7e49fa1cd383fbf0fd1178005d32c9ec

Sharing

Copy URL Twitter E-mail

General

Target

7e49fa1cd383fbf0fd1178005d32c9ec
Size

467KB
MD5

7e49fa1cd383fbf0fd1178005d32c9ec
SHA1

914158e4c56dc84ef86104f90b9cb0dee97203e0
SHA256

41b133b3a2c56987e32eb81614ad8ceea962f0fa924eda102fc58bda7e525f9f
SHA512

eaec202687bd9479aa85dac51334b4d1b3b57107aa013cced20fea32d27752870663a00a8d06015f9531728be5bd6bd554d4e1e19f8d551720a102f0374ebfae
SSDEEP

12288:aD9OjOX2/jNfH56ufYP+Z9AAumTJl7C2x:QojA6ZHNxZ9AAumTHT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7e49fa1cd383fbf0fd1178005d32c9ec

Files

7e49fa1cd383fbf0fd1178005d32c9ec
.exe windows:4 windows x86 arch:x86

3d0434d89cc82f49f99707f9adf40504

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlInitUnicodeString
RtlLargeIntegerShiftRight
RtlRunDecodeUnicodeString
NtAllocateVirtualMemory

ole32

CoCreateInstance
CoGetInterfaceAndReleaseStream
CoCreateFreeThreadedMarshaler
ReleaseStgMedium
CreateBindCtx
CoInitializeEx
CoUninitialize
CoTaskMemFree
CoMarshalInterThreadInterfaceInStream
CoInitialize

secur32

TranslateNameW

shell32

SHGetSpecialFolderPathW
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHBrowseForFolderW
SHParseDisplayName
ShellExecuteExW
SHGetFileInfoW
SHBindToParent
SHGetPathFromIDListW
SHCreateShellItem

mpr

WNetOpenEnumW
WNetAddConnection3W
WNetCloseEnum
WNetEnumResourceW
WNetGetConnectionW
WNetCancelConnection2W

msvcrt

_except_handler3
wcschr

ntdsapi

DsFreeNameResultW
DsCrackNamesW

netapi32

NetLocalGroupEnum
NetUserAdd
NetUserDel
NetLocalGroupDelMembers
NetUnjoinDomain
NetLocalGroupGetMembers
NetValidateName
DsRoleFreeMemory
DsGetDcNameW
NetUserGetLocalGroups
NetJoinDomain
NetLocalGroupAddMembers
NetRenameMachineInDomain
NetUserSetInfo
NetUserGetInfo
NetApiBufferFree
DsRoleGetPrimaryDomainInformation

gdi32

GetObjectW
SetTextColor
DeleteObject
SelectObject
GetTextMetricsW
SetBkColor
CreateFontIndirectW
ExtTextOutW
GetDeviceCaps

user32

LoadImageW
RegisterWindowMessageW
EndDialog
SetWindowTextW
GetSysColor
GetWindowTextW
IsWindow
SendMessageW
SetWindowLongW
GetDC
CheckDlgButton
GetParent
IsWindowVisible
IsDlgButtonChecked
DialogBoxParamW
CheckRadioButton
GetWindowTextLengthW
SetWindowPos
LoadIconW
RegisterClipboardFormatW
FindWindowW
SetCursor
GetDlgCtrlID
SetFocus
GetClientRect
OffsetRect
DestroyIcon
LoadCursorW
SendDlgItemMessageW
WinHelpW
DrawTextExW
EnableWindow
MoveWindow
RedrawWindow
IsWindowEnabled
KillTimer
GetDesktopWindow
ReleaseDC
ShowWindow
GetDialogBaseUnits
GetSystemMetrics
SystemParametersInfoW
CharLowerBuffW
GetDlgItemTextW
GetWindowLongA
DrawFocusRect
SetForegroundWindow
GetWindowLongW
SetDlgItemTextW
LoadStringW
SetTimer
CharNextW
PostMessageW
MapWindowPoints
MessageBoxW
GetWindowRect
GetDlgItem

urlmon

URLDownloadToCacheFileW

shlwapi

PathFindExtensionW
StrCmpW
PathMatchSpecW
PathIsUNCW
PathRemoveBackslashW
PathCombineW
PathAppendW
SHRegGetBoolUSValueW
StrCatBuffW
SHGetValueW
StrRetToBufW
StrCmpNIW
PathFindFileNameW
UrlGetPartW
UrlCombineW
StrToIntExW
wnsprintfW
StrToIntW
PathRemoveFileSpecW
PathIsUNCServerW
StrCpyNW
PathRenameExtensionW
StrChrW
PathParseIconLocationW
StrDupW
PathGetDriveNumberW
AssocQueryStringW
StrCmpIW
SHStrDupW
SHSetValueW

advapi32

CheckTokenMembership
IsValidSid
RegEnumKeyW
RegCreateKeyExW
CreateProcessWithLogonW
RegCloseKey
RegDeleteValueW
FreeSid
OpenSCManagerW
RegOpenKeyExW
LsaOpenPolicy
OpenThreadToken
OpenServiceW
LookupAccountNameW
CopySid
GetLengthSid
LookupAccountSidW
EqualSid
AllocateAndInitializeSid
LsaClose
OpenProcessToken
RegQueryValueExW
CloseServiceHandle
QueryServiceStatus
RegQueryValueExA
GetTokenInformation
LsaStorePrivateData
RegOpenKeyExA
RegSetValueExW

kernel32

GetTickCount
SetComputerNameExW
WideCharToMultiByte
GetDriveTypeW
ExpandEnvironmentStringsW
lstrcpynW
lstrcpyW
GetCurrentProcess
GetSystemTimeAsFileTime
DelayLoadFailureHook
LoadLibraryA
TerminateProcess
UnhandledExceptionFilter
GlobalLock
SetUnhandledExceptionFilter
lstrlenW
InterlockedDecrement
MulDiv
CreateProcessW
OpenEventW
lstrcmpiW
GetLocaleInfoW
GetSystemDefaultLCID
CreateEventW
CreateThread
InterlockedIncrement
MultiByteToWideChar
QueryPerformanceCounter
GetLastError
FormatMessageW
GetGeoInfoW
GetComputerNameW
GetACP
WaitForSingleObject
LoadLibraryW
LocalAlloc
InterlockedCompareExchange
GetModuleHandleW
GetUserGeoID
ExitProcess
GetModuleFileNameW
GetUserDefaultLangID
GetCurrentThread
GetCurrentThreadId
GetProcAddress
GlobalUnlock
SetEvent
GetWindowsDirectoryW
GetVersionExA
CloseHandle
LocalFree
DnsHostnameToComputerNameW
DosDateTimeToFileTime
GetCurrentProcessId
lstrcmpiA
GetUserDefaultLCID
FreeLibrary

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.data
Size: 299KB - Virtual size: 492KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3d0434d89cc82f49f99707f9adf40504

Headers

File Characteristics

Imports

ntdll

ole32

secur32

shell32

mpr

msvcrt

ntdsapi

netapi32

gdi32

user32

urlmon

shlwapi

advapi32

kernel32

Sections

.text Size: 12KB - Virtual size: 11KB

.reloc Size: 512B - Virtual size: 20B

.data Size: 299KB - Virtual size: 492KB

.rdata Size: 5KB - Virtual size: 4KB

.rsrc Size: 150KB - Virtual size: 149KB

.text
Size: 12KB - Virtual size: 11KB

.reloc
Size: 512B - Virtual size: 20B

.data
Size: 299KB - Virtual size: 492KB

.rdata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 150KB - Virtual size: 149KB