f85fec2704dd0fe1354e0ca20c7b5876

Sharing

Copy URL Twitter E-mail

General

Target

f85fec2704dd0fe1354e0ca20c7b5876
Size

136KB
MD5

f85fec2704dd0fe1354e0ca20c7b5876
SHA1

83f080c6262a5f6f8e9577ed41cf9381345cc04b
SHA256

71fb02f82138f62f55b806a479b922c74c617e017fa2654205cc2e6ba2de82ed
SHA512

bc65a36a716298ab850c104766b87febcb03ffd5c3aff65330053268a525836d463a9e0a95da311c4f416ebe68abc6bcdecf2a1169dc59beb9415d2b879f6702
SSDEEP

3072:EZY9ulVjl2Rp+vKQuxmNr3aR97ngcMmBg6ivOYw45JtcLtOs:+qul2p0B3ab7gcMmBg6F4iw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f85fec2704dd0fe1354e0ca20c7b5876

Files

f85fec2704dd0fe1354e0ca20c7b5876
.exe windows:4 windows x86 arch:x86

282cd50b682ef6c968a88224f3182d0d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

recv
closesocket
send
gethostbyname
WSAStartup
socket
WSACleanup
gethostname
WSAGetLastError
bind
inet_ntoa
recvfrom
sendto
ioctlsocket
listen
accept
setsockopt

rpcrt4

UuidCreate

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

kernel32

CloseHandle
CreateEventA
TerminateProcess
OpenProcess
GetCurrentProcessId
GetCurrentProcess
GetVersionExA
CreateThread
WaitForSingleObject
SetEvent
GetSystemDirectoryA
CreateFileA
GetProcAddress
GetModuleHandleA
QueryPerformanceCounter
GetTimeFormatA
GetDateFormatA
FileTimeToSystemTime
FileTimeToLocalFileTime
CompareFileTime
SystemTimeToFileTime
GetSystemTime
lstrcatA
FreeLibrary
LoadLibraryA
VirtualFree
DeviceIoControl
VirtualAlloc
SetLastError
lstrlenA
OpenEventA
WriteProcessMemory
SetFilePointer
VirtualProtect
LCMapStringW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
SearchPathA
TlsFree
GetCPInfo
GetOEMCP
GetACP
IsBadWritePtr
HeapReAlloc
EnterCriticalSection
FatalAppExitA
LeaveCriticalSection
DeleteCriticalSection
HeapCreate
HeapDestroy
GetTickCount
GetCommandLineA
GetStartupInfoA
RtlUnwind
GetLastError
TlsGetValue
TlsSetValue
ExitThread
VirtualQuery
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
WriteFile
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
GetSystemInfo
InitializeCriticalSection
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetTimeZoneInformation
SetStdHandle
FlushFileBuffers
GetUserDefaultLCID
EnumSystemLocalesA
WaitForMultipleObjects
ResetEvent
GetModuleFileNameA
GetCurrentThreadId
OutputDebugStringA
GetCurrentThread
SetThreadPriority
GetComputerNameA
Sleep
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
TlsAlloc
GetFileType
IsValidLocale
IsValidCodePage
HeapSize
SetEndOfFile
ReadFile
GetLocaleInfoW
CompareStringA
CompareStringW
UnhandledExceptionFilter
SetEnvironmentVariableA

user32

GetDC
GetCursorPos
EnumDisplaySettingsA
wvsprintfA
GetWindowRect
ReleaseDC
DestroyCursor
GetWindowLongA
LoadStringA
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
LoadCursorA
RegisterClassExA
LoadIconA
InvalidateRect
wsprintfA
WindowFromPoint
mouse_event
FindWindowA
GetWindowTextA
GetForegroundWindow
ExitWindowsEx
EnumWindows
keybd_event
GetClassNameA
GetWindowThreadProcessId
DestroyWindow
PostThreadMessageA
PostMessageA
DialogBoxParamA
MessageBoxA
DefWindowProcA
EndDialog
GetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
CloseDesktop
SetThreadDesktop
CreateWindowExA
ShowWindow
GetSystemMetrics
PostQuitMessage

gdi32

GetPixel
GetDeviceCaps
StretchBlt
CreateCompatibleDC
CreateCompatibleBitmap
GetDIBits
CreateDIBSection
BitBlt
SelectObject
DeleteDC
DeleteObject
ExtEscape
GetRegionData

advapi32

QueryServiceStatus
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegCloseKey
RegNotifyChangeKeyValue
RegQueryValueExA
RegSetValueExA
GetUserNameA
CloseServiceHandle
OpenServiceA
OpenSCManagerA
RegCreateKeyA
RegCreateKeyExA
LookupAccountSidA
GetTokenInformation
RegDeleteValueA
RegDeleteKeyA
OpenProcessToken

shell32

ShellExecuteA
Shell_NotifyIconA

ole32

CoCreateInstance
CoInitialize
CoUninitialize

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

282cd50b682ef6c968a88224f3182d0d

Headers

File Characteristics

Imports

wsock32

rpcrt4

version

kernel32

user32

gdi32

advapi32

shell32

ole32

Sections

.text Size: 96KB - Virtual size: 95KB

.rdata Size: 24KB - Virtual size: 22KB

.data Size: 4KB - Virtual size: 72KB

.rsrc Size: 8KB - Virtual size: 5KB

.text
Size: 96KB - Virtual size: 95KB

.rdata
Size: 24KB - Virtual size: 22KB

.data
Size: 4KB - Virtual size: 72KB

.rsrc
Size: 8KB - Virtual size: 5KB