122bfa097dbd0ed34f6254584f3437d3

Sharing

Copy URL

Twitter E-mail

General

Target

122bfa097dbd0ed34f6254584f3437d3
Size

369KB
MD5

122bfa097dbd0ed34f6254584f3437d3
SHA1

c0f8c7dc8ca330f33df3fe041c776cd175f5d542
SHA256

617f1c78f4fb98b0f17b82edd4f6bec203dc033a33e7eb6166d8d4dd54fd621f
SHA512

94d641643cd11c9b3b377b1d6a0c6b338b5c19735aeb2a5d23d82e6fd2aa75df4a2244620451bcdefcfb525d006d2707b6c4e9cac92545e6bf1d8b9bf776a6b8
SSDEEP

6144:LtJbYbxe96XFtEN9Me4tjjO8CVq92fhqObkEfWN0SvoDC+1mjgA1sc05He:LtJbYb6qO4tfbCVq4oO5SEC+88mnD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
122bfa097dbd0ed34f6254584f3437d3

Files

122bfa097dbd0ed34f6254584f3437d3
.exe windows:5 windows x86 arch:x86

2e82d883c8624f64fd2f884f1ff3d75f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

shlwapi

PathFindSuffixArrayA
StrRStrIA
PathIsFileSpecA
SHStrDupA
SHCreateStreamOnFileW
PathFileExistsA
PathGetDriveNumberA
PathCanonicalizeW
StrFormatByteSize64A
PathStripPathW
PathRenameExtensionA
StrChrA
PathRemoveBackslashW
SHCreateShellPalette
StrPBrkW
PathIsUNCServerW
PathSearchAndQualifyA
PathRemoveFileSpecW
UrlGetLocationA
SHEnumKeyExW
UrlIsNoHistoryA
PathAddExtensionA
StrTrimA
StrCSpnA
SHRegSetPathA
AssocQueryKeyW
StrCmpNA
SHGetInverseCMAP
StrCpyNW
StrCSpnIW
PathCombineA
ChrCmpIA
AssocQueryStringByKeyW
StrRetToStrW
GetMenuPosFromID
PathMakePrettyW
SHSetThreadRef
PathSkipRootA
PathGetCharTypeW
SHRegEnumUSKeyA
PathParseIconLocationW
wnsprintfW
StrCmpNIW
SHRegGetBoolUSValueA

kernel32

ShowConsoleCursor
SetClientTimeZoneInformation
WaitForMultipleObjects
SetLocalPrimaryComputerNameW
GetNumaProcessorNode
SetComputerNameExW
LoadLibraryA
EnumResourceLanguagesW
lstrlen
OpenConsoleW
MoveFileExW
SetFirmwareEnvironmentVariableW
IsBadStringPtrA
SetCalendarInfoA
WriteFileEx
GlobalSize
QueryDosDeviceW
SetHandleCount
GlobalAlloc
SetCommMask
LocalShrink
GetCurrentThread
RtlCaptureStackBackTrace
LZClose
GetCalendarInfoW
GetDiskFreeSpaceExA
VirtualAlloc
QueryActCtxW
GetComputerNameExA
GetFileAttributesA
GetConsoleAliasesW
FindResourceExA
FreeConsole
SetLastError
DebugBreak
LocalUnlock
QueryPerformanceCounter
GetEnvironmentStringsA
SetConsoleCtrlHandler
SetEndOfFile
TryEnterCriticalSection
IsProcessInJob
VerLanguageNameA
RtlCaptureContext
GetVolumeInformationW
GetCommConfig
ResumeThread
FreeEnvironmentStringsA
FoldStringW
SetCommBreak

clbcatq

OpenComponentLibraryEx
SetSetupOpen
CLSIDFromStringByBitness
InprocServer32FromString
CreateComponentLibraryEx
UpdateFromAppChange
ActivatorUpdateForIsRouterChanges
OpenComponentLibraryOnMemEx
OpenComponentLibraryOnStreamEx
DllGetClassObject
GetSimpleTableDispenser
ComPlusMigrate
GetCatalogObject2
GetComputerObject
ServerGetApplicationType
UpdateFromComponentChange
CoRegCleanup
CheckMemoryGates
SetupSave
SetupOpen
GetCatalogObject
SetSetupSave
DowngradeAPL
DeleteAllActivatorsForClsid

crtdll

_fstat
__isascii
strerror
strftime
_CIatan2
_eof
_mbctokata
_execlpe
_unlink
wscanf
putc
_chsize
_getdrive
setbuf
_mbsset
wcsrchr
vwprintf
_ismbcspace
_environ_dll
_mbsbtype
_CIacos
ldexp
getc
_pgmptr_dll
iswprint
_creat
qsort
wcstok
_execvp
_strtime
swprintf
_mbsnbcpy
_mbsnbcat
puts
fputc
_dup2
_mbslwr
cos
_nextafter
_vsnwprintf

ole32

HDC_UserFree
CreateErrorInfo
WriteOleStg
CoLoadLibrary
FreePropVariantArray
CoGetClassObject
SNB_UserSize
OleGetAutoConvert
CoTaskMemAlloc
OleGetClipboard
CoMarshalHresult
CoInitializeSecurity
EnableHookObject
CreateItemMoniker
HWND_UserFree
CLIPFORMAT_UserSize
HACCEL_UserSize
CoGetClassVersion
OleConvertIStorageToOLESTREAMEx
OleConvertOLESTREAMToIStorage
CoReleaseServerProcess
WriteFmtUserTypeStg
CLIPFORMAT_UserFree
StgIsStorageILockBytes
CoSetState
CoRegisterClassObject
CoAllowSetForegroundWindow
CoGetCallContext
WdtpInterfacePointer_UserUnmarshal
CLSIDFromOle1Class
GetConvertStg
ComPs_NdrDllUnregisterProxy
CoGetObject
CoGetMarshalSizeMax
GetDocumentBitStg
ProgIDFromCLSID
GetHGlobalFromILockBytes
WdtpInterfacePointer_UserSize
CLSIDFromString

iphlpapi

_PfRebindFilters@8
GetIfTable
GetRTTAndHopCount
InternalSetTcpEntry
_PfMakeLog@4
_PfRemoveGlobalFilterFromInterface@8
GetIpStatistics
IcmpSendEcho
CreateIpForwardEntry
GetIpForwardTable
NhGetInterfaceNameFromDeviceGuid
_PfRemoveFilterHandles@12
AddIPAddress
_PfUnBindInterface@4
InternalGetIpForwardTable
SetIpNetEntry
IcmpParseReplies
AllocateAndGetIpAddrTableFromStack
SetTcpEntry
_PfDeleteLog@0
InternalGetIpAddrTable
CreateProxyArpEntry
GetIpStatisticsEx
InternalDeleteIpForwardEntry
Icmp6SendEcho2
NhGetGuidFromInterfaceName
_PfGetInterfaceStatistics@16
GetIcmpStatistics
IpRenewAddress
NTPTimeToNTFileTime
_PfTestPacket@20
SetIpForwardEntry
IcmpSendEcho2
InternalCreateIpNetEntry
IcmpCloseHandle
SetAdapterIpAddress
IpReleaseAddress
_PfBindInterfaceToIndex@16
NotifyAddrChange

Sections

.text
Size: 102KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 137KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 464KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 127KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2e82d883c8624f64fd2f884f1ff3d75f

Headers

File Characteristics

Imports

shlwapi

kernel32

clbcatq

crtdll

ole32

iphlpapi

Sections

.text Size: 102KB - Virtual size: 104KB

.rdata Size: 137KB - Virtual size: 140KB

.data Size: 512B - Virtual size: 464KB

.rsrc Size: 127KB - Virtual size: 128KB

.reloc Size: 1024B - Virtual size: 4KB

.text
Size: 102KB - Virtual size: 104KB

.rdata
Size: 137KB - Virtual size: 140KB

.data
Size: 512B - Virtual size: 464KB

.rsrc
Size: 127KB - Virtual size: 128KB

.reloc
Size: 1024B - Virtual size: 4KB