778a4f7b7778deae4a63c7db956cdfcf

Sharing

Copy URL Twitter E-mail

General

Target

778a4f7b7778deae4a63c7db956cdfcf
Size

382KB
MD5

778a4f7b7778deae4a63c7db956cdfcf
SHA1

3ee528e4340798eeb3142c884cb82d70760b0901
SHA256

893e22aeabcf8cfb1bd65ad840f78432f51d36492ac252209d121556833a640b
SHA512

32a19d82229785ac677a96241920cfd0b091c0569258fcc23431454d578b45956e5599297c13dfbbcfed6d5db2656dc297edb3401b420f08669cc8a73ac15f69
SSDEEP

6144:sluRB1GqKNdprzxv4aKFn/09SmaCp18BxJF5iNVMk9fEiKZFwt8Pkot4vq+qk5C:sIRBVKT4aKN/ed8bjEMk9UFwOsot4C6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
778a4f7b7778deae4a63c7db956cdfcf

Files

778a4f7b7778deae4a63c7db956cdfcf
.exe windows:5 windows x86 arch:x86

d401ef1e06f9d52d0c86c70904d0f50b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExA
ChangeServiceConfig2W
EnumDependentServicesW
CreateProcessWithLogonW
CryptEncrypt
SaferiIsExecutableFileType
GetFileSecurityW
AddAccessAllowedObjectAce
LsaGetUserName
RegisterServiceCtrlHandlerW
BuildExplicitAccessWithNameW
A_SHAFinal
SaferRecordEventLogEntry
LsaOpenTrustedDomain
CredReadDomainCredentialsW
MD5Update
GetNamedSecurityInfoExA
CryptDuplicateKey
LsaAddPrivilegesToAccount
CryptDuplicateHash
EncryptFileA
LogonUserW
AccessCheckByTypeResultList
SetSecurityDescriptorDacl
BuildTrusteeWithObjectsAndNameA
ReportEventW
EnumDependentServicesA
GetSidSubAuthorityCount
SystemFunction020
CredWriteW
LsaEnumerateAccountsWithUserRight
MD5Init
SetInformationCodeAuthzPolicyW
GetExplicitEntriesFromAclW
ObjectDeleteAuditAlarmW
SystemFunction035
SystemFunction040
SetInformationCodeAuthzLevelW
CreatePrivateObjectSecurity
StartServiceCtrlDispatcherA
CryptVerifySignatureW
GetEffectiveRightsFromAclW
GetMultipleTrusteeOperationA
LsaSetDomainInformationPolicy

msi

MsiRecordSetStringA
MsiDatabaseExportW
MsiRecordGetStringW
MsiDatabaseOpenViewA
MsiQueryProductStateW
MsiProvideQualifiedComponentExW
MsiDatabaseGenerateTransformW
MsiRecordGetStringA
MsiRecordGetInteger
MsiEnumComponentsA
MsiMessageBoxW
MsiRecordClearData
MsiGetFeatureCostW
MsiDatabaseCommit
MsiCollectUserInfoW
MsiSetInstallLevel
MsiOpenPackageW
MsiSetComponentStateW
MsiGetProductInfoW
MsiInstallProductW
MsiGetComponentStateA
MsiProvideQualifiedComponentW
MsiEnumProductsW
MsiGetFileVersionW
MsiSetTargetPathW
MsiEnumProductsA
MsiViewClose
MsiRecordIsNull
MsiEvaluateConditionW
MsiGetFeatureInfoW
MsiSetInternalUI
MsiSourceListForceResolutionW
MsiInstallMissingComponentW
MsiPreviewDialogA
MsiConfigureFeatureFromDescriptorA
MsiDatabaseMergeA
MsiUseFeatureExW
MsiGetPropertyW
MsiDecomposeDescriptorA
MsiDatabaseGenerateTransformA
MsiEnumFeaturesW
MsiGetComponentPathA
MsiSummaryInfoSetPropertyA
MsiOpenPackageExA
MsiGetMode

kernel32

FindFirstFileA
GetTickCount
RegisterWaitForInputIdle
CreateWaitableTimerA
RemoveDirectoryW
SetConsoleScreenBufferSize
GetCompressedFileSizeA
FindResourceExW
LocalShrink
SetCommMask
CreateEventA
EnumSystemCodePagesW
DeleteTimerQueueTimer
GetConsoleAliasA
SetLastError
UnlockFileEx
InvalidateConsoleDIBits
QueryMemoryResourceNotification
HeapReAlloc
GetComputerNameExA
SuspendThread
LZOpenFileW
GetFullPathNameW
LoadLibraryA
SetFirmwareEnvironmentVariableW
GetNumberFormatA
GetLocaleInfoW
GetSystemDefaultLangID
GetPrivateProfileStringA
GetSystemDirectoryW
GetConsoleWindow
_llseek
QueryPerformanceCounter
GetNumberFormatW
ReadConsoleInputA
ConvertFiberToThread
SwitchToThread
SetFileValidData
LocalAlloc
EnumResourceLanguagesA
VirtualAlloc
OutputDebugStringA
ExpandEnvironmentStringsW

oleaut32

LPSAFEARRAY_UserFree
VarI4FromI2
VarUI4FromBool
VarUI1FromDec
VarAbs
VariantInit
VariantChangeTypeEx
SafeArrayGetUBound
VarR8FromUI1
SafeArrayAllocData
VarBoolFromI8
VarDecDiv
LPSAFEARRAY_UserSize
VarR8FromStr
SafeArrayGetDim
VarDateFromUI8
VarUI8FromStr
VarCyFromI1
VarCyMul
VarInt
VarR8FromR4
SafeArrayPtrOfIndex
VarDateFromR8
VarCyFromI2
VarCyFromR8

ntdll

RtlpNtOpenKey
NtOpenEventPair
RtlCopyUnicodeString
RtlEnlargedUnsignedDivide
NtReadVirtualMemory
ZwQueryInformationProcess
fabs
RtlTimeToSecondsSince1980
_ftol
RtlRunDecodeUnicodeString
NtAreMappedFilesTheSame
DbgPrompt
NtQueryMultipleValueKey
wcspbrk
RtlQueryTimeZoneInformation
RtlPrefixUnicodeString
ZwFindAtom
ZwDisplayString
strstr
RtlLargeIntegerNegate
RtlAreAnyAccessesGranted
RtlDebugPrintTimes
ZwDelayExecution
NtPrivilegedServiceAuditAlarm
NtOpenThreadTokenEx

msvcrt40

_mbsncat
_pctype
_wspawnve
??_7bad_cast@@6B@
wcschr
?get@istream@@QAEAAV1@PADHD@Z
_strnset
??5istream@@QAEAAV0@AAF@Z
ceil
ungetwc
_wasctime
??0ofstream@@QAE@ABV0@@Z
??6ostream@@QAEAAV0@J@Z
_kbhit
??1bad_cast@@UAE@XZ
strcpy
?close@ofstream@@QAEXXZ
_mbscspn
?base@streambuf@@IBEPADXZ
?lockbuf@ios@@QAAXXZ
_lrotr
??_Gifstream@@UAEPAXI@Z
??_Distream_withassign@@QAEXXZ
__p__amblksiz
_abnormal_termination
__setusermatherr
_adj_fdivr_m16i
_wtoi
ferror
??0ostrstream@@QAE@PADHH@Z

sensapi

IsDestinationReachableW
IsDestinationReachableA
IsNetworkAlive

Sections

.text
Size: 173KB - Virtual size: 173KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 145KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 547KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d401ef1e06f9d52d0c86c70904d0f50b

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

msi

kernel32

oleaut32

ntdll

msvcrt40

sensapi

Sections

.text Size: 173KB - Virtual size: 173KB

.rdata Size: 145KB - Virtual size: 145KB

.data Size: 55KB - Virtual size: 547KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 173KB - Virtual size: 173KB

.rdata
Size: 145KB - Virtual size: 145KB

.data
Size: 55KB - Virtual size: 547KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 1KB - Virtual size: 1KB