563bea8d119dbd1dbb6b655e76bdd11f

Sharing

Copy URL Twitter E-mail

General

Target

563bea8d119dbd1dbb6b655e76bdd11f
Size

252KB
MD5

563bea8d119dbd1dbb6b655e76bdd11f
SHA1

6972d397d81570e1ce3de4c45cd78cdd89cd04fb
SHA256

0eeb8153465c9532f10c65480869b5c799db1119e16de6d5796200b28567c1c3
SHA512

23024ee4ad8b09a43f8a9d97b8747d3096eae693430edb10d3054d94c71803a5dbc3eb78443574d2c96d1616715dc86323e32326b342e4185481270c9548a5a8
SSDEEP

6144:G1rwii7st1Y+S6pYQCR+gs74dVGwG+oISthMZzLkV:GT+sH4wgsLMFkV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
563bea8d119dbd1dbb6b655e76bdd11f

Files

563bea8d119dbd1dbb6b655e76bdd11f
.exe windows:4 windows x86 arch:x86

729e2b8cebe03557fa750328914aa7f2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

ws2_32

WSACleanup
inet_ntoa
gethostbyname
gethostname
WSAStartup

kernel32

GetProcessHeap
RaiseException
CreateMutexW
CreateDirectoryW
RemoveDirectoryW
SetErrorMode
GetExitCodeThread
MoveFileW
GetSystemTime
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
GetSystemDirectoryW
FileTimeToSystemTime
GlobalAlloc
lstrlenW
lstrcmpiW
DosDateTimeToFileTime
ExpandEnvironmentStringsA
WaitForSingleObject
CreateEventW
LoadResource
FindResourceW
FreeLibrary
LocalFree
lstrlenA
OpenEventW
SystemTimeToFileTime
GetLocalTime
GetModuleHandleW
GetTempPathW
lstrcmpW
GetProcAddress

user32

GetForegroundWindow
MessageBoxW

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
CreateProcessAsUserW
SetSecurityInfo
SetEntriesInAclW
BuildExplicitAccessWithNameW
GetSecurityDescriptorDacl
GetSecurityInfo
DuplicateTokenEx
RegQueryValueExA
RegOpenKeyExA
DeregisterEventSource
ReportEventW
RegisterEventSourceW
GetTokenInformation
OpenProcessToken
ControlService
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
StartServiceW
QueryServiceConfigW
ImpersonateLoggedOnUser
RevertToSelf
SetThreadToken
LookupAccountSidW
GetUserNameW

shell32

ShellExecuteW

shlwapi

PathGetDriveNumberW

quartz

AMGetErrorTextA
DllUnregisterServer
DBToAmpFactor
AMGetErrorTextW
DllRegisterServer
AmpFactorToDB
DllCanUnloadNow

dsauth

StoreSetSearchSubTree
StoreInitHandle

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.o
Size: 1KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.NCfFn
Size: 5KB - Virtual size: 558KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.HFHP
Size: 81KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.G
Size: 1KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ReMw
Size: 2KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 6KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.BmRgDG
Size: 135KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

729e2b8cebe03557fa750328914aa7f2

Headers

File Characteristics

Imports

version

ws2_32

kernel32

user32

advapi32

shell32

shlwapi

quartz

dsauth

Sections

.text Size: 13KB - Virtual size: 12KB

.o Size: 1KB - Virtual size: 69KB

.rdata Size: 3KB - Virtual size: 21KB

.NCfFn Size: 5KB - Virtual size: 558KB

.HFHP Size: 81KB - Virtual size: 169KB

.G Size: 1KB - Virtual size: 47KB

.ReMw Size: 2KB - Virtual size: 122KB

.data Size: 6KB - Virtual size: 160KB

.BmRgDG Size: 135KB - Virtual size: 196KB

.rsrc Size: 2KB - Virtual size: 2KB

.text
Size: 13KB - Virtual size: 12KB

.o
Size: 1KB - Virtual size: 69KB

.rdata
Size: 3KB - Virtual size: 21KB

.NCfFn
Size: 5KB - Virtual size: 558KB

.HFHP
Size: 81KB - Virtual size: 169KB

.G
Size: 1KB - Virtual size: 47KB

.ReMw
Size: 2KB - Virtual size: 122KB

.data
Size: 6KB - Virtual size: 160KB

.BmRgDG
Size: 135KB - Virtual size: 196KB

.rsrc
Size: 2KB - Virtual size: 2KB