3fe487ac2b4870559f197ed395e9ca48

Sharing

Copy URL Twitter E-mail

General

Target

3fe487ac2b4870559f197ed395e9ca48
Size

96KB
MD5

3fe487ac2b4870559f197ed395e9ca48
SHA1

35a2bacd290d808f0d73f623f6745d291be2c77a
SHA256

a776539c7e9a3591110d9ed84f4f8112207527d51816b9839119ddc13f0ae6ae
SHA512

4a4ab5ecc0a5783f5f1dfff767e057aac2c38cb1fe29886160a6e2740c11f4463c66bbb90b9924006d17552a3cba8a309344eaab4b195c90b947e3f67581a8c3
SSDEEP

1536:r0ISfX81DJpaaT9jIp87jxvHQPmPvYHjex0yvGY:3SfXyDhjIpAvwPMvPx0yvGY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3fe487ac2b4870559f197ed395e9ca48

Files

3fe487ac2b4870559f197ed395e9ca48
.exe .ps1 windows:4 windows x86 arch:x86 polyglot

d0f2cffbb8749191f156b800ca8a4a53

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAGetLastError
sendto
htons
inet_addr
gethostbyname
setsockopt
inet_ntoa
WSASocketA
send
connect
socket
__WSAFDIsSet
recv
shutdown
select
closesocket

mfc42

ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4432
ord6742
ord6514
ord6478
ord6803
ord665
ord1979
ord3318
ord5186
ord354
ord5442
ord6010
ord3571
ord3626
ord3663
ord2414
ord2405
ord1641
ord640
ord1640
ord323
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord3136
ord4622
ord4424
ord3738
ord2976
ord561
ord641
ord2514
ord2621
ord1247
ord1134
ord2725
ord5265
ord4376
ord4998
ord6052
ord1775
ord5241
ord5280
ord3749
ord1727
ord5261
ord2124
ord4425
ord3597
ord1146
ord1168
ord324
ord2362
ord2370
ord4234
ord6197
ord6380
ord1175
ord6215
ord4160
ord2863
ord4710
ord2379
ord755
ord470
ord6453
ord5773
ord353
ord4853
ord1105
ord2915
ord668
ord1980
ord3178
ord4058
ord2781
ord2770
ord356
ord941
ord5710
ord940
ord6055
ord5290
ord1576
ord3742
ord567
ord818
ord3081
ord2985
ord3262
ord6691
ord4465
ord3259
ord3147
ord2982
ord5277
ord6614
ord2446
ord5260
ord1725
ord5065
ord3748
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5281
ord4353
ord6374
ord5163
ord2385
ord5240
ord4407
ord1776
ord4078
ord6054
ord4108
ord4960
ord4963
ord4524
ord4529
ord4526
ord4543
ord4545
ord4531
ord4889
ord4720
ord4347
ord4340
ord5076
ord6817
ord4892
ord4370
ord4899
ord4588
ord4589
ord6835
ord6808
ord6856
ord6845
ord6812
ord6815
ord6816
ord6858
ord6846
ord6839
ord6814
ord6847
ord6867
ord6859
ord6832
ord6855
ord6823
ord6857
ord6807
ord6591
ord6650
ord6800
ord2614
ord1200
ord2919
ord5572
ord1158
ord6334
ord537
ord536
ord924
ord823
ord2818
ord860
ord858
ord825
ord540
ord535
ord800
ord815
ord3402

msvcrt

__p__commode
_adjust_fdiv
__p__fmode
_initterm
__getmainargs
_setmbcp
__set_app_type
_except_handler3
__setusermatherr
_controlfp
__CxxFrameHandler
vsprintf
sprintf
strstr
fopen
fclose
fwrite
fread
_mbscmp
free
malloc
_endthreadex
_purecall
_beginthreadex
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln

kernel32

FindClose
RemoveDirectoryA
DeleteFileA
GetCurrentProcess
GetComputerNameA
GetModuleFileNameA
PeekNamedPipe
ReadFile
WriteFile
CreateEventA
TerminateThread
DisconnectNamedPipe
CloseHandle
CreatePipe
GetStartupInfoA
GetSystemDirectoryA
CreateProcessA
HeapFree
FindNextFileA
GetCurrentThreadId
LoadLibraryA
GetProcAddress
FreeLibrary
GetDriveTypeA
GetLastError
GetProcessHeap
HeapAlloc
Sleep
GetTickCount
GetWindowsDirectoryA
GetModuleHandleA
FileTimeToSystemTime
FindFirstFileA
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
ResumeThread
SetThreadPriority
GetCurrentThread
SetPriorityClass
SetFileAttributesA
lstrcatA
GetEnvironmentVariableA
GetShortPathNameA
VirtualQuery
InterlockedDecrement
WaitForSingleObject
SetEvent
lstrcpyA
InterlockedExchange
TerminateProcess
GetFileAttributesA

user32

SetWindowLongA
CreateWindowExA
RegisterClassA
LoadCursorA
DrawIcon
GetSystemMenu
AppendMenuA
SendMessageA
SetTimer
LoadIconA
GetWindowRect
GetDC
ReleaseDC
SetCursorPos
GetSystemMetrics
CloseWindowStation
MoveWindow
GetUserObjectInformationA
CloseDesktop
GetProcessWindowStation
GetThreadDesktop
OpenWindowStationA
SetProcessWindowStation
OpenDesktopA
SetThreadDesktop
EnableWindow
ShowWindow
keybd_event
EnumWindows
FindWindowA
IsWindow
FindWindowExA
PostMessageA
mouse_event
DefWindowProcA
GetWindowTextA
SendMessageTimeoutA
GetWindowThreadProcessId
GetClassNameA
ExitWindowsEx
IsIconic
OpenInputDesktop
GetClientRect

gdi32

GetPixel
GetBitmapBits
GetDeviceCaps
SelectObject
DeleteObject
DeleteDC
CreateCompatibleDC
BitBlt
GetDIBits
CreateDCA
CreateCompatibleBitmap
GetObjectA
GetStockObject

advapi32

StartServiceA
ControlService
LockServiceDatabase
UnlockServiceDatabase
ChangeServiceConfigA
OpenSCManagerA
EnumServicesStatusA
OpenServiceA
QueryServiceConfigA
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

shell32

ShellExecuteA

ole32

CoInitialize
CoUninitialize

msvcp60

??0Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ

msvfw32

ICSeqCompressFrameStart
ICOpen
ICInfo
ICSeqCompressFrame
ICSendMessage

avicap32

capCreateCaptureWindowA

winmm

waveInPrepareHeader
waveInUnprepareHeader
waveInOpen
waveInGetDevCapsA
waveInGetNumDevs
waveInClose
waveInReset
waveInStart
timeGetTime
waveInAddBuffer

psapi

GetModuleBaseNameA

Sections

.text
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d0f2cffbb8749191f156b800ca8a4a53

Headers

File Characteristics

Imports

ws2_32

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ole32

msvcp60

msvfw32

avicap32

winmm

psapi

Sections

.text Size: 60KB - Virtual size: 57KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 2KB

.text
Size: 60KB - Virtual size: 57KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 2KB