1cae93696ec030be6317a338c3c8bc4274a53632c03ca60aab0bee59d361a380

Sharing

Copy URL Twitter E-mail

General

Target

1cae93696ec030be6317a338c3c8bc4274a53632c03ca60aab0bee59d361a380
Size

44KB
MD5

08ac00f4d05e68d8b5ab6870bf1f076e
SHA1

b8eb503bf860df5938df5cd59cea47392d129217
SHA256

1cae93696ec030be6317a338c3c8bc4274a53632c03ca60aab0bee59d361a380
SHA512

1da050749fb1e8f2917e550a86933b9f69cf4e972f1a166d0c24a2c9e1307fbad88aad36e7f1082d481c116f36e8e2b3327d630c136f02f6f465835fbd76db2e
SSDEEP

768:6QAMQ9VKxyrwDjJCPru5g193lY5/LoNqN/qCD:Pl4KxZuq5gso8NL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1cae93696ec030be6317a338c3c8bc4274a53632c03ca60aab0bee59d361a380

Files

1cae93696ec030be6317a338c3c8bc4274a53632c03ca60aab0bee59d361a380
.dll windows:4 windows x86 arch:x86

c2cabe8290915bcd7397e0dbd553cb6e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WideCharToMultiByte
GlobalFree
GlobalLock
WriteFile
MultiByteToWideChar
GlobalUnlock
GlobalAlloc
GlobalAddAtomW
GlobalDeleteAtom
ReadFile

user32

GetSysColor
GetActiveWindow
CopyRect
ReleaseCapture
GetCapture
KillTimer
SetPropW
SendMessageW
GetClientRect
CreateWindowExW
LoadStringW
RemovePropW
DestroyWindow
EnableMenuItem
GetParent
GetKeyState
GetDC
ReleaseDC
GetCursorPos
ChildWindowFromPoint
SetTimer
LoadCursorW
SetCapture
PostMessageW
CheckMenuItem
GetMessageTime
GetMenu
GetMenuState
GetWindowLongW
GetWindowRect
ScreenToClient
ClientToScreen
GetPropW

gdi32

SetPixel
SelectObject
DeleteObject
CreateCompatibleDC
CreateFontIndirectW
CreateCompatibleBitmap
GetDIBits
GetDeviceCaps
DeleteDC

mmfs2

ord585
ord493
ord169
ord541
ord476
ord724
ord520
ord343
ord756
ord620
ord762
ord170
ord286
ord1029
ord679
ord372
ord753
ord445
ord355
ord1076
ord1075
ord1072
ord34
ord39
ord50
ord176
ord24
ord18
ord47
ord1068
ord443
ord264

comctl32

ord17

msvcrt

calloc
realloc
malloc
??3@YAXPAX@Z
??2@YAPAXI@Z
_ftol
wcslen
wcscpy
wcscmp
_initterm
_adjust_fdiv
free

Exports

Exports

ContinueRunObject
CreateObject
CreateRunObject
DestroyRunObject
DisplayRunObject
EditorDisplay
EndApp
EndFrame
EnumElts
Free
GetActionCodeFromMenu
GetActionInfos
GetActionMenu
GetActionString
GetActionTitle
GetConditionCodeFromMenu
GetConditionInfos
GetConditionMenu
GetConditionString
GetConditionTitle
GetExpressionCodeFromMenu
GetExpressionInfos
GetExpressionMenu
GetExpressionString
GetExpressionTitle
GetHelpFileName
GetInfos
GetObjInfos
GetObjectRect
GetRunObjectDataSize
GetRunObjectFont
GetRunObjectInfos
GetRunObjectTextColor
GetTextAlignment
GetTextCaps
GetTextClr
GetTextFont
HandleRunObject
Initialize
LoadRunObject
MakeIconEx
PauseRunObject
ReInitRunObject
SaveRunObject
SelectPopup
SetEditSize
SetRunObjectFont
SetRunObjectTextColor
SetTextAlignment
SetTextClr
SetTextFont
StartApp
StartFrame
UpdateEditStructure
WToA
WindowProc

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c2cabe8290915bcd7397e0dbd553cb6e

Headers

File Characteristics

Imports

kernel32

user32

gdi32

mmfs2

comctl32

msvcrt

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 20KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 24KB - Virtual size: 20KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 1KB