3eccde951a575d8c5d01e280ac1b38ac

Sharing

Copy URL Twitter E-mail

General

Target

3eccde951a575d8c5d01e280ac1b38ac
Size

328KB
MD5

3eccde951a575d8c5d01e280ac1b38ac
SHA1

745a9dffc9c514a93f2948cfea8c077ebea6c86c
SHA256

111970f8d82c703cafba1dac9b4ab17e49cc696456ce538ee03fab1983aaa8ec
SHA512

4da5253a0efacf34323051eacbcc2b4acbee86c5991ef9ed1e1cfb272b823b232aa7d69a7f23c80bc9c9f829380e9e93be2fd7be1c6069e2cf914bdb7623c744
SSDEEP

6144:tQJhcMrGRyZ3cLLHVZMgCMHUrs1vcA1UME6ELQtuAzLFVxdqzSJrDGU+:aw5LHlP0A1zHELwHzJVxc2JrDGU+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3eccde951a575d8c5d01e280ac1b38ac

Files

3eccde951a575d8c5d01e280ac1b38ac
.exe windows:4 windows x86 arch:x86

bdc78b384b41303d3118b444d4deec69

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

netapi32

NetMessageBufferSend

kernel32

GetEnvironmentVariableA
GetExitCodeProcess
GetFileAttributesW
GetFileSize
GetFileTime
GetFileType
GetLastError
GetLocalTime
GetLocaleInfoA
GetLocaleInfoW
GetLogicalDrives
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetPrivateProfileSectionW
GetPrivateProfileStringW
GetProcAddress
GetProcessHeap
GetShortPathNameW
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemTime
GetSystemTimeAsFileTime
GetTempFileNameW
GetTempPathW
GetTickCount
GetTimeFormatA
GetTimeFormatW
GetTimeZoneInformation
GetVersion
GetVersionExA
GetVersionExW
GetWindowsDirectoryW
GlobalMemoryStatus
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsBadCodePtr
GetEnvironmentStringsW
IsBadWritePtr
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalAlloc
LocalFree
MapViewOfFile
MoveFileExW
MoveFileW
MultiByteToWideChar
OpenFileMappingW
OpenMutexW
OpenProcess
QueryDosDeviceW
ReadFile
ReadProcessMemory
ReleaseMutex
ResetEvent
RtlUnwind
GetEnvironmentStringsA
SetEnvironmentVariableA
SetEvent
SetFileAttributesW
SetFilePointer
SetHandleCount
SetLastError
SetStdHandle
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
TerminateThread
TlsAlloc
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
WritePrivateProfileSectionW
WritePrivateProfileStringW
lstrcmpA
lstrlenA
lstrlenW
GetDriveTypeW
GetDiskFreeSpaceW
GetDateFormatW
GetDateFormatA
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetComputerNameW
GetComputerNameA
GetCommandLineA
GetCPInfo
GetACP
FreeLibrary
FreeEnvironmentStringsW
FreeEnvironmentStringsA
FlushFileBuffers
FindNextFileW
FindFirstFileW
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
ExpandEnvironmentStringsW
ExitProcess
EnterCriticalSection
DuplicateHandle
DeviceIoControl
DeleteFileW
DeleteCriticalSection
CreateThread
CreateProcessW
CreateMutexW
CreateFileW
CreateFileMappingW
CreateFileA
CreateEventW
CreateDirectoryW
CopyFileW
CompareStringW
CompareStringA
CompareFileTime
CloseHandle
IsBadReadPtr
SetEndOfFile

user32

wsprintfW
TranslateMessage
SetTimer
SendMessageW
RegisterClassW
PostMessageW
PeekMessageW
MsgWaitForMultipleObjects
LoadStringW
KillTimer
GetMessageW
DispatchMessageW
CreateWindowExW
DefWindowProcW

advapi32

RegOpenKeyExW
RegOpenKeyA
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
QueryServiceStatus
OpenThreadToken
OpenServiceW
OpenSCManagerW
OpenProcessToken
LookupAccountSidW
IsValidSid
InitializeSecurityDescriptor
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
GetSecurityDescriptorDacl
GetKernelObjectSecurity
FreeSid
EqualSid
DuplicateTokenEx
DuplicateToken
DeleteService
CreateServiceW
CreateProcessAsUserW
ControlService
CloseServiceHandle
AllocateAndInitializeSid
RegQueryInfoKeyW
RegQueryValueExA
RegQueryValueExW
RegSetValueExW
RegisterServiceCtrlHandlerW
RevertToSelf
SetKernelObjectSecurity
SetSecurityDescriptorDacl
SetServiceStatus
SetThreadToken
StartServiceCtrlDispatcherW
StartServiceW
RegEnumKeyExW
RegEnumKeyW
RegEnumValueW
RegDeleteValueW

wsock32

WSASetLastError
WSAGetLastError
__WSAFDIsSet
closesocket
connect
gethostbyname
htons
ioctlsocket
inet_ntoa
recv
select
send
setsockopt
socket
WSACleanup
WSAStartup

ole32

CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

VariantClear
SysFreeString
SysAllocString

Exports

Exports

adler32
compress
compress2
compressBound
crc32
deflate
deflateBound
deflateCopy
deflateEnd
deflateInit2_
deflateInit_
deflateParams
deflatePrime
deflateReset
deflateSetDictionary
get_crc_table
gzclearerr
gzclose
gzdopen
gzeof
gzerror
gzflush
gzgetc
gzgets
gzopen
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzsetparams
gztell
gzungetc
gzwrite
inflate
inflateBack
inflateBackEnd
inflateBackInit_
inflateCopy
inflateEnd
inflateInit2_
inflateInit_
inflateReset
inflateSetDictionary
inflateSync
inflateSyncPoint
uncompress
zError
zlibCompileFlags
zlibVersion

Sections

.text
Size: 228KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bdc78b384b41303d3118b444d4deec69

Headers

File Characteristics

Imports

netapi32

kernel32

user32

advapi32

wsock32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 228KB - Virtual size: 228KB

.rdata Size: 40KB - Virtual size: 40KB

.data Size: 20KB - Virtual size: 1.7MB

.idata Size: 8KB - Virtual size: 8KB

.rsrc Size: 28KB - Virtual size: 28KB

.text
Size: 228KB - Virtual size: 228KB

.rdata
Size: 40KB - Virtual size: 40KB

.data
Size: 20KB - Virtual size: 1.7MB

.idata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 28KB - Virtual size: 28KB