f8e2ef9988dbac46b636966793eeae32

Sharing

Copy URL Twitter E-mail

General

Target

f8e2ef9988dbac46b636966793eeae32
Size

26KB
MD5

f8e2ef9988dbac46b636966793eeae32
SHA1

15ae61344af49eebeb697eb6bcad18703c0de654
SHA256

ecb398773b2fdffe9d347904c266a3316c16cb29c5eec5d140e1e055e0be07b6
SHA512

112a23ce6a0c64ef943558cf8b4e5031fff1bb5b693138661f7982f3584e18b23b54e3227fbc5ea550b4d28743a870c2051312677446c6d3ed2990663b6e9467
SSDEEP

384:+/VUypnHjXlYQ79V6DptwaAE+cTVwceoysVUyx+FodPEILwCk2ftrs7JsFvbX:GVUypDeWowbEDVjzVUysGcekisQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f8e2ef9988dbac46b636966793eeae32

Files

f8e2ef9988dbac46b636966793eeae32
.exe windows:5 windows x86 arch:x86

71aa2644e8701573f7d2f913f94c7790

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WritePrivateProfileSectionW
WriteProcessMemory
WriteProfileStringA
WriteConsoleA
lstrcmpi
lstrcpynW
WinExec
WaitForSingleObjectEx
WaitForMultipleObjects
VirtualQuery
VerLanguageNameA
UpdateResourceW
UnhandledExceptionFilter
TlsSetValue
TlsFree
TerminateJobObject
SwitchToThread
SwitchToFiber
SetThreadExecutionState
SetProcessShutdownParameters
SetHandleInformation
SetFileAttributesW
SetFileAttributesA
SetErrorMode
SetEndOfFile
SetCurrentDirectoryA
SetConsoleDisplayMode
SetConsoleCursorPosition
SetComputerNameExA
SearchPathA
ScrollConsoleScreenBufferA
ResetWriteWatch
ReadFileEx
ReadConsoleOutputAttribute
ReadConsoleInputW
Process32FirstW
PeekNamedPipe
OpenWaitableTimerA
OpenEventA
MulDiv
MoveFileExW
Module32Next
MapUserPhysicalPagesScatter
LoadLibraryA
IsValidLanguageGroup
IsSystemResumeAutomatic
IsDBCSLeadByte
IsBadReadPtr
InterlockedExchangeAdd
HeapReAlloc
HeapDestroy
GlobalUnfix
GlobalReAlloc
GetVersionExA
GetUserDefaultUILanguage
GetThreadTimes
GetTapeParameters
GetStringTypeW
GetProcessWorkingSetSize
GetPrivateProfileSectionNamesW
GetPrivateProfileIntW
GetMailslotInfo
GetFileInformationByHandle
GetEnvironmentVariableW
GetCurrencyFormatA
GetConsoleOutputCP
GetConsoleCursorInfo
GetConsoleAliasesW
GetCPInfoExW
GetCPInfoExA
GetBinaryType
GetModuleHandleW
FormatMessageW
FlushConsoleInputBuffer
FindResourceW
EnumResourceTypesW
EnumDateFormatsExW
EnumDateFormatsA
DnsHostnameToComputerNameA
DisconnectNamedPipe
DisableThreadLibraryCalls
DeleteCriticalSection
CreateSemaphoreA
CreateMailslotA
CreateJobObjectA
CreateFileW
ConvertThreadToFiber
ContinueDebugEvent
ConnectNamedPipe
CancelWaitableTimer
CancelTimerQueueTimer
BuildCommDCBAndTimeoutsA
AllocConsole
AddAtomA
GetStartupInfoA
GetStartupInfoW
ExitProcess
_lopen

msvcrt

memset

user32

EnumWindowStationsA
EnumDisplaySettingsExW
EnumDisplaySettingsExA
EmptyClipboard
DrawIconEx
DlgDirSelectExW
DlgDirListA
DdeSetQualityOfService
DdeReconnect
DdePostAdvise
DdeInitializeA
DdeClientTransaction
CreateWindowStationW
CreateWindowExA
CreateIcon
CreateCursor
CopyImage
ClipCursor
CharUpperBuffW
CharToOemW
CharToOemA
CharLowerA
ChangeDisplaySettingsA
CallWindowProcW
CallMsgFilter
BringWindowToTop
BlockInput
WaitForInputIdle
VkKeyScanExW
FillRect
FindWindowA
FindWindowExA
FindWindowW
GetActiveWindow
GetCaretPos
GetClassInfoA
GetCursorPos
GetDC
GetDlgItem
GetKeyboardLayout
GetKeyboardLayoutNameA
GetMenuState
GetMenuStringW
GetPriorityClipboardFormat
GetQueueStatus
GetScrollBarInfo
GetSubMenu
GetTitleBarInfo
GetUpdateRgn
GetWindowInfo
GetWindowModuleFileNameA
GetWindowModuleFileNameW
GetWindowRect
HiliteMenuItem
IMPQueryIMEA
InsertMenuItemA
IntersectRect
InvalidateRgn
IsMenu
LoadIconA
LoadImageA
LoadKeyboardLayoutW
MapWindowPoints
MessageBoxIndirectA
MonitorFromWindow
OpenWindowStationA
PostThreadMessageW
RealGetWindowClassA
RegisterDeviceNotificationW
ReleaseDC
RemovePropA
SetActiveWindow
SetCaretPos
SetClassLongA
SetClassWord
SetDoubleClickTime
SetLayeredWindowAttributes
SetMessageExtraInfo
SetPropA
SetThreadDesktop
SetTimer
SetUserObjectInformationW
VkKeyScanExA
UnhookWinEvent
SwitchDesktop
SetWindowsHookExW
SetWindowsHookExA
SetWindowWord
SetWindowTextA
SetUserObjectSecurity

gdi32

AddFontResourceExW
AddFontResourceW
AnyLinkedFonts
BRUSHOBJ_pvGetRbrush
BeginPath
BitBlt
CopyMetaFileA
CopyMetaFileW
CreateDCA
CreateDIBPatternBrushPt
CreateEllipticRgnIndirect
CreatePalette
EndDoc
EngAlphaBlend
EngCreateBitmap
EngCreateClip
EngCreatePalette
EngDeletePath
EngFindResource
EngLoadModule
EngQueryLocalTime
EngTransparentBlt
EnumEnhMetaFile
ExtCreateRegion
FONTOBJ_pxoGetXform
GdiConsoleTextOut
GdiConvertBitmapV5
GdiConvertBrush
GdiConvertRegion
GdiDeleteSpoolFileHandle
GdiEndPageEMF
GdiEntry12
GdiEntry14
GdiEntry15
GdiEntry7
GdiEntry9
GdiGetPageCount
GdiPlayDCScript
GdiPlayJournal
GdiProcessSetup
GdiStartPageEMF
GetBkColor
GetCharABCWidthsA
AddFontMemResourceEx
GetDCPenColor
GetEUDCTimeStamp
GetEnhMetaFileDescriptionA
GetFontLanguageInfo
GetKerningPairsA
GetLogColorSpaceA
GetObjectA
GetOutlineTextMetricsW
GetTextFaceAliasW
GetTransform
GetViewportExtEx
GetWindowOrgEx
HT_Get8BPPMaskPalette
InvertRgn
MaskBlt
OffsetClipRgn
Pie
PolyDraw
PolylineTo
PtVisible
RectVisible
RemoveFontResourceA
RemoveFontResourceExA
RemoveFontResourceTracking
RestoreDC
ScaleViewportExtEx
SelectClipRgn
SetBrushOrgEx
SetDIBits
SetICMMode
SetMapMode
SetTextColor
SetTextJustification
SetVirtualResolution
SetWinMetaFileBits
SetWorldTransform
StartDocA
StartFormPage
UpdateColors
UpdateICMRegKeyA
UpdateICMRegKeyW
bMakePathNameW
GetDCBrushColor
ExtTextOutW
AbortPath

advapi32

RegOpenKeyA

shell32

SHCreateDirectoryExA
Shell_NotifyIcon
ShellHookProc
ShellExecuteExA
ShellExecuteEx
SHQueryRecycleBinA
SHPathPrepareForWriteW
SHLoadNonloadedIconOverlayIdentifiers
SHIsFileAvailableOffline
SHInvokePrinterCommandA
SHGetSpecialFolderPathW
CheckEscapesW
CommandLineToArgvW
DoEnvironmentSubstA
DoEnvironmentSubstW
DragAcceptFiles
DragFinish
DragQueryFileA
DragQueryFileAorW
DragQueryFileW
ExtractAssociatedIconExA
ExtractAssociatedIconExW
ExtractIconEx
ExtractIconExA
ExtractIconExW
ExtractIconW
FindExecutableA
FindExecutableW
SHAddToRecentDocs
SHAppBarMessage
SHBindToParent
SHBrowseForFolder
SHChangeNotify
SHGetSpecialFolderLocation
SHCreateProcessAsUserW
SHEmptyRecycleBinA
SHFileOperation
SHFileOperationA
SHFileOperationW
SHGetDataFromIDListA
SHGetDiskFreeSpaceExA
SHGetFileInfoA
SHGetFileInfoW
SHGetFolderLocation
SHGetFolderPathW
SHGetIconOverlayIndexA
SHGetInstanceExplorer
SHGetPathFromIDList
SHGetPathFromIDListA
SHGetPathFromIDListW
SHGetSettings
Shell_NotifyIconW

ole32

CoGetTreatAsClass
CoInitialize
CoInitializeEx
CoInitializeWOW
CoRegisterClassObject
CoRegisterMallocSpy
CoRevertToSelf
CoRevokeClassObject
CoTaskMemFree
CoTestCancel
CoUnmarshalInterface
CoWaitForMultipleHandles
CreateGenericComposite
CreateStdProgressIndicator
FmtIdToPropStgName
FreePropVariantArray
GetDocumentBitStg
GetHookInterface
GetRunningObjectTable
HACCEL_UserUnmarshal
HBITMAP_UserSize
HBITMAP_UserUnmarshal
HBRUSH_UserMarshal
HDC_UserMarshal
HENHMETAFILE_UserSize
HGLOBAL_UserFree
HGLOBAL_UserSize
HMENU_UserFree
HMETAFILEPICT_UserFree
HMETAFILEPICT_UserMarshal
HMETAFILEPICT_UserUnmarshal
HMETAFILE_UserFree
HPALETTE_UserSize
HWND_UserFree
HkOleRegisterObject
IIDFromString
MonikerCommonPrefixWith
OleConvertIStorageToOLESTREAMEx
OleCreate
OleCreateFromData
OleCreateLinkEx
OleCreateLinkFromDataEx
CoGetStandardMarshal
OleCreateMenuDescriptor
OleCreateStaticFromData
OleFlushClipboard
OleGetIconOfFile
OleInitialize
OleInitializeWOW
OleLoadFromStream
OleNoteObjectVisible
OleQueryCreateFromData
OleQueryLinkFromData
OleSetAutoConvert
OleSetClipboard
OleTranslateAccelerator
OleUninitialize
PropStgNameToFmtId
ReadClassStm
ReadFmtUserTypeStg
SNB_UserSize
SNB_UserUnmarshal
STGMEDIUM_UserMarshal
SetDocumentBitStg
StgCreateDocfile
StgGetIFillLockBytesOnFile
StgIsStorageILockBytes
StgOpenAsyncDocfileOnIFillLockBytes
StgOpenPropStg
StgPropertyLengthAsVariant
UpdateDCOMSettings
UtConvertDvtd32toDvtd16
WdtpInterfacePointer_UserSize
WdtpInterfacePointer_UserUnmarshal
WriteClassStg
WriteFmtUserTypeStg
CoGetCallerTID
CoFileTimeNow
CoCreateInstanceEx
CoBuildVersion
CoAllowSetForegroundWindow
CLSIDFromProgIDEx
CLIPFORMAT_UserUnmarshal
BindMoniker
OleCreateLinkToFileEx
CoGetPSClsid
CoGetObject

shlwapi

StrChrA
StrChrIA
StrChrIW
StrCmpNA
StrCmpNIA
StrCmpNIW
StrRChrIW
StrRChrW
StrRStrIA
StrRStrIW

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

71aa2644e8701573f7d2f913f94c7790

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

user32

gdi32

advapi32

shell32

ole32

shlwapi

Sections

.text Size: 23KB - Virtual size: 22KB

.data Size: 512B - Virtual size: 80B

.rsrc Size: 2KB - Virtual size: 1KB

.text
Size: 23KB - Virtual size: 22KB

.data
Size: 512B - Virtual size: 80B

.rsrc
Size: 2KB - Virtual size: 1KB