06f0a198c3492ccf357fe119d2b2e50a

Sharing

Copy URL Twitter E-mail

General

Target

06f0a198c3492ccf357fe119d2b2e50a
Size

183KB
MD5

06f0a198c3492ccf357fe119d2b2e50a
SHA1

281acc81fa473b338eb5434b57107ca17477a99d
SHA256

2b8151fe56d0bcaaffc1ff686c7ed327ff6fdfeb6306814dce291e53c57eb193
SHA512

5647412f536f057833d21d8f45ba2de4ebcce6f86d8c07e07da269cf915eee2ca5829f7d359a4d81b936ce65e1cf248bdc4599693fab3d5d71b43d8af06faf46
SSDEEP

3072:7BFlRmmFn28w2liIaF8+L6QvjyMzFtS70Ckb7KpitY96f0uFmM5niy:dFlfn28hiIaF5Lh7yMze7LvYh0ubL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06f0a198c3492ccf357fe119d2b2e50a

Files

06f0a198c3492ccf357fe119d2b2e50a
.exe windows:5 windows x86 arch:x86

7d88f1d51e78ac8df80ff4a83897173e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

htons
WSAGetLastError
shutdown
setsockopt
sendto
WSACleanup
recv
bind
socket
closesocket
gethostbyname
send
listen
accept
gethostname
WSAStartup
inet_addr
htonl

msgcallback

ord1
ord4
ord3
ord6
ord2
ord5

kernel32

UnmapViewOfFile
GetLastError
CreateFileMappingW
lstrcpyW
GetFileSize
GetModuleHandleW
WriteFile
GetModuleFileNameW
FindFirstFileW
GetDriveTypeW
GetLogicalDriveStringsW
WaitForSingleObject
FindClose
CreateEventW
FindNextFileW
HeapAlloc
HeapFree
GetProcessHeap
lstrlenA
lstrcatA
lstrcpyA
CreateProcessW
SetEvent
GetSystemDirectoryW
Sleep
GetTempPathW
GetCurrentProcess
CreateDirectoryW
OpenProcess
OpenFileMappingA
ExitProcess
SetErrorMode
TerminateThread
lstrcpynW
WaitForMultipleObjects
LocalFree
CreateRemoteThread
VirtualFreeEx
TerminateProcess
lstrlenW
VirtualAllocEx
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
DuplicateHandle
WriteProcessMemory
CopyFileW
OpenMutexW
GetTickCount
GetDriveTypeA
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetLogicalDriveStringsA
EnterCriticalSection
DeleteCriticalSection
CreateThread
CreateMutexW
lstrcmpiA
MapViewOfFile
GetWindowsDirectoryA
WideCharToMultiByte
GetSystemDirectoryA
MultiByteToWideChar
GetLongPathNameW
GetLongPathNameA
GetWindowsDirectoryW
GetTempPathA
ReleaseMutex
GlobalMemoryStatus
GlobalMemoryStatusEx
GetSystemInfo
GetVersionExA
GetVersion
DeviceIoControl
GetCurrentProcessId
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStdHandle
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
LCMapStringW
LCMapStringA
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
InterlockedIncrement
GetCPInfo
InterlockedDecrement
CloseHandle
GetModuleHandleA
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoA
GetCommandLineA
GetSystemTimeAsFileTime
GetCurrentThreadId
ExitThread
CreateFileW
ReadFile
SetFilePointer
GetProcAddress
LoadLibraryW
FreeLibrary
RtlUnwind
HeapSize
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
SetStdHandle
WriteConsoleA
SetCurrentDirectoryW
GetCurrentDirectoryW
SetEnvironmentVariableW
GetTimeZoneInformation
GetLocalTime
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
CreateFileA
FlushFileBuffers
lstrcmpiW

user32

FindWindowW
PeekMessageW
GetWindowThreadProcessId
DispatchMessageW
MessageBoxA
wsprintfW
mouse_event
MessageBoxW
TranslateMessage
PostMessageW
SendMessageW
SendMessageTimeoutW
EnumChildWindows
GetCursorPos
GetClassNameW
SetCursorPos
SetTimer
ClientToScreen
DefWindowProcW
LoadIconW
EnumDisplayDevicesA
MsgWaitForMultipleObjects
GetMessageW
PostQuitMessage
TrackPopupMenu
SetForegroundWindow
LoadCursorW
RegisterClassW
CreateWindowExW

gdi32

GetStockObject

winspool.drv

EnumJobsW
FreePrinterNotifyInfo
OpenPrinterW
FindNextPrinterChangeNotification
FindFirstPrinterChangeNotification
ClosePrinter
FindClosePrinterChangeNotification

advapi32

SetSecurityInfo
GetAclInformation
SetSecurityDescriptorDacl
InitializeAcl
AllocateAndInitializeSid
AddAccessAllowedAce
IsValidSid
FreeSid
GetLengthSid
GetUserNameA
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
AdjustTokenPrivileges
SetEntriesInAclW
RegQueryValueExA
LookupPrivilegeValueW
GetTokenInformation
OpenProcessToken
RegCloseKey
RegOpenKeyExA
InitializeSecurityDescriptor

shell32

SHGetFolderPathW
SHGetFolderPathA

iten

ord1
ord6
ord4
ord5
ord7
ord2
ord3
ord8

shlwapi

PathMatchSpecW

iphlpapi

GetAdaptersInfo

bugtrapu

BT_SetSupportServer
BT_SetAppName
BT_InstallSehFilter
BT_SetReportFilePath
BT_SetFlags
BT_SetSupportEMail

psapi

GetModuleFileNameExW
EnumProcessModules
EnumProcesses

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

netapi32

Netbios

Sections

.text
Size: 145KB - Virtual size: 145KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7d88f1d51e78ac8df80ff4a83897173e

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

msgcallback

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

iten

shlwapi

iphlpapi

bugtrapu

psapi

version

netapi32

Sections

.text Size: 145KB - Virtual size: 145KB

.rdata Size: 27KB - Virtual size: 26KB

.data Size: 5KB - Virtual size: 14KB

.sdata Size: 512B - Virtual size: 4B

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 145KB - Virtual size: 145KB

.rdata
Size: 27KB - Virtual size: 26KB

.data
Size: 5KB - Virtual size: 14KB

.sdata
Size: 512B - Virtual size: 4B

.rsrc
Size: 4KB - Virtual size: 3KB