6803c3b9e922cccd0a7024a0aa48efd0

Sharing

Copy URL Twitter E-mail

General

Target

6803c3b9e922cccd0a7024a0aa48efd0
Size

58KB
MD5

6803c3b9e922cccd0a7024a0aa48efd0
SHA1

4f346646abd776bf3104423cdf3f868911e49f58
SHA256

7b9c417d16cad16cd56502cd0c146e032d87d5b102fe410dafc9904a923edec5
SHA512

ce1154082125e8540026c279346db69b31722886622e91c12875ac3db4d83e2a93fb2235da08b8dfea67a38432be8428225922e0963b32cdaaddc49d2f614da2
SSDEEP

768:nrlFBi6hSTyC+fkNVLugaJW35hCDMBY4xoKmpmsTeIxzaQQ+kae1iz+WG/Sw19O:Rv10TIkvqtW35IIY4xWk+kaey+WCq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6803c3b9e922cccd0a7024a0aa48efd0

Files

6803c3b9e922cccd0a7024a0aa48efd0
.exe windows:5 windows x86 arch:x86

80cdfe020d6c331dfb1100d2dcd6aba7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

cfgmgr32

CM_Disconnect_Machine
CM_Enumerate_Classes_Ex
CM_Add_IDA
CM_Get_HW_Prof_FlagsA
CM_Get_HW_Prof_FlagsW
CM_Query_Arbitrator_Free_Size_Ex
CM_Open_Class_KeyW
CM_Get_Log_Conf_Priority_Ex
CMP_Report_LogOn
CM_Set_Class_Registry_PropertyA
CM_Get_Device_Interface_AliasW
CM_Create_DevNode_ExW
CM_Query_And_Remove_SubTreeW
CM_Query_Arbitrator_Free_Size
CM_Delete_Class_Key
CM_Get_Resource_Conflict_Count
CM_Delete_DevNode_Key_Ex
CM_Is_Dock_Station_Present_Ex
CM_Get_Device_ID_List_Size_ExW
CM_Set_DevNode_Problem_Ex
CM_Get_Version
CM_Enable_DevNode
CM_Register_Device_Interface_ExW
CM_Locate_DevNode_ExW
CM_First_Range
CM_Get_Hardware_Profile_InfoA
CM_Add_Range
CM_Query_Arbitrator_Free_Data_Ex
CM_Open_Class_Key_ExW

msvcrt40

_CIatan2
_getws
??_Gostream_withassign@@UAEPAXI@Z
_exit
??0istream_withassign@@QAE@XZ
sprintf
_loaddll
strcspn
tanh
_ismbcdigit
??0strstream@@QAE@ABV0@@Z
_mbsspnp
_execlp
??_7bad_typeid@@6B@
wcsrchr
_execvpe
??_Gbad_typeid@@UAEPAXI@Z
_dup
_wmktemp
_mkdir
_mbsnbcoll
_pctype
_wtempnam
_wpgmptr
_scalb
vswprintf
wcsxfrm
??0stdiostream@@QAE@PAU_iobuf@@@Z

mfcsubs

?SetAt@CString@@QAEXHG@Z
?GetNextAssoc@CMapStringToPtr@@QBEXAAPAU__POSITION@@AAVCString@@AAPAX@Z
??1CString@@QAE@XZ
?AfxLoadString@@YGHIPAGI@Z
?AfxExtractSubString@@YGHAAVCString@@PBGHG@Z
??YCString@@QAEABV0@G@Z
??4CString@@QAEABV0@G@Z
??0CString@@QAE@PBG@Z
?Append@CStringArray@@QAEHABV1@@Z
?ReleaseBuffer@CString@@QAEXH@Z
??8@YG_NPBGABVCString@@@Z
?SpanIncluding@CString@@QBE?AV1@PBG@Z
?FreeDataChain@CPlex@@QAEXXZ
?NewAssoc@CMapStringToPtr@@IAEPAUCAssoc@1@XZ
?Right@CString@@QBE?AV1@H@Z
??0CStringArray@@QAE@XZ
?InitHashTable@CMapStringToPtr@@QAEXIH@Z
??9@YG_NABVCString@@PBG@Z
?ConcatInPlace@CString@@IAEXHPBG@Z
?GetData@CStringArray@@QAEPAVCString@@XZ
?Collate@CString@@QBEHPBG@Z
?SafeStrlen@CString@@KGHPBG@Z
?InsertAt@CStringArray@@QAEXHPAV1@@Z
??O@YG_NABVCString@@0@Z
?Release@CString@@IAEXXZ
?Init@CString@@IAEXXZ
?AllocBuffer@CString@@IAEXH@Z

msvcp60

??_7?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@
?scan_not@?$ctype@G@std@@QBEPBGFPBG0@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?_Getcat@?$codecvt@DDH@std@@SAIXZ
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
?to_int_type@?$char_traits@G@std@@SAGABG@Z
??_F?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ
?underflow@?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@MAEGXZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
?min@?$numeric_limits@K@std@@SAKXZ
?_Nanv@?$_Ctr@O@std@@SAOO@Z
?_Getcat@?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIXZ
?exp@?$_Ctr@M@std@@SAMM@Z
?_Gninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
??0length_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
?in@?$codecvt@GDH@std@@QBEHAAHPBD1AAPBDPAG3AAPAG@Z
?underflow@?$basic_filebuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?is@?$ctype@G@std@@QBE_NFG@Z
??4?$complex@O@std@@QAEAAV01@ABV01@@Z

kernel32

ExitVDM
GlobalReAlloc
TlsAlloc
GetComputerNameA
SetConsoleLocalEUDC
GetConsoleAliasesA
SetConsoleMode
HeapCreate
WriteProfileSectionA
GetVersion
DeleteCriticalSection
VirtualAlloc
SetInformationJobObject
UnlockFileEx
SetComputerNameW
GetUserDefaultLCID
GetCommState
FindActCtxSectionStringA
GetSystemInfo
FindFirstFileExA
QueryPerformanceCounter
LoadLibraryA
AddLocalAlternateComputerNameA
Heap32First
EnumSystemLocalesA
DosPathToSessionPathW
SetConsoleCursorInfo

lz32

LZCreateFileW
GetExpandedNameA
GetExpandedNameW
LZOpenFileW
LZRead
LZSeek
LZDone
LZClose
LZCloseFile
LZStart
LZCopy
LZOpenFileA
CopyLZFile
LZInit

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

80cdfe020d6c331dfb1100d2dcd6aba7

Headers

DLL Characteristics

File Characteristics

Imports

cfgmgr32

msvcrt40

mfcsubs

msvcp60

kernel32

lz32

Sections

.text Size: 5KB - Virtual size: 4KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 17KB - Virtual size: 94KB

.rsrc Size: 19KB - Virtual size: 18KB

.reloc Size: 512B - Virtual size: 248B

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 17KB - Virtual size: 94KB

.rsrc
Size: 19KB - Virtual size: 18KB

.reloc
Size: 512B - Virtual size: 248B