85e7fba3c01a680d30c67a8d534cc579

Sharing

Copy URL Twitter E-mail

General

Target

85e7fba3c01a680d30c67a8d534cc579
Size

505KB
MD5

85e7fba3c01a680d30c67a8d534cc579
SHA1

26dddc2701c4627ebd362dc9a9d1ba84911d6749
SHA256

e6f4a51d773edb2101eef493a8bbf7ff91636d9585f24324ebf9f96e464e1cc8
SHA512

3ed1d57caf322552f64a6d22a7f78cf5a8589f9f5cc8611e1a20b1f4c07fc453a98c64779afaeb09038de2be776e5d4244dfa0f303e1c71c9e627f620d95deb6
SSDEEP

12288:cJidga2aokPNjwYxLkLhwtHoyDz6NKrjC1esE5V4rKJ8c:cJidga5NPsLatvDz6NiYesEnJ8c

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
85e7fba3c01a680d30c67a8d534cc579

Files

85e7fba3c01a680d30c67a8d534cc579
.exe windows:4 windows x64 arch:x64

e8724d3dc22c4765155890459092980b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memset
wcschr
memcpy
wcslen
wcscpy
wcscmp
memmove
wcscat
strncpy
memcmp
_wfopen
_setjmp
fclose
malloc
free
longjmp
wcsncmp
wcsncpy
_wcsicmp
tolower
floor
_localtime64
_mktime64
_wcsnicmp
_itow
_gmtime64
fabs
ceil
fseek
ftell
fread
pow
??3@YAXPEAX@Z
wcsstr
_wcsdup
_isnan
exit
sprintf
__iob_func
fprintf
fwrite
fflush
ferror
getenv
sscanf
_vsnwprintf
sinf
cosf
fmodf
abs

kernel32

GetModuleHandleW
HeapCreate
HeapDestroy
ExitProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CloseHandle
OpenProcess
TerminateProcess
CreateFileW
ReadDirectoryChangesW
GetDriveTypeW
GetVolumeInformationW
GetTickCount
HeapFree
TlsGetValue
HeapAlloc
TlsSetValue
TlsAlloc
UnregisterWait
EnterCriticalSection
LeaveCriticalSection
TlsFree
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcess
GetCurrentThread
DuplicateHandle
RegisterWaitForSingleObject
WaitForSingleObject
LoadLibraryW
GetProcAddress
CreateThread
TerminateThread
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameW
CreatePipe
GetStdHandle
CreateProcessW
RtlLookupFunctionEntry
RtlVirtualUnwind
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
FreeLibrary
HeapReAlloc
GetCurrentThreadId
WideCharToMultiByte
DeleteFileW
QueryPerformanceFrequency
QueryPerformanceCounter
Sleep
GetComputerNameW
SetLastError
GetCurrentProcessId
SetFileAttributesW
FindFirstFileW
FindClose
GetFileAttributesW
GetLastError
FindNextFileW
GetTempPathW
MoveFileW
CopyFileW
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateDirectoryW
WriteFile
SetFilePointer
ReadFile
MulDiv
GetLocalTime
GlobalLock
GlobalUnlock
HeapSize
MultiByteToWideChar

user32

GetForegroundWindow
SetWindowsHookExW
MapVirtualKeyW
GetKeyNameTextW
GetAsyncKeyState
CallNextHookEx
GetWindowTextLengthW
GetWindowTextW
GetWindowRect
ClientToScreen
GetDesktopWindow
GetDC
ReleaseDC
GetLastInputInfo
GetClassNameW
GetWindowLongPtrW
IsWindow
SetMenu
DestroyMenu
GetSystemMetrics
DestroyWindow
SystemParametersInfoW
GetWindow
SetActiveWindow
SendMessageW
DestroyIcon
LoadIconW
LoadCursorW
GetPropW
RegisterClassW
AdjustWindowRectEx
CreateWindowExW
SetPropW
ShowWindow
CreateAcceleratorTableW
UnregisterClassW
PeekMessageW
MsgWaitForMultipleObjects
GetMessageW
GetActiveWindow
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
DefFrameProcW
DefWindowProcW
GetParent
RemovePropW
DestroyAcceleratorTable
SetRect
EnumChildWindows
SetFocus
GetFocus
PostMessageW
SetWindowPos
IsWindowEnabled
IsWindowVisible
GetKeyState
GetWindowThreadProcessId
IsChild
RegisterWindowMessageW
EnumDisplaySettingsW
OpenClipboard
GetClipboardData
CloseClipboard
FillRect
CopyImage
CharLowerW
CharUpperW
CallWindowProcW
SetWindowLongPtrW
GetIconInfo
DrawIconEx

gdi32

BitBlt
DeleteObject
GetStockObject
CreateFontIndirectW
GetDeviceCaps
CreateDCW
DeleteDC
GetObjectType
GetObjectW
CreateCompatibleDC
SelectObject
CreateSolidBrush
GdiGetBatchLimit
GdiSetBatchLimit
CreateDIBSection
SetStretchBltMode
SetBrushOrgEx
StretchBlt
CreateBitmap
SetPixel
GetDIBits
GetTextExtentPoint32W
SetBkMode
SetTextAlign
SetBkColor
SetTextColor
TextOutW
GetTextMetricsW
CreateCompatibleBitmap
GetPixel

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
ShellExecuteExW
SHGetFolderLocation

wsock32

closesocket
WSACleanup
WSAStartup
select
__WSAFDIsSet
ioctlsocket
recvfrom
socket
inet_addr
gethostbyname
htons
bind
connect
recv
send
sendto
accept
listen
WSAGetLastError

ole32

CoInitialize
CoCreateInstance
CoUninitialize
RevokeDragDrop
CoTaskMemFree

winmm

timeBeginPeriod

gdiplus

GdipDeleteFont
GdipDeleteGraphics
GdipDeletePath
GdipDeleteMatrix
GdipDeletePen
GdipDeleteStringFormat
GdipFree
GdipGetDpiX
GdipGetDpiY

advapi32

GetUserNameW

comctl32

InitCommonControlsEx

Sections

.code
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 219KB - Virtual size: 218KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e8724d3dc22c4765155890459092980b

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

gdi32

shell32

wsock32

ole32

winmm

gdiplus

advapi32

comctl32

Sections

.code Size: 88KB - Virtual size: 88KB

.text Size: 219KB - Virtual size: 218KB

.rdata Size: 37KB - Virtual size: 36KB

.pdata Size: 11KB - Virtual size: 10KB

.data Size: 73KB - Virtual size: 86KB

.rsrc Size: 75KB - Virtual size: 75KB

.code
Size: 88KB - Virtual size: 88KB

.text
Size: 219KB - Virtual size: 218KB

.rdata
Size: 37KB - Virtual size: 36KB

.pdata
Size: 11KB - Virtual size: 10KB

.data
Size: 73KB - Virtual size: 86KB

.rsrc
Size: 75KB - Virtual size: 75KB