseMutex
GetSystemTimeAsFileTime
ExpandEnvironmentStringsA
LeaveCriticalSection
DuplicateHandle
SetEndOfFile
GetModuleFileNameW
MapViewOfFile
GetSystemDefaultLangID
CreateFileMappingA
LoadLibraryExW
MultiByteToWideChar
CreateFileMappingW
CreateMutexW

advapi32

GetLengthSid
LookupPrivilegeValueA
RegQueryInfoKeyA
FreeSid
AllocateAndInitializeSid
InitializeSecurityDescriptor
RegEnumKeyA
GetSecurityDescriptorDacl
CryptCreateHash
CryptDecrypt
CopySid
RegOpenKeyExA
CryptSetProvParam
GetSidSubAuthority
RegEnumValueA
RegOpenKeyExW
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetTokenInformation
RegSetValueExA
IsValidSid
OpenServiceW
RegEnumValueW
CryptSetProviderA
QueryServiceStatus
QueryServiceConfigA
CryptGenRandom
CryptSetKeyParam
RegConnectRegistryA
OpenSCManagerW
RegDeleteKeyW
StartServiceA
ControlService
RegDeleteKeyA
OpenProcessToken
InitializeAcl
GetUserNameA
CryptSetHashParam
CryptGetUserKey
SetSecurityDescriptorOwner
GetSecurityDescriptorOwner
CryptReleaseContext
RegEnumKeyExW
RegCreateKeyExW
CryptDestroyHash
StartServiceW
CryptExportKey
CryptVerifySignatureA
CryptGetProvParam
RegEnumKeyExA
UnlockServiceDatabase
GetUserNameW
CryptEncrypt
RegDeleteValueA
GetSidSubAuthorityCount
OpenThreadToken
CryptHashData
SetSecurityDescriptorGroup
GetAce
CryptGetKeyParam
RegNotifyChangeKeyValue
RegCreateKeyExA
RegQueryInfoKeyW
CryptGetHashParam
LockServiceDatabase
RegQueryValueExW
RegDeleteValueW
CryptDestroyKey
RegCloseKey
SetSecurityDescriptorSacl
EqualSid
CryptSignHashA
CryptGetDefaultProviderW
CryptGenKey
RegGetKeySecurity
RegSetKeySecurity
AdjustTokenPrivileges
GetSidIdentifierAuthority
CryptAcquireContextA
RegConnectRegistryW
ChangeServiceConfigA
CryptImportKey
RegSetValueExW
RegQueryValueExA
CryptDeriveKey
CloseServiceHandle
SystemFunction041

ntdll

NtAllocateVirtualMemory
LdrGetDllHandle
RtlUshortByteSwap

msasn1

ASN1BERDecCharString
ASN1BEREncChar32String
ASN1_CloseModule
ASN1CEREncNewBlkElement
ASN1_CloseEncoder
ASN1BERDecOpenType2
ASN1_CreateEncoder
ASN1CEREncFlushBlkElement
ASN1BEREncU32
ASN1BEREncMultibyteString
ASN1BEREncCharString
ASN1BERDecEndOfContents
ASN1BERDecZeroCharString
ASN1BEREoid_free
ASN1BERDecEoid
ASN1BERDecGeneralizedTime
ASN1BERDecExplicitTag
ASN1BERDecNotEndOfContents
ASN1ztcharstring_free
ASN1DecSetError
ASN1BEREoid2DotVal
ASN1BEREncChar16String
ASN1BEREncOctetString
ASN1char16string_free
ASN1_CloseDecoder
ASN1BERDecOpenType
ASN1BEREncObjectIdentifier2
ASN1BERDecPeekTag
ASN1DecRealloc
ASN1CEREncUTCTime
ASN1BERDecBool
ASN1EncSetError
ASN1BERDotVal2Eoid
ASN1CEREncBeginBlk
ASN1BERDecChar16String
ASN1octetstring_free
ASN1intx_free
ASN1_SetEncoderOption
ASN1_FreeDecoded
ASN1BERDecObjectIdentifier2
ASN1BEREncEndOfContents
ASN1charstring_free
ASN1BEREncS32
ASN1_Encode
ASN1_CreateDecoder
ASN1BEREncEoid
ASN1BERDecU32Val
ASN1BERDecSXVal
ASN1BEREncExplicitTag
ASN1BERDecOctetString
ASN1BERDecUTCTime
ASN1BERDecS32Val
ASN1BEREncBitString
ASN1BERDecBitString2
ASN1BEREncSX
ASN1BEREncOpenType
ASN1BERDecChar32String
ASN1_Decode
ASN1bitstring_free
ASN1Free
ASN1BERDecBitString
ASN1_CreateModule
ASN1objectidentifier2_cmp
ASN1BEREncUTF8String
ASN1CEREncGeneralizedTime
ASN1CEREncEndBlk
ASN1open_free
ASN1BERDecUTF8String
ASN1_FreeEncoded
ASN1char32string_free
ASN1BERDecOctetString2
ASN1BERDecMultibyteString
ASN1utf8string_free
ASN1BEREncBool

user32

LoadStringW
GetProcessDefaultLayout
GetSystemMetrics
wsprintfW
wsprintfA
LoadStringA
MessageBoxW
MessageBoxA

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 120KB - Virtual size: 22.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 290KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

815e42db800c71a8b3f9eef5798e8202

Headers

File Characteristics

Imports

kernel32

advapi32

ntdll

msasn1

user32

Sections

.text Size: 26KB - Virtual size: 25KB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 120KB - Virtual size: 22.3MB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 290KB - Virtual size: 290KB

.text
Size: 26KB - Virtual size: 25KB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 120KB - Virtual size: 22.3MB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 290KB - Virtual size: 290KB