73bb77c5262fe10215554b4194d32e53

Sharing

Copy URL Twitter E-mail

General

Target

73bb77c5262fe10215554b4194d32e53
Size

278KB
MD5

73bb77c5262fe10215554b4194d32e53
SHA1

779a4058d9c8a2e18fee0a425a80f7400ced6e7a
SHA256

37d264e0a60ffc1a075faccac49123e8b7a876b6a4b55be8920723466b1c0b7b
SHA512

f0ec21840eb9f81ee49892c88a5549c1c055ba6701cb022fd7f52512ef1aee3379862de5d0635515d57beb6f03913cde293f747f41ad5b442107a6eb1df18fe5
SSDEEP

6144:Uw8yL7ppV+WJG6de5dAqkNLBeYClpKzkc4qkeBACbx8YGLcRf:Uw/t+AMlkN1eYCDckc4jXgSYGI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
73bb77c5262fe10215554b4194d32e53

Files

73bb77c5262fe10215554b4194d32e53
.exe windows:4 windows x86 arch:x86

5b323ad38fa98d3f877190adc06e1e82

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

SysStringLen
SysAllocString
SysFreeString
VarUI4FromStr
SysStringByteLen
VariantClear
SysAllocStringByteLen
SysAllocStringLen
SysReAllocStringLen
VarBstrCmp
VariantCopy
VariantChangeType
VariantInit
LoadRegTypeLib
VarI2FromUI1
VarBstrFromBool
VarTokenizeFormatString
VarBoolFromDec
LHashValOfNameSys
VarUI2FromI8
VarI4FromI2
SysStringByteLen
VarI1FromCy
VarBoolFromStr
VarR8FromI1
VarDecCmpR8
VarI4FromUI4
VarCyInt
VarBstrCat
VarCyFix
VarDateFromUI1
SafeArrayDestroyData
SafeArrayGetLBound
CreateDispTypeInfo
VariantChangeType
VarI1FromUI4
VarI2FromStr
VarDecFromI4
SystemTimeToVariantTime
VarCmp
VarI8FromDate
VarDecFromI2
VarDecFromUI2
VarDecSub
VarCyMulI8
VarR8FromBool
VarUI1FromDec
OaBuildVersion

kernel32

LeaveCriticalSection
VirtualProtectEx
OpenProcess
GetWindowsDirectoryW
FindResourceExW
CreateProcessW
lstrcmpiA
GetThreadPriority
SearchPathW
GetModuleHandleW
GetFileSize
LoadLibraryExW
lstrlenW
HeapReAlloc
RaiseException
CreateRemoteThread
CreateEventA
ContinueDebugEvent
SizeofResource
TlsSetValue
ReadProcessMemory
MapViewOfFile
GetFileInformationByHandle
GetSystemTimeAsFileTime
CreateThread
SetThreadAffinityMask
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
FreeLibrary
HeapDestroy
GetCurrentDirectoryW
OpenThread
FindFirstFileW
GetThreadSelectorEntry
GetLongPathNameW
ResumeThread
VirtualQuery
CancelIo
SetLastError
LCMapStringW
LoadLibraryExA
QueryDosDeviceW
EnterCriticalSection
ResetEvent
SetErrorMode
ReadFile
GetProcessHeap
TlsFree
WaitForDebugEvent
SetNamedPipeHandleState
LocalAlloc
CreateFileMappingW
FormatMessageA
FindClose
CreateMutexW
GetSystemInfo
VirtualAlloc
FindResourceW
GetComputerNameW
GetSystemDirectoryW
GetFileTime
GetLogicalDrives
SwitchToThread
TransactNamedPipe
GetVolumeInformationW
GetFullPathNameW
CreateEventW
UnhandledExceptionFilter
GetOverlappedResult
FormatMessageW
Process32First
WaitNamedPipeW
SetHandleInformation
VirtualQueryEx
HeapAlloc
SetUnhandledExceptionFilter
GetProcessAffinityMask
FlushInstructionCache
DuplicateHandle
OutputDebugStringW
DeleteFileW
SuspendThread
IsDebuggerPresent
GetCurrentThreadId
FindResourceA
CreateFileMappingA
GetThreadContext
FreeLibraryAndExitThread
Process32Next
ExpandEnvironmentStringsW
LoadResource
WideCharToMultiByte
QueryPerformanceFrequency
CreateFileW
FreeEnvironmentStringsW
LockResource
WriteProcessMemory
DeleteCriticalSection
VirtualFree
HeapFree
IsDBCSLeadByte
CloseHandle
DebugActiveProcess
UnmapViewOfFile
ProcessIdToSessionId
GetModuleHandleA
CreateToolhelp32Snapshot
HeapSize
ReleaseMutex
TlsGetValue
TlsAlloc
SetFilePointer
lstrlenA
SetThreadContext
LocalFree
VirtualAllocEx

user32

SetDebugErrorLevel
EnumWindows
PostThreadMessageW
GetWindowThreadProcessId
IsWindowVisible
CharLowerBuffA
LoadStringA
LoadStringW
GetWindowTextW
CharNextA

ole32

CoCreateFreeThreadedMarshaler
CoInitializeEx
CoCreateInstance
CoReleaseMarshalData
StringFromCLSID
CoTaskMemFree
CoTaskMemRealloc
CoUninitialize
CoTaskMemAlloc
CoWaitForMultipleHandles
CoCreateGuid
StringFromGUID2

advapi32

GetSecurityDescriptorOwner
CryptGetHashParam
RegCloseKey
GetSidIdentifierAuthority
CryptDestroyHash
IsValidSecurityDescriptor
RegQueryInfoKeyA
GetUserNameW
PrivilegeCheck
FreeSid
SetSecurityDescriptorGroup
RegEnumKeyExA
CryptReleaseContext
SetSecurityDescriptorDacl
LookupPrivilegeValueW
GetKernelObjectSecurity
RegDeleteKeyA
RegOpenKeyExA
CryptHashData
AdjustTokenPrivileges
AddAccessAllowedAce
GetTokenInformation
RegConnectRegistryW
AllocateAndInitializeSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteValueA
CryptCreateHash
RegQueryValueExW
CryptAcquireContextA
RegEnumValueA
RegOpenKeyExW
RegQueryValueExA
RegSetValueExA
GetSidSubAuthority
AccessCheck
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
RegQueryInfoKeyW
EqualSid
OpenProcessToken
RegCreateKeyExA
DuplicateToken
SetSecurityDescriptorOwner
GetSidSubAuthorityCount
RegCreateKeyExW

shell32

CommandLineToArgvW

qedit

DllGetClassObject

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 30KB - Virtual size: 892KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 180KB - Virtual size: 841KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 315KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5b323ad38fa98d3f877190adc06e1e82

Headers

File Characteristics

Imports

oleaut32

kernel32

user32

ole32

advapi32

shell32

qedit

Sections

.text Size: 22KB - Virtual size: 21KB

.bss Size: 30KB - Virtual size: 892KB

.reloc Size: 180KB - Virtual size: 841KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 35KB - Virtual size: 315KB

.rsrc Size: 3KB - Virtual size: 15KB

.text
Size: 22KB - Virtual size: 21KB

.bss
Size: 30KB - Virtual size: 892KB

.reloc
Size: 180KB - Virtual size: 841KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 35KB - Virtual size: 315KB

.rsrc
Size: 3KB - Virtual size: 15KB