749d653ff5c193cee2d9f76b5f0c4dd6

Sharing

Copy URL

Twitter E-mail

General

Target

749d653ff5c193cee2d9f76b5f0c4dd6
Size

86KB
MD5

749d653ff5c193cee2d9f76b5f0c4dd6
SHA1

486a8fa30d1612be0cf41cdbe294968d31201ca1
SHA256

8ea60e4c9f48f27d999e7fac37da77f74f7a0f24de2d4883bc511e24452037e4
SHA512

fcb675f257099a6cfc1fc8b3c821a92d7aa257ae085dfe8ff6564921694eb1b0d593ae63869ece2c90966ff4b9b782e05276d8b1bca81192de67f927080b4387
SSDEEP

1536:PvKQKORXUIoJDgj8x2pBG2BZ4I98MaqM4Dfo0DUuKOnrJnPsy+ZMbLm:PvKrORXlwK1AI9JaqMao0IZsBsyC4Lm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
749d653ff5c193cee2d9f76b5f0c4dd6

Files

749d653ff5c193cee2d9f76b5f0c4dd6
.dll windows:4 windows x86 arch:x86

7c8d78b57a071e024e653db71f31e635

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

InternetOpenA
InternetOpenUrlA
InternetCloseHandle
HttpQueryInfoA
InternetReadFile

ws2_32

inet_addr
setsockopt
connect
socket
htons
inet_ntoa
WSAStartup
recv
send
gethostbyname
closesocket

psapi

GetModuleFileNameExA

gdiplus

GdiplusStartup
GdipDisposeImage
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipSaveImageToStream
GdipCreateBitmapFromGdiDib
GdipCloneImage
GdipFree
GdipAlloc

mfc42

ord815
ord561
ord3738
ord4424
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord2725
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord3178
ord3010
ord1116
ord3790
ord356
ord2770
ord1980
ord2781
ord4058
ord3181
ord800
ord3319
ord3310
ord6385
ord668
ord354
ord5186
ord3318
ord5442
ord1979
ord665
ord823
ord825
ord269
ord826
ord600
ord1578
ord6467
ord1255
ord1253
ord1570
ord1197
ord1243
ord342
ord1182
ord1577
ord1168
ord1575
ord1176
ord4622

msvcrt

??1type_info@@UAE@XZ
_adjust_fdiv
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
_except_handler3
free
wcscmp
malloc
_beginthread
abs
memset
memcpy
memcmp
__CxxFrameHandler
strchr
strrchr
strcmp
strcpy
sprintf
strlen
getenv
fclose
fread
fseek
fopen
atoi
isdigit
calloc

kernel32

CreateToolhelp32Snapshot
Process32First
GetCurrentProcess
Process32Next
OpenProcess
lstrcatA
GetVolumeInformationA
GetLogicalDriveStringsA
GetDriveTypeA
GetModuleFileNameA
MoveFileA
CreateDirectoryA
lstrlenA
lstrcpyA
WaitForSingleObject
TerminateProcess
Sleep
CloseHandle
CreateEventA
GlobalLock
GlobalAlloc
GlobalUnlock
GlobalFree
GetCurrentThreadId
SetPriorityClass
GetThreadPriority
GetCurrentThread
GetPriorityClass
lstrcmpA
LocalFree
LocalAlloc
GetTickCount
ReadFile
GetOEMCP
WriteFile
DuplicateHandle
CreateProcessA
GetStdHandle
CreatePipe
SetStdHandle
DeleteFileA
GetLastError
GetSystemDirectoryA
GetCurrentProcessId
GetLocalTime
GetComputerNameA
GlobalMemoryStatus
GetSystemInfo
SetThreadPriority
GetVersionExA
GetVersion
QueryPerformanceCounter
QueryPerformanceFrequency
GetDiskFreeSpaceExA
SetEvent

user32

CallNextHookEx
GetKeyboardState
ToAscii
IsWindow
SendMessageA
GetMessageA
DispatchMessageA
DestroyWindow
wsprintfA
CharUpperA
UnhookWindowsHookEx
ReleaseDC
OpenDesktopA
PostMessageA
SetCursorPos
SendInput
GetProcessWindowStation
GetThreadDesktop
OpenWindowStationA
SetProcessWindowStation
OpenInputDesktop
SetThreadDesktop
ExitWindowsEx
GetActiveWindow
GetWindowTextA
GetDC
SetWindowsHookExA

gdi32

GetDIBits
CreateCompatibleDC
SelectObject
BitBlt
CreateDCA
GetDeviceCaps
CreateCompatibleBitmap
DeleteDC
DeleteObject

advapi32

RegCloseKey
EnumServicesStatusA
DeleteService
ControlService
StartServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
ChangeServiceConfigA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
QueryServiceConfigA
RegQueryValueExA
RegOpenKeyExA
RegisterServiceCtrlHandlerA
SetServiceStatus
QueryServiceStatus
CreateServiceA
ImpersonateSelf
OpenThreadToken
RegCreateKeyExA
RegSetValueExA

shell32

ShellExecuteA
SHFileOperationA
SHEmptyRecycleBinA

ole32

CreateStreamOnHGlobal

avicap32

capCreateCaptureWindowA

Exports

Exports

LoadProfile
ServiceMain
TestFunc

Sections

.text
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Share
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7c8d78b57a071e024e653db71f31e635

Headers

File Characteristics

Imports

wininet

ws2_32

psapi

gdiplus

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ole32

avicap32

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 46KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 8KB - Virtual size: 10KB

Share Size: 4KB - Virtual size: 8B

.rsrc Size: 4KB - Virtual size: 16B

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 48KB - Virtual size: 46KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 8KB - Virtual size: 10KB

Share
Size: 4KB - Virtual size: 8B

.rsrc
Size: 4KB - Virtual size: 16B

.reloc
Size: 4KB - Virtual size: 2KB