10c1800829353d71be7efd4a77b126e9[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

10c1800829353d71be7efd4a77b126e9.exe
Size

734KB
MD5

10c1800829353d71be7efd4a77b126e9
SHA1

43ea3aa190ed7fdc9830314109b1c4c0f80c6b0d
SHA256

6f915ed4cd98d06fa885bbe1477a85e96e09f95f70b2126760011a57cecf9bcc
SHA512

5434966531d25f6a80d7f5dc3175f03f5e85e52d3a847d68a3dc51332cce55e51ce4449bd72f2ecdcfdfd269dd2c2aa5b5582ea5913ab5d740a9eec9a405542d
SSDEEP

12288:UfKswKXh8VxdWr8/83arRueBYl7/lfh3P27ExwOm8YqdKoMCG:UiswswdWr08qrkVfh3P6ROm8n

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
10c1800829353d71be7efd4a77b126e9.exe

Files

10c1800829353d71be7efd4a77b126e9.exe
.exe windows:5 windows x86 arch:x86

8183531671e102d00d23bd4e52243a0e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

comctl32

ImageList_Create
ImageList_GetIcon
ImageList_Remove
ImageList_Draw
ImageList_ReplaceIcon
ImageList_Add
ord17
ImageList_GetImageCount

crypt32

CryptSIPLoad
CertDuplicateCertificateContext
CryptSIPRetrieveSubjectGuidForCatalogFile
CertGetNameStringW
CryptDecodeObject

wintrust

CryptCATAdminCalcHashFromFileHandle

ntdll

NtDeleteKey
RtlUnwind
NtOpenKey
NtCreateKey

kernel32

CreateDirectoryW
RemoveDirectoryW
GetFullPathNameW
SetFileAttributesW
DeleteFileW
MoveFileW
GetComputerNameW
IsWow64Process
GetLocaleInfoW
GetNumberFormatW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
MultiByteToWideChar
DecodePointer
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForSingleObject
GetCurrentThread
SetThreadPriority
SetEvent
GetSystemWindowsDirectoryW
CreateEventW
CreateThread
GetExitCodeThread
ExpandEnvironmentStringsA
LoadLibraryA
GetSystemWow64DirectoryW
ReadConsoleInputA
GetConsoleMode
GetModuleHandleExW
ExitProcess
TlsFree
EncodePointer
OutputDebugStringW
WideCharToMultiByte
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
ResetEvent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetStdHandle
ResumeThread
FreeLibraryAndExitThread
GetACP
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetStringTypeW
GetWindowsDirectoryW
GetTempFileNameW
GetTempPathW
WritePrivateProfileStringW
GetPrivateProfileStringW
WriteProfileStringW
GetProfileStringW
ExpandEnvironmentStringsW
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
SetEnvironmentVariableW
CreateProcessW
LoadLibraryExW
CreateSemaphoreW
TlsSetValue
TlsAlloc
lstrlenW
lstrcatW
GetTickCount
GetFileTime
WriteFile
GetFileSize
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetErrorMode
ExitThread
TerminateProcess
GetCurrentProcess
OpenProcess
GetLongPathNameW
GlobalUnlock
GlobalLock
GlobalAlloc
GetVersion
FreeLibrary
TlsGetValue
GetModuleFileNameW
GetCommandLineW
GetStdHandle
GetFileType
LocalFree
LocalAlloc
GetDateFormatW
GetTimeFormatW
GetModuleHandleW
FormatMessageW
FileTimeToSystemTime
FileTimeToLocalFileTime
MulDiv
ReadFile
InterlockedIncrement
FindNextFileW
FindFirstFileW
GetFileAttributesW
CreateFileW
FindClose
Sleep
GetLastError
GetProcAddress
InterlockedDecrement
FreeEnvironmentStringsW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
CloseHandle
GetFileSizeEx
GetSystemDirectoryW
LoadLibraryW
SetLastError
SetFilePointerEx
WriteConsoleW
ReadConsoleW
SetEndOfFile
WaitForMultipleObjects
SetConsoleMode

user32

EnumChildWindows
SetParent
GetParent
SetWindowLongW
GetWindowLongW
PtInRect
OffsetRect
UnionRect
IntersectRect
GetSysColor
ChildWindowFromPoint
MapWindowPoints
ScreenToClient
ClientToScreen
GetCursorPos
GetWindowRect
GetClientRect
GetWindowTextW
GetPropW
SetPropW
InvalidateRgn
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
FindWindowW
SetForegroundWindow
DrawTextW
TrackPopupMenu
DeleteMenu
ModifyMenuW
InsertMenuW
GetSubMenu
EnableMenuItem
CheckMenuItem
FindWindowExW
GetClassNameW
GetWindowThreadProcessId
LoadBitmapW
LoadIconW
DestroyIcon
LoadImageW
CopyImage
DrawIconEx
DrawMenuBar
GetMenu
GetSystemMetrics
TranslateAcceleratorW
LoadAcceleratorsW
EnableWindow
KillTimer
SetTimer
ReleaseCapture
GetFocus
SetFocus
CharUpperW
EmptyClipboard
SetClipboardData
CloseClipboard
CreateIconIndirect
GetIconInfo
LoadStringW
IsDialogMessageW
EnumDisplaySettingsW
GetDC
OpenClipboard
IsDlgButtonChecked
CheckDlgButton
GetDlgItemTextW
SetDlgItemTextW
DialogBoxParamW
CreateDialogParamW
IsZoomed
IsIconic
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPos
MoveWindow
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
CallWindowProcW
PostQuitMessage
DefWindowProcW
WaitForInputIdle
PostMessageW
DispatchMessageW
TranslateMessage
GetMessageW
DrawFrameControl
RegisterWindowMessageW
LoadCursorW
InflateRect
GetSysColorBrush
SetCursor
SetWindowTextW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
SendMessageW
MessageBoxW
SetMenuItemInfoW

gdi32

GetStockObject
CreateSolidBrush
CreateFontIndirectW
CreateBitmap
BitBlt
EndPage
StartPage
EndDoc
SetBkColor
StartDocW
SetMapMode
GetDeviceCaps
GetTextExtentPoint32W
DeleteDC
CreateCompatibleDC
DeleteObject
SetBkMode
SetTextColor
GetTextMetricsW
GetObjectW
ExtTextOutW
GetDIBits
CreateDIBSection
GdiFlush
SelectObject

comdlg32

GetOpenFileNameW
FindTextW
ChooseFontW
CommDlgExtendedError
GetSaveFileNameW
PrintDlgW

advapi32

CryptHashData
RegOpenKeyExA
RegQueryValueExA
QueryServiceConfig2W
GetServiceDisplayNameW
DeleteService
RegQueryValueW
RegUnLoadKeyW
RegSetKeySecurity
RegQueryInfoKeyW
RegLoadKeyW
RegGetKeySecurity
RegEnumValueW
RegEnumKeyW
RegDeleteKeyW
DuplicateTokenEx
ImpersonateLoggedOnUser
LookupPrivilegeValueW
LookupAccountNameW
LookupAccountSidW
FreeSid
AllocateAndInitializeSid
EqualSid
AdjustTokenPrivileges
GetTokenInformation
OpenProcessToken
RevertToSelf
RegOpenKeyW
RegCreateKeyW
RegSetValueExW
RegDeleteValueW
RegCreateKeyExW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegQueryValueExW
CryptAcquireContextW
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
RegCloseKey
CryptDestroyHash
RegOpenKeyExW

shell32

ShellExecuteExW
SHGetMalloc
SHGetPathFromIDListW
CommandLineToArgvW
SHGetFileInfoW
SHGetFolderPathW
ShellExecuteW
SHChangeNotify
SHBrowseForFolderW

ole32

CoInitializeEx
CoUninitialize
CoTaskMemFree
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance

oleaut32

VariantClear
SysStringLen
SysAllocString
VariantInit
VariantChangeType
SysAllocStringByteLen
SysFreeString

shlwapi

SHAutoComplete
UrlUnescapeW
SHCreateStreamOnFileW
ord176

winhttp

WinHttpSendRequest
WinHttpOpenRequest
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpWriteData
WinHttpReadData
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpOpen
WinHttpGetProxyForUrl
WinHttpReceiveResponse
WinHttpConnect

Sections

.text
Size: 446KB - Virtual size: 446KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8183531671e102d00d23bd4e52243a0e

Headers

File Characteristics

Imports

version

comctl32

crypt32

wintrust

ntdll

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

winhttp

Sections

.text Size: 446KB - Virtual size: 446KB

.rdata Size: 138KB - Virtual size: 137KB

.data Size: 10KB - Virtual size: 20KB

.rsrc Size: 105KB - Virtual size: 104KB

.reloc Size: 33KB - Virtual size: 33KB

.text
Size: 446KB - Virtual size: 446KB

.rdata
Size: 138KB - Virtual size: 137KB

.data
Size: 10KB - Virtual size: 20KB

.rsrc
Size: 105KB - Virtual size: 104KB

.reloc
Size: 33KB - Virtual size: 33KB