0035b43092995762844777cb53a65fec

Sharing

Copy URL Twitter E-mail

General

Target

0035b43092995762844777cb53a65fec
Size

276KB
MD5

0035b43092995762844777cb53a65fec
SHA1

3e1d220dd838f9b4bb53f9de98bfb9c659e6c141
SHA256

79190dcb6f04b994e71a124df35f3c52da3092995880fa59a964936b0b061276
SHA512

85a39c3d477a3210ad371e5b745c5f35217c0a52a32c93f03711872c07962fd27fba654b22821ac826aaaed658fac4e24369455147b49f33c0a4b6bbe449fa55
SSDEEP

6144:405rzVZf250gv0DJUGsdxMae71XSRJ8N08IiKU0MW3Cu:lf28UV7e78J8NHIXUyC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0035b43092995762844777cb53a65fec

Files

0035b43092995762844777cb53a65fec
.exe windows:4 windows x86 arch:x86

5eafaaf666cdfc633a491e4fe8df8b66

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetLengthSid
RegEnumKeyExW
QueryServiceConfigW
SetThreadToken
RegisterServiceCtrlHandlerW
RegDeleteValueA
ImpersonateSelf
CopySid
SetSecurityDescriptorGroup
CreateServiceA
CryptAcquireContextA
RegEnumKeyW
CryptReleaseContext
AccessCheck

winspool.drv

GetPrinterA
ClosePrinter
DeletePrinter
GetPrinterDataA

user32

CharToOemBuffA
MapDialogRect
MonitorFromPoint
DdeUninitialize
LoadStringA
ScrollWindowEx
ScrollDC
EnumThreadWindows
SetClipboardData
SendMessageA
HideCaret
DispatchMessageW
CharLowerW
GetMonitorInfoW
GetDlgItemInt
SendDlgItemMessageA
CheckMenuItem
SystemParametersInfoA
CharNextA
LoadKeyboardLayoutA
GetKeyState
DrawFrameControl
GetLastActivePopup
InsertMenuItemW
PostThreadMessageA
SetMenu
GrayStringW
GetSubMenu
MoveWindow
GetScrollPos
KillTimer
TrackPopupMenuEx
SetParent
TabbedTextOutA
ModifyMenuW
TranslateAcceleratorW
GetMessageTime
GetSystemMenu
CharLowerA
DrawTextA
UpdateWindow
SetMenuItemInfoW
IsCharAlphaW

kernel32

GetModuleHandleA
GetNumberFormatW
HeapCreate
QueryDosDeviceA
WritePrivateProfileStringA
WritePrivateProfileSectionA
SetProcessWorkingSetSize
GlobalHandle
GetProfileStringW
WritePrivateProfileStringW
GetTempFileNameW
GetSystemDirectoryA
DeleteCriticalSection
IsDBCSLeadByte
LCMapStringA
HeapDestroy
lstrcmpiA
SetPriorityClass
GetFileAttributesW
GetDateFormatA
GetLocalTime
SetEndOfFile
ReleaseSemaphore
GetComputerNameW
GetCurrentProcessId
FlushInstructionCache
CloseHandle
GetLongPathNameW
GetCommandLineW
ExitThread
TransactNamedPipe
FindResourceExW
MoveFileA
IsValidLocale
CreateFileA
CreateThread
GetVersionExA
GetSystemDirectoryW
lstrcmpW
ResetEvent
TlsGetValue
ReadFile
GetUserGeoID
WriteConsoleA
GetCPInfo
InterlockedIncrement
EnumResourceLanguagesA
LockFile
VirtualAlloc
GlobalFree
DeleteFileA
QueryPerformanceCounter
GlobalAlloc
CreateNamedPipeA
GetSystemDefaultLangID
MulDiv
SystemTimeToTzSpecificLocalTime
FindResourceA
GetDiskFreeSpaceW
GetSystemWindowsDirectoryW
RemoveDirectoryW
GetDriveTypeA
LockResource
SetFileAttributesW
OpenMutexA
GetPrivateProfileIntW
DeleteTimerQueueTimer
GetCurrentThreadId
FileTimeToDosDateTime
CompareStringW
GetFileSize
DuplicateHandle
GetShortPathNameW
OpenProcess
CompareStringA
GetFileSizeEx
GetProcAddress
GetStartupInfoA

shlwapi

PathFileExistsW
PathCanonicalizeW
SHGetValueW

version

GetFileVersionInfoA

ole32

CreateILockBytesOnHGlobal
CoTreatAsClass
OleLoad
OleCreateLinkFromData
ReleaseStgMedium
CreateItemMoniker

oleaut32

GetActiveObject

msvcrt

_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
bsearch
towlower
wcscspn
wcstol
memmove
_iob
_itow
_beginthreadex
_CxxThrowException
malloc
swprintf
qsort
ceil
_msize
_setmbcp
strncmp
_exit
_strnicmp
_itoa
wcsrchr
_splitpath
wcstok
atol
_controlfp
_stricmp
wcsncmp
floor
wcscpy
_cexit
wcsspn
exit
_vsnprintf
sprintf
localtime
wcsstr
srand
tolower
rand
ctime
_wtoi
_wcslwr
swscanf
calloc
strstr
fclose
_ismbblead
longjmp
_wtol
_errno
wcstoul
strrchr
wcsncpy
wcstod
isdigit

Sections

.text
Size: 192KB - Virtual size: 191KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

eykyesm
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

wkwas
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

oqsciom
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5eafaaf666cdfc633a491e4fe8df8b66

Headers

File Characteristics

Imports

advapi32

winspool.drv

user32

kernel32

shlwapi

version

ole32

oleaut32

msvcrt

Sections

.text Size: 192KB - Virtual size: 191KB

eykyesm Size: 40KB - Virtual size: 39KB

wkwas Size: 8KB - Virtual size: 6KB

oqsciom Size: 32KB - Virtual size: 28KB

.text
Size: 192KB - Virtual size: 191KB

eykyesm
Size: 40KB - Virtual size: 39KB

wkwas
Size: 8KB - Virtual size: 6KB

oqsciom
Size: 32KB - Virtual size: 28KB