1f4060e879e38377eed67246da0764df

Sharing

Copy URL Twitter E-mail

General

Target

1f4060e879e38377eed67246da0764df
Size

340KB
MD5

1f4060e879e38377eed67246da0764df
SHA1

d1779a17c2db14816d979ff4952e56a909388be4
SHA256

8429918f7b1593ffed4c3f4d4509f523e2264abe99a58a99c99bce90e16e8343
SHA512

a6404ddc3caa59527726c349eafe5ea8d3a133f4bd4172076d4a11d292e8a035f9162f0e5f561457674444cce6389fe43aadf8a277e6129330d3d912bf1cecc2
SSDEEP

6144:qzhb0+i4OmqNhiuvGOA/dWYOY0sJkGhEnwzZnr8IA0xyzSwrDGU+:AbUFmmhik+/dWYSQK0r8r2wrDGU+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1f4060e879e38377eed67246da0764df

Files

1f4060e879e38377eed67246da0764df
.exe windows:4 windows x86 arch:x86

bdc78b384b41303d3118b444d4deec69

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

netapi32

NetMessageBufferSend

kernel32

GetEnvironmentVariableA
GetExitCodeProcess
GetFileAttributesW
GetFileSize
GetFileTime
GetFileType
GetLastError
GetLocalTime
GetLocaleInfoA
GetLocaleInfoW
GetLogicalDrives
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetPrivateProfileSectionW
GetPrivateProfileStringW
GetProcAddress
GetProcessHeap
GetShortPathNameW
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemTime
GetSystemTimeAsFileTime
GetTempFileNameW
GetTempPathW
GetTickCount
GetTimeFormatA
GetTimeFormatW
GetTimeZoneInformation
GetVersion
GetVersionExA
GetVersionExW
GetWindowsDirectoryW
GlobalMemoryStatus
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsBadCodePtr
GetEnvironmentStringsW
IsBadWritePtr
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalAlloc
LocalFree
MapViewOfFile
MoveFileExW
MoveFileW
MultiByteToWideChar
OpenFileMappingW
OpenMutexW
OpenProcess
QueryDosDeviceW
ReadFile
ReadProcessMemory
ReleaseMutex
ResetEvent
RtlUnwind
GetEnvironmentStringsA
SetEnvironmentVariableA
SetEvent
SetFileAttributesW
SetFilePointer
SetHandleCount
SetLastError
SetStdHandle
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
TerminateThread
TlsAlloc
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
WritePrivateProfileSectionW
WritePrivateProfileStringW
lstrcmpA
lstrlenA
lstrlenW
GetDriveTypeW
GetDiskFreeSpaceW
GetDateFormatW
GetDateFormatA
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetComputerNameW
GetComputerNameA
GetCommandLineA
GetCPInfo
GetACP
FreeLibrary
FreeEnvironmentStringsW
FreeEnvironmentStringsA
FlushFileBuffers
FindNextFileW
FindFirstFileW
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
ExpandEnvironmentStringsW
ExitProcess
EnterCriticalSection
DuplicateHandle
DeviceIoControl
DeleteFileW
DeleteCriticalSection
CreateThread
CreateProcessW
CreateMutexW
CreateFileW
CreateFileMappingW
CreateFileA
CreateEventW
CreateDirectoryW
CopyFileW
CompareStringW
CompareStringA
CompareFileTime
CloseHandle
IsBadReadPtr
SetEndOfFile

user32

wsprintfW
TranslateMessage
SetTimer
SendMessageW
RegisterClassW
PostMessageW
PeekMessageW
MsgWaitForMultipleObjects
LoadStringW
KillTimer
GetMessageW
DispatchMessageW
CreateWindowExW
DefWindowProcW

advapi32

RegOpenKeyExW
RegOpenKeyA
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
QueryServiceStatus
OpenThreadToken
OpenServiceW
OpenSCManagerW
OpenProcessToken
LookupAccountSidW
IsValidSid
InitializeSecurityDescriptor
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
GetSecurityDescriptorDacl
GetKernelObjectSecurity
FreeSid
EqualSid
DuplicateTokenEx
DuplicateToken
DeleteService
CreateServiceW
CreateProcessAsUserW
ControlService
CloseServiceHandle
AllocateAndInitializeSid
RegQueryInfoKeyW
RegQueryValueExA
RegQueryValueExW
RegSetValueExW
RegisterServiceCtrlHandlerW
RevertToSelf
SetKernelObjectSecurity
SetSecurityDescriptorDacl
SetServiceStatus
SetThreadToken
StartServiceCtrlDispatcherW
StartServiceW
RegEnumKeyExW
RegEnumKeyW
RegEnumValueW
RegDeleteValueW

wsock32

WSASetLastError
WSAGetLastError
__WSAFDIsSet
closesocket
connect
gethostbyname
htons
ioctlsocket
inet_ntoa
recv
select
send
setsockopt
socket
WSACleanup
WSAStartup

ole32

CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

VariantClear
SysFreeString
SysAllocString

Exports

Exports

adler32
compress
compress2
compressBound
crc32
deflate
deflateBound
deflateCopy
deflateEnd
deflateInit2_
deflateInit_
deflateParams
deflatePrime
deflateReset
deflateSetDictionary
get_crc_table
gzclearerr
gzclose
gzdopen
gzeof
gzerror
gzflush
gzgetc
gzgets
gzopen
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzsetparams
gztell
gzungetc
gzwrite
inflate
inflateBack
inflateBackEnd
inflateBackInit_
inflateCopy
inflateEnd
inflateInit2_
inflateInit_
inflateReset
inflateSetDictionary
inflateSync
inflateSyncPoint
uncompress
zError
zlibCompileFlags
zlibVersion

Sections

.text
Size: 232KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bdc78b384b41303d3118b444d4deec69

Headers

File Characteristics

Imports

netapi32

kernel32

user32

advapi32

wsock32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 232KB - Virtual size: 232KB

.rdata Size: 48KB - Virtual size: 48KB

.data Size: 20KB - Virtual size: 1.7MB

.idata Size: 8KB - Virtual size: 8KB

.rsrc Size: 28KB - Virtual size: 28KB

.text
Size: 232KB - Virtual size: 232KB

.rdata
Size: 48KB - Virtual size: 48KB

.data
Size: 20KB - Virtual size: 1.7MB

.idata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 28KB - Virtual size: 28KB