669bca0c50f41024fe76c065f48f8de0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

669bca0c50f41024fe76c065f48f8de0.exe
Size

4.5MB
MD5

669bca0c50f41024fe76c065f48f8de0
SHA1

e2d5111d6c6f700dd10590cf532d60c666291149
SHA256

7faf9f070116053e441d83bdb88c8209cb9d3c30ba2133bc9d8245df4b643dbc
SHA512

c1c39c35775288a15c8b391d4d0a0cf1ab53b10490e06f042ae146e35c4e64f9cbe20129a85c578ece682f0c879bca1d68d2b7975e84e68d9ac738614a057b63
SSDEEP

49152:5MsqVvPCPXnBu+PJqBT61oquzqWntWejTftVvhX0fZDXezKjjAq5LYsS85aCRQut:ypf+3/59VHpRTboT7ei/HoF2SHpcBsPf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
669bca0c50f41024fe76c065f48f8de0.exe

Files

669bca0c50f41024fe76c065f48f8de0.exe
.exe windows:6 windows x86 arch:x86

098491521a1b9a4483726cf667edd9ea

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceMessage
RegCloseKey
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
SetServiceStatus
RegOpenKeyExW
RegQueryValueExW
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
FreeSid
RegDeleteKeyW
RegCreateKeyExW
CheckTokenMembership
AllocateAndInitializeSid
ConvertStringSidToSidW
RegEnumKeyW
RegQueryInfoKeyW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSetKeySecurity
RegDeleteValueW
RegSetValueExW
CryptGenRandom
CryptAcquireContextW
CryptReleaseContext
DeregisterEventSource
ReportEventW
RegisterEventSourceW
EqualSid
OpenProcessToken
ConvertSidToStringSidW
LookupAccountNameW
RegEnumKeyExW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptDestroyKey
CryptEncrypt
CryptDecrypt
CryptImportKey
CryptSignHashA
CryptVerifySignatureA
CryptExportKey
CryptGenKey
RegOpenKeyW
RegCreateKeyW
GetTokenInformation

kernel32

DeleteTimerQueue
Sleep
InterlockedCompareExchange
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
GetCurrentThreadId
DeleteTimerQueueEx
ReleaseSemaphore
LoadLibraryW
SetThreadPriority
GetThreadPriority
DuplicateHandle
GetCurrentProcess
GetCurrentThread
OpenThread
GetTickCount
ReleaseMutex
CreateSemaphoreW
IsWow64Process
OpenMutexW
CreateMutexW
ExpandEnvironmentStringsW
GetTimeFormatW
GetDateFormatW
FileTimeToSystemTime
SetFileAttributesW
GetFileAttributesW
ChangeTimerQueueTimer
CreateDirectoryW
WriteFile
CreateFileW
GetFileSizeEx
QueueUserWorkItem
ReadFile
GetFileSize
MultiByteToWideChar
OpenProcess
GetCurrentProcessId
UnregisterWaitEx
CompareFileTime
SystemTimeToFileTime
GetSystemTimeAsFileTime
lstrlenW
GetSystemTime
DebugBreak
GetPrivateProfileStringW
lstrcmpiW
GetPrivateProfileSectionW
InitializeCriticalSection
SetLastError
VirtualProtect
VirtualFree
VirtualAlloc
GetLocalTime
MoveFileExW
CopyFileW
FlushFileBuffers
DeleteFileW
SetFilePointer
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetComputerNameW
DeviceIoControl
GetLocaleInfoW
GetSystemDirectoryW
LCMapStringW
WideCharToMultiByte
GetVersionExA
GetVersion
UnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedExchange
SetEvent
GetModuleHandleExW
GetProcAddress
CreateTimerQueue
CreateTimerQueueTimer
CreateEventW
RegisterWaitForSingleObject
RaiseException
InterlockedDecrement
GetVersionExW
InterlockedIncrement
GetLastError
HeapSetInformation
DeleteTimerQueueTimer
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
LocalFree
LocalAlloc
FreeLibrary
CloseHandle
DecodePointer
EncodePointer
HeapFree
GetProcessHeap
HeapAlloc
GetSystemInfo

msvcrt

srand
_itow
time
rand
malloc
_controlfp
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
wcsncmp
_wcsnicmp
wcschr
memmove
swscanf
_wcsicmp
_purecall
sscanf
memcpy
memset
_vsnwprintf
free
_wtof
_wtoi
_ui64tow

rpcrt4

UuidFromStringW
I_RpcMapWin32Status
RpcServerRegisterIfEx
RpcServerUseProtseqEpW
RpcServerListen
RpcServerUnregisterIf
RpcMgmtStopServerListening
I_RpcBindingInqLocalClientPID
RpcServerInqCallAttributesW
RpcRaiseException
RpcStringFreeW
RpcRevertToSelfEx
UuidToStringW
NdrServerCall2
UuidCreate
RpcImpersonateClient

ntdll

RtlUnwind

user32

CharPrevW
CharNextW

ole32

CoInitializeEx
CoUninitialize
CoInitializeSecurity

Sections

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 489KB - Virtual size: 489KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 189KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

098491521a1b9a4483726cf667edd9ea

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

rpcrt4

ntdll

user32

ole32

Sections

.text Size: 3.8MB - Virtual size: 3.8MB

.data Size: 489KB - Virtual size: 489KB

.rsrc Size: 25KB - Virtual size: 25KB

.reloc Size: 189KB - Virtual size: 192KB

.text
Size: 3.8MB - Virtual size: 3.8MB

.data
Size: 489KB - Virtual size: 489KB

.rsrc
Size: 25KB - Virtual size: 25KB

.reloc
Size: 189KB - Virtual size: 192KB