0b3df2c97110fb3f2b85dbb2251a11ff

Sharing

Copy URL Twitter E-mail

General

Target

0b3df2c97110fb3f2b85dbb2251a11ff
Size

213KB
MD5

0b3df2c97110fb3f2b85dbb2251a11ff
SHA1

5d3ef36cc0fad343672a8139f94fd9f380c0654a
SHA256

6b885c23c94450fffe7564441be83648fefce501b976b533265bcbfe87368019
SHA512

f57e120a25f150203eecfbbc2fa797b5af85b5a39d847cbbd3d2ee036115eda6bdae29bcc18504c67224dc887ffb347c0b42ff69e852fb2086c2a16a4f6a34c7
SSDEEP

6144:3nT/XLzuguVXMvP9dIFf5tjTBm5nS2FUumkVD4rszhzfiwJ:bvhuVXMvzIFfDQ5dZXJJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b3df2c97110fb3f2b85dbb2251a11ff

Files

0b3df2c97110fb3f2b85dbb2251a11ff
.exe windows:2 windows x86 arch:x86

ef921c40b4a49cd26f067427caad9a9a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlen
EndUpdateResourceW
SetCurrentDirectoryA
SuspendThread
SearchPathA
GetACP
GetShortPathNameW
SetLastError
WaitForSingleObject
CompareStringA
LoadLibraryA
MoveFileW
ReplaceFileA
GetHandleInformation
GetCurrentThread
GetModuleHandleA
GetCurrentProcess
lstrcmpA
lstrcatA
InitializeCriticalSection
CopyFileExA
OpenEventA
GetVersionExA
SetCalendarInfoW
GlobalGetAtomNameA
GetThreadLocale
ExpandEnvironmentStringsA
CreateMutexA
CreateMailslotA
GlobalFindAtomA
RaiseException
GetProcAddress
GetSystemDirectoryA
GetLogicalDriveStringsA
FindAtomW
SetPriorityClass
CopyFileExW
CreateSemaphoreA
CreateMutexW
FindResourceA
GetSystemDefaultLCID
GetLongPathNameW
GlobalFindAtomW
SetComputerNameW

user32

GetClassLongW
LoadMenuIndirectA
InsertMenuItemW
EnumDesktopWindows
GetParent
GetWindowTextLengthA
EnumDesktopsW
SetForegroundWindow
MessageBoxW
GetIconInfo
PostMessageW
GetWindowRect
GetWindowTextA
GetForegroundWindow
CharUpperW
MonitorFromWindow
SendDlgItemMessageW
CreateMenu
InsertMenuItemA
GetAsyncKeyState
GetMessageA
SetWindowTextA
CheckMenuItem
GetClassNameA
GetWindowRgn
UnregisterClassA
SendMessageW
PeekMessageW
RemoveMenu
DestroyCursor
mouse_event
TrackPopupMenuEx
LoadMenuA
SendDlgItemMessageA
DefFrameProcA
AppendMenuA
DrawTextW
RegisterWindowMessageW
IsMenu
RegisterWindowMessageA
MoveWindow
RegisterClassA
GetMenuState
GetMenuItemInfoW
CreateWindowExW
SetCapture
SetDlgItemTextA
IsIconic
GetClassNameW
GetClassInfoExW
GetSystemMetrics
EnableWindow
CreatePopupMenu
EnumDesktopsW
EnumChildWindows
CharNextA
RegisterClassW
DestroyMenu
SetMenu
GetCursorPos
CharUpperA
PeekMessageA
DefDlgProcA
DefDlgProcW
GetKeyboardLayout
DialogBoxParamA

gdi32

GetCharWidthI
EnumICMProfilesA
AngleArc
GetMetaFileBitsEx
GetWorldTransform
SelectBrushLocal
CopyEnhMetaFileW
GetEnhMetaFileDescriptionW
GetCharWidthA
GetCharABCWidthsFloatA
PolylineTo
GetMiterLimit
CloseMetaFile
GetStockObject
Arc
GetCharABCWidthsW
CreateICA
SetWindowOrgEx
SetViewportOrgEx
GetEnhMetaFileHeader
SetMetaFileBitsEx
EndFormPage
CreateDIBSection

advapi32

RegDeleteValueA
RegSaveKeyA
RegQueryValueExA
RegCreateKeyW
CryptSetProviderW
RegCloseKey
RegEnumKeyW
RegSetValueW
RegQueryValueA
RegRestoreKeyW
RegDeleteKeyW
RegEnumValueW
RegEnumKeyA
RegSetValueA
RegReplaceKeyA
RegOpenKeyA
RegFlushKey
RegQueryInfoKeyA

shell32

ExtractIconExA

shlwapi

StrIsIntlEqualA
AssocQueryStringA
PathUnquoteSpacesW
PathFileExistsW

ole32

CoFreeLibrary
StringFromCLSID
CoCreateInstanceEx
IsValidIid
BindMoniker
OleCreate
CoCreateInstance

version

GetFileVersionInfoA
VerFindFileW
VerLanguageNameW

ws2_32

gethostbyname
WSADuplicateSocketW
getpeername
bind
htonl

wininet

FindFirstUrlCacheEntryExW
GetUrlCacheConfigInfoA
InternetConnectW
InternetDial
HttpSendRequestW
InternetInitializeAutoProxyDll
DeleteUrlCacheContainerW
UrlZonesDetach
FindFirstUrlCacheEntryW
InternetErrorDlg
GopherFindFirstFileW
InternetGetLastResponseInfoA
InternetAutodialCallback

urlmon

CompareSecurityIds
HlinkNavigateMoniker
PrivateCoInstall
DllRegisterServerEx
URLDownloadToCacheFileA
IsJITInProgress
RevokeBindStatusCallback
CoInternetCombineUrl
GetClassFileOrMime
RevokeFormatEnumerator
HlinkNavigateMoniker

winspool.drv

WritePrinter
GetFormW
WaitForPrinterChange
GetPrinterDataExA
FindNextPrinterChangeNotification
DEVICEMODE
AbortPrinter
SetDefaultPrinterW
DeletePrinterDriverExW
DeletePrinterDataA

inetcomm

MimeOleUnEscapeStringInPlace
MimeOleGetPropertySchema
CreateIMAPTransport
MimeOleGetRelatedSection
MimeOleGenerateCID
MimeOleSMimeCapRelease
MimeOleSetCompatMode
MimeOleAlgNameFromSMimeCap
MimeOleClearDirtyTree

oledlg

OleUIInsertObjectW
OleUIConvertW
OleUIAddVerbMenuW
OleUIChangeIconW
OleUIEditLinksA
OleUIUpdateLinksW
OleUIObjectPropertiesA
OleUIConvertA

sqlunirl

_CreateFileMapping_@24
_VkKeyScanEx_@8
_RegQueryValueEx_@24
_CharPrev_@8
_GetCompressedFileSize_@8
_GetEnvironmentVariable_@12
_GetLocaleInfo_@16
_RemoveDirectory_@4
_CreateDC_@16

crypt32

CryptGetDefaultOIDFunctionAddress
CertOpenSystemStoreA
CryptSIPRetrieveSubjectGuidForCatalogFile
CertGetNameStringW
CertFindChainInStore
PFXImportCertStore
CertSerializeCTLStoreElement
CertFreeCertificateContext
I_CryptFindLruEntryData
CertGetCTLContextProperty
CertEnumCertificateContextProperties

Sections

.X
Size: 126KB - Virtual size: 250KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Owjp
Size: 1KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qHnplJ
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.b
Size: 2KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.AoSQhW
Size: 3KB - Virtual size: 43KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ef921c40b4a49cd26f067427caad9a9a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

shlwapi

ole32

version

ws2_32

wininet

urlmon

winspool.drv

inetcomm

oledlg

sqlunirl

crypt32

Sections

.X Size: 126KB - Virtual size: 250KB

.Owjp Size: 1KB - Virtual size: 31KB

.qHnplJ Size: 21KB - Virtual size: 20KB

.rdata Size: 7KB - Virtual size: 7KB

.b Size: 2KB - Virtual size: 25KB

.data Size: 4KB - Virtual size: 8KB

.AoSQhW Size: 3KB - Virtual size: 43KB

.rsrc Size: 45KB - Virtual size: 44KB

.reloc Size: 512B - Virtual size: 4KB

.X
Size: 126KB - Virtual size: 250KB

.Owjp
Size: 1KB - Virtual size: 31KB

.qHnplJ
Size: 21KB - Virtual size: 20KB

.rdata
Size: 7KB - Virtual size: 7KB

.b
Size: 2KB - Virtual size: 25KB

.data
Size: 4KB - Virtual size: 8KB

.AoSQhW
Size: 3KB - Virtual size: 43KB

.rsrc
Size: 45KB - Virtual size: 44KB

.reloc
Size: 512B - Virtual size: 4KB