3f3670d89205fea3a7f953fa18016fd1

Sharing

Copy URL Twitter E-mail

General

Target

3f3670d89205fea3a7f953fa18016fd1
Size

152KB
MD5

3f3670d89205fea3a7f953fa18016fd1
SHA1

e1eb16f61b1aa7daa60eed1cabe5f7634f1149b5
SHA256

91ee6b9b1d33e3c7bbc86bb294763581a465c73db8a0a216394f8448b6a8a560
SHA512

0250d9ab6e2a985a3a50783f66995d84934702c15eab19596ecb5c43aa92de825fbb90a57b78caaa5355a43c959b62bcfc83f7864badbcb1788093fa2d235c05
SSDEEP

3072:B5cHInde+q51wunMcWY5GNwHlwoamytCpeEnJwdVnpl/B:B5Rde+q51hGIwfmytbl5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f3670d89205fea3a7f953fa18016fd1

Files

3f3670d89205fea3a7f953fa18016fd1
.exe windows:5 windows x86 arch:x86

5f385213d88777004c44f9795d9ce0f7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadFile
GetTimeZoneInformation
CreateFileW
MultiByteToWideChar
SetThreadPriority
FlushFileBuffers
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
SetLastError
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
FindClose
LoadLibraryA
SetNamedPipeHandleState
WaitForMultipleObjects
lstrcmpiW
FindNextFileW
CreateToolhelp32Snapshot
GetFileTime
GetCurrentThreadId
ReleaseMutex
GetDiskFreeSpaceExW
CloseHandle
FileTimeToLocalFileTime
DeleteFileW
GetFileInformationByHandle
LocalFree
SetFileAttributesW
GetComputerNameW
Thread32Next
GetLogicalDrives
ExitThread
CreateTimerQueueTimer
GetCommandLineA
CopyFileW
GetModuleFileNameW
Process32FirstW
Process32NextW
SetEvent
GetExitCodeProcess
GetUserDefaultUILanguage
MapViewOfFile
CreateFileMappingW
GetModuleHandleA
OpenFileMappingW
lstrcmpiA
GetPrivateProfileStringW
GetPrivateProfileIntW
GetThreadPriority
ConnectNamedPipe
CreateNamedPipeW
GetProcessTimes
DisconnectNamedPipe
lstrcatW
lstrcpyW
lstrcpyA
GlobalLock
GlobalUnlock
ResetEvent
MoveFileExW
CreateDirectoryW
HeapFree
SetFilePointerEx
HeapCreate
HeapDestroy
GetVersionExW
ReadProcessMemory
Sleep
VirtualFreeEx
WideCharToMultiByte
Thread32First
OpenProcess
WriteFile
WaitNamedPipeW
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualFree
GetCurrentThread
ExpandEnvironmentStringsW
GetTickCount
SystemTimeToFileTime
HeapAlloc
CreateProcessW
FreeLibrary
SetEndOfFile
GetDriveTypeW
GetNativeSystemInfo
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
WriteProcessMemory
GetCurrentProcessId
TlsAlloc
CreateEventW
GetProcAddress
TlsSetValue
GetModuleHandleW
SetErrorMode
TlsGetValue
SetThreadContext
GetThreadContext
ExitProcess
GetSystemTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateThread
WaitForSingleObject

user32

CreateDesktopW
GetWindow
IsWindowVisible
SendMessageTimeoutW
ShowWindow
DefWindowProcA
ReleaseDC
GetDC
GetClassLongW
BeginPaint
FindWindowW
WindowFromPoint
DestroyWindow
GetParent
PostMessageW
GetTopWindow
RegisterWindowMessageW
EndPaint
GetCursorPos
GetIconInfo
DrawIcon
GetWindowThreadProcessId
CharLowerBuffA
OpenWindowStationA
GetForegroundWindow
MapVirtualKeyW
GetWindowInfo
ExitWindowsEx
OpenDesktopA
ToUnicode
GetClipboardData
CharLowerW
DispatchMessageW
DefWindowProcW
GetKeyboardState
TranslateMessage
PeekMessageW
SetTimer
SetProcessWindowStation
GetMessageW
GetThreadDesktop
UnregisterClassW
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
GetWindowLongW
MsgWaitForMultipleObjects
OpenWindowStationW
GetUserObjectInformationW
GetSystemMetrics
RegisterClassW
CreateWindowExW
SetThreadDesktop
SetWindowLongW
CharUpperW
LoadCursorW

advapi32

CryptGetHashParam
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
OpenThreadToken
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
RegSetValueExA
RegCreateKeyExA
RegDeleteValueW
RegEnumKeyExW
GetUserNameW
LookupAccountSidW
DuplicateTokenEx
CryptAcquireContextW
GetSidSubAuthority
OpenProcessToken
GetSidSubAuthorityCount

shlwapi

SHDeleteKeyA
StrStrIW
StrStrIA
StrCmpNIA
wnsprintfA
StrStrW
wnsprintfW
wvnsprintfA
PathMatchSpecW
StrCmpNIW
PathGetDriveNumberW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
wvnsprintfW
PathBuildRootW
PathCombineW

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW

secur32

GetUserNameExW

psapi

GetModuleFileNameExW

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

GetDeviceCaps
BitBlt
DeleteDC
CreateDIBSection
GetDIBits
GdiFlush
DeleteObject
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC

ws2_32

listen
send
closesocket
WSASetLastError
freeaddrinfo
socket
bind
recv
WSASend
WSAIoctl
getpeername
connect
WSAAddressToStringW
WSAStartup
recvfrom
getaddrinfo
select
WSAGetLastError
getsockname
shutdown
setsockopt
sendto
accept

crypt32

CertEnumCertificatesInStore
PFXExportCertStoreEx
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
PFXImportCertStore
CertDuplicateCertificateContext

wininet

HttpAddRequestHeadersA
InternetGetCookieA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetOpenUrlA
FindCloseUrlCache
FindFirstUrlCacheEntryW
FindNextUrlCacheEntryW
DeleteUrlCacheEntryW
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
HttpQueryInfoA
InternetConnectA
InternetCrackUrlA

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

mpr

WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum

Sections

.text
Size: 108KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.data1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5f385213d88777004c44f9795d9ce0f7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

psapi

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

mpr

Sections

.text Size: 108KB - Virtual size: 106KB

.data Size: 28KB - Virtual size: 26KB

.reloc Size: 8KB - Virtual size: 5KB

.data1 Size: 4KB - Virtual size: 4KB

.text
Size: 108KB - Virtual size: 106KB

.data
Size: 28KB - Virtual size: 26KB

.reloc
Size: 8KB - Virtual size: 5KB

.data1
Size: 4KB - Virtual size: 4KB