2b43e0d0a6bba3d1d46094b6a5d77ef8

Sharing

Copy URL

Twitter E-mail

General

Target

2b43e0d0a6bba3d1d46094b6a5d77ef8
Size

468KB
MD5

2b43e0d0a6bba3d1d46094b6a5d77ef8
SHA1

ef4013910240342db1e7c7833e698e8a381cc436
SHA256

a8a6b48cd219a3a2bc70e6e0ae117b87520a984a9d26ee6e8aeee5d39ee66be2
SHA512

d0a7053762bef10a80683c17fecf9dacc81e1605d9af91be1f23c445818e2df87edde5fc4255202895502bb5956044087d34cd13bb80a6d07006a14648c5a0af
SSDEEP

12288:LiXZ4ExRMF7MRgqLyvk80gAU5i2sbRhEPi:CRO7sg4QkXi5i3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b43e0d0a6bba3d1d46094b6a5d77ef8

Files

2b43e0d0a6bba3d1d46094b6a5d77ef8
.exe windows:4 windows x86 arch:x86

229bfa713fa5680e1ad66aa81ff5f97a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wpcap

pcap_findalldevs
pcap_freealldevs
pcap_open_live
pcap_loop
pcap_close

kernel32

GetFileAttributesA
SetErrorMode
GetTickCount
HeapFree
HeapAlloc
RtlUnwind
GetSystemTimeAsFileTime
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStartupInfoA
GetCommandLineA
ExitProcess
ExitThread
CreateThread
HeapReAlloc
SetStdHandle
GetFileType
HeapSize
HeapDestroy
VirtualFree
IsBadWritePtr
DebugBreak
SetUnhandledExceptionFilter
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
QueryPerformanceCounter
LCMapStringA
LCMapStringW
IsBadReadPtr
IsBadCodePtr
GetProcessHeap
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetLocaleInfoW
SetEnvironmentVariableA
FileTimeToLocalFileTime
GetOEMCP
GetCPInfo
FileTimeToSystemTime
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
EnterCriticalSection
GlobalHandle
GlobalReAlloc
LeaveCriticalSection
LocalAlloc
GlobalFlags
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GlobalGetAtomNameA
GlobalFindAtomA
lstrcatA
lstrcmpW
SetLastError
MulDiv
GlobalUnlock
FormatMessageA
LocalFree
FreeResource
GlobalFree
WritePrivateProfileStringA
lstrcpynA
CreateEventA
SuspendThread
SetEvent
WaitForSingleObject
ResumeThread
SetThreadPriority
GlobalAddAtomA
GetCurrentThread
GetCurrentThreadId
GlobalLock
GlobalAlloc
GlobalDeleteAtom
lstrcmpA
GetModuleHandleA
ConvertDefaultLocale
EnumResourceLanguagesA
GetLastError
lstrlenA
lstrcmpiA
CompareStringA
CompareStringW
MultiByteToWideChar
Thread32First
Thread32Next
CreateFileA
GetFileTime
CompareFileTime
Sleep
InterlockedDecrement
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
GetModuleFileNameA
OpenProcess
TerminateProcess
WideCharToMultiByte
LoadResource
LockResource
SizeofResource
FindResourceA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetVersionExA
GetVersion
LoadLibraryA
GetProcAddress
GetCurrentProcessId
FreeLibrary
lstrcpyA
HeapCreate

user32

RegisterClipboardFormatA
PostThreadMessageA
CharNextA
GetSysColorBrush
ReleaseCapture
LoadCursorA
SetCapture
DestroyMenu
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
RegisterWindowMessageA
WinHelpA
GetCapture
CreateWindowExA
GetClassLongA
GetClassInfoExA
RemovePropA
IsChild
GetForegroundWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
UpdateWindow
GetMenu
GetSysColor
AdjustWindowRectEx
EqualRect
GetClassInfoA
UnregisterClassA
DefWindowProcA
CallWindowProcA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
PtInRect
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetNextDlgTabItem
EndDialog
GetMenuItemID
GetMenuItemCount
GetSubMenu
SetWindowContextHelpId
MapDialogRect
GetWindowTextA
SetWindowPos
SetFocus
ShowWindow
MoveWindow
SetWindowLongA
GetDlgCtrlID
SetWindowTextA
IsDialogMessageA
SendDlgItemMessageA
GetDlgItem
SetMenuItemBitmaps
GetFocus
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
MessageBeep
GetNextDlgGroupItem
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
SetCursor
PostQuitMessage
PostMessageA
EnumChildWindows
GetWindow
FindWindowExA
CharUpperA
InvalidateRgn
InvalidateRect
CopyAcceleratorTableA
SetRect
RegisterClassA
IsRectEmpty
LoadIconA
EnableWindow
KillTimer
SetTimer
GetClientRect
IsIconic
GetSystemMenu
AppendMenuA
DrawIcon
EnumThreadWindows
FindWindowA
GetSystemMetrics
SetPropA
SendMessageA
GetClassNameA
GetPropA
EnumWindows
wsprintfA
MessageBoxA
CopyRect
GetTopWindow

gdi32

SelectObject
GetBkColor
GetTextColor
CreateRectRgnIndirect
GetRgnBox
GetMapMode
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
GetStockObject
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
GetClipBox
GetDeviceCaps
CreateBitmap
DeleteObject
SetMapMode
RestoreDC
SaveDC
GetObjectA
SetBkColor
SetTextColor
SetViewportOrgEx

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyA
RegQueryValueA
RegCreateKeyExA
RegSetValueExA
RegCloseKey

shell32

ShellExecuteA

comctl32

ord17

shlwapi

PathFindFileNameA
PathStripToRootA
PathFindExtensionA
PathIsUNCA

ole32

CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoTaskMemAlloc
OleInitialize
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
OleRun
CoInitialize
CoUninitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter

oleaut32

SysStringLen
SysAllocStringByteLen
GetErrorInfo
SysAllocStringLen
OleCreateFontIndirect
SystemTimeToVariantTime
SafeArrayDestroy
SysFreeString
VariantChangeType
SysAllocString
VariantClear
VariantInit
VariantCopy

oledlg

ord8

ws2_32

inet_ntoa
ntohs
gethostbyname
gethostname
WSACleanup
WSAStartup
ntohl
WSAGetLastError

Sections

.text
Size: 328KB - Virtual size: 325KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 64KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vymm
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

229bfa713fa5680e1ad66aa81ff5f97a

Headers

File Characteristics

Imports

wpcap

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

ws2_32

Sections

.text Size: 328KB - Virtual size: 325KB

.rdata Size: 64KB - Virtual size: 61KB

.data Size: 12KB - Virtual size: 31KB

.rsrc Size: 40KB - Virtual size: 37KB

.vymm Size: 20KB - Virtual size: 20KB

.text
Size: 328KB - Virtual size: 325KB

.rdata
Size: 64KB - Virtual size: 61KB

.data
Size: 12KB - Virtual size: 31KB

.rsrc
Size: 40KB - Virtual size: 37KB

.vymm
Size: 20KB - Virtual size: 20KB