0df61497635b292fcdd54df59f6138e9

Sharing

Copy URL Twitter E-mail

General

Target

0df61497635b292fcdd54df59f6138e9
Size

601KB
MD5

0df61497635b292fcdd54df59f6138e9
SHA1

dd29de78726c857b241e81b7164b5cbb1266690f
SHA256

c72d7aa2d418f29ff6bbc77dec8810dfb443cd8db58788970509525b94bf284d
SHA512

e367549d313f5c1ceb152a4b2ba28ad76b84924ec93c1e2766bc4441aa64353101c270dff921ab1e4650bbfd5204bb6c954d2d7b11472a608db03b5a32474cb5
SSDEEP

12288:LusNZhth+Id9ZWmtVbeZS3Z2JUS0TmVe9486Zf0Mc7ePu7yAy:LsIgmTu+S0TatB07JyAy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0df61497635b292fcdd54df59f6138e9

Files

0df61497635b292fcdd54df59f6138e9
.exe windows:4 windows x86 arch:x86

569897bd913b28578d131bc36b001e5d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr80

__CxxQueryExceptionSize
__CxxUnregisterExceptionObject
_cexit
_amsg_exit
__set_app_type
_XcptFilter
__wgetmainargs
_configthreadlocale
__p__commode
__p__fmode
__FrameUnwindFilter
_time64
??2@YAPAXI@Z
??3@YAXPAX@Z
sprintf
memmove
strncmp
strchr
atol
atoi
_strtoui64
??_U@YAPAXI@Z
strncpy
strrchr
strtoul
isdigit
isalpha
_strupr
_gmtime32_s
srand
rand
_wcsupr
wcsncmp
wcstombs
strstr
_aligned_malloc
free
memset
_CxxThrowException
_strnicmp
__CxxDetectRethrow
__CxxRegisterExceptionObject
__CxxExceptionFilter
malloc
__CxxFrameHandler3
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
memcpy
_except_handler3
_crt_debugger_hook
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
_encode_pointer

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
Sleep
GetModuleHandleA
UnmapViewOfFile
CloseHandle
InterlockedExchange
VirtualProtect
VirtualQuery
GetCurrentThreadId
InterlockedIncrement
InterlockedCompareExchange
InterlockedDecrement
GetCurrentProcessId
CreateMutexA
WaitForSingleObject
ReleaseMutex
FindResourceA
LoadResource
UnhandledExceptionFilter
CreateToolhelp32Snapshot
Module32First
GetProcAddress
Module32Next
EnumResourceNamesA
GetModuleFileNameA
CreateFileA
ReadFile
VirtualAlloc
SetFilePointer
VirtualFree
GetModuleHandleExA
CreateEventA
ExitProcess
SetEvent
GetExitCodeThread
TerminateThread
CreateThread
HeapAlloc
HeapFree
GetComputerNameW
WideCharToMultiByte
LocalFree
HeapCreate
HeapDestroy
GetSystemTime
SystemTimeToFileTime
GetCommandLineW
GlobalAlloc
GetSystemInfo
GetWindowsDirectoryA
GetVolumeInformationA
DeviceIoControl
GetCurrentThread
CreateFileW
GlobalFree
LoadLibraryA
TlsAlloc
TlsSetValue
TlsGetValue
TlsFree
FreeLibrary
MapViewOfFile
CreateFileMappingA
lstrcmpA
LocalAlloc
GetModuleFileNameW
GetLastError
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
GetProcessHeap
OutputDebugStringA
GetCurrentProcess
TerminateProcess
LockResource
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
lstrlenW
MultiByteToWideChar
lstrlenA

advapi32

CryptAcquireContextA
CryptDestroyKey
CryptExportKey
CryptGenKey
CloseEventLog
ReadEventLogA
GetNumberOfEventLogRecords
OpenEventLogA
CryptGenRandom
LookupAccountSidW
ConvertSidToStringSidA
GetTokenInformation
SetThreadToken
RevertToSelf
RegOpenKeyExA
RegEnumValueA
RegCloseKey
OpenThreadToken
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptGetHashParam
OpenProcessToken

oleaut32

CreateErrorInfo
GetErrorInfo
VariantChangeType
SetErrorInfo
VariantClear
VariantInit
SysFreeString
SystemTimeToVariantTime
SysAllocString

msvcm80

?DoDllLanguageSupportValidation@<CrtImplementationDetails>@@YAXXZ
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@P$AAVException@3@@Z
__setusermatherr_m
?RegisterModuleUninitializer@<CrtImplementationDetails>@@YAXP$AAVEventHandler@System@@@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@@Z
?ThrowNestedModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVException@System@@0@Z
?DoCallBackInDefaultDomain@<CrtImplementationDetails>@@YAXP6GJPAX@Z0@Z

mscoree

GetHashFromFileW
_CorExeMain

ws2_32

setsockopt
WSACleanup
freeaddrinfo
getaddrinfo
closesocket
WSAStartup
socket
send
recv
shutdown
connect

wintrust

CryptCATCatalogInfoFromContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminAcquireContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseContext
WinVerifyTrust

crypt32

CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringA
CryptMsgClose
CertCloseStore
CryptDecodeObject
CryptMsgGetParam
CryptQueryObject

iphlpapi

GetAdaptersAddresses
GetAdaptersInfo

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize
CoSetProxyBlanket
CoTaskMemAlloc

shell32

CommandLineToArgvW

setupapi

SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA
SetupDiClassNameFromGuidA
SetupDiEnumDeviceInfo
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA

rpcrt4

UuidCreate

Sections

.text
Size: 450KB - Virtual size: 449KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 122KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 838B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

569897bd913b28578d131bc36b001e5d

Headers

File Characteristics

Imports

msvcr80

kernel32

advapi32

oleaut32

msvcm80

mscoree

ws2_32

wintrust

crypt32

iphlpapi

ole32

shell32

setupapi

rpcrt4

Sections

.text Size: 450KB - Virtual size: 449KB

.rdata Size: 122KB - Virtual size: 122KB

.data Size: 6KB - Virtual size: 10KB

.rsrc Size: 1024B - Virtual size: 838B

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 450KB - Virtual size: 449KB

.rdata
Size: 122KB - Virtual size: 122KB

.data
Size: 6KB - Virtual size: 10KB

.rsrc
Size: 1024B - Virtual size: 838B

.reloc
Size: 13KB - Virtual size: 12KB