0eee362bf06ba0caf9336cfc325e8fab

Sharing

Copy URL Twitter E-mail

General

Target

0eee362bf06ba0caf9336cfc325e8fab
Size

156KB
MD5

0eee362bf06ba0caf9336cfc325e8fab
SHA1

a8db369d0d9a07faec8752a2dfb4b7ec7d40e1c1
SHA256

a66fee5debdf15e555555a6fb652b3bf288c3169c8ac99afef004d6ab9f04006
SHA512

1b82ab75f5f8196906714c262cba9d72483d0aa9fed8b2d231859b49842ae5e4b483e26d2bcd468b4704dec2a513a5bb9dd417a0115b8814314d8281b140221d
SSDEEP

1536:n6/Rz0windcWTdaA9k8ZRm4RNKBc9ryOCL05Hu+H7mkkZZtP6sM+YIKjanq5ftV7:n6/wcWTQumYK4Jm+5jaq5ftV1Hp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0eee362bf06ba0caf9336cfc325e8fab

Files

0eee362bf06ba0caf9336cfc325e8fab
.exe windows:4 windows x86 arch:x86

e085b73a92621c85fb3c6d5674c8ad54

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

urlmon

URLDownloadToFileA

ws2_32

recv
closesocket
getsockopt
bind
socket
connect
htonl
inet_addr
gethostbyname
htons
WSASetLastError
send
WSAStartup
WSAGetLastError
setsockopt
WSACleanup

netapi32

Netbios

kernel32

GetConsoleMode
GetConsoleCP
SetFilePointer
GetStringTypeW
HeapDestroy
GetVersionExA
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
WideCharToMultiByte
GetCurrentProcess
InterlockedIncrement
GetCurrentThreadId
MultiByteToWideChar
lstrlenW
GetLastError
InterlockedDecrement
lstrlenA
lstrcmpiA
IsDBCSLeadByte
SetLastError
FreeLibrary
LoadLibraryExA
GetModuleHandleA
GetModuleFileNameA
DeleteFileA
GetExitCodeProcess
Sleep
WaitForSingleObject
FindClose
FindFirstFileA
InterlockedExchange
SetStdHandle
LocalFree
FormatMessageA
GetStringTypeA
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
ExitProcess
IsValidCodePage
GetOEMCP
GetCPInfo
HeapCreate
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStdHandle
WriteFile
GetStartupInfoA
GetCommandLineA
GetSystemTimeAsFileTime
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CloseHandle
FlushFileBuffers
GetThreadLocale
HeapAlloc
HeapFree
RtlUnwind
VirtualQuery
GetSystemInfo
VirtualProtect
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
VirtualAlloc
VirtualFree
LoadLibraryA
GetProcAddress
GetProcessHeap
GetLocaleInfoA
GetACP
HeapReAlloc
HeapSize

user32

UnregisterClassA
DefWindowProcA
DestroyWindow
CharNextA

advapi32

RegEnumKeyExA
RegDeleteValueA
RegQueryValueExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteKeyA

shell32

SHGetFolderPathA
ShellExecuteExA
SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA

ole32

CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoUninitialize
CoTaskMemAlloc
CoInitialize
OleRun

oleaut32

SysStringByteLen
SysStringLen
SysAllocStringByteLen
VarUI4FromStr
SysFreeString
SysAllocString
VariantClear
GetErrorInfo

comctl32

InitCommonControlsEx

Sections

.text
Size: 116KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e085b73a92621c85fb3c6d5674c8ad54

Headers

File Characteristics

Imports

urlmon

ws2_32

netapi32

kernel32

user32

advapi32

shell32

ole32

oleaut32

comctl32

Sections

.text Size: 116KB - Virtual size: 114KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 8KB - Virtual size: 13KB

.rsrc Size: 8KB - Virtual size: 32KB

.text
Size: 116KB - Virtual size: 114KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 8KB - Virtual size: 13KB

.rsrc
Size: 8KB - Virtual size: 32KB