3e06e15047ba0e45b99f3f99cfbd3092

Sharing

Copy URL Twitter E-mail

General

Target

3e06e15047ba0e45b99f3f99cfbd3092
Size

467KB
MD5

3e06e15047ba0e45b99f3f99cfbd3092
SHA1

03ed253d7c2cb1e97d973fa03706dd05446ec629
SHA256

eb0b14de0c9add0b032d2c260785ccf4df52308fa80755df85004734c8bcdf41
SHA512

ea1d1822469384327ac9a6315bea82260abeb06d68d63b42468a373ce10f3516f3adda2d9143d200fe6d5bf4cd205930bd1a8983632824b056a027158402a69e
SSDEEP

6144:upIpKj+ub1e7wi62NftIhilcrgpV+2WqIbYjIFVVMwOdRt+D/VuDsyjmfCSX:upPqub1e7wix8i58gI9JOdn+LyjmqSX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e06e15047ba0e45b99f3f99cfbd3092

Files

3e06e15047ba0e45b99f3f99cfbd3092
.exe windows:4 windows x86 arch:x86

ac65ea925a090009677810572e43f763

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msasn1

ASN1BERDecBitString
ASN1_FreeEncoded
ASN1_FreeDecoded
ASN1BERDecPeekTag
ASN1BEREncExplicitTag
ASN1_CreateDecoder
ASN1objectidentifier_free
ASN1BERDecGeneralizedTime
ASN1BEREncCharString
ASN1intx2int32
ASN1intx_free
ASN1BEREncObjectIdentifier
ASN1EncSetError
ASN1BEREncBitString
ASN1intx_setuint32
ASN1BERDecOpenType2
ASN1DecSetError
ASN1_Decode
ASN1intx2uint32
ASN1BEREncOpenType
ASN1octetstring_free
ASN1BERDecCharString
ASN1_CreateModule
ASN1BEREncSX
ASN1intxisuint32
ASN1ztcharstring_free
ASN1BERDecExplicitTag
ASN1BEREncOctetString
ASN1_CloseEncoder
ASN1DecAlloc
ASN1_Encode
ASN1_CloseDecoder
ASN1BERDecSkip
ASN1BERDecZeroCharString
ASN1BEREncBool
ASN1BEREncEndOfContents
ASN1BERDecBool
ASN1BERDecNotEndOfContents
ASN1_CreateEncoder
ASN1bitstring_free
ASN1BERDecOctetString
ASN1BEREncU32
ASN1Free
ASN1CEREncGeneralizedTime
ASN1BEREncS32
ASN1charstring_free
ASN1BERDecSXVal
ASN1BERDecU32Val
ASN1BERDecEndOfContents
ASN1BERDecS32Val
ASN1BERDecObjectIdentifier

cryptdll

MD5Init
MD5Final
CDFindCommonCSystemWithKey
CDLocateCSystem
MD5Update
CDLocateCheckSum
CDBuildIntegrityVect
CDGenerateRandomBits

secur32

LsaGetLogonSessionData
LsaFreeReturnBuffer
FreeContextBuffer
CredMarshalTargetInfo
CredUnmarshalTargetInfo

advapi32

RegCreateKeyExW
RegCloseKey
RegDeleteValueW
AllocateAndInitializeSid
CredFree
CryptAcquireContextW
RegSetValueExW
OpenThreadToken
OpenProcessToken
QueryServiceStatus
RevertToSelf
ReportEventW
CryptCreateHash
CryptReleaseContext
LookupAccountSidW
FreeSid
RegisterEventSourceW
DeregisterEventSource
CryptHashData
GetTokenInformation
QueryServiceConfigW
CryptGetProvParam
RegOpenKeyW
CloseServiceHandle
CryptGetHashParam
RegQueryValueExW
SystemFunction007
RegisterTraceGuidsW
GetTraceLoggerHandle
SystemFunction006
RegNotifyChangeKeyValue
RegEnumKeyExW
TraceEvent
RegConnectRegistryW
SetThreadToken
OpenServiceW
RegQueryInfoKeyW
RegOpenKeyExW
CryptDestroyHash
CredUnmarshalCredentialW
OpenSCManagerW
CryptSetProvParam

kernel32

CreateFileW
OpenEventW
lstrlenA
TerminateProcess
ExpandEnvironmentStringsW
GetModuleHandleW
InterlockedDecrement
CreateEventW
SetEvent
GetCurrentProcess
LoadLibraryW
MultiByteToWideChar
WideCharToMultiByte
DebugBreak
QueryPerformanceCounter
GetSystemTimeAsFileTime
WriteFile
DisableThreadLibraryCalls
DeleteCriticalSection
GetModuleFileNameW
CreateFileA
LoadLibraryA
GetProcAddress
GetLastError
InterlockedExchange
SetUnhandledExceptionFilter
InterlockedIncrement
LocalAlloc
GetCurrentProcessId
OpenFileMappingW
VirtualAlloc
lstrcmpW
GetCurrentThread
FormatMessageW
EnterCriticalSection
GetProfileStringA
lstrcmpiA
UnregisterWait
RegisterWaitForSingleObjectEx
GetSystemInfo
lstrlenW
InterlockedExchangeAdd
MapViewOfFileEx
OutputDebugStringA
GetComputerNameExW
LeaveCriticalSection
Sleep
GetLocalTime
InitializeCriticalSection
CloseHandle
GetComputerNameW
GetCurrentThreadId
RaiseException
GetTickCount
GetACP
GetEnvironmentVariableW
LocalFree
InterlockedCompareExchange
FileTimeToSystemTime
UnmapViewOfFile
UnhandledExceptionFilter
CreateFileMappingW
lstrcpyW
FreeLibrary
GetModuleFileNameA

ntdll

RtlFreeSid
RtlDowncaseUnicodeString
RtlDeleteResource
RtlConvertSharedToExclusive
RtlCreateTimerQueue
RtlCreateSecurityDescriptor
RtlUniform
RtlCompareUnicodeString
NtAllocateVirtualMemory
NtWaitForSingleObject
NtSetSecurityObject
RtlDeleteCriticalSection
RtlFreeUnicodeString
RtlInitializeSid
RtlAcquireResourceExclusive
RtlEraseUnicodeString
RtlAnsiStringToUnicodeString
RtlDeleteElementGenericTable
RtlConvertSidToUnicodeString
RtlEqualSid
RtlTimeFieldsToTime
RtlUpcaseUnicodeString
RtlEqualUnicodeString
NtClose
RtlValidSid
RtlNtStatusToDosError
RtlLengthSid
RtlRegisterWait
RtlEnterCriticalSection
RtlCopyLuid
DbgPrint
RtlInsertElementGenericTableAvl
RtlInitAnsiString
RtlSystemTimeToLocalTime
RtlSubAuthoritySid
NtOpenThreadToken
RtlSubAuthorityCountSid
NtOpenProcessToken
RtlAppendUnicodeStringToString
NtOpenEvent
RtlAcquireResourceShared
RtlCopyUnicodeString
RtlUnicodeStringToAnsiString
RtlAddAccessAllowedAce
RtlOemStringToUnicodeString
RtlReleaseResource
RtlTimeToTimeFields
RtlPrefixUnicodeString
RtlLookupElementGenericTableAvl
RtlInsertElementGenericTable
RtlGetElementGenericTable
RtlInitializeGenericTable
RtlEqualDomainName
RtlCreateAcl
RtlLookupElementGenericTable
RtlIntegerToUnicodeString
RtlLengthRequiredSid
RtlInitializeCriticalSection
NtDuplicateObject
RtlDeregisterWait
RtlInitializeResource
RtlCompareMemory
NtQuerySystemTime
NtQuerySystemInformation
NtAllocateLocallyUniqueId
RtlFreeAnsiString
RtlDeleteTimerQueue
NtQueryInformationToken
RtlCopySid
RtlInitializeGenericTableAvl
RtlInitUnicodeString
NtCreateEvent
RtlRunDecodeUnicodeString
VerSetConditionMask
RtlSetDaclSecurityDescriptor
RtlVerifyVersionInfo
RtlCreateTimer
RtlAllocateAndInitializeSid

msvcrt

_strnicmp
_wcsnicmp
wcscat
_stricmp
wcscpy
strchr
_strcmpi
strrchr
_adjust_fdiv
wcsrchr
_except_handler3
wcslen
qsort
malloc
swprintf
_ultoa
wcscmp
wcsspn
sscanf
wcstoul
_wcsicmp
_vsnprintf
_initterm
free
sprintf

user32

wsprintfW
CharLowerBuffW

Sections

.text
Size: 270KB - Virtual size: 269KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.data
Size: 59KB - Virtual size: 984KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ac65ea925a090009677810572e43f763

Headers

File Characteristics

Imports

msasn1

cryptdll

secur32

advapi32

kernel32

ntdll

msvcrt

user32

Sections

.text Size: 270KB - Virtual size: 269KB

.reloc Size: 512B - Virtual size: 24B

.data Size: 59KB - Virtual size: 984KB

.rsrc Size: 28KB - Virtual size: 27KB

.rdata Size: 108KB - Virtual size: 108KB

.text
Size: 270KB - Virtual size: 269KB

.reloc
Size: 512B - Virtual size: 24B

.data
Size: 59KB - Virtual size: 984KB

.rsrc
Size: 28KB - Virtual size: 27KB

.rdata
Size: 108KB - Virtual size: 108KB