0a4512b18fe1132b84f77fde38cb40e8

Sharing

Copy URL Twitter E-mail

General

Target

0a4512b18fe1132b84f77fde38cb40e8
Size

861KB
MD5

0a4512b18fe1132b84f77fde38cb40e8
SHA1

2fef80bddb14e64c1eee77807852ced32494d526
SHA256

0e1ff777a7a81f3e90e620db860d61cc7586ec04005c71b9e878a6dc5e3b1a07
SHA512

2a34ada857a90ff45860128aaabdebc08ea889423149b7656d6cb0b5a4f297d6381516ad685c2bda9e31d4f191f715e1283eceb658b30176e2a4475eeb1e7e57
SSDEEP

24576:ifnJ23ZNEY1eHm37qepaemgP2mfoEk5Y+Q/ZuYz:kQt1eG3ueplmo22X5Zxz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a4512b18fe1132b84f77fde38cb40e8

Files

0a4512b18fe1132b84f77fde38cb40e8
.exe windows:5 windows x86 arch:x86

fae8ce63a9bbb691c2e7443604ae99a2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

SetupGetSourceInfoA
CM_Add_ID_ExW
SetupDiGetClassDevsExW
SetupFindNextLine
InstallHinfSection
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInterfaceAlias
CM_Query_And_Remove_SubTreeW
pSetupGetFileTitle
CM_Get_Sibling_Ex
pSetupGetInfSections
SetupDiGetClassDevsExA
pSetupGetRealSystemTime
CM_Get_Sibling
SetupAdjustDiskSpaceListW
SetupQuerySpaceRequiredOnDriveW
SetupVerifyInfFileA
CM_Get_Class_Name_ExA
SetupFreeSourceListW
SetupCopyErrorW
MyMalloc
SetupDiGetSelectedDriverA
CM_Query_Arbitrator_Free_Data
SetupRemoveSectionFromDiskSpaceListW
pSetupIsUserAdmin
CM_Uninstall_DevNode
SetupDiInstallClassExA
CM_Disable_DevNode
CM_Get_Device_Interface_List_Size_ExA
SetupDiBuildClassInfoListExW
SetupQueueRenameSectionA

shlwapi

PathRemoveFileSpecW
SHRegGetPathA
StrNCatW
StrDupA
PathAddBackslashA
DelayLoadFailureHook
SHSetValueW
PathStripPathW
PathIsURLA
PathUnquoteSpacesW
UrlUnescapeW
AssocQueryKeyA
SHSkipJunction
StrSpnW
StrCSpnIW
ColorAdjustLuma
StrCmpLogicalW
PathStripPathA
IntlStrEqWorkerW
PathQuoteSpacesW
ChrCmpIW
DllGetVersion
PathSearchAndQualifyA
StrStrIW
StrIsIntlEqualW
PathParseIconLocationW
PathIsSameRootW
StrStrIA
UrlHashW
PathRemoveBackslashA
PathCreateFromUrlA
StrFormatKBSizeA
StrDupW
PathCompactPathExW
UrlEscapeA
SHReleaseThreadRef
PathFindFileNameW
PathRemoveBlanksW

mprapi

MprConfigInterfaceTransportAdd
MprAdminMIBEntryGetNext
RasPrivilegeAndCallBackNumber
MprAdminPortEnum
MprAdminMIBBufferFree
MprAdminInterfaceGetCredentials
MprInfoDelete
MprAdminInterfaceGetHandle
MprGetUsrParams
MprAdminUserClose
MprInfoDuplicate
MprInfoBlockRemove
MprAdminInterfaceDeviceSetInfo
MprAdminServerSetCredentials
MprAdminServerGetInfo
MprAdminPortClearStats
MprConfigInterfaceTransportGetHandle
MprAdminInterfaceEnum
CompressPhoneNumber
MprAdminInterfaceSetInfo
MprAdminMIBServerDisconnect
MprAdminUserOpen
MprAdminTransportGetInfo
MprDomainRegisterRasServer
MprAdminInterfaceUpdatePhonebookInfo
MprInfoCreate
MprAdminGetErrorString
MprAdminInterfaceGetInfo
MprInfoBlockQuerySize
MprInfoBlockSet
MprConfigServerInstall
MprAdminInterfaceUpdateRoutes
MprAdminUserWrite
MprAdminUserSetInfo
MprConfigTransportCreate
MprConfigInterfaceTransportGetInfo
MprInfoBlockFind
MprAdminInterfaceDisconnect
MprAdminPortGetInfo
MprAdminBufferFree

crypt32

CertSetEnhancedKeyUsage
I_CryptUninstallAsn1Module
I_CryptUninstallOssGlobal
CertEnumCertificatesInStore
CryptSIPGetSignedDataMsg
CryptSIPAddProvider
CryptGetMessageCertificates
CertDeleteCRLFromStore
PFXExportCertStoreEx
CertFindChainInStore
CertCreateCertificateContext
PFXVerifyPassword
CertDuplicateCertificateContext
CertFreeCRLContext
CertSetCertificateContextPropertiesFromCTLEntry
CertAddEncodedCertificateToSystemStoreW
CryptMemRealloc
CertCreateCRLContext
CertFindExtension
I_CryptGetDefaultCryptProv
CertAddEncodedCRLToStore
CryptDecryptMessage
I_CryptUnregisterSmartCardStore
CryptVerifyMessageSignature
CertGetNameStringA
I_CryptRegisterSmartCardStore
CertCreateContext
CertEnumSystemStoreLocation
CryptFindOIDInfo
CertRegisterPhysicalStore
CertDuplicateCertificateChain
CertAddCRLLinkToStore
CertFindSubjectInCTL
PFXImportCertStore
I_CryptGetAsn1Decoder
CertFreeCertificateContext
CertGetIssuerCertificateFromStore

kernel32

VirtualAlloc
EnumResourceTypesA
IsValidCodePage
lstrcpyW
OpenFileMappingA
GetSystemPowerStatus
GetNextVDMCommand
GetSystemDirectoryA
HeapSetInformation
SetFileShortNameW
CreateEventA
GetNumberFormatA
ExpandEnvironmentStringsA
GetDefaultCommConfigW
CloseProfileUserMapping
ReadConsoleOutputW
GlobalAddAtomA
SetLocaleInfoW
OpenSemaphoreA
WriteProfileStringA
GetEnvironmentStringsA
GetModuleHandleW
GetConsoleCommandHistoryLengthW
LZClose
_lread
LoadLibraryA
CreateProcessInternalA
EnterCriticalSection
GlobalFree
GetProcessPriorityBoost
SetSystemTime

vdmdbg

VDMDetectWOW
VDMTerminateTaskWOW
VDMGetPointer
VDMGetThreadContext
VDMGetContext
VDMGetThreadSelectorEntry
VDMSetDbgFlags
VDMGetAddrExpression
VDMGetSelectorModule
VDMStartTaskInWOW
VDMSetContext
VDMModuleFirst
VDMIsModuleLoaded
VDMGlobalFirst
VDMEnumTaskWOW
VDMGlobalNext
VDMGetSymbol
VDMModuleNext
VDMBreakThread
VDMSetThreadContext
VDMGetDbgFlags
VDMGetSegtablePointer
VDMEnumTaskWOWEx
VDMGetModuleSelector
VDMEnumProcessWOW
VDMProcessException
VDMGetSegmentInfo
VDMKillWOW

qcap

DllGetClassObject

Sections

.text
Size: 456KB - Virtual size: 456KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 303KB - Virtual size: 303KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 99KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fae8ce63a9bbb691c2e7443604ae99a2

Headers

DLL Characteristics

File Characteristics

Imports

setupapi

shlwapi

mprapi

crypt32

kernel32

vdmdbg

qcap

Sections

.text Size: 456KB - Virtual size: 456KB

.rdata Size: 303KB - Virtual size: 303KB

.data Size: 99KB - Virtual size: 1.5MB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 456KB - Virtual size: 456KB

.rdata
Size: 303KB - Virtual size: 303KB

.data
Size: 99KB - Virtual size: 1.5MB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 1024B - Virtual size: 1024B