3ab1bfa01aef826a1ebfbf25caa2022d

Sharing

Copy URL Twitter E-mail

General

Target

3ab1bfa01aef826a1ebfbf25caa2022d
Size

66KB
MD5

3ab1bfa01aef826a1ebfbf25caa2022d
SHA1

2476cbea1ef7e03b0cbb68725aae6c1bc3e06c66
SHA256

8cc59bde162025a24a7a977186c32d8aba236c7f9a7c58e167965ae5d153adb9
SHA512

38b0f38df7776729925b8c8de50e186750cb73be0c78575e337ffbf5f95c42426090db19cf61f0ae37169eac80cf63e652c16e3f6d36460753a8d5b987b2d4f1
SSDEEP

1536:dy7wyEKfBAvRzSPi75TdwvMFeqpaBAR4RWFKQS1:GwypAvRzSPKpdwvMUqpHqRYFS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3ab1bfa01aef826a1ebfbf25caa2022d

Files

3ab1bfa01aef826a1ebfbf25caa2022d
.exe windows:4 windows x86 arch:x86

9abcea570c19251c9585856f0031407a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

LockServiceDatabase
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
LookupPrivilegeDisplayNameA
ClearEventLogA
RegQueryValueA
OpenEventLogW
CryptSetHashParam
GetSidLengthRequired
CryptEnumProviderTypesA
OpenBackupEventLogW
NotifyBootConfigStatus
BuildSecurityDescriptorW
AllocateLocallyUniqueId
RegQueryValueExW
RegOpenKeyExW
LookupPrivilegeNameW
StartServiceCtrlDispatcherW
CloseServiceHandle
SetEntriesInAuditListA
CryptGenKey
RegQueryMultipleValuesA
RegisterServiceCtrlHandlerA
CryptEncrypt
BackupEventLogW
CryptReleaseContext
GetOverlappedAccessResults
IsValidSid
QueryServiceConfigW
GetSecurityInfoExA
GetAuditedPermissionsFromAclW
TrusteeAccessToObjectW
RegGetKeySecurity
OpenSCManagerA
GetTrusteeNameA
CryptEnumProvidersW
RegCreateKeyW
GetMultipleTrusteeW
AllocateAndInitializeSid
GetLengthSid
EqualPrefixSid
SetServiceBits
RegUnLoadKeyW

shlwapi

SHRegEnumUSKeyW
SHQueryValueExA
wvnsprintfA
PathCreateFromUrlA
SHRegCloseUSKey
StrPBrkA
SHRegDuplicateHKey
PathIsSameRootW
ChrCmpIA
StrFromTimeIntervalW
PathFindNextComponentW
SHCopyKeyA
PathIsUNCServerShareW
PathIsURLW
UrlIsOpaqueW
PathAppendA
PathIsSameRootA
SHAutoComplete
PathRemoveExtensionA
StrCmpNIA
PathMatchSpecW
PathIsSystemFolderA
wvnsprintfW
SHEnumValueA
PathCombineW
AssocQueryStringByKeyW
SHRegQueryUSValueA
PathFindFileNameW
PathIsRelativeA
SHSetThreadRef
SHRegQueryInfoUSKeyA
StrFromTimeIntervalA
UrlApplySchemeW
StrCSpnIA
StrChrA
UrlEscapeA
UrlApplySchemeA
PathFindOnPathA
SHRegQueryUSValueW
StrDupA
SHSetValueW
UrlIsNoHistoryW
PathSetDlgItemPathW
PathGetArgsW
UrlUnescapeW
PathCombineA
PathRemoveArgsW
StrCatBuffW

kernel32

HeapDestroy
GetThreadPriorityBoost
SwitchToThread
PulseEvent
LockFile
QueryPerformanceFrequency
SetConsoleOutputCP
FreeEnvironmentStringsW
HeapCompact
GetProfileStringW
WriteProfileSectionW
VirtualProtect
GetLastError
WriteFile
FormatMessageW
GetUserDefaultLCID
SetTimeZoneInformation
VirtualAlloc
Heap32First
IsBadStringPtrW
GetConsoleTitleW
GetFileTime
FindNextFileA
MulDiv
CreateDirectoryW
GetDiskFreeSpaceExA
GetCommConfig
GetThreadLocale
LocalFileTimeToFileTime
PeekConsoleInputW
GetTimeFormatA
EnumResourceNamesW
GetShortPathNameA
IsValidLocale
SearchPathW
GetCurrentProcessId
FreeConsole
WriteProcessMemory
SetMailslotInfo
SetConsoleCtrlHandler
CreateSemaphoreW
OutputDebugStringW
HeapCreate
SetCommTimeouts
SetMessageWaitingIndicator
MoveFileExA
GetLocaleInfoW

ole32

SetDocumentBitStg
UtConvertDvtd16toDvtd32
CoFreeUnusedLibraries
CreatePointerMoniker
CoTreatAsClass
OleCreateFromData
OleLoadFromStream
CoFreeAllLibraries
CoIsHandlerConnected
OleConvertIStorageToOLESTREAM
OleSave
CLSIDFromProgID
OleCreateFromFileEx
OleDuplicateData
GetConvertStg
OleCreateMenuDescriptor
OleTranslateAccelerator
CoMarshalHresult
OleInitialize
CoImpersonateClient
OleFlushClipboard
MonikerRelativePathTo
StgOpenAsyncDocfileOnIFillLockBytes
RegisterDragDrop
MonikerCommonPrefixWith
CoTaskMemRealloc
CoTaskMemAlloc
CreateItemMoniker
CoCreateInstanceEx
CoDosDateTimeToFileTime
OleCreateEmbeddingHelper
CoRevokeClassObject
CoUninitialize
DllGetClassObjectWOW
CreateOleAdviseHolder

Sections

.text
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9abcea570c19251c9585856f0031407a

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shlwapi

kernel32

ole32

Sections

.text Size: 59KB - Virtual size: 59KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 16KB

.text
Size: 59KB - Virtual size: 59KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 16KB