027c6afca2bb7b224e473e02a8b5010f

Sharing

Copy URL Twitter E-mail

General

Target

027c6afca2bb7b224e473e02a8b5010f
Size

224KB
MD5

027c6afca2bb7b224e473e02a8b5010f
SHA1

a0255f6bee318b9a74f04a14e52944aa7a965b74
SHA256

0c1432db6c6870d749c70f43a0c2ccd5d447bda9d9a05fa86f7e65d1d4a42371
SHA512

e2d6daee1bdb8402a6a5241896b4d357f75d17fa13c9405896f55a07db1a138d1e201f340038db71a25c87f609d5dd051b0110757ee75d46f40cfad3fda75a7f
SSDEEP

6144:ugUvvkfWTPAKPggVg3nEDLXn5UTmHbcPJTK:uZoWbAlgVqEnJUeghT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
027c6afca2bb7b224e473e02a8b5010f

Files

027c6afca2bb7b224e473e02a8b5010f
.exe windows:5 windows x86 arch:x86

d0aca49ce7014d1b3ec3c1df8f27cb16

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

Heap32ListNext
GetHandleInformation
GetCurrencyFormatA
BuildCommDCBA
WriteProfileStringA
Heap32First
ReadFileEx
EnumDateFormatsExA
GetThreadSelectorEntry
WaitForDebugEvent
MapViewOfFileEx
TerminateJobObject
SetConsoleFont
LockFile
SetEnvironmentVariableA
FreeConsole
FindCloseChangeNotification
SetThreadLocale
GetProcessShutdownParameters
SetConsoleCtrlHandler
GetNumberFormatA
FillConsoleOutputCharacterA
Beep
SystemTimeToFileTime
WritePrivateProfileSectionA
VirtualProtect
SetUnhandledExceptionFilter
SetConsoleCursorPosition
SearchPathA
OpenEventA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetACP
GetFileAttributesExA
VirtualFree
WriteFile
CancelIo
AssignProcessToJobObject
DuplicateHandle
GetConsoleKeyboardLayoutNameA
SetConsolePalette
GetConsoleAliasesA
FindVolumeMountPointClose
VirtualAllocEx
GetStdHandle
GetLocalTime
SetThreadPriority
GetProcAddress
RtlFillMemory
TransmitCommChar
GlobalWire
IsBadStringPtrA
GetQueuedCompletionStatus
ConvertThreadToFiber
_lread
IsProcessorFeaturePresent
GetCPInfoExA
MapViewOfFile
ReadConsoleOutputA
CreateMutexA
IsBadWritePtr
CancelWaitableTimer
GlobalLock
SizeofResource
LocalFlags
GetConsoleInputWaitHandle
SetInformationJobObject
WaitForSingleObject
SetProcessAffinityMask
Thread32First
SystemTimeToTzSpecificLocalTime
GetLogicalDrives
LocalFree
EnumCalendarInfoExA
IsValidCodePage
DisconnectNamedPipe
LocalUnlock
GetAtomNameA
DeviceIoControl
GetLocaleInfoA
IsBadCodePtr
GetLongPathNameA
GetDevicePowerState
IsDBCSLeadByte
GetCurrentProcess
GetConsoleFontSize
MultiByteToWideChar
lstrcatA
WritePrivateProfileStructA
GetPrivateProfileStringA
IsValidLocale
WriteProfileSectionA
WaitCommEvent
GetCommMask
GetCommConfig
GetConsoleCursorInfo
GetModuleFileNameA
SetConsoleCursor
GetNamedPipeInfo
CreateFileA
SetHandleInformation
GetVersionExA
UpdateResourceA
GlobalFree
CreateNamedPipeA
SetTimeZoneInformation
GetProcessHeap
DeleteTimerQueue
WaitForMultipleObjectsEx
FreeLibrary
CloseHandle
SetConsoleOutputCP
GetSystemDefaultLCID
GetConsoleAliasA
TerminateThread
VirtualAlloc
GetModuleHandleA
GlobalCompact
LoadLibraryA
GetStartupInfoA

msvcrt

__mb_cur_max
_isctype
vwprintf
_adj_fdiv_m64
_isatty
bsearch
_atoi64
__argc
_wremove
_onexit
_mbsnccnt
_mbsnbcpy
__p__pwctype
_mbsdec
_XcptFilter
exit
_acmdln
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__set_app_type
_except_handler3
_controlfp
_rotr
freopen
fsetpos
_mbsnbcnt
free
_mbsnset
_fputchar
tmpfile
vsprintf
pow
_adj_fprem
_setmaxstdio
toupper
_mktemp
_wsetlocale
fflush
fseek
ldiv
strrchr
ftell
_tell
iswspace
__p__fmode
_mbstrlen
__pxcptinfoptrs
_expand
fwprintf
iswalnum
_ltow
signal
_chdrive
__p__acmdln
_wspawnlpe
atoi
_mbslen
_ismbbalpha
_CIsinh
_strnset
realloc
memcpy
vswprintf
_ultow
fclose
_mbsnbcoll
_ismbclower
_wfsopen
__dllonexit
isleadbyte
printf
_finite
_locking
_flsbuf
_endthread
_exit
fputc
fread
_mbsicoll
_ftol
iswlower
_getpid
_unlock
fprintf
__p___winitenv
_iob
_mbsbtype
fputs
_dup2
_itow
fwrite
memmove
_mbsrchr
__CxxFrameHandler
__lc_handle
_fpreset
_mbsrev
wcscspn
_global_unwind2
_wmkdir
_wexecvp
_strupr
__p__tzname
_wcsset
malloc
__RTCastToVoid
_snprintf
_mbspbrk
_mbclen
iswxdigit
memset
_open
_close
_wchmod
_strdup
_adj_fptan
feof
_getdrives
_j0
_wfdopen
_spawnvpe
islower
__getmainargs
__badioinfo
_CIcos
clearerr
_tolower
_ltoa
_pipe
_atodbl
__p__wenviron
getwchar
_errno
ferror
fopen
_fcloseall
sprintf
_mbsncpy
atol

user32

FlashWindow
ShowCursor
LoadIconA
UnhookWindowsHook
MsgWaitForMultipleObjectsEx
CheckMenuItem
CharPrevA
IMPSetIMEA
EnableWindow
MessageBoxExA
GetSystemMenu
PostMessageA
SetMessageExtraInfo
GetCaretBlinkTime
CharLowerA
CloseWindow
OpenDesktopA
SetDeskWallpaper
MessageBeep
LockWindowUpdate
GetMessageExtraInfo
ToAscii
IsRectEmpty
LoadStringA
DefDlgProcA
DdeSetQualityOfService
GetPropA
AppendMenuA
GetDesktopWindow
GetWindowWord
ShowScrollBar
IMPGetIMEA
GetDialogBaseUnits
ScrollWindow
MapVirtualKeyExA
InvalidateRect
GetWindowTextLengthA
PtInRect
InflateRect
ExcludeUpdateRgn
ChildWindowFromPoint
MessageBoxA
CharNextA
IsWindowEnabled
GetMenuDefaultItem
SendIMEMessageExA
SetProcessDefaultLayout
DdeQueryNextServer
SubtractRect
FrameRect
ReleaseDC
SetWindowContextHelpId
MonitorFromRect
GetWindowDC
GetMessageTime
ArrangeIconicWindows
GetDC
GetOpenClipboardWindow
SetMessageQueue
AnimateWindow
wsprintfA
DrawEdge
UserHandleGrantAccess
OemToCharA
GetClipCursor
TrackMouseEvent
FindWindowA
LookupIconIdFromDirectory
SendNotifyMessageA
EmptyClipboard
ReuseDDElParam
FindWindowExA
SetClipboardViewer
ImpersonateDdeClientWindow
GetUserObjectInformationA
MonitorFromWindow
GetCursor
ValidateRgn
GetMessagePos
GetForegroundWindow
GetClassInfoExA
SetWindowsHookA
LoadCursorA
SetMenu
ActivateKeyboardLayout
SetDebugErrorLevel
GetFocus
GetCapture
GetActiveWindow
IsCharUpperA

advapi32

QueryServiceObjectSecurity
ConvertToAutoInheritPrivateObjectSecurity
LsaSetTrustedDomainInformation
LsaEnumeratePrivileges
RegCloseKey
GetSecurityDescriptorDacl
RegCreateKeyExA
QueryServiceLockStatusA
InitializeSecurityDescriptor
AdjustTokenGroups
CryptGetHashParam
BuildTrusteeWithNameA
CryptCreateHash
RegCreateKeyA
RegisterEventSourceA
BuildImpersonateTrusteeA
GetAuditedPermissionsFromAclA
LsaNtStatusToWinError
CryptSetKeyParam
SystemFunction016
CryptSetProvParam
CryptGetKeyParam
GetSecurityDescriptorOwner
AccessCheckByType
SetSecurityDescriptorSacl
SystemFunction009
LsaSetSystemAccessAccount
LsaClearAuditLog
CreatePrivateObjectSecurityEx
LsaEnumerateAccountRights
LookupSecurityDescriptorPartsA
GetAce
ConvertStringSecurityDescriptorToSecurityDescriptorA
FreeSid
RegOverridePredefKey
DeleteService
EqualSid
LsaEnumerateTrustedDomains
LsaEnumerateAccounts
CryptDuplicateKey
SystemFunction027
SystemFunction025
RegRestoreKeyA
CreatePrivateObjectSecurity
SystemFunction001
I_ScSetServiceBitsA
SystemFunction023
RegReplaceKeyA
GetAclInformation
GetKernelObjectSecurity
ElfOldestRecord
LsaAddPrivilegesToAccount
SystemFunction002
SetKernelObjectSecurity
IsValidSecurityDescriptor
RegFlushKey
CryptGetProvParam
SetNamedSecurityInfoA
LsaEnumeratePrivilegesOfAccount
LsaAddAccountRights
LsaRemoveAccountRights
LsaDelete
CryptSetHashParam
GetFileSecurityA
SetThreadToken
ElfOpenBackupEventLogA
GetSecurityInfoExA
LsaGetSystemAccessAccount
GetTrusteeNameA
CancelOverlappedAccess
ObjectCloseAuditAlarmA
EncryptFileA
OpenSCManagerA
LsaClose
SystemFunction028
TrusteeAccessToObjectA
LsaSetInformationTrustedDomain
UnlockServiceDatabase
BuildSecurityDescriptorA
SetServiceStatus
RegQueryMultipleValuesA
SystemFunction008
LsaDeleteTrustedDomain
RegisterServiceCtrlHandlerA
SetEntriesInAccessListA
LsaQueryInfoTrustedDomain
QueryServiceConfigA
LsaQueryTrustedDomainInfo
NotifyBootConfigStatus
FreeEncryptionCertificateHashList
CryptHashData
SetFileSecurityA
DestroyPrivateObjectSecurity
LsaSetDomainInformationPolicy
LsaRetrievePrivateData
GetNamedSecurityInfoExA
ObjectDeleteAuditAlarmA
SetServiceObjectSecurity
ConvertSecurityDescriptorToAccessNamedA
RegOpenKeyA
LsaSetQuotasForAccount
InitializeSid
DeregisterEventSource
LsaCreateTrustedDomain
RegQueryValueA
RegEnumKeyA
PrivilegeCheck
LsaSetSecret
RegGetKeySecurity
ElfClearEventLogFileA

msvcp60

??0Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 168KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d0aca49ce7014d1b3ec3c1df8f27cb16

Headers

File Characteristics

Imports

kernel32

msvcrt

user32

advapi32

msvcp60

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 168KB - Virtual size: 164KB

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 168KB - Virtual size: 164KB