2264222dbdd24bf40678281edc8b655f

Sharing

Copy URL Twitter E-mail

General

Target

2264222dbdd24bf40678281edc8b655f
Size

163KB
MD5

2264222dbdd24bf40678281edc8b655f
SHA1

25288f1a0fcd93ad6348605e568fd53bd17ebc73
SHA256

8dc542e53ce4b85e9f7530f9c8caf27f557aa110db57740a0e7adfccb565a7de
SHA512

801cdf604ba1926ddf136171aafcaab285a89bcd81539afcc6b1fbe4370b18bf155411e2c15355d73d2476b708b475fd9db4382be123d830fcf033515b96552a
SSDEEP

3072:CFeit33zZqflxd79XrxdbkQkOxKOszhi1VoOYOPS:CFnt33zK7vbFo/hi1nb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2264222dbdd24bf40678281edc8b655f

Files

2264222dbdd24bf40678281edc8b655f
.exe windows:5 windows x86 arch:x86

e589649dcb37494451c1758817135c65

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mprapi

MprConfigServerInstall
RasPrivilegeAndCallBackNumber
MprPortSetUsage
MprAdminMIBEntryCreate
MprAdminConnectionGetInfo
MprAdminInterfaceGetInfo
MprConfigInterfaceDelete
MprAdminInterfaceTransportAdd
MprConfigInterfaceCreate
MprConfigTransportSetInfo
MprConfigInterfaceTransportGetHandle
MprAdminPortDisconnect
MprConfigInterfaceGetInfo
MprConfigServerRefresh
MprInfoRemoveAll
MprConfigInterfaceTransportAdd
MprAdminInterfaceDeviceGetInfo
MprAdminConnectionEnum
MprConfigGetFriendlyName
MprAdminPortReset
MprInfoBlockAdd
MprAdminPortGetInfo
MprAdminInterfaceGetCredentials
MprAdminUserReadProfFlags
MprAdminMIBServerConnect
MprAdminServerConnect
MprConfigInterfaceTransportSetInfo
MprAdminUserWrite
MprAdminUserWriteProfFlags
MprDomainRegisterRasServer
MprDomainQueryRasServer
MprConfigTransportGetInfo
MprAdminTransportSetInfo
MprInfoBlockFind
MprAdminInterfaceQueryUpdateResult
MprAdminMIBEntryDelete
MprConfigTransportGetHandle

hhsetup

?GetOrder@CFolder@@QAEKXZ
?CheckTitleRef@CCollection@@AAEKPBDG@Z
?GetLangId@CCollection@@QAEGPBG@Z
?ParseFile@CCollection@@AAEKPBD@Z
?RemoveAll@CPointerList@@QAEXXZ
?GetMasterCHM@CCollection@@QAEHPAPAGPAG@Z
?GetFirstChildFolder@CFolder@@QAEPAV1@XZ
?GetIdW@CTitle@@QAEPBGXZ
?WriteFolders@CCollection@@AAEHPAPAVCFolder@@@Z
?GetIdW@CLocation@@QAEPBGXZ
??0CFolder@@QAE@XZ
?NewTitle@CCollection@@AAEPAVCTitle@@XZ
?FindTitle@CCollection@@QAEPAVCTitle@@PBDG@Z
?GetTitleW@CFolder@@QAEPBGXZ
?SetFindMergedCHMS@CCollection@@QAEXH@Z
?RemoveCollection@CCollection@@QAEKH@Z
?AddFolder@CCollection@@QAEPAVCFolder@@PBGKPAKG@Z
?GetId@CLocation@@QBEPADXZ
??1CCollection@@QAE@XZ
?NewLocationHistory@CTitle@@QAEPAULocationHistory@@XZ
??1CLocation@@QAE@XZ
?AddLocation@CCollection@@QAEPAVCLocation@@PBD000PAK@Z
?Open@CCollection@@QAEKPBG@Z
?SetMasterCHM@CCollection@@QAEXPBDG@Z
?SetParent@CFolder@@QAEXPAV1@@Z
?HandleFolder@CCollection@@AAEKPAVCParseXML@@PAD@Z

kernel32

LZRead
GetProfileSectionW
GetConsoleHardwareState
GetThreadContext
BuildCommDCBA
GetConsoleFontInfo
SetCalendarInfoA
SetLastError
SetTapeParameters
GetBinaryType
Module32NextW
CreateEventW
LZOpenFileW
GetModuleHandleExA
GetConsoleAliasW
OpenThread
GetCommState
RemoveDirectoryA
MulDiv
CreateNamedPipeA
InitializeCriticalSectionAndSpinCount
FileTimeToDosDateTime
GetProcessHeap
ChangeTimerQueueTimer
LZSeek
IsValidCodePage
GetModuleHandleExW
WritePrivateProfileSectionW
CreateFileMappingA
GetHandleContext
SetHandleInformation
AddAtomW
EraseTape
GetWindowsDirectoryA
RtlMoveMemory
FindNextVolumeA
RegisterConsoleVDM
IsValidLocale
GetNumberFormatA
GetDiskFreeSpaceA
LCMapStringW
RequestWakeupLatency
WaitForMultipleObjectsEx
SetUnhandledExceptionFilter
LoadLibraryA
WriteConsoleOutputCharacterA
GetModuleFileNameW
FindVolumeClose
GetEnvironmentStringsA
EnterCriticalSection
GetLocalTime
lstrcatW
GetThreadPriority
SetCommMask
GetTempPathW
GetConsoleKeyboardLayoutNameW
GetNumaHighestNodeNumber
RemoveLocalAlternateComputerNameA
FlushInstructionCache
CreateDirectoryExA
VirtualAlloc
GlobalFindAtomA
RemoveDirectoryW
SetFirmwareEnvironmentVariableA
QueryDosDeviceA
_llseek
GetLargestConsoleWindowSize
GetEnvironmentVariableA
GetWindowsDirectoryW
CreateHardLinkW
MoveFileExW
MapViewOfFileEx
HeapFree
CmdBatNotification
GetBinaryTypeW
GetThreadLocale
GetFileAttributesA
GetMailslotInfo
SetVolumeMountPointW
GetStartupInfoW
GetModuleHandleW
SetTimeZoneInformation
GetProfileSectionA

Sections

.text
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e589649dcb37494451c1758817135c65

Headers

DLL Characteristics

File Characteristics

Imports

mprapi

hhsetup

kernel32

Sections

.text Size: 90KB - Virtual size: 90KB

.rdata Size: 55KB - Virtual size: 55KB

.data Size: 15KB - Virtual size: 187KB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 90KB - Virtual size: 90KB

.rdata
Size: 55KB - Virtual size: 55KB

.data
Size: 15KB - Virtual size: 187KB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 1024B - Virtual size: 1024B