4f65725667a78effc0e093da7a5f2afb

Sharing

Copy URL Twitter E-mail

General

Target

4f65725667a78effc0e093da7a5f2afb
Size

1.5MB
MD5

4f65725667a78effc0e093da7a5f2afb
SHA1

170125a27ad34837e44b260b0a4d6d31004e747e
SHA256

00db2177a6c2334f4dd064067e46adeab3c1f19c45ebacfea5076fed4eb82018
SHA512

f0916f75204862affe4fbe2baee27226a32db230e65b7aabdaf4b576b117a58b30d3aad122faf524db2e7d2d3a8606241c0af21d738cd6df179792522c182194
SSDEEP

24576:6KqzCxF2DrnPMc2gJt86IukPz8ULLD1w279pGRt/3y8/wV5om+6qVNBm:6KqzCI7Pog46g8qLK2xp+nwDoBhbm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4f65725667a78effc0e093da7a5f2afb

Files

4f65725667a78effc0e093da7a5f2afb
.exe windows:4 windows x86 arch:x86

627b79eaae03b0cadbcd9e3bf404dc51

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

closesocket
socket
WSAGetLastError
setsockopt
connect
sendto
recvfrom
recv
send
ntohl
accept
WSAStartup
gethostname
inet_addr
listen
inet_ntoa
ioctlsocket
gethostbyname
bind
htons
htonl
WSASetLastError
select
__WSAFDIsSet

kernel32

OpenMutexA
InitializeCriticalSection
DeleteCriticalSection
lstrcpyA
GetCurrentProcessId
GetFileSize
WriteFile
GetComputerNameA
SetFilePointer
FindClose
FindFirstFileA
SetEndOfFile
TerminateThread
OpenEventA
GetWindowsDirectoryA
GetLocalTime
SetEvent
GetVersionExA
DeviceIoControl
SetPriorityClass
InterlockedDecrement
WideCharToMultiByte
GetSystemDefaultLangID
LocalFree
LocalHandle
LocalAlloc
lstrcmpiA
OpenProcess
GetDriveTypeA
GetTempPathA
CreateDirectoryA
GetFileAttributesA
GetExitCodeThread
CreateMutexA
ReleaseMutex
TerminateProcess
FileTimeToSystemTime
FileTimeToLocalFileTime
GetProcessTimes
CopyFileA
lstrcatA
OpenFile
SetThreadPriority
GetThreadPriority
GetCurrentThread
ExitProcess
WritePrivateProfileStringA
GetPrivateProfileStringA
UnmapViewOfFile
FlushViewOfFile
MapViewOfFile
CreateFileMappingA
FindNextFileA
GetCommandLineA
GetShortPathNameA
LoadLibraryExA
lstrcpynA
IsDBCSLeadByte
SetWaitableTimer
CreateWaitableTimerA
CancelWaitableTimer
SetLastError
SetLocalTime
SetFileAttributesA
GetEnvironmentVariableA
GetTempFileNameA
GlobalMemoryStatus
WaitForMultipleObjects
WaitForSingleObject
GetVersion
DeleteFileA
OutputDebugStringA
GetCurrentProcess
FlushInstructionCache
lstrcmpA
InterlockedIncrement
GetModuleHandleA
SizeofResource
GetLogicalDriveStringsA
CreateEventA
LoadResource
SetVolumeLabelA
GetLocaleInfoW
SetConsoleCtrlHandler
GetExitCodeProcess
IsBadCodePtr
IsBadReadPtr
GetStringTypeW
GetStringTypeA
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetFullPathNameA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetStdHandle
SetHandleCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapSize
GetOEMCP
GetACP
TlsGetValue
TlsFree
TlsAlloc
CompareStringW
CompareStringA
GetCPInfo
LCMapStringW
LCMapStringA
FatalAppExitA
SetStdHandle
FlushFileBuffers
GetFileType
SetCurrentDirectoryA
SetEnvironmentVariableA
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
GetStartupInfoA
HeapReAlloc
HeapFree
HeapAlloc
GetSystemTime
GetTimeZoneInformation
RaiseException
ExitThread
TlsSetValue
CreateThread
RtlUnwind
InterlockedExchange
FormatMessageA
MoveFileA
GetModuleFileNameA
GetCurrentDirectoryA
GetDiskFreeSpaceA
MoveFileExA
LocalLock
LocalUnlock
GlobalLock
FindResourceA
GetSystemDirectoryA
Sleep
FreeResource
GlobalFree
GlobalHandle
GlobalAlloc
lstrlenW
lstrlenA
LockResource
GetLastError
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
GlobalUnlock
GetCurrentThreadId
CreateProcessA
CreateFileA
ReadFile
CloseHandle
LoadLibraryA
GetProcAddress

user32

EndPaint
CallWindowProcA
GetSysColor
FillRect
SetTimer
KillTimer
SendMessageA
LoadStringA
DestroyWindow
IsWindow
GetParent
GetClassNameA
SetWindowPos
SetWindowTextA
GetWindowLongA
RedrawWindow
GetDesktopWindow
ReleaseDC
GetDC
InvalidateRect
SetWindowLongA
GetFocus
GetClientRect
InvalidateRgn
CreateWindowExA
wsprintfA
SystemParametersInfoA
BlockInput
SetDlgItemTextA
ExitWindowsEx
keybd_event
GetDlgItem
ShowWindow
MessageBoxA
EndDialog
PostThreadMessageA
GetActiveWindow
PeekMessageA
DialogBoxIndirectParamA
RegisterClassExA
LoadCursorA
GetClassInfoExA
RegisterWindowMessageA
DefWindowProcA
GetWindow
CreateAcceleratorTableA
BeginPaint
GetWindowTextLengthA
GetWindowTextA
IsChild
SetFocus
ReleaseCapture
SetCapture
DispatchMessageA
OemToCharBuffA
CharToOemBuffA
IsWindowVisible
MsgWaitForMultipleObjectsEx
RegisterHotKey
SetForegroundWindow
EnableWindow
MsgWaitForMultipleObjects
CreateDialogIndirectParamA
TranslateMessage
FindWindowA
UnregisterDeviceNotification
GetSystemMetrics
SetActiveWindow
UnhookWindowsHookEx
GetWindowRect
SendInput
SetWindowsHookExA
UnregisterHotKey
GetMessageA
PostMessageA
CharNextA
PostQuitMessage
UpdateWindow
RegisterDeviceNotificationA
LoadIconA
GetDlgItemTextA
GetTopWindow
GetWindowThreadProcessId
EnumWindows

gdi32

GetDeviceCaps
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
DeleteObject
CreateSolidBrush
GetObjectA
GetStockObject
GetDIBits
RealizePalette
SelectPalette
CreateDCA

winspool.drv

EnumPrintersA

advapi32

CloseServiceHandle
QueryServiceStatus
RegCloseKey
RegNotifyChangeKeyValue
GetTokenInformation
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
GetLengthSid
CopySid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
StartServiceCtrlDispatcherA
ControlService
DeleteService
CreateServiceA
OpenThreadToken
SetServiceStatus
RegisterServiceCtrlHandlerA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
OpenSCManagerA
OpenServiceA
RegCreateKeyExA
RegQueryValueExA
StartServiceA
QueryServiceConfigA
ChangeServiceConfigA
RegRestoreKeyA
RegSaveKeyA
RegDeleteKeyA
RegEnumValueA
RegCreateKeyA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteValueA
RegOpenKeyA
CreateProcessAsUserA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetUserNameA
RevertToSelf
RegFlushKey
RegOpenKeyExA
RegSetValueExA

shell32

ShellExecuteExA
SHFileOperationA

ole32

CoInitializeEx
CoTaskMemAlloc
StringFromCLSID
CoCreateGuid
CoSetProxyBlanket
OleLockRunning
CLSIDFromProgID
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoRevokeClassObject
CoInitializeSecurity
CoTaskMemRealloc
CLSIDFromString
CoTaskMemFree
CoCreateInstance
CoRegisterClassObject
CoUninitialize
CoInitialize

oleaut32

CreateErrorInfo
VarUI4FromStr
SetErrorInfo
GetErrorInfo
RegisterTypeLi
LoadTypeLi
SafeArrayDestroy
VariantChangeType
LoadRegTypeLi
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
SafeArrayGetElement
SysAllocStringLen
OleCreateFontIndirect
SysStringLen
VariantClear
SysAllocString
SysFreeString

odbc32

ord60
ord11
ord4
ord66
ord65
ord70
ord56
ord67
ord40
ord54
ord12
ord76
ord30
ord72
ord31
ord8
ord18
ord20
ord19
ord24
ord75
ord39
ord50
ord7
ord41
ord16
ord36
ord29
ord9

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

wininet

FindCloseUrlCache
DeleteUrlCacheEntry
FindNextUrlCacheEntryA
FindFirstUrlCacheEntryA

setupapi

SetupDiDestroyDeviceInfoList
SetupDiSetClassInstallParamsA
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiChangeState

rpcrt4

UuidFromStringA

comctl32

InitCommonControlsEx

sensapi

IsNetworkAlive

mpr

WNetAddConnection2A

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 140KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 120KB - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

627b79eaae03b0cadbcd9e3bf404dc51

Headers

File Characteristics

Imports

wsock32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

odbc32

version

wininet

setupapi

rpcrt4

comctl32

sensapi

mpr

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 140KB - Virtual size: 136KB

.data Size: 120KB - Virtual size: 193KB

.rsrc Size: 16KB - Virtual size: 14KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 140KB - Virtual size: 136KB

.data
Size: 120KB - Virtual size: 193KB

.rsrc
Size: 16KB - Virtual size: 14KB