4cf82ffc204fe3aa2c52681c5a3ffd24

Sharing

Copy URL Twitter E-mail

General

Target

4cf82ffc204fe3aa2c52681c5a3ffd24
Size

866KB
MD5

4cf82ffc204fe3aa2c52681c5a3ffd24
SHA1

b3017de6d2514ccd8b1c7dc0807db04298e788e3
SHA256

5d5fa698cc6c7f3b690e2d51f7564c3f3f4b5affd9e8792f79aafe343bb17827
SHA512

99983245e1e99de73911815bd7722d0d56853d5105192252a4950aaf6ea3cc107c91f75c9e299aad1198855bc75e7e7d469f6677ffe15defa4d56e1835fd309f
SSDEEP

24576:5eGLYoGNf0FZKeu1p7A0XlQshIrwR30BlW9wMO:4GcFNMFsv1pUkhI0REBaU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4cf82ffc204fe3aa2c52681c5a3ffd24

Files

4cf82ffc204fe3aa2c52681c5a3ffd24
.exe windows:5 windows x86 arch:x86

e0d1b46ebd4d0f961b607025db304fb5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

catsrvut

??1CComPlusComponent@@UAE@XZ
??4CComPlusInterface@@QAEAAV0@ABV0@@Z
SysprepComplus
??_7CComPlusInterface@@6B@
??_7CComPlusObject@@6B@
DllGetClassObject
??1CComPlusInterface@@UAE@XZ
??0CComPlusMethod@@QAE@ABV0@@Z
RegDBRestore
ManagedRequestW
SysprepComplus2
??_7CComPlusComponent@@6B@
CGMIsAdministrator
WinlogonHandlePendingInfOperations
??_7CComPlusMethod@@6B@
RunMTSToCom
??0CComPlusInterface@@QAE@ABV0@@Z
QueryUserDllW
StartMTSTOCOM
??4CComPlusMethod@@QAEAAV0@ABV0@@Z
??0CComPlusObject@@QAE@ABV0@@Z
FindAssemblyModulesW
??0CComPlusComponent@@QAE@ABV0@@Z
??4CComPlusComponent@@QAEAAV0@ABV0@@Z
??4CComPlusObject@@QAEAAV0@ABV0@@Z
??4CComPlusTypelib@@QAEAAV0@ABV0@@Z
RegDBBackup
COMPlusUninstallActionW
?GetITypeLib@CComPlusTypelib@@QAEPAUITypeLib@@XZ

mmcbase

??0CEventBuffer@@QAE@XZ
?MMCErrorBox@@YGHVSC@mmcerror@@I@Z
?s_dwMainThreadID@SC@mmcerror@@0KA
?SetHinst@SC@mmcerror@@SGXPAUHINSTANCE__@@@Z
?FatalError@SC@mmcerror@@QBEXXZ
??0?$CEventLock@UAppEvents@@@@QAE@XZ
?ScFromMMC@@YG?AVSC@mmcerror@@J@Z
??1?$CEventLock@UAppEvents@@@@QAE@XZ
?Unlock@CEventBuffer@@QAEXXZ
?FormatErrorIds@@YGXIVSC@mmcerror@@IPAG@Z
?GetEventBuffer@@YGAAVCEventBuffer@@XZ
?s_pDispatcher@CConsoleEventDispatcherProvider@@0PAVCConsoleEventDispatcher@@A
?Clear@SC@mmcerror@@QAEXXZ
??9SC@mmcerror@@QBE_NABV01@@Z
?ToHr@SC@mmcerror@@QBEJXZ
??4CEventBuffer@@QAEAAV0@ABV0@@Z
?GetHWnd@SC@mmcerror@@SGPAUHWND__@@XZ
??4CMMCStrongReferences@@QAEAAV0@ABV0@@Z
??8SC@mmcerror@@QBE_NABV01@@Z
?GetSingletonObject@CMMCStrongReferences@@CGAAV1@XZ
??0CEventBuffer@@QAE@ABV0@@Z
?InternalRelease@CMMCStrongReferences@@AAEKXZ
?AddRef@CMMCStrongReferences@@SGKXZ
?IsError@SC@mmcerror@@QBE_NXZ
??_FSC@mmcerror@@QAEXXZ
??0CMMCStrongReferences@@AAE@XZ
?GetCode@SC@mmcerror@@QBEJXZ
?InternalAddRef@CMMCStrongReferences@@AAEKXZ
?MMCUpdateRegistry@@YGJHPBVCObjectRegParams@@PBVCControlRegParams@@@Z
?ScFlushPostponed@CEventBuffer@@AAE?AVSC@mmcerror@@XZ
??7SC@mmcerror@@QBEHXZ

advapi32

SystemFunction020
StopTraceA
CryptDestroyHash
CryptGetDefaultProviderA
ConvertStringSDToSDRootDomainW
LsaLookupNames2
SetNamedSecurityInfoExW
SetFileSecurityW
LookupAccountSidA
LogonUserA
EqualPrefixSid
SetSecurityInfoExA
RegOpenKeyExA
CredReadW
ConvertSDToStringSDRootDomainA
SystemFunction024
SetSecurityInfo
ConvertSecurityDescriptorToAccessW
CryptGetUserKey
QueryServiceStatusEx
GetTrusteeNameA
OpenEncryptedFileRawA
NotifyChangeEventLog
FileEncryptionStatusW
GetManagedApplicationCategories
I_ScSetServiceBitsA
DeregisterEventSource
CryptHashSessionKey
MD5Final
RegOpenCurrentUser
SetServiceBits
GetTrusteeFormA
MD5Update
SystemFunction026
TreeResetNamedSecurityInfoW
GetFileSecurityW
SystemFunction003
WriteEncryptedFileRaw
GetNamedSecurityInfoExW
QueryRecoveryAgentsOnEncryptedFile

mapi32

FBadRestriction@4
GetTnefStreamCodepage
MAPIDetails
SzFindLastCh@8
ScUNCFromLocalPath@12
MAPIDeleteMail
FGetComponentPath@20
DeregisterIdleRoutine@4
FreeProws@4
FtDivFtBogus@20
InstallFilterHook@4
cmc_look_up
__ValidateParameters@8
MAPIDeinitIdle@0
HrSetOmiProvidersFlagsInvalid@4
FtAdcFt@20
FBadEntryList@4
HrAddColumnsEx@20
SwapPword@8
LAUNCHWIZARD
MAPIInitialize@4
MAPIUninitialize@0
LpValFindProp@12
OpenIMsgOnIStg@44
HrAddColumns@16
OpenTnefStreamEx@32
BMAPISendMail
cmc_logon
SzFindSz@8
MNLS_lstrcpyW@8
FPropCompareProp@12
MAPIUninitialize
ScCreateConversationIndex@16
MAPIOpenLocalFormContainer@4

kernel32

FileTimeToLocalFileTime
GlobalFlags
ReplaceFileW
CreateToolhelp32Snapshot
BaseUpdateAppcompatCache
GetTapeStatus
SetThreadLocale
CommConfigDialogW
GetPrivateProfileSectionA
EnumSystemLanguageGroupsW
SetFirmwareEnvironmentVariableW
SleepEx
GetConsoleAliasExesW
HeapValidate
GetConsoleOutputCP
VirtualQueryEx
AddConsoleAliasA
GetNamedPipeHandleStateA
lstrcmpA
GetComputerNameExA
EnterCriticalSection
GetLogicalDrives
_llseek
LeaveCriticalSection
GetConsoleCursorMode
GetCommandLineA
EndUpdateResourceW
LocalCompact
CloseHandle
LZOpenFileA
ReplaceFileA
SetStdHandle
FoldStringW
SetTapeParameters
SetEnvironmentVariableA
GetSystemWindowsDirectoryA
VirtualQuery
InterlockedExchangeAdd
GetProfileStringW
DeleteCriticalSection
VirtualAlloc
ContinueDebugEvent
GetThreadSelectorEntry
LoadLibraryA
GetVolumePathNameW
NlsGetCacheUpdateCount
GetStringTypeW
GetProcessAffinityMask
GetEnvironmentStringsA
HeapSize
CreateDirectoryExW
ReadConsoleOutputA
GetProcessHeap
Module32FirstW
GetBinaryTypeA
TransactNamedPipe
OpenConsoleW
UTRegister
GetProcessVersion
LocalLock
WaitForDebugEvent
WritePrivateProfileSectionA
GetCompressedFileSizeW
FindCloseChangeNotification
GetCurrentThread

crtdll

_mbsnbcnt
isalpha
ispunct
_strnicmp
_close
wcsftime
wcsstr
strtod
_toupper
memchr
_get_osfhandle
fabs
_mbscmp
_fmode_dll
_gcvt
_ismbcalpha
strncpy
_expand
iswctype
atof
strchr
_getdiskfree
_mbctokata
_fileinfo_dll
getchar
_CItanh
_wcsdup
_CIlog

comctl32

LBItemFromPt
ImageList_Add
ImageList_DragMove
FlatSB_GetScrollPos
ImageList_GetBkColor
ShowHideMenuCtl
CreateStatusWindowA
PropertySheetW
ImageList_SetIconSize
MakeDragList
DrawStatusTextW
ImageList_DragLeave
ImageList_DrawIndirect
ImageList_DrawEx
CreateToolbar
FlatSB_GetScrollRange
ImageList_AddIcon
DrawStatusText
ImageList_BeginDrag
ImageList_GetIconSize
ImageList_GetFlags
MenuHelp
_TrackMouseEvent
FlatSB_SetScrollPos
InitCommonControlsEx
ImageList_Remove
ImageList_AddMasked
InitCommonControls
FlatSB_ShowScrollBar
ImageList_Read
FlatSB_SetScrollProp
ImageList_SetOverlayImage
ImageList_Duplicate
CreateUpDownControl
CreatePropertySheetPage
GetMUILanguage
ImageList_LoadImageW
ImageList_ReplaceIcon
DllGetVersion
ImageList_GetImageRect
DrawInsert
ImageList_LoadImage

Sections

.text
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 330KB - Virtual size: 330KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 361KB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e0d1b46ebd4d0f961b607025db304fb5

Headers

DLL Characteristics

File Characteristics

Imports

catsrvut

mmcbase

advapi32

mapi32

kernel32

crtdll

comctl32

Sections

.text Size: 171KB - Virtual size: 170KB

.rdata Size: 330KB - Virtual size: 330KB

.data Size: 361KB - Virtual size: 1.8MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 972B

.text
Size: 171KB - Virtual size: 170KB

.rdata
Size: 330KB - Virtual size: 330KB

.data
Size: 361KB - Virtual size: 1.8MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 972B