7347ea62ac4c7dcd1f64022338dcfd75

Sharing

Copy URL Twitter E-mail

General

Target

7347ea62ac4c7dcd1f64022338dcfd75
Size

186KB
MD5

7347ea62ac4c7dcd1f64022338dcfd75
SHA1

f71213fe49c368e6af58edb701661490100857a3
SHA256

d76489e491864d6ee85d14edaf7d33e6251fca4730705e142379d45c83785bf7
SHA512

308b6fe8c6ed20c1601966ae1becc897bc8584cc93db88b4f08313965882d8b4172a1dac7af8088ec9b4f90a0c8c44cf558603bb558d64344b38ad9432124e24
SSDEEP

3072:RqSLySMUmC2tBK2aVMKeySNgjiU1PeJWe+IGQJdOxtTg96xmgIStdYv7psl+5BhH:zLyhC2tiNAgjiUxbRIGeUtg0A2dYil+0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7347ea62ac4c7dcd1f64022338dcfd75

Files

7347ea62ac4c7dcd1f64022338dcfd75
.exe windows:5 windows x86 arch:x86

7ad4d49e8d1f5975e3d0bc139af8ac6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxW
BeginPaint
GetScrollRange
SendMessageTimeoutA
WinHelpA
SendDlgItemMessageA
WCSToMBEx
AllowSetForegroundWindow
VkKeyScanW
IsWindowInDestroy
PrivateExtractIconExA
SetMenuItemInfoA
UserRealizePalette
SetUserObjectSecurity
CheckMenuItem
AlignRects
GetWindowModuleFileNameW
CreateIconFromResourceEx
MapWindowPoints
SetCursor
GetUserObjectInformationW
DdeUnaccessData
AnimateWindow
UserLpkTabbedTextOut
SystemParametersInfoA
SetDebugErrorLevel
GetMenuStringW
LoadAcceleratorsA
SetLastErrorEx
GetClassInfoW
HideCaret
GetProgmanWindow
RegisterHotKey
IsCharAlphaNumericA
DlgDirSelectExA
SendDlgItemMessageW
ScreenToClient
RegisterServicesProcess
CharUpperBuffW
ScrollChildren

kernel32

GetFirmwareEnvironmentVariableW
GetVersionExW
GetUserDefaultLangID
GetFileSize
GetCurrentThread
GetModuleHandleA
BackupSeek
VirtualAlloc
GetPrivateProfileSectionNamesA
GetCurrentDirectoryW
SetLastError
lstrcmp
ReadConsoleOutputAttribute
GlobalAlloc
EnumResourceLanguagesA
GetConsoleTitleA
FindNextVolumeMountPointA
OpenJobObjectA
SetStdHandle
BuildCommDCBW
LoadLibraryA
SetCurrentDirectoryW
QueryMemoryResourceNotification
MulDiv
DeleteFileA
_hread
GetModuleHandleW
UpdateResourceA
TlsAlloc
VerLanguageNameW
WritePrivateProfileStructA
SetNamedPipeHandleState
FatalExit

shlwapi

UrlGetLocationW
AssocQueryStringW
StrTrimW
ColorHLSToRGB
SHRegisterValidateTemplate
PathFindNextComponentA
StrToInt64ExA
UrlApplySchemeA
PathCombineW
PathStripToRootA
SHQueryInfoKeyW
PathSkipRootA
SHIsLowMemoryMachine
StrCatChainW
SHRegOpenUSKeyW
SHRegDuplicateHKey
StrSpnW
StrRChrA
IntlStrEqWorkerA
PathUndecorateW
SHEnumValueA
StrCatW
UrlCompareA
PathGetDriveNumberA
StrStrIA
StrCSpnIW
StrRStrIA
UrlUnescapeA
SHRegSetUSValueA
SHRegGetPathA
PathUnExpandEnvStringsW
StrCmpIW
SHQueryValueExW
PathCompactPathExW
PathIsContentTypeA
SHRegSetPathA
UrlEscapeA
StrIsIntlEqualA
PathSearchAndQualifyW
SHRegGetBoolUSValueW
SHRegDeleteEmptyUSKeyW
PathFindNextComponentW
StrToIntExA
PathRemoveFileSpecA
StrCmpW

msvcirt

??1stdiobuf@@UAE@XZ
??_Gistream_withassign@@UAEPAXI@Z
??0fstream@@QAE@PBDHH@Z
?sputn@streambuf@@QAEHPBDH@Z
?read@istream@@QAEAAV1@PADH@Z
??0ofstream@@QAE@HPADH@Z
?lock@ios@@QAAXXZ
?put@ostream@@QAEAAV1@D@Z
??0filebuf@@QAE@H@Z
??4stdiostream@@QAEAAV0@AAV0@@Z
?xalloc@ios@@SAHXZ
??6ostream@@QAEAAV0@PBD@Z
?opfx@ostream@@QAEHXZ
??4ostream_withassign@@QAEAAVostream@@ABV1@@Z
??_8ostrstream@@7B@
??7ios@@QBEHXZ
??_Eistream_withassign@@UAEPAXI@Z
??4logic_error@@QAEAAV0@ABV0@@Z
??_Eostrstream@@UAEPAXI@Z
?lockc@ios@@KAXXZ
??_7ofstream@@6B@
??4iostream@@IAEAAV0@AAV0@@Z
??_Estreambuf@@UAEPAXI@Z
??_Dstdiostream@@QAEXXZ
?sh_write@filebuf@@2HB
??0ostream_withassign@@QAE@XZ
?in_avail@streambuf@@QBEHXZ
?cerr@@3Vostream_withassign@@A
?ws@@YAAAVistream@@AAV1@@Z
??5istream@@QAEAAV0@AAN@Z
??1iostream@@UAE@XZ
?gptr@streambuf@@IBEPADXZ
?out_waiting@streambuf@@QBEHXZ
??_Dofstream@@QAEXXZ
?setmode@fstream@@QAEHH@Z
??1ostream_withassign@@UAE@XZ
??4istream_withassign@@QAEAAV0@ABV0@@Z

dnsapi

DnsDhcpSrvRegisterTerm
DnsRecordSetCopyEx
Dns_FindAuthoritativeZoneLib
DnsNotifyResolverEx
DnsUpdateTest_UTF8
Dns_PingAdapterServers
DnsSetConfigDword
Dns_ReadRecordStructureFromPacket
DnsNameCopyAllocate
DnsDhcpSrvRegisterInit
Dns_UpdateLib
DnsRecordBuild_UTF8
NetInfo_ResetServerPriorities
DnsQueryExUTF8
DnsGetDomainName
DnsRegisterClusterAddress
DnsReplaceRecordSetA
DnsAsyncRegisterTerm
DnsApiHeapReset
Dns_ParsePacketRecord
DnsValidateName_UTF8
DnsApiRealloc
DnsIsStatusRcode
DnsGetPrimaryDomainName_A
DnsApiAlloc
DnsValidateName_A
DnsNameCompare_A
DnsNotifyResolver
DnsModifyRecordsInSet_W
DnsNameCompare_UTF8
DnsFlushResolverCacheEntry_UTF8
Dns_SkipPacketName
DnsReplaceRecordSetUTF8
DnsApiSetDebugGlobals
Dns_AllocateMsgBuf
NetInfo_Clean
DnsRecordStringForWritableType
DnsRecordListFree
Dns_OpenTcpConnectionAndSend
DnsRemoveRegistrations
NetInfo_IsForUpdate
DnsAsyncRegisterInit

msasn1

ASN1char16string_cmp
ASN1DecAlloc
ASN1generalizedtime_cmp
ASN1bitstring_free
ASN1CEREncBeginBlk
ASN1BERDecS16Val
ASN1BERDecMultibyteString
ASN1BEREncUTF8String
ASN1ztchar32string_free
ASN1BEREncFlush
ASN1ztcharstring_free
ASN1_CreateDecoder
ASN1BERDecNull
ASN1_FreeEncoded
ASN1Free
ASN1BEREncTag
ASN1BERDecLength
ASN1open_free
ASN1BERDecNotEndOfContents
ASN1BERDecSkip
ASN1uint32_uoctets
ASN1BEREoid2DotVal
ASN1BERDecBool
ASN1BEREncObjectIdentifier2
ASN1BEREncZeroMultibyteString
ASN1ztchar16string_cmp
ASN1CEREncCharString
ASN1intx_sub
ASN1char16string_free
ASN1BERDecEoid
ASN1BERDecU16Val
ASN1char32string_free
ASN1intx_setuint32
ASN1_CreateDecoderEx
ASN1utf8string_free
ASN1intx2int32
ASN1BEREncGeneralizedTime
ASN1BEREncUTCTime
ASN1_Decode
ASN1open_cmp
ASN1CEREncOctetString
ASN1_CreateModule
ASN1BEREncRemoveZeroBits
ASN1bitstring_cmp
ASN1BEREncObjectIdentifier

clusapi

GetClusterNotify
OpenClusterGroup
PauseClusterNode
ClusterNetInterfaceControl
CreateClusterResource
ClusterResourceTypeCloseEnum
ClusterGetEnumCount
OpenClusterResource
ClusterNetworkCloseEnum
ClusterNetworkOpenEnum
GetClusterFromNetwork
GetClusterNodeId
ClusterNodeCloseEnum
ClusterRegDeleteKey
OpenClusterNode
GetClusterNetInterfaceKey
ClusterRegQueryValue
EvictClusterNodeEx
OfflineClusterGroup
OpenClusterNetInterface
MoveClusterGroup
ChangeClusterResourceGroup
ClusterResourceTypeOpenEnum
GetClusterNetworkKey
SetClusterResourceName
ClusterGroupOpenEnum
ClusterNetworkGetEnumCount
ClusterNodeOpenEnum
DeleteClusterResourceType
CanResourceBeDependent

Sections

.text
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 249KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7ad4d49e8d1f5975e3d0bc139af8ac6d

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

shlwapi

msvcirt

dnsapi

msasn1

clusapi

Sections

.text Size: 67KB - Virtual size: 66KB

.rdata Size: 68KB - Virtual size: 67KB

.data Size: 512B - Virtual size: 249KB

.rsrc Size: 48KB - Virtual size: 47KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 67KB - Virtual size: 66KB

.rdata
Size: 68KB - Virtual size: 67KB

.data
Size: 512B - Virtual size: 249KB

.rsrc
Size: 48KB - Virtual size: 47KB

.reloc
Size: 1KB - Virtual size: 1KB