6831e85f2b050c9dd8f5c0f454a33100

Sharing

Copy URL Twitter E-mail

General

Target

6831e85f2b050c9dd8f5c0f454a33100
Size

382KB
MD5

6831e85f2b050c9dd8f5c0f454a33100
SHA1

4863ba1300e1a9ac054a012708f62390b0ee4a7f
SHA256

c7ddf1567e7b01816af44c2a1aa63899957b78aaf6010e3e35b41f224e79f450
SHA512

32ed86583c2517e4220b43433e1be532cc3e2d2538b42a8912d37cc4c108fefb50bd0dce765b72040a53bb7c1d7206e8f7ce70389fb8c856a01e98ea14a062a8
SSDEEP

6144:sluRB1GqKNdprzxv4aKFn/09SmaCp18BxJF5iNVMk9fEiKZFwt8Pkot4vq+qk5C:sIRBVKT4aKN/ed8bjEMk9UFwOsot4C6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6831e85f2b050c9dd8f5c0f454a33100

Files

6831e85f2b050c9dd8f5c0f454a33100
.exe windows:5 windows x86 arch:x86

d401ef1e06f9d52d0c86c70904d0f50b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExA
ChangeServiceConfig2W
EnumDependentServicesW
CreateProcessWithLogonW
CryptEncrypt
SaferiIsExecutableFileType
GetFileSecurityW
AddAccessAllowedObjectAce
LsaGetUserName
RegisterServiceCtrlHandlerW
BuildExplicitAccessWithNameW
A_SHAFinal
SaferRecordEventLogEntry
LsaOpenTrustedDomain
CredReadDomainCredentialsW
MD5Update
GetNamedSecurityInfoExA
CryptDuplicateKey
LsaAddPrivilegesToAccount
CryptDuplicateHash
EncryptFileA
LogonUserW
AccessCheckByTypeResultList
SetSecurityDescriptorDacl
BuildTrusteeWithObjectsAndNameA
ReportEventW
EnumDependentServicesA
GetSidSubAuthorityCount
SystemFunction020
CredWriteW
LsaEnumerateAccountsWithUserRight
MD5Init
SetInformationCodeAuthzPolicyW
GetExplicitEntriesFromAclW
ObjectDeleteAuditAlarmW
SystemFunction035
SystemFunction040
SetInformationCodeAuthzLevelW
CreatePrivateObjectSecurity
StartServiceCtrlDispatcherA
CryptVerifySignatureW
GetEffectiveRightsFromAclW
GetMultipleTrusteeOperationA
LsaSetDomainInformationPolicy

msi

MsiRecordSetStringA
MsiDatabaseExportW
MsiRecordGetStringW
MsiDatabaseOpenViewA
MsiQueryProductStateW
MsiProvideQualifiedComponentExW
MsiDatabaseGenerateTransformW
MsiRecordGetStringA
MsiRecordGetInteger
MsiEnumComponentsA
MsiMessageBoxW
MsiRecordClearData
MsiGetFeatureCostW
MsiDatabaseCommit
MsiCollectUserInfoW
MsiSetInstallLevel
MsiOpenPackageW
MsiSetComponentStateW
MsiGetProductInfoW
MsiInstallProductW
MsiGetComponentStateA
MsiProvideQualifiedComponentW
MsiEnumProductsW
MsiGetFileVersionW
MsiSetTargetPathW
MsiEnumProductsA
MsiViewClose
MsiRecordIsNull
MsiEvaluateConditionW
MsiGetFeatureInfoW
MsiSetInternalUI
MsiSourceListForceResolutionW
MsiInstallMissingComponentW
MsiPreviewDialogA
MsiConfigureFeatureFromDescriptorA
MsiDatabaseMergeA
MsiUseFeatureExW
MsiGetPropertyW
MsiDecomposeDescriptorA
MsiDatabaseGenerateTransformA
MsiEnumFeaturesW
MsiGetComponentPathA
MsiSummaryInfoSetPropertyA
MsiOpenPackageExA
MsiGetMode

kernel32

FindFirstFileA
GetTickCount
RegisterWaitForInputIdle
CreateWaitableTimerA
RemoveDirectoryW
SetConsoleScreenBufferSize
GetCompressedFileSizeA
FindResourceExW
LocalShrink
SetCommMask
CreateEventA
EnumSystemCodePagesW
DeleteTimerQueueTimer
GetConsoleAliasA
SetLastError
UnlockFileEx
InvalidateConsoleDIBits
QueryMemoryResourceNotification
HeapReAlloc
GetComputerNameExA
SuspendThread
LZOpenFileW
GetFullPathNameW
LoadLibraryA
SetFirmwareEnvironmentVariableW
GetNumberFormatA
GetLocaleInfoW
GetSystemDefaultLangID
GetPrivateProfileStringA
GetSystemDirectoryW
GetConsoleWindow
_llseek
QueryPerformanceCounter
GetNumberFormatW
ReadConsoleInputA
ConvertFiberToThread
SwitchToThread
SetFileValidData
LocalAlloc
EnumResourceLanguagesA
VirtualAlloc
OutputDebugStringA
ExpandEnvironmentStringsW

oleaut32

LPSAFEARRAY_UserFree
VarI4FromI2
VarUI4FromBool
VarUI1FromDec
VarAbs
VariantInit
VariantChangeTypeEx
SafeArrayGetUBound
VarR8FromUI1
SafeArrayAllocData
VarBoolFromI8
VarDecDiv
LPSAFEARRAY_UserSize
VarR8FromStr
SafeArrayGetDim
VarDateFromUI8
VarUI8FromStr
VarCyFromI1
VarCyMul
VarInt
VarR8FromR4
SafeArrayPtrOfIndex
VarDateFromR8
VarCyFromI2
VarCyFromR8

ntdll

RtlpNtOpenKey
NtOpenEventPair
RtlCopyUnicodeString
RtlEnlargedUnsignedDivide
NtReadVirtualMemory
ZwQueryInformationProcess
fabs
RtlTimeToSecondsSince1980
_ftol
RtlRunDecodeUnicodeString
NtAreMappedFilesTheSame
DbgPrompt
NtQueryMultipleValueKey
wcspbrk
RtlQueryTimeZoneInformation
RtlPrefixUnicodeString
ZwFindAtom
ZwDisplayString
strstr
RtlLargeIntegerNegate
RtlAreAnyAccessesGranted
RtlDebugPrintTimes
ZwDelayExecution
NtPrivilegedServiceAuditAlarm
NtOpenThreadTokenEx

msvcrt40

_mbsncat
_pctype
_wspawnve
??_7bad_cast@@6B@
wcschr
?get@istream@@QAEAAV1@PADHD@Z
_strnset
??5istream@@QAEAAV0@AAF@Z
ceil
ungetwc
_wasctime
??0ofstream@@QAE@ABV0@@Z
??6ostream@@QAEAAV0@J@Z
_kbhit
??1bad_cast@@UAE@XZ
strcpy
?close@ofstream@@QAEXXZ
_mbscspn
?base@streambuf@@IBEPADXZ
?lockbuf@ios@@QAAXXZ
_lrotr
??_Gifstream@@UAEPAXI@Z
??_Distream_withassign@@QAEXXZ
__p__amblksiz
_abnormal_termination
__setusermatherr
_adj_fdivr_m16i
_wtoi
ferror
??0ostrstream@@QAE@PADHH@Z

sensapi

IsDestinationReachableW
IsDestinationReachableA
IsNetworkAlive

Sections

.text
Size: 173KB - Virtual size: 173KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 145KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 547KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d401ef1e06f9d52d0c86c70904d0f50b

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

msi

kernel32

oleaut32

ntdll

msvcrt40

sensapi

Sections

.text Size: 173KB - Virtual size: 173KB

.rdata Size: 145KB - Virtual size: 145KB

.data Size: 55KB - Virtual size: 547KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 173KB - Virtual size: 173KB

.rdata
Size: 145KB - Virtual size: 145KB

.data
Size: 55KB - Virtual size: 547KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 1KB - Virtual size: 1KB