cd6318398e3bb65a5b42ac541dedacedb251c06c44a5ea770112a69f1624a9d9

Sharing

Copy URL Twitter E-mail

General

Target

cd6318398e3bb65a5b42ac541dedacedb251c06c44a5ea770112a69f1624a9d9
Size

1.7MB
MD5

d92901e30e96211ad934f8abd7352e8d
SHA1

5c4c7cd685d5da0b1abc4539e64caed7988e6e77
SHA256

cd6318398e3bb65a5b42ac541dedacedb251c06c44a5ea770112a69f1624a9d9
SHA512

de4245f48beb827bae5073dabd160178914987af0eafc61c94533056f3a14090437c969a7699128faaba64a716b135befb4b7c6736d01d6edebcc1132013cd2b
SSDEEP

24576:Rs80442i7WnUAgBVkJphhPk1wPpX1SeCPf7uShK1BoEs6ZliFdChzBy8:RqSUAgBVEhPkKhlSBfhK1BoEsFdChVD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cd6318398e3bb65a5b42ac541dedacedb251c06c44a5ea770112a69f1624a9d9

Files

cd6318398e3bb65a5b42ac541dedacedb251c06c44a5ea770112a69f1624a9d9
.exe windows:6 windows x86 arch:x86

11ec5b52013ee91a157c5ce079cdd6f3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSASetLastError
WSACleanup
WSAStartup
recv
connect
socket
send
shutdown
setsockopt
htons
WSAGetLastError
htonl
getservbyname
inet_ntoa
ntohs
gethostbyname
inet_addr
gethostbyaddr
closesocket
getservbyport

wininet

InternetGetConnectedState
HttpOpenRequestA
InternetWriteFile
InternetCrackUrlA
InternetOpenW
HttpEndRequestW
HttpAddRequestHeadersW
InternetConnectA
InternetCloseHandle
HttpSendRequestExW

kernel32

LoadLibraryW
GetSystemDirectoryW
GlobalUnlock
FreeLibrary
GetCurrentProcessId
GlobalLock
ResetEvent
LoadLibraryA
GetSystemDirectoryA
GlobalSize
Sleep
GetModuleFileNameW
GetProcAddress
InitializeCriticalSectionAndSpinCount
DecodePointer
RaiseException
GetVersion
InitializeCriticalSectionEx
lstrlenW
GetModuleHandleW
DeleteCriticalSection
SetEvent
GetLastError
CreateEventW
OpenEventW
WaitForSingleObject
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetTickCount
CloseHandle
OutputDebugStringW
SetEndOfFile
WriteConsoleW
SetEnvironmentVariableA
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
FindFirstFileExW
SetStdHandle
GetConsoleCP
GetOEMCP
IsValidCodePage
ReadConsoleW
GetConsoleMode
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
GetStdHandle
MultiByteToWideChar
GetCommandLineW
GetCurrentProcess
GetTempPathW
CreateToolhelp32Snapshot
GlobalAlloc
GlobalFree
OpenMutexW
GetCurrentThreadId
CreateDirectoryW
CreateFileW
GetFileAttributesW
SetFileAttributesW
FileTimeToSystemTime
DeleteFileW
MoveFileExW
CreateProcessW
CopyFileW
GetTempFileNameW
GetFileTime
ReadFile
SetLastError
WriteFile
SetFilePointer
DuplicateHandle
ExitThread
FormatMessageW
CreateThread
LocalFree
GetFileSize
Thread32Next
Thread32First
GetThreadTimes
OpenThread
OpenFileMappingW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
FindFirstFileW
FindNextFileW
RemoveDirectoryW
FindClose
OpenProcess
HeapFree
LocalAlloc
HeapAlloc
GetProcessHeap
lstrcpyW
CreateMutexW
ReleaseMutex
FlushFileBuffers
LoadLibraryExW
GetModuleFileNameA
OutputDebugStringA
GetEnvironmentVariableW
GetEnvironmentVariableA
SuspendThread
GetCurrentDirectoryA
ResumeThread
GetVersionExA
GetThreadContext
GetThreadId
ReadProcessMemory
VirtualQuery
GetSystemInfo
GetSystemTimeAsFileTime
GetProcessTimes
GetVersionExW
VirtualFree
VirtualAlloc
QueryPerformanceFrequency
QueryPerformanceCounter
GetDiskFreeSpaceExW
GetSystemTime
TryEnterCriticalSection
HeapSize
HeapReAlloc
TerminateProcess
lstrcatW
GetLocalTime
IsDebuggerPresent
SetUnhandledExceptionFilter
ExpandEnvironmentStringsW
SetWaitableTimer
CreateNamedPipeW
ConnectNamedPipe
DisconnectNamedPipe
GetOverlappedResult
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
WaitForSingleObjectEx
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
FreeLibraryAndExitThread
GetModuleHandleA
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
RtlUnwind
GetModuleHandleExW
ExitProcess
GetTimeZoneInformation
GetFileType

user32

TranslateMessage
PostThreadMessageW
SetTimer
DispatchMessageW
SetRectEmpty
GetSystemMetrics
KillTimer
wvsprintfW
LoadStringW
wsprintfW
DestroyIcon
UnloadKeyboardLayout
LoadKeyboardLayoutW
GetKeyboardLayoutList
SystemParametersInfoW
CreateWindowExW
DefWindowProcW
GetMessageW
PostMessageW
SetClipboardViewer
SendMessageW
RegisterClassExW
IsWindow
OpenClipboard
IsDialogMessageW
ChangeClipboardChain
CloseClipboard
PeekMessageW
GetClipboardData
IsClipboardFormatAvailable

advapi32

CryptAcquireContextW
CryptDecrypt
CryptSetKeyParam
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptReleaseContext
SetEntriesInAclW
BuildExplicitAccessWithNameW
GetNamedSecurityInfoW
SetSecurityDescriptorSacl
GetUserNameA
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
SetSecurityInfo
RegNotifyChangeKeyValue
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTokenInformation
LookupAccountSidW
OpenProcessToken
RegQueryValueExW
RegEnumValueW
RegSetValueExW
RegFlushKey
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumKeyW
RegOpenKeyW
GetLengthSid
AddAccessAllowedAceEx
SetNamedSecurityInfoW

ole32

CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

SysFreeString
SysAllocString

imm32

ImmDisableIME

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

GetProcessMemoryInfo

shlwapi

SHDeleteKeyW

shell32

SHFileOperationW
SHGetSpecialFolderPathW
SHGetFolderPathW
ShellExecuteW

Sections

.text
Size: 1007KB - Virtual size: 1006KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 485KB - Virtual size: 485KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 30KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 145KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

11ec5b52013ee91a157c5ce079cdd6f3

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wininet

kernel32

user32

advapi32

ole32

oleaut32

imm32

version

psapi

shlwapi

shell32

Sections

.text Size: 1007KB - Virtual size: 1006KB

.rdata Size: 485KB - Virtual size: 485KB

.data Size: 30KB - Virtual size: 136KB

.rsrc Size: 32KB - Virtual size: 31KB

.reloc Size: 145KB - Virtual size: 148KB

.text
Size: 1007KB - Virtual size: 1006KB

.rdata
Size: 485KB - Virtual size: 485KB

.data
Size: 30KB - Virtual size: 136KB

.rsrc
Size: 32KB - Virtual size: 31KB

.reloc
Size: 145KB - Virtual size: 148KB