037e8159c89a1ef5d0fbc0fc9642f6a1

Sharing

Copy URL Twitter E-mail

General

Target

037e8159c89a1ef5d0fbc0fc9642f6a1
Size

779KB
MD5

037e8159c89a1ef5d0fbc0fc9642f6a1
SHA1

bc0286e5d57fd49aa0161face5343de5d070675d
SHA256

04a6c21767c472e8272fb5618679eac151ea7f0b55082bb49bdfb5b7449abc16
SHA512

2cfb9a971af8601d0fe297bb96ea7fe4d55e307984f8cee525c66c2e2595b6a6e5d9c29a15e13b6fdfc09e97803594bf5a5985ae7ab6f1d5bce53f9424d2e34f
SSDEEP

12288:cTgd03Ovig6sS266qoTZQiS3LH3fNqTp:cTguOvig692hqoy4T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
037e8159c89a1ef5d0fbc0fc9642f6a1

Files

037e8159c89a1ef5d0fbc0fc9642f6a1
.exe windows:5 windows x86 arch:x86

babf3ab2e9c9a07a0100f2ac39354ee9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winspool.drv

EnumPrintersW

shell32

CommandLineToArgvW
ShellExecuteExW

gdi32

CreateFontIndirectW
GetDeviceCaps
DeleteObject
ExtEscape
CreateDCW
DeleteDC
RectVisible
ScaleViewportExtEx
SetArcDirection
PolylineTo
GetStockObject
GetClipBox
OffsetViewportOrgEx
ScaleWindowExtEx
GetTextColor
SelectObject

advapi32

CredEnumerateW
RegQueryValueExW
CredDeleteW
RegOpenKeyExW
RegCloseKey
CredFree
RegSetValueA
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptDestroyHash
RegQueryValueA
RegOpenKeyA
RegCreateKeyA

shlwapi

PathRenameExtensionW
PathRemoveFileSpecW
PathRemoveBackslashW

user32

TranslateMessage
ReleaseDC
SendDlgItemMessageW
GetDesktopWindow
GetDC
CreateDialogParamW
MessageBoxW
SetDlgItemTextW
GetMessageW
SetWindowTextW
MoveWindow
DispatchMessageW
SetActiveWindow
GetWindowRect
LoadStringW
SendMessageW
DestroyWindow
PostQuitMessage
GetWindowLongA
DrawCaption
DefWindowProcA
SetMenuItemBitmaps
GetMonitorInfoW
GetMenuCheckMarkDimensions
GetClientRect
RegisterClassA
CreateWindowExA
SetTimer
SetWindowLongA
GetMessageA
DispatchMessageA
KillTimer

ole32

CoInitialize
CoTreatAsClass
CoResumeClassObjects

kernel32

GetConsoleOutputCP
CreateFileA
WriteConsoleW
FlushFileBuffers
GetLocalTime
WriteConsoleA
SetStdHandle
LoadLibraryA
GetConsoleMode
GetConsoleCP
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
HeapSize
InitializeCriticalSectionAndSpinCount
MapViewOfFile
UnmapViewOfFile
FreeLibrary
HeapAlloc
LoadLibraryExW
HeapFree
GetProcessHeap
GlobalAlloc
GetLastError
GetProcAddress
GlobalFree
CreateFileMappingW
lstrcmpiW
GetCurrentThreadId
CloseHandle
GetCurrentProcessId
lstrlenW
GetSystemDefaultLangID
GetCommandLineW
GetDateFormatW
CreateMutexW
GetModuleHandleW
GetPrivateProfileStringW
GetVersionExW
GetFileAttributesW
MulDiv
GetModuleFileNameW
LocalFree
CreateThread
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
VirtualProtect
GetNamedPipeInfo
GetExitCodeProcess
GetProcessInformation
GetExitCodeThread
SizeofResource
LocalAlloc
LoadResource
GlobalLock
ReadFile
DeviceIoControl
OpenProcess
GetFileSize
SetEvent
GlobalUnlock
GlobalFlags
LockResource
FindFirstFileA
ResetEvent
FormatMessageA
SetThreadStackGuarantee
GetCommMask
WaitForSingleObject
ReleaseMutex
GetModuleHandleA
CreateFileMappingA
OpenFileMappingA

oleaut32

RegisterTypeLib
SafeArrayAllocDescriptor
SysStringLen

setupapi

SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList

Sections

.text
Size: 361KB - Virtual size: 360KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 332KB - Virtual size: 331KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

babf3ab2e9c9a07a0100f2ac39354ee9

Headers

DLL Characteristics

File Characteristics

Imports

winspool.drv

shell32

gdi32

advapi32

shlwapi

user32

ole32

kernel32

oleaut32

setupapi

Sections

.text Size: 361KB - Virtual size: 360KB

.rdata Size: 17KB - Virtual size: 17KB

.data Size: 24KB - Virtual size: 24KB

.rsrc Size: 332KB - Virtual size: 331KB

.reloc Size: 43KB - Virtual size: 43KB

.text
Size: 361KB - Virtual size: 360KB

.rdata
Size: 17KB - Virtual size: 17KB

.data
Size: 24KB - Virtual size: 24KB

.rsrc
Size: 332KB - Virtual size: 331KB

.reloc
Size: 43KB - Virtual size: 43KB