01ee41e51e4d737ed5d767f3fdd63d52

Sharing

Copy URL Twitter E-mail

General

Target

01ee41e51e4d737ed5d767f3fdd63d52
Size

440KB
MD5

01ee41e51e4d737ed5d767f3fdd63d52
SHA1

053e857b1d9636baa006436bfa251659c14c600f
SHA256

79e095830c30c0f1e76ef08c0d0bf2e39e6fdbb56a834d1cd2aba0593acb8405
SHA512

fa101dfc93c634cfc7fbb4105b521686237fbc749d05edf1915f031bcec4a4398fade8faaf7efb954b764267cba25b6205d975dd0acc90309824459396c3d4b6
SSDEEP

12288:TgepK5F3qfgS1qBvtYED3ScIdEX8VsPXof:TrpmFqfJqBvtbSDi/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01ee41e51e4d737ed5d767f3fdd63d52

Files

01ee41e51e4d737ed5d767f3fdd63d52
.exe windows:4 windows x86 arch:x86

6656bd2bf719761e0c18944b9b78d8d1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

Arc
FloodFill
SetBkColor
SetMetaRgn
GetRegionData
StartDocW
FrameRgn
StartPage
Ellipse
CopyEnhMetaFileW
CreateMetaFileW
ExtCreateRegion
SetPolyFillMode
MoveToEx
GetDCOrgEx
WidenPath
GetRandomRgn
Polygon
GetRasterizerCaps
DPtoLP
Rectangle
CreateHalftonePalette
SetBkMode

comctl32

DestroyPropertySheetPage
ImageList_Merge
CreatePropertySheetPageW
ImageList_DragEnter
ImageList_SetOverlayImage
InitCommonControlsEx

user32

EmptyClipboard
SetDlgItemInt
AppendMenuA
ShowScrollBar
ReleaseCapture
GrayStringA
GetMenuItemInfoW
RegisterClassA
SendMessageTimeoutA
TrackPopupMenu
MessageBoxA
EnumDisplaySettingsExW
SendIMEMessageExW
DialogBoxParamA
SetFocus
WinHelpA
ArrangeIconicWindows
SetPropA
IsDlgButtonChecked
SetWindowTextW
GetDCEx
IsCharLowerA
BroadcastSystemMessageA
WaitMessage
MapVirtualKeyExA
DestroyCursor
DialogBoxIndirectParamA
SetDebugErrorLevel
GetPropA
MapVirtualKeyW
SetMenuItemInfoA
DrawEdge
GetKeyboardLayoutNameW
GetWindowInfo
DdeGetData
DdeCreateStringHandleW
EndDeferWindowPos
DdeClientTransaction
GetMessagePos
RegisterClassExA
InsertMenuItemW

kernel32

ReadFile
GetLastError
TlsSetValue
EnterCriticalSection
GetUserDefaultLCID
GetModuleFileNameA
SetLastError
SetHandleCount
ExitProcess
TlsFree
AddAtomW
FillConsoleOutputCharacterA
GetNamedPipeHandleStateW
CompareStringW
GetCurrentProcessId
SetConsoleOutputCP
GetCPInfo
SetLocaleInfoW
GetDateFormatA
LCMapStringA
GetConsoleCursorInfo
FlushFileBuffers
GetOEMCP
WaitForMultipleObjects
LoadLibraryA
VirtualProtect
GetStringTypeW
GetCurrentProcess
SetPriorityClass
GetLocaleInfoA
SetConsoleTitleA
lstrcpynW
WritePrivateProfileStructW
GetStartupInfoA
GetFileType
GetACP
GetStdHandle
ReadConsoleW
GetModuleHandleA
LoadLibraryW
TlsAlloc
DebugBreak
MultiByteToWideChar
CompareStringA
IsBadWritePtr
HeapCreate
GetVolumeInformationA
GetTimeFormatA
GetDriveTypeA
EnumResourceLanguagesW
FindResourceA
PulseEvent
GetEnvironmentStringsW
FoldStringW
UnhandledExceptionFilter
GetPrivateProfileStructW
FreeEnvironmentStringsA
VirtualAlloc
InterlockedExchange
IsValidLocale
GetStringTypeA
WideCharToMultiByte
DeleteCriticalSection
HeapAlloc
InitializeCriticalSection
SetConsoleCtrlHandler
GetLongPathNameW
QueryPerformanceCounter
GetCurrentThread
GetTickCount
lstrcpy
CreateEventA
GetThreadTimes
GetSystemDefaultLCID
WriteFile
TlsGetValue
GlobalAddAtomW
SleepEx
ReleaseMutex
GetShortPathNameA
GetCommandLineA
LCMapStringW
CreateMutexA
HeapReAlloc
GetVolumeInformationW
TerminateProcess
CreateNamedPipeW
GetCurrentThreadId
SetEnvironmentVariableA
GetVersionExA
GetEnvironmentStrings
lstrlenA
ResumeThread
GetSystemInfo
GetSystemTimeAsFileTime
SetStdHandle
GetLocaleInfoW
HeapFree
VirtualQuery
OpenProcess
CreateThread
lstrlen
GetTimeZoneInformation
HeapDestroy
FreeEnvironmentStringsW
RaiseException
SystemTimeToFileTime
OpenMutexA
SetFilePointer
GetProcAddress
VirtualFree
LeaveCriticalSection
GetDriveTypeW
FindResourceExA
SetThreadPriority
RtlUnwind
CloseHandle
HeapSize
RemoveDirectoryA
IsValidCodePage
GetModuleFileNameW
EnumSystemLocalesA

comdlg32

GetOpenFileNameW
PageSetupDlgA
FindTextA
ReplaceTextA

shell32

FindExecutableW
SHFreeNameMappings
DragQueryFile
DragQueryFileAorW
SHInvokePrinterCommandW

advapi32

ReportEventW
CryptSetProviderExA
CryptSetProviderW
RegCreateKeyExW
LookupPrivilegeValueA
InitiateSystemShutdownA
LookupPrivilegeDisplayNameA
CreateServiceW
RegCreateKeyW
LookupPrivilegeNameW
CreateServiceA
RegEnumKeyA
RegQueryInfoKeyA
CryptImportKey
GetUserNameW
CryptEnumProviderTypesW
RegCreateKeyA
RegEnumKeyExW
StartServiceW
LookupSecurityDescriptorPartsW

Sections

.text
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6656bd2bf719761e0c18944b9b78d8d1

Headers

File Characteristics

Imports

gdi32

comctl32

user32

kernel32

comdlg32

shell32

advapi32

Sections

.text Size: 160KB - Virtual size: 159KB

.rdata Size: 120KB - Virtual size: 119KB

.data Size: 108KB - Virtual size: 118KB

.rsrc Size: 48KB - Virtual size: 46KB

.text
Size: 160KB - Virtual size: 159KB

.rdata
Size: 120KB - Virtual size: 119KB

.data
Size: 108KB - Virtual size: 118KB

.rsrc
Size: 48KB - Virtual size: 46KB