099986baad97050e507b73d845aded40

Sharing

Copy URL Twitter E-mail

General

Target

099986baad97050e507b73d845aded40
Size

45KB
MD5

099986baad97050e507b73d845aded40
SHA1

ad5b0d30a61e74ff0bc1961ee5903ee8d3d74894
SHA256

b0918c24c526184c50d59a24c474774fa3d7931197c042c874b84b900d7d7fae
SHA512

026f24ff0f82b508a9bd45725e4944442a54dbad0d700ecdfd756f448cbc135399d4e1c8dce259964fb37c2c709334d63b445f5357f0ba4523f35ea966bab5bb
SSDEEP

768:sezSjT6rwgIBRb9vMCOXXo2Uh2cgFUh0C5hat1A9W8VqaSfaNdG6y48:7OPuwgepMC5V2caYxA8VnN2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
099986baad97050e507b73d845aded40

Files

099986baad97050e507b73d845aded40
.exe .js windows:4 windows x86 arch:x86 polyglot

625c77b0cbbf66b1aa65d08cbc0dbe53

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord354
ord665
ord537
ord2915
ord535
ord823
ord3522
ord858
ord3521
ord6402
ord825
ord561
ord3738
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord3401
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord3953
ord5714
ord5289
ord5307
ord4698
ord800
ord4079
ord2725
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord815
ord540

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_onexit
__dllonexit
srand
rand
_wcsicmp
memcmp
strstr
tmpnam
wcscat
fgetc
memcpy
div
sprintf
_unlink
_splitpath
__CxxFrameHandler
??1type_info@@UAE@XZ
_CxxThrowException
_wcsupr
strcpy
_strdup
strcat
free
memset
fclose
_strcmpi
exit
wcslen
strlen
fopen
fprintf

kernel32

LoadLibraryA
GetProcAddress
GetCurrentProcessId
OpenProcess
GetLastError
TerminateProcess
WideCharToMultiByte
GetFileSize
GetVersionExA
GetWindowsDirectoryA
CreateFileA
GetFileTime
CloseHandle
SetFileTime
GetSystemDirectoryA
CreateThread
GetSystemDefaultLCID
GetTickCount
MultiByteToWideChar
MoveFileW
ReadFile
CreateMutexA
DuplicateHandle
GetCurrentProcess
VirtualAlloc
VirtualFree
CompareStringW
HeapAlloc
HeapFree
GetProcessHeap
GetSystemDirectoryW
GetVersion
lstrcatA
lstrcpyA
lstrcpynA
lstrcmpA
InterlockedIncrement
InterlockedDecrement
LocalFree
LocalAlloc
DeleteFileA
GetModuleFileNameA
FreeResource
WriteFile
LockResource
LoadResource
SizeofResource
FindResourceA
GetExitCodeProcess
GetModuleHandleA
Sleep
lstrlenA
CreateFileW
GetStartupInfoA
GetCurrentThreadId
GetLocaleInfoA

user32

EnumWindows
DispatchMessageA
TranslateMessage
GetMessageA
GetDC
wsprintfW
IsCharAlphaNumericA
wsprintfA
GetSystemMetrics

gdi32

CreateCompatibleBitmap
CreateCompatibleDC
SelectObject

advapi32

RegCloseKey
RegEnumKeyExA
RegOpenKeyExW
RegSetValueExW
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA

ole32

CoCreateInstance
OleUninitialize
OleInitialize

oleaut32

VariantCopy
SysAllocStringLen
SysAllocString
VariantClear
VariantInit
GetErrorInfo
SafeArrayCreateVector
SysFreeString
SafeArrayUnaccessData
SafeArrayAccessData

ws2_32

send
connect
socket
ioctlsocket
select
accept
htons
recv
WSAStartup
closesocket
__WSAFDIsSet

gdiplus

GdipGetImageEncodersSize
GdipGetImageEncoders

Sections

.text
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

625c77b0cbbf66b1aa65d08cbc0dbe53

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

ole32

oleaut32

ws2_32

gdiplus

Sections

.text Size: 33KB - Virtual size: 32KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 5KB - Virtual size: 21KB

.text
Size: 33KB - Virtual size: 32KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 5KB - Virtual size: 21KB