22cf53566065f1caa83e3a4a2129a5b1

Sharing

Copy URL Twitter E-mail

General

Target

22cf53566065f1caa83e3a4a2129a5b1
Size

209KB
MD5

22cf53566065f1caa83e3a4a2129a5b1
SHA1

3c096d5be40247cc3b17853be8fc4e4a597691a7
SHA256

8dc906e3da5f5c8cf2bac1be43047f6956bb3b6b2b9197253277aacbc0cea006
SHA512

7ef683802ead60ebd3294d02f19e56ba1f8fb5cafc55a9fad181957870969c4698c2db37278a6c5c4da827b54dff217b587f0eb7ab9e620ec72caf2c70f99d3b
SSDEEP

768:+Z1HkptwxVoloQJcWAICaffn+fo1iqhWMzYnqsPCJnPT65nO4rGQzTGfmgc33em0:+1oqQJcHI2kiWzHNQVgd54vRdJlsp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
22cf53566065f1caa83e3a4a2129a5b1

Files

22cf53566065f1caa83e3a4a2129a5b1
.exe .vbs windows:4 windows x86 arch:x86 polyglot

6e8915f34d559b80bc80fbf09b8a002a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemDirectoryA
MoveFileExA
DeleteFileA
WinExec
GetTempFileNameA
GetTempPathA
ReadFile
SetFilePointer
lstrcpynA
CreateDirectoryA
FindNextFileA
ReleaseMutex
WaitForSingleObject
lstrcmpiA
lstrcpyA
lstrcmpA
GetEnvironmentVariableA
lstrcatA
GetDiskFreeSpaceA
GetProcAddress
GetModuleHandleA
Sleep
MoveFileA
GetCurrentProcess
FormatMessageA
GetLastError
GetComputerNameA
SetCurrentDirectoryA
GetSystemTime
LoadLibraryA
GetLocalTime
VirtualFree
VirtualAlloc
FileTimeToDosDateTime
FindFirstFileA
DosDateTimeToFileTime
GetFileTime
SetFileTime
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
WaitForMultipleObjects
CreateThread
GetTickCount
InitializeCriticalSection
ExitProcess
ReleaseSemaphore
OpenSemaphoreA
CreateMutexA
GetWindowsDirectoryA
SystemTimeToFileTime
CreateProcessA
CreateSemaphoreA
GetVolumeInformationA
DeviceIoControl
HeapFree
HeapAlloc
GetProcessHeap
GetDriveTypeA
GetLogicalDrives
GetLogicalDriveStringsA
SizeofResource
LockResource
LoadResource
FindResourceA
FileTimeToSystemTime
GetCurrentProcessId
TerminateProcess
OpenProcess
FindClose
lstrlenA
MultiByteToWideChar
SetFileAttributesW
CreateFileA
GetFileSize
CloseHandle
CreateFileMappingA
MapViewOfFile
WriteFile
UnmapViewOfFile
GetModuleFileNameA
CopyFileA
SetEndOfFile
SetFileAttributesA

user32

DialogBoxParamA
CharLowerBuffA
wsprintfA
DefWindowProcA
SetTimer
ShowWindow
PostQuitMessage
EndDialog
KillTimer

advapi32

InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetFileSecurityA
InitializeSecurityDescriptor
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegSaveKeyA
RegOpenKeyExA
RegRestoreKeyA
RegCloseKey
RegQueryValueExA
LookupAccountNameA

shell32

SHChangeNotify

ole32

CoUninitialize
CoInitialize

ws2_32

gethostbyname
inet_ntoa
socket
inet_addr
htons
connect
send
closesocket
setsockopt
recv
WSAGetLastError
WSACleanup
WSAStartup

msvcrt

_strcmpi
_findfirst
_findnext
_findclose
_strlwr
atoi
__CxxFrameHandler
strrchr
strncmp
wcslen
strchr
memmove
isdigit
malloc
_stricmp
strncpy
free

psapi

GetModuleFileNameExA
EnumProcessModules

Sections

.data
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.srsrc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6e8915f34d559b80bc80fbf09b8a002a

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

ws2_32

msvcrt

psapi

Sections

.data Size: 46KB - Virtual size: 45KB

.rsrc Size: 81KB - Virtual size: 81KB

.srsrc Size: 80KB - Virtual size: 80KB

.data
Size: 46KB - Virtual size: 45KB

.rsrc
Size: 81KB - Virtual size: 81KB

.srsrc
Size: 80KB - Virtual size: 80KB