1ade5ec462c2effb5824178337f5289b

Sharing

Copy URL Twitter E-mail

General

Target

1ade5ec462c2effb5824178337f5289b
Size

227KB
MD5

1ade5ec462c2effb5824178337f5289b
SHA1

4c893ae111b5b5f3dc7a2bb87fc37305c1ebd010
SHA256

814bffe971aa5446990e753aad9805123057d6e9ae8063c3376678a6381aff17
SHA512

d16a767932272237f81c7dc2770d7d4c7fd1525290b0fa6dbc7c86d60ea46a659db2e727841400b8b11d660788475bda71a4dcf364cc9cbad13b3c2bcb45c884
SSDEEP

6144:SdfsZTY/WNuR3BwsWu8VJgUtfq+ZO7B4jbWlp:Sn+N6jw/ggq+Zghp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1ade5ec462c2effb5824178337f5289b

Files

1ade5ec462c2effb5824178337f5289b
.exe windows:5 windows x86 arch:x86

ac70d9695a45958c5f2f85664b99a523

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord2567
ord4390
ord3569
ord2403
ord2015
ord4213
ord2570
ord4392
ord3577
ord616
ord2578
ord4399
ord3718
ord797
ord3562
ord602
ord6303
ord3579
ord543
ord803
ord4847
ord5276
ord3592
ord521
ord4162
ord2110
ord6193
ord6375
ord6266
ord6279
ord6278
ord3867
ord4370
ord2857
ord5977
ord1197
ord3871
ord324
ord641
ord4229
ord2293
ord6211
ord686
ord2445
ord384
ord3296
ord3084
ord1635
ord5949
ord5852
ord4273
ord6655
ord3092
ord941
ord2776
ord1683
ord2371
ord4433
ord2046
ord4425
ord3695
ord496
ord771
ord4254
ord4709
ord3798
ord3870
ord4253
ord768
ord489
ord2729
ord1196
ord2281
ord1258
ord1899
ord3621
ord2406
ord3614
ord1634
ord2854
ord491
ord600
ord1240
ord1173
ord1571
ord1250
ord1248
ord1563
ord1194
ord342
ord1179
ord1570
ord1568
ord1115
ord269
ord826
ord1165
ord6466
ord2294
ord1764
ord6362
ord2405
ord3133
ord4294
ord1143
ord1637
ord2858
ord2430
ord3649
ord2576
ord4215
ord1262
ord2016
ord4214
ord2362
ord2291
ord4272
ord927
ord4198
ord2756
ord1008
ord2520
ord1565
ord5855
ord3979
ord5706
ord2755
ord4124
ord6868
ord2910
ord1644
ord2455
ord818
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord3397
ord609
ord4199
ord6137
ord713
ord414
ord3657
ord5817
ord6379
ord5436
ord6390
ord5446
ord5603
ord5293
ord5617
ord1083
ord998
ord1145
ord3658
ord2820
ord2810
ord2385
ord1128
ord2717
ord4418
ord3948
ord925
ord922
ord2914
ord5568
ord561
ord3733
ord4616
ord3396
ord5710
ord5285
ord5303
ord4692
ord4074
ord5298
ord5296
ord3341
ord2388
ord5193
ord1089
ord3917
ord5727
ord2504
ord2546
ord4480
ord6371
ord815
ord538
ord2821
ord2606
ord5798
ord3087
ord2634
ord6024
ord535
ord1001
ord542
ord802
ord6896
ord6330
ord4219
ord942
ord940
ord6451
ord3281
ord501
ord3697
ord773
ord4970
ord6898
ord861
ord3991
ord3635
ord3365
ord4396
ord2574
ord2644
ord1662
ord3716
ord2859
ord823
ord795
ord693
ord4704
ord540
ord4155
ord6195
ord800
ord858
ord3694
ord4419
ord4829
ord5283
ord1767
ord6048
ord2506
ord4992
ord4848
ord4371
ord5261
ord4352
ord4942
ord4736
ord4899
ord5154
ord5156
ord5155
ord656
ord3605
ord4401
ord692
ord567
ord3634
ord5284
ord2573
ord6051
ord4073
ord1768
ord4395
ord5237
ord2377
ord5157
ord6370
ord4347
ord5286
ord3793
ord4831
ord4435
ord2640
ord2047
ord6372
ord3744
ord5059
ord1720
ord5257
ord2438
ord2116
ord5273
ord2977
ord3142
ord3254
ord4459
ord3131
ord3257
ord2980
ord3076
ord2971
ord825

msvcrt

malloc
free
wcscoll
wcstol
wcsncmp
_wcsnicmp
_endthread
_beginthread
wcschr
iswspace
_ltow
wcsrchr
wcstoul
_CxxThrowException
_initterm
_adjust_fdiv
?terminate@@YAXXZ
??1type_info@@UAE@XZ
__dllonexit
_onexit
_purecall
__CxxFrameHandler
wcscpy
_itow
__RTDynamicCast
_except_handler3
wcsncpy
_wcsupr
wcsstr
wcscspn
mbstowcs
_wcsicmp
wcscmp
wcscat
wcslen
_stricmp

atl

ord32
ord15
ord22
ord18
ord21
ord16

certcli

CAFreeCertTypeProperty
CAGetCertTypeProperty
CAGetCertTypeExtensions
CAFreeCAProperty
CAGetCAProperty
CAGetCACertificate
CACloseCertType
CAEnumNextCertType
CAGetCertTypePropertyEx
CAGetCertTypeFlags
CAEnumCertTypes
CAFindCertTypeByName
CACountCAs
CAEnumFirstCA
CACloseCA
CAEnumNextCA

kernel32

IsBadWritePtr
LoadLibraryA
lstrcmpiW
CloseHandle
GetSystemWindowsDirectoryW
FormatMessageW
OutputDebugStringA
GetModuleFileNameW
SetLastError
LoadLibraryW
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
CompareStringW
lstrcpyW
lstrlenW
GetVersionExW
MultiByteToWideChar
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
GetProcAddress
GetCommandLineW
GetModuleHandleW
GetModuleHandleA
GetSystemTime
SystemTimeToFileTime
LocalAlloc
GetSystemTimeAsFileTime
LocalFree
GetLastError
GetCurrentProcess
GlobalFree
SetEvent
OpenEventW
GetComputerNameW
GlobalAlloc
ReadFile
GetFileSize
CreateFileW
GlobalUnlock
GlobalLock
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
CreateEventW
WaitForSingleObject
ResetEvent
UnmapViewOfFile
LoadResource
FindResourceW
MapViewOfFileEx
CreateFileMappingW
GetUserDefaultLangID
GetFileTime
GetFileSizeEx
MapViewOfFile
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsBadReadPtr
GetShortPathNameW
GetWindowsDirectoryW
lstrcpynW
GetComputerNameExW
CompareFileTime

user32

SystemParametersInfoW
ReleaseDC
ShowWindow
GetDlgItem
SetWindowTextW
SendDlgItemMessageW
DestroyIcon
SetMenu
GetDlgCtrlID
GetCursorPos
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExW
GetDC
GetMenu
GetSystemMetrics
ChildWindowFromPointEx
InvalidateRect
ScreenToClient
GetWindowRect
LoadMenuW
EnableMenuItem
GetWindowLongW
SetWindowLongW
GetSysColor
GetClientRect
LoadStringW
MessageBoxW
wsprintfW
RegisterClipboardFormatW
GetParent
PostMessageW
WinHelpW
SendMessageW
EnableWindow
LoadBitmapW
LoadIconW
GetSubMenu

oleaut32

SafeArrayAccessData
SafeArrayUnaccessData
BstrFromVector
VariantClear
SysAllocString
SysFreeString

ole32

CoInitialize
ReleaseStgMedium
GetHGlobalFromStream
CreateStreamOnHGlobal
CoCreateInstance
CoCreateGuid
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2
CLSIDFromString
StringFromCLSID

advapi32

SaferiChangeRegistryScope
SaferiPopulateDefaultsInRegistry
GetLengthSid
CopySid
OpenSCManagerW
EnumServicesStatusW
CloseServiceHandle
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
SaferSetLevelInformation
SaferSetPolicyInformation
LookupAccountNameW
RegDeleteValueW
SaferGetPolicyInformation
SaferGetLevelInformation
GetUserNameW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
SaferCreateLevel
SaferCloseLevel
CryptAcquireContextW
OpenProcessToken
GetTokenInformation
RegDeleteKeyW
RegOpenKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
SHGetFileInfoW

cryptui

CryptUIGetCertificatePropertiesPagesW
CryptUIDlgViewCRLW
CryptUIDlgViewCertificateW
CryptUIDlgViewCertificatePropertiesW
CryptUIWizImport
CryptUIDlgViewCTLW
CryptUIWizBuildCTL
CryptUIWizExport
CryptUIWizCertRequest

crypt32

CertDeleteCTLFromStore
CertFreeCertificateChain
CertGetCertificateChain
CryptEnumOIDInfo
CertAddCertificateContextToStore
CertFreeCTLContext
CertEnumPhysicalStore
CertEnumCertificatesInStore
CertAddEncodedCTLToStore
CertControlStore
CryptMsgEncodeAndSignCTL
CertFreeCertificateContext
CertGetCertificateContextProperty
CryptDecodeObject
CertFindExtension
CertDuplicateCertificateContext
CertFindCertificateInStore
CertSetCertificateContextProperty
CertGetEnhancedKeyUsage
CertDeleteCertificateFromStore
CertNameToStrW
CryptFindOIDInfo
CertGetNameStringW
CryptUnregisterOIDInfo
CertEnumSystemStore
CertCloseStore
CertOpenStore
CertGetStoreProperty
CryptFindLocalizedName
CertGetSubjectCertificateFromStore
CertCompareCertificate
CryptFindCertificateKeyProvInfo
CryptMsgOpenToDecode
CryptMsgUpdate
CryptMsgGetParam
CryptMsgClose
CertGetCTLContextProperty
CertFindCTLInStore
CertDuplicateCTLContext
CertDeleteCRLFromStore
CertDuplicateCRLContext
CertAddStoreToCollection
CertAddCRLContextToStore
CertAddCTLContextToStore
CertFreeCRLContext
CertAddSerializedElementToStore
CryptQueryObject
CertGetCRLFromStore
CertEnumCRLsInStore
CertEnumCTLsInStore

gdi32

CreateFontIndirectW
DeleteObject
GetDeviceCaps

ntdsapi

DsUnBindW
DsFreeNameResultW
DsCrackNamesW
DsBindW

wintrust

WTHelperGetFileHash

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

wldap32

ord13
ord18
ord73
ord14
ord16
ord145
ord210
ord208
ord26
ord127
ord140
ord224
ord167
ord41

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 200KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac70d9695a45958c5f2f85664b99a523

Headers

File Characteristics

Imports

mfc42u

msvcrt

atl

certcli

kernel32

user32

oleaut32

ole32

advapi32

shell32

cryptui

crypt32

gdi32

ntdsapi

wintrust

version

wldap32

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 200KB - Virtual size: 200KB

.data Size: 1KB - Virtual size: 320KB

.rsrc Size: 16KB - Virtual size: 16KB

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 200KB - Virtual size: 200KB

.data
Size: 1KB - Virtual size: 320KB

.rsrc
Size: 16KB - Virtual size: 16KB