199b3dfa13ee383ef88ae0f641f5ba55

Sharing

Copy URL Twitter E-mail

General

Target

199b3dfa13ee383ef88ae0f641f5ba55
Size

276KB
MD5

199b3dfa13ee383ef88ae0f641f5ba55
SHA1

1510662f3e10c825dcdd98ff3206ee0df99b457c
SHA256

78b8b5805f490f465288be511df51073904333a85a3d4a8ce08750b9a65b71c7
SHA512

81b1db6476ea905beed76e27a300d20394980907f6cbecfa001e5279fbf366e2573e89ed776a4a6449e31ae4c817a2983201428557b6ce7a2216ee276ab2e72a
SSDEEP

6144:s64Zl6iCmkRsbmm4PoK6HOwQlIZZMN6HW+KLLn7mhlIQHQg0:sHgKbmme6HOwwIi7LLnSbHHQg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
199b3dfa13ee383ef88ae0f641f5ba55

Files

199b3dfa13ee383ef88ae0f641f5ba55
.exe windows:6 windows x86 arch:x86

6199b3f7b851154bc163fe8a178b52cd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegCloseKey
RegDeleteValueW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
UpdateTraceW
ControlTraceW
StopTraceW
EnableTraceEx
StartTraceW
RegQueryValueExW
QueryTraceW
IsValidSid
CloseTrace
ProcessTrace
OpenTraceW
ConvertSidToStringSidW
RegSetValueExW
RegCreateKeyExW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
CopySid
GetLengthSid
GetTokenInformation
CloseServiceHandle
QueryServiceStatus
OpenServiceW
OpenSCManagerW
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetNamedSecurityInfoW
GetSecurityDescriptorOwner
GetSecurityDescriptorDacl
RevertToSelf
ImpersonateLoggedOnUser
RegGetValueW
TraceEvent

kernel32

GetTickCount
SetThreadPriority
GetCurrentThread
CreateMutexW
GetCommandLineW
HeapSetInformation
GetLogicalProcessorInformationEx
LocalFree
FreeLibrary
GetProcAddress
LoadLibraryW
GetUserGeoID
GetSystemDefaultLCID
GetSystemDefaultUILanguage
GlobalMemoryStatusEx
GetSystemInfo
GetActiveProcessorCount
GetProductInfo
CompareFileTime
GetLastError
OpenMutexW
ReleaseMutex
LoadLibraryExW
FindResourceW
SizeofResource
LoadResource
LockResource
FreeResource
GetModuleHandleW
FileTimeToSystemTime
FileTimeToDosDateTime
GetTempFileNameW
GlobalFree
WaitForMultipleObjects
GetTempPathW
GetLongPathNameW
SetLastError
WideCharToMultiByte
CreateDirectoryW
GetFileAttributesW
GetFileSizeEx
SetFilePointerEx
InterlockedDecrement
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
VirtualAlloc
UnmapViewOfFile
VirtualFree
InterlockedIncrement
ResetEvent
CreateThread
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeLibraryAndExitThread
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventW
GetFileSize
ReadFile
DuplicateHandle
SetEvent
EnterCriticalSection
LeaveCriticalSection
RaiseException
GetSystemDirectoryW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
lstrlenW
SystemTimeToFileTime
GetModuleFileNameW
LocalAlloc
GetLocalTime
CreateFileW
SetFileAttributesW
WriteFile
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
CloseHandle
DeleteFileW
GetFileAttributesExW
FindNextFileW
FindFirstFileW
FindClose
MoveFileExW
GetVersionExW
GetSystemTime
GetThreadPriority

user32

LoadStringW
PeekMessageW
MsgWaitForMultipleObjects
DispatchMessageW
TranslateMessage
GetSystemMetrics

msvcrt

_initterm
wcstoul
_controlfp
_except_handler4_common
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
wcstok_s
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
free
_callnewh
malloc
wcschr
memset
__CxxFrameHandler3
towupper
_vsnwprintf
wcsstr
wcsrchr
memcpy
_vsnprintf
memmove
_wcsicmp
realloc
_wcsnicmp
ceil
_ftol2
_purecall

shlwapi

PathRemoveExtensionW
PathFindFileNameW
PathCombineW
StrStrIW
StrToIntExW
PathFileExistsW
ord437
PathAppendW

tdh

TdhGetProperty
TdhGetPropertySize

ole32

CoCreateGuid
StringFromGUID2

shell32

CommandLineToArgvW
SHGetFolderPathW
SHGetFolderPathAndSubDirW

winhttp

WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpSetOption
WinHttpOpen
WinHttpGetDefaultProxyConfiguration
WinHttpWriteData
WinHttpCrackUrl
WinHttpSetTimeouts
WinHttpSetCredentials
WinHttpTimeFromSystemTime
WinHttpCloseHandle
WinHttpReadData
WinHttpSetStatusCallback
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpReceiveResponse
WinHttpConnect
WinHttpSendRequest

wevtapi

EvtClose
EvtNext
EvtQuery
EvtRender
EvtCreateRenderContext

powrprof

PowerDeterminePlatformRole

ntdll

NtQuerySystemTime
RtlFreeHeap
RtlAllocateHeap

oleaut32

SysFreeString
SysAllocString

Sections

.text
Size: 205KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6199b3f7b851154bc163fe8a178b52cd

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

shlwapi

tdh

ole32

shell32

winhttp

wevtapi

powrprof

ntdll

oleaut32

Sections

.text Size: 205KB - Virtual size: 204KB

.data Size: 512B - Virtual size: 5KB

.rsrc Size: 29KB - Virtual size: 28KB

.reloc Size: 40KB - Virtual size: 41KB

.text
Size: 205KB - Virtual size: 204KB

.data
Size: 512B - Virtual size: 5KB

.rsrc
Size: 29KB - Virtual size: 28KB

.reloc
Size: 40KB - Virtual size: 41KB