f8fca743f20097930787d458d2827299

Sharing

Copy URL

Twitter E-mail

General

Target

f8fca743f20097930787d458d2827299
Size

227KB
MD5

f8fca743f20097930787d458d2827299
SHA1

1f9814b06cb871c7456e5a816e65a18566581baa
SHA256

158372de77dce76ca5e8d7fe4454be9853f7e115f5ebca042a7b7a8828dadae9
SHA512

f60ba1cf8d2e21ca2347af8106aed098b3400330982c32e4911b29d9c433865f9b8fabc2dd2072d768fb19e08a707dc5ef9830522a15f0c5027f9975fd72e48c
SSDEEP

6144:RyWTBJjFLBSIUA8CFUfHty8TCjv4bfGu:RyWTrjFLVUBfNReu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f8fca743f20097930787d458d2827299

Files

f8fca743f20097930787d458d2827299
.exe windows:5 windows x86 arch:x86

a7dbceb5e855687254a33e0c52e12c82

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtectEx
HeapFree
HeapCreate
SetLastError
ResetEvent
SystemTimeToFileTime
GetTimeZoneInformation
GetSystemTime
GetThreadContext
SetThreadContext
GetProcessId
lstrcmpA
SetEndOfFile
GetCurrentThreadId
TryEnterCriticalSection
ReleaseMutex
HeapReAlloc
GetProcessHeap
HeapDestroy
FileTimeToDosDateTime
GetTempFileNameW
GetTempPathW
FileTimeToLocalFileTime
GetFileInformationByHandle
GetNativeSystemInfo
CreateRemoteThread
OpenProcess
Process32FirstW
ReadProcessMemory
CreateDirectoryW
MoveFileExW
GetUserDefaultUILanguage
GetCurrentThread
SetThreadPriority
GetVolumeNameForVolumeMountPointW
lstrcpynA
CreateMutexW
OpenMutexW
TlsAlloc
TlsFree
SetFilePointerEx
SetFileTime
GetFileSizeEx
VirtualAlloc
RemoveDirectoryW
GetFileTime
DeleteFileW
SetFileAttributesW
TlsGetValue
TlsSetValue
TerminateProcess
GetHandleInformation
GetEnvironmentVariableW
Thread32First
Thread32Next
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
RtlUnwind
OutputDebugStringA
VirtualQueryEx
HeapAlloc
LoadLibraryA
VirtualAllocEx
IsBadReadPtr
lstrcpyA
WriteProcessMemory
GetCurrentProcessId
OpenEventW
GetFileAttributesExW
lstrcatW
WaitForMultipleObjects
CreateEventW
GetModuleFileNameW
GetVersionExW
Sleep
VirtualFreeEx
VirtualFree
GetModuleHandleW
GetComputerNameW
SetErrorMode
GetPrivateProfileIntW
TerminateThread
GetPrivateProfileStringW
VirtualProtect
QueryPerformanceCounter
lstrcpyW
WTSGetActiveConsoleSessionId
GetProcAddress
GetFileAttributesW
Process32NextW
LoadLibraryW
FreeLibrary
ExitProcess
FindNextFileW
FindClose
GetLastError
FlushFileBuffers
CreateFileW
ReadFile
WriteFile
FindFirstFileW
CreateThread
lstrcmpiW
lstrcmpiA
GlobalUnlock
GetTickCount
GlobalLock
ExpandEnvironmentStringsW
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
ResumeThread
LocalFree
CloseHandle
DuplicateHandle
CreateFileMappingW
SetEvent
WaitForSingleObject
CreateProcessW
UnmapViewOfFile
MapViewOfFile
lstrlenA
GetCommandLineW
CreateToolhelp32Snapshot

user32

GetWindowLongW
SetWindowLongW
SendMessageTimeoutW
GetWindow
GetSystemMetrics
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
OpenWindowStationW
EndPaint
GetMessageA
GetUpdateRgn
GetTopWindow
GetIconInfo
DrawIcon
WindowFromPoint
MsgWaitForMultipleObjects
IsRectEmpty
GetWindowThreadProcessId
MapWindowPoints
SendMessageW
IsWindow
SetWindowPos
GetAncestor
GetClassLongW
GetWindowInfo
GetParent
PostMessageW
GetWindowRect
CharLowerW
MapVirtualKeyW
FillRect
DrawEdge
IntersectRect
EqualRect
PrintWindow
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
DispatchMessageW
LoadImageW
GetSubMenu
MenuItemFromPoint
GetMenu
GetMenuItemRect
CharLowerA
ToUnicode
GetClipboardData
GetKeyboardState
TranslateMessage
CharToOemW
ExitWindowsEx
GetMessageW
RegisterClassExA
GetWindowDC
SetCapture
DefDlgProcW
DefFrameProcA
OpenInputDesktop
BeginPaint
GetUpdateRect
GetDC
GetCapture
RegisterClassExW
SetCursorPos
PeekMessageW
GetDCEx
PeekMessageA
ReleaseDC
DefWindowProcA
GetCursorPos
DefMDIChildProcW
DefFrameProcW
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
GetMenuItemCount
PostThreadMessageW
HiliteMenuItem
EndMenu
GetShellWindow
GetMessagePos
DefWindowProcW
CallWindowProcW
CallWindowProcA
RegisterClassW
ReleaseCapture
DefMDIChildProcA
DefDlgProcA
SwitchDesktop
RegisterClassA

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegSetValueExW
EqualSid
RegEnumKeyExW
IsWellKnownSid
GetLengthSid
GetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptVerifySignatureW
CryptGetKeyParam
CryptImportKey
CryptDestroyKey
CryptDestroyHash
InitiateSystemShutdownExW
ConvertSidToStringSidW
CryptGetHashParam
CryptAcquireContextW
CryptReleaseContext
CryptCreateHash
CryptHashData
OpenProcessToken
GetSidSubAuthority
OpenThreadToken
GetSidSubAuthorityCount
CreateProcessAsUserW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCreateKeyExW

shlwapi

PathMatchSpecW
PathUnquoteSpacesW
PathSkipRootW
PathIsDirectoryW
ord14
PathAddExtensionW
PathAddBackslashW
PathQuoteSpacesW
PathFindFileNameW
PathIsURLW
PathRemoveBackslashW
PathCanonicalizeW
StrStrIW
StrStrIA
StrCmpNIW
PathRemoveFileSpecW
SHDeleteKeyW
SHDeleteValueW
wvnsprintfA
wvnsprintfW
StrCmpNW
StrCmpNIA
UrlUnescapeA

shell32

ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoInitializeEx
CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal

gdi32

GetDIBits
CreateCompatibleDC
CreateCompatibleBitmap
SetViewportOrgEx
GdiFlush
SetRectRgn
SaveDC
RestoreDC
BitBlt
DeleteDC
CreateDCW
GetDeviceCaps
CreateDIBSection
SelectObject
DeleteObject

ws2_32

shutdown
WSAGetLastError
select
getaddrinfo
WSAStartup
connect
WSASend
WSARecv
sendto
WSACloseEvent
WSAIoctl
WSAEnumNetworkEvents
WSAEventSelect
setsockopt
WSACreateEvent
getsockopt
getpeername
recvfrom
WSACleanup
recv
bind
socket
freeaddrinfo
WSASetLastError
closesocket
send
listen
accept
getsockname

crypt32

CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
PFXImportCertStore
CryptUnprotectData
PFXExportCertStoreEx

wininet

InternetSetCookieA
InternetQueryOptionW
InternetQueryOptionA
HttpAddRequestHeadersW
GetUrlCacheEntryInfoW
InternetSetStatusCallbackW
HttpSendRequestW
InternetSetOptionA
InternetReadFile
InternetReadFileExA
InternetQueryDataAvailable
InternetSetStatusCallbackA
HttpSendRequestExW
HttpSendRequestExA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetCrackUrlA
HttpQueryInfoA
InternetConnectA

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocString

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetInfo

msvcrt

_errno
memcpy
memset
strcmp
memmove
_wtoi
memcmp
_ultow
_ultoa
_purecall
abs
free
_except_handler3
malloc

Sections

.text
Size: 214KB - Virtual size: 214KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a7dbceb5e855687254a33e0c52e12c82

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

msvcrt

Sections

.text Size: 214KB - Virtual size: 214KB

.data Size: 2KB - Virtual size: 9KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 214KB - Virtual size: 214KB

.data
Size: 2KB - Virtual size: 9KB

.reloc
Size: 9KB - Virtual size: 9KB