656944423b1d1a0a6561b87baa63886f783d9d929e3a4d0eac0b49c8812dbf86

Sharing

Copy URL Twitter E-mail

General

Target

656944423b1d1a0a6561b87baa63886f783d9d929e3a4d0eac0b49c8812dbf86
Size

3.4MB
MD5

a9be436ada1bf319ff99064f16f07230
SHA1

f62172955ec55fa335cc32bb1714a58f3f9bde6e
SHA256

656944423b1d1a0a6561b87baa63886f783d9d929e3a4d0eac0b49c8812dbf86
SHA512

9153037c2b0d88203a91206dc7b3f1340671686b1ef94489f9bf0bf99fcd5bf5badaa113a4b4f8c09a2efdeed831de6d3c970ddc36dc95634a53f71bc010fa0b
SSDEEP

49152:A2/nU/TbwU2IqtWPaPidkhQQjqcvFwxinoIJMVlc0:pU/z2IqtWPahQQjqcvFwWoI0l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
656944423b1d1a0a6561b87baa63886f783d9d929e3a4d0eac0b49c8812dbf86

Files

656944423b1d1a0a6561b87baa63886f783d9d929e3a4d0eac0b49c8812dbf86
.exe windows:5 windows x86 arch:x86

Password: infected

ff9a6eecf51cd6e1f046c3cc236121f5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

_TrackMouseEvent
InitCommonControlsEx

winmm

sndPlaySoundA

winhttp

WinHttpSendRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpSetStatusCallback
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpOpenRequest
WinHttpSetDefaultProxyConfiguration
WinHttpCrackUrl
WinHttpReceiveResponse
WinHttpReadData
WinHttpSetCredentials
WinHttpAddRequestHeaders
WinHttpSetOption

ws2_32

WSASetLastError
gethostbyname
WSCEnumProtocols
WSCGetProviderPath
socket
htons
WSAGetLastError
select
inet_addr
inet_ntoa
connect
WSAIoctl
ioctlsocket
closesocket
WSARecv

kernel32

CloseHandle
GetCurrentProcessId
CreateThread
GetFileAttributesA
WaitForSingleObjectEx
GetProcessTimes
TerminateThread
GetExitCodeProcess
CreateProcessA
ReadFile
GetExitCodeThread
ResumeThread
GetFileSize
SetFilePointer
WriteFile
GetVersionExA
OpenFile
FileTimeToSystemTime
GetSystemTime
GetFullPathNameA
lstrcmpA
InitializeCriticalSectionAndSpinCount
GetShortPathNameA
RemoveDirectoryA
SetFileAttributesA
FindClose
CreateFileMappingA
WinExec
OpenFileMappingA
lstrcpyW
GetSystemDefaultLangID
HeapReAlloc
CreateFileA
GlobalMemoryStatus
SetPriorityClass
FindFirstFileW
GetLocaleInfoA
MoveFileExA
lstrcpynA
SetEndOfFile
HeapAlloc
HeapFree
GetTimeFormatA
GetCurrentThread
GetProcessHeap
ExpandEnvironmentStringsA
GetWindowsDirectoryA
WideCharToMultiByte
ReleaseMutex
TerminateProcess
GetTimeZoneInformation
GetEnvironmentVariableA
FlushFileBuffers
CreateDirectoryA
InterlockedExchange
SetCurrentDirectoryA
GetStartupInfoA
FindFirstFileA
lstrcmpiA
GetThreadLocale
CopyFileA
OpenMutexA
ProcessIdToSessionId
WritePrivateProfileStringA
MoveFileA
GlobalMemoryStatusEx
OpenEventA
GetProfileStringA
GetDiskFreeSpaceA
SetProcessWorkingSetSize
GetSystemInfo
SetEnvironmentVariableA
FindNextFileA
WriteProfileStringA
CreateMutexA
FindNextFileW
GetCurrentDirectoryA
GetFileTime
GetVersion
DeleteFileW
GetFileInformationByHandle
SetFileAttributesW
AreFileApisANSI
DeleteFileA
LocalFileTimeToFileTime
SystemTimeToTzSpecificLocalTime
TlsAlloc
TlsGetValue
RtlUnwind
RaiseException
GetCommandLineA
HeapSize
GetFileType
ExitProcess
GetModuleHandleW
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ExitThread
DuplicateHandle
DeleteCriticalSection
FindFirstChangeNotificationA
WaitForMultipleObjects
FindNextChangeNotification
LocalAlloc
LoadLibraryA
ResetEvent
GetProcAddress
GetSystemDirectoryA
LocalReAlloc
GetSystemPowerStatus
OpenProcess
GetDriveTypeA
FindCloseChangeNotification
QueryDosDeviceA
CompareFileTime
GetCurrentProcess
SystemTimeToFileTime
GlobalAddAtomA
FreeLibrary
UnmapViewOfFile
MapViewOfFile
GlobalDeleteAtom
GetCurrentThreadId
GetModuleFileNameA
SetLastError
GetVolumeInformationA
InitializeCriticalSection
lstrcpyA
LocalFree
GetTempPathA
GetModuleHandleA
DeviceIoControl
GetLocalTime
GetPrivateProfileStringA
GetTempFileNameA
EnterCriticalSection
GetLastError
MultiByteToWideChar
lstrcatA
CreateFileW
LeaveCriticalSection
CreateEventA
Sleep
GetDateFormatA
FormatMessageA
GetTickCount
SetEvent
WaitForSingleObject
InterlockedDecrement
InterlockedIncrement
lstrlenA
TlsSetValue
TlsFree
HeapCreate
VirtualFree
VirtualAlloc
GetStdHandle
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
SetHandleCount
GetConsoleCP
GetConsoleMode
SetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
ReadProcessMemory

user32

SetSystemCursor
SendInput
IsIconic
CloseWindowStation
CopyImage
GetParent
AttachThreadInput
CreateCursor
GetProcessWindowStation
FindWindowExA
GetUserObjectSecurity
EnumWindows
GetCapture
GetWindowTextA
OpenWindowStationA
SetCursorPos
BringWindowToTop
RedrawWindow
DestroyCursor
EnumChildWindows
PostMessageA
EqualRect
GetWindowThreadProcessId
MoveWindow
GetWindowInfo
GetForegroundWindow
wsprintfW
PostThreadMessageA
GetWindowLongA
RegisterWindowMessageA
RegisterClassA
ModifyMenuA
RegisterHotKey
SetDlgItemTextA
DestroyIcon
DialogBoxParamA
GetDlgItemTextA
LoadCursorA
SetMenuItemInfoA
CharLowerA
CharUpperA
wsprintfA
PeekMessageA
ClientToScreen
SetCursor
GetMessageA
CloseClipboard
SetTimer
GetWindowRect
OpenDesktopA
RegisterClassExA
SendDlgItemMessageA
TrackPopupMenu
SetCapture
KillTimer
DrawTextA
SetForegroundWindow
LoadIconA
OpenInputDesktop
GetClientRect
ExitWindowsEx
SetFocus
CloseDesktop
SendMessageA
BeginPaint
GetDC
TranslateMessage
ChildWindowFromPoint
GetAsyncKeyState
InvalidateRect
CreateWindowExA
ReleaseDC
EmptyClipboard
GetDlgItem
EndDialog
DefWindowProcA
SetWindowPos
GetCursorPos
GetMenuItemInfoA
CheckDlgButton
ShowWindow
CreatePopupMenu
IsDlgButtonChecked
SwitchDesktop
SetMenuInfo
DispatchMessageA
OpenClipboard
SystemParametersInfoA
ReleaseCapture
GetSystemMetrics
IsWindowVisible
InsertMenuA
SetWindowTextA
LoadImageA
SendMessageW
UpdateWindow
SetWinEventHook
GetWindowTextW
BlockInput
IsWindow
DestroyWindow
FindWindowA
DestroyMenu
UnregisterHotKey
CallWindowProcA
EnableWindow
GetClassNameA
SetProcessWindowStation
ScreenToClient
EndPaint
SetActiveWindow
DrawIconEx

gdi32

BitBlt
DeleteDC
CreateFontA
GetDeviceCaps
StretchBlt
CreateHalftonePalette
CreatePalette
CreateCompatibleDC
RealizePalette
GetDIBColorTable
GetObjectA
GetTextExtentPoint32A
SetTextColor
SetBkColor
SetBkMode
DeleteObject
SelectObject
CreatePen
RoundRect
GetStockObject
SelectPalette
CreateSolidBrush

winspool.drv

ReadPrinter
FreePrinterNotifyInfo
DeletePrinterConnectionW
EnumPrintersW
DeletePrinter
AddPrinterConnectionA
GetJobW
FindFirstPrinterChangeNotification
ClosePrinter
DeletePrinterKeyW
FindNextPrinterChangeNotification
AddPrinterA
OpenPrinterW
FindClosePrinterChangeNotification
DeletePrinterDataW
EndDocPrinter

advapi32

RegOpenKeyA
RegFlushKey
ControlService
GetUserNameA
QueryServiceConfigA
FreeSid
IsValidSid
OpenSCManagerA
GetSecurityDescriptorOwner
AllocateAndInitializeSid
QueryServiceStatus
ReportEventA
SetSecurityDescriptorDacl
ChangeServiceConfigA
LookupAccountNameW
StartServiceA
InitializeSecurityDescriptor
DeregisterEventSource
DuplicateToken
LookupAccountSidA
EnumDependentServicesA
EqualSid
GetTokenInformation
RegDeleteKeyA
RegCloseKey
OpenProcessToken
RegSetValueExA
RegQueryValueExA
RegCreateKeyA
LookupPrivilegeValueA
RegCreateKeyExA
RegOpenKeyExA
DuplicateTokenEx
ImpersonateLoggedOnUser
RegDeleteValueA
RegEnumValueA
RevertToSelf
RegNotifyChangeKeyValue
RegEnumKeyA
AdjustTokenPrivileges
RegEnumKeyExA
RegQueryInfoKeyA
LogonUserA
CreateProcessAsUserA
OpenServiceA
CloseServiceHandle
RegisterEventSourceA
GetSidSubAuthority
DeleteService
OpenThreadToken
GetSidSubAuthorityCount

shell32

SHGetDesktopFolder
Shell_NotifyIconA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA
SHGetMalloc

ole32

GetRunningObjectTable
CreateClassMoniker
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoCreateGuid

oleaut32

SysFreeString
VariantInit
SysAllocString
VariantClear

oleacc

AccessibleObjectFromEvent

Sections

.text
Size: 762KB - Virtual size: 762KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 180KB - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 149KB - Virtual size: 277KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 632KB - Virtual size: 636KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

ff9a6eecf51cd6e1f046c3cc236121f5

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

winmm

winhttp

ws2_32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

oleacc

Sections

.text Size: 762KB - Virtual size: 762KB

.rdata Size: 180KB - Virtual size: 179KB

.data Size: 149KB - Virtual size: 277KB

.rsrc Size: 1.7MB - Virtual size: 1.7MB

.reloc Size: 632KB - Virtual size: 636KB

.text
Size: 762KB - Virtual size: 762KB

.rdata
Size: 180KB - Virtual size: 179KB

.data
Size: 149KB - Virtual size: 277KB

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

.reloc
Size: 632KB - Virtual size: 636KB