fe7cc6040a2c0f468e959a94747d9e0d

Sharing

Copy URL Twitter E-mail

General

Target

fe7cc6040a2c0f468e959a94747d9e0d
Size

15.6MB
MD5

fe7cc6040a2c0f468e959a94747d9e0d
SHA1

5baad70a4c1bdca2268f4b4ea981fc5b3a436486
SHA256

4bda589549bdaeefa5f55f51f6a10750b324e240485c4cb2259d94cc16878f9a
SHA512

0e86535235734c33cef45d4b5e6823383f2a406a6e792ab828ff32d67d24b1611899f58c4738f16a713f04922d819b553b3f4f6674fabafaf93ad41cfe6cddd2
SSDEEP

393216:YbfsuH+cYtsuvRJrjANbfA5a2ShWP/YpzGq03pb495ZqymK:YWcYmkJrMJfx2SgP/YApy0A

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fe7cc6040a2c0f468e959a94747d9e0d

Files

fe7cc6040a2c0f468e959a94747d9e0d
.exe windows:5 windows x86 arch:x86

e416601731d54ae3f3ef0fb7b305f4be

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msimg32

AlphaBlend

kernel32

LockResource
SizeofResource
Sleep
GetTickCount
GetModuleHandleW
OutputDebugStringW
LoadResource
FindResourceW
GetCommandLineW
ExitThread
FlushFileBuffers
GetProcessHeap
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetCurrentDirectoryA
GetFullPathNameA
SetStdHandle
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
HeapSize
HeapCreate
GetStartupInfoA
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
LCMapStringW
LCMapStringA
GetCPInfo
RaiseException
FindFirstFileA
GetDriveTypeA
GetUserDefaultLangID
GetVersionExW
LoadLibraryW
GetProcAddress
FreeLibrary
GetCurrentProcess
GetCurrentThread
GetLastError
LocalAlloc
CloseHandle
LocalFree
FreeResource
FindResourceExW
LoadLibraryExW
SetLastError
GetDiskFreeSpaceW
CreateFileW
GetCurrentProcessId
InterlockedIncrement
LoadLibraryA
GetCurrentThreadId
CreateThread
WaitForSingleObject
InterlockedDecrement
OutputDebugStringA
IsDebuggerPresent
SetUnhandledExceptionFilter
lstrcpynA
VirtualQuery
GetModuleFileNameA
CreateToolhelp32Snapshot
Thread32First
Thread32Next
OpenThread
SuspendThread
GetThreadContext
ResumeThread
IsBadWritePtr
GetLocalTime
WriteFile
GetVersion
GetExitCodeProcess
TerminateProcess
CreateDirectoryW
GetFileAttributesW
CreateProcessW
GetModuleFileNameW
FindFirstFileW
FindClose
GetComputerNameW
IsBadReadPtr
GetModuleHandleA
VirtualFree
VirtualAlloc
Module32FirstW
Module32NextW
FormatMessageA
CreateFileA
ReadFile
GetFileSizeEx
GetFileSize
GetFileAttributesExW
SetCurrentDirectoryW
GetCurrentDirectoryW
FindNextFileW
GetFullPathNameW
GetShortPathNameW
GetDiskFreeSpaceExW
SetFilePointer
MoveFileW
RemoveDirectoryW
SetEndOfFile
SetFileTime
SetFileAttributesW
DeleteFileW
GetSystemInfo
WideCharToMultiByte
InterlockedCompareExchange
CreateEventW
SetEvent
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
MultiByteToWideChar
SetThreadPriority
GetThreadPriority
SetThreadAffinityMask
TlsAlloc
TlsSetValue
TlsGetValue
TlsFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
QueryPerformanceFrequency
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
GetVersionExA
IsBadStringPtrA
Process32First
Process32Next
Module32First
Module32Next
SleepEx
PeekNamedPipe
WaitForMultipleObjects
GetFileType
GetStdHandle
ExpandEnvironmentStringsA
InterlockedExchange
UnhandledExceptionFilter
ExitProcess
GetStartupInfoW
HeapFree
HeapAlloc
RtlUnwind
HeapReAlloc
GetFileInformationByHandle

user32

PostQuitMessage
DispatchMessageW
DefWindowProcW
UpdateWindow
SendMessageW
GetSystemMetrics
MessageBoxW
AdjustWindowRectEx
CreateWindowExW
GetSysColorBrush
ShowWindow
GetSysColor
SetWindowLongW
EndPaint
PeekMessageW
SystemParametersInfoW
GetWindowLongW
InvalidateRect
LoadIconW
RegisterClassExW
TranslateMessage
EnumWindows
GetWindowThreadProcessId
GetDC
BeginPaint
ReleaseDC
PostMessageW
GetClientRect
LoadCursorW
DrawTextW
FillRect
DestroyWindow

gdi32

CreateDIBSection
CreateSolidBrush
GetStockObject
GetObjectW
CreateFontW
SetDCPenColor
Rectangle
CreateCompatibleDC
SelectObject
SetBkMode
SetBkColor
SetDCBrushColor
CreateFontIndirectW
DeleteDC
SetTextColor

shell32

SHGetFolderPathW
ShellExecuteExW
SHBrowseForFolderW
SHGetMalloc
ShellExecuteW
SHGetPathFromIDListW
CommandLineToArgvW

comctl32

InitCommonControlsEx

ws2_32

setsockopt
htons
connect
bind
listen
closesocket
getsockopt
ioctlsocket
select
__WSAFDIsSet
WSAGetLastError
WSASetLastError
recv
send
socket
gethostname
WSACleanup
getpeername
ntohs
getsockname
WSAStartup
getaddrinfo
sendto
recvfrom
accept
freeaddrinfo

wininet

InternetReadFileExA
HttpQueryInfoA
HttpOpenRequestA
InternetCrackUrlA
InternetSetOptionA
HttpSendRequestA
InternetConnectA
InternetSetStatusCallbackA
InternetOpenA
InternetCloseHandle
InternetSetCookieW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

advapi32

OpenProcessToken
OpenThreadToken
AccessCheck
DuplicateToken
GetUserNameW
RegOpenKeyExA
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetFileSecurityW
GetFileSecurityW
RegQueryValueExW
MapGenericMask

oleaut32

VariantClear

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 244KB - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 116KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e416601731d54ae3f3ef0fb7b305f4be

Headers

DLL Characteristics

File Characteristics

Imports

msimg32

kernel32

user32

gdi32

shell32

comctl32

ws2_32

wininet

version

advapi32

oleaut32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 244KB - Virtual size: 244KB

.data Size: 116KB - Virtual size: 169KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 153KB - Virtual size: 153KB

.reloc Size: 59KB - Virtual size: 59KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 244KB - Virtual size: 244KB

.data
Size: 116KB - Virtual size: 169KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 153KB - Virtual size: 153KB

.reloc
Size: 59KB - Virtual size: 59KB