8988fd8ca15de68027f2151814c0cc67

Sharing

Copy URL Twitter E-mail

General

Target

8988fd8ca15de68027f2151814c0cc67
Size

695KB
MD5

8988fd8ca15de68027f2151814c0cc67
SHA1

8e100f2f6d8dd15561e176863d96a4b3f3c84f6a
SHA256

e257febfce2ce5dc56ef54098eddaf82e15501aca91bdc3b1854ab8c66897a65
SHA512

f62d9e27a3e60d9cdcc893652beb3029cd9958ec46ceb6505e7fac79384f1352a6affee2c0ccbebf234f78a0796daa095c1c2199bcc28e49a944af9f5136469e
SSDEEP

6144:dQh1+VPLHCkY9TEnReTm8rexR4BGydfTWV8rv5NdNFwMYL+LBO0VEArtLHgGKGuw:dDmTB+aMygg8AeIrUQ6EKnb3f+qYiSXV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8988fd8ca15de68027f2151814c0cc67

Files

8988fd8ca15de68027f2151814c0cc67
.exe windows:5 windows x86 arch:x86

cfead1252e1d7e9f635df9d114f15eb4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

kernel32

ExitProcess
SetUnhandledExceptionFilter
SetEnvironmentVariableA
GetSystemInfo
lstrlenA
FreeResource
LockResource
LoadResource
FindResourceA
LoadLibraryExA
GetTempPathA
GetCurrentProcess
GetDiskFreeSpaceExA
GetDiskFreeSpaceA
GetCompressedFileSizeA
GetComputerNameA
ReleaseSemaphore
SetEndOfFile
InterlockedDecrement
GetCurrentThread
GetExitCodeThread
CreateSemaphoreA
MoveFileA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
HeapCreate
HeapDestroy
GlobalAlloc
GlobalLock
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
GlobalHandle
GlobalUnlock
GlobalFree
RaiseException
GetFileInformationByHandle
CreateProcessW
GetFullPathNameA
GetSystemDefaultLangID
GetModuleFileNameW
ReleaseMutex
CopyFileW
GetTempFileNameW
GetVersionExW
ExpandEnvironmentStringsW
SearchPathW
lstrcpyW
lstrcpynW
GetDriveTypeW
lstrlenW
GetLocalTime
OpenEventA
GetFileSizeEx
CreateRemoteThread
VirtualAllocEx
WriteProcessMemory
CreateEventW
lstrcpyA
QueryDosDeviceA
DefineDosDeviceA
lstrcpynA
GetFullPathNameW
LoadLibraryW
FindFirstFileW
lstrcmpiW
FindNextFileW
MapViewOfFileEx
CreateProcessA
GetExitCodeProcess
FlushFileBuffers
HeapFree
GetProcessHeap
HeapAlloc
FlushViewOfFile
CreateFileW
DeleteFileW
GetFileTime
GetStartupInfoA
DelayLoadFailureHook
GetVolumeInformationA
lstrcmpA
GetWindowsDirectoryW
GetVolumeInformationW
SetErrorMode
GetCommandLineA
GetCommandLineW
DuplicateHandle
CreateMutexA
FileTimeToDosDateTime
GetModuleHandleA
FormatMessageW
ReadFile
GetTickCount
CreateEventA
CreateThread
SetThreadPriority
WaitForSingleObject
SetEvent
RemoveDirectoryA
EnterCriticalSection
LeaveCriticalSection
FileTimeToLocalFileTime
FileTimeToSystemTime
DeviceIoControl
GetFileAttributesExA
VirtualFree
WritePrivateProfileStringA
SetCurrentDirectoryA
GetModuleFileNameA
GetEnvironmentVariableA
InitializeCriticalSection
Sleep
GetPrivateProfileStringA
VirtualAlloc
SetFilePointer
WriteFile
InterlockedCompareExchange
GetSystemDirectoryA
GetTempFileNameA
CopyFileA
OpenProcess
MoveFileExA
SetFileAttributesA
GetVersionExA
LocalAlloc
LocalFree
SetLastError
CreateFileA
GetFileSize
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
CloseHandle
GetThreadLocale
GetLocaleInfoA
GetDriveTypeA
ExpandEnvironmentStringsA
FindFirstFileA
FindNextFileA
FindClose
MultiByteToWideChar
WideCharToMultiByte
lstrcmpiA
FormatMessageA
GetFileAttributesA
CreateDirectoryA
GetSystemDirectoryW
LoadLibraryA
GetLastError
GetProcAddress
GetWindowsDirectoryA
DeleteFileA
OpenFileMappingA
FreeLibrary
DeleteCriticalSection
RtlUnwind
InitializeCriticalSectionAndSpinCount
GetSystemTime
VirtualProtect
FlushInstructionCache

shell32

SHGetMalloc
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetSpecialFolderPathA

comctl32

CreatePropertySheetPageW
PropertySheetW

user32

SetProcessWindowStation
EnumDesktopsA
CloseWindowStation
OpenDesktopA
GetThreadDesktop
SetThreadDesktop
EnumWindows
GetProcessWindowStation
GetClientRect
FindWindowExA
GetWindowThreadProcessId
GetWindow
RegisterClassA
CreateWindowExA
DefWindowProcA
MessageBoxW
OpenWindowStationA
EnumWindowStationsA
wvsprintfW
CloseDesktop
GetSystemMetrics
LoadStringA
LoadStringW
MessageBoxA
PostQuitMessage
DestroyWindow
SendMessageA
SetDlgItemTextA
ShowWindow
EnableWindow
GetDlgItem
DispatchMessageA
TranslateMessage
GetMessageA
PostThreadMessageA
SetWindowTextW
RedrawWindow
SetWindowLongA
GetWindowLongA
GetWindowTextA
PostMessageA
EnumChildWindows
SetDlgItemTextW
LoadBitmapA
IsDlgButtonChecked
SetTimer
CheckDlgButton
KillTimer
ReleaseDC
GetDC
SystemParametersInfoA
SetForegroundWindow
SetWindowTextA
EndDialog
DialogBoxParamA
GetDesktopWindow
SetFocus

msvcrt

strncpy
_except_handler3
strchr
_stricmp
strrchr
sprintf
mbstowcs
malloc
free
strncmp
memmove
vsprintf
strncat
_wcsdup
_errno
_open
_read
_write
_close
_lseek
remove
_tempnam
wcscat
_vsnprintf
_vsnwprintf
rename
ctime
_wcsicmp
wcscpy
_snprintf
_local_unwind2
_memicmp
atoi
realloc
_c_exit
_exit
_XcptFilter
_cexit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
swprintf
wcslen
_strnicmp
memchr
_itoa
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_ltoa
wcstoul
_snwprintf
_strcmpi
strstr
_strdup
_strlwr
calloc
getenv
_strupr
wcschr
fprintf
strtoul
wcsstr
strcspn
isdigit
wcsrchr
wcscmp
wcsncat
wcsncpy
_wcslwr
toupper
strspn
atol
strpbrk
isspace
_ultoa
_wtoi64
strtok
_itow
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
__CxxFrameHandler
??3@YAXPAX@Z
??0exception@@QAE@ABV0@@Z
_CxxThrowException
fclose
??2@YAPAXI@Z
fopen

ntdll

LdrUnloadDll
NtQuerySystemTime
RtlInitUnicodeString
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
NtClose
NtAdjustPrivilegesToken
NtOpenProcessToken
NtQueryInformationProcess
RtlCharToInteger
LdrAccessResource
LdrFindResource_U
NtQuerySystemInformation
NtShutdownSystem
RtlFreeHeap
RtlAllocateHeap
RtlRaiseStatus
NtYieldExecution
NtSetSystemInformation
NtCreateSection
NtOpenFile
NtOpenSection
NtOpenDirectoryObject
RtlCompareUnicodeString
NtCreateFile
RtlDosPathNameToNtPathName_U
RtlFreeUnicodeString
NtFreeVirtualMemory
NtQueryInformationThread
NtWaitForSingleObject
RtlCreateUserThread
NtWriteVirtualMemory
NtAllocateVirtualMemory
NtOpenProcess
LdrGetProcedureAddress
LdrLoadDll
RtlDestroyHeap
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlGetAce
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
RtlAllocateAndInitializeSid
RtlCreateHeap
DbgPrint
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlTimeToTimeFields

imagehlp

EnumerateLoadedModules64

mpr

WNetGetUserA
WNetGetUniversalNameA

version

GetFileVersionInfoA
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeW
VerQueryValueA

psapi

GetModuleFileNameExA

ole32

CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

SysFreeString

winspool.drv

GetPrinterDriverDirectoryA

crypt32

CertCloseStore
CertAddCertificateContextToStore
CryptEncodeObject
CertCreateCertificateContext
CertOpenStore
CertSetCertificateContextProperty
CertFreeCertificateContext

advapi32

RegSaveKeyA
RegOpenKeyExW
GetFileSecurityA
RegCloseKey
EnumServicesStatusExA
OpenServiceW
InitiateSystemShutdownA
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyExA
FreeSid
RegSetKeySecurity
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AllocateAndInitializeSid
CloseServiceHandle
ControlService
StartServiceA
OpenServiceA
OpenSCManagerA
RegDeleteValueA
RegOpenKeyA
GetServiceDisplayNameA
QueryServiceStatus
SetFileSecurityA
AddAccessAllowedAce
InitializeAcl
EnumDependentServicesA
RegFlushKey
LockServiceDatabase
RegQueryInfoKeyA
AddAce
SetFileSecurityW
GetAclInformation
CopySid
GetLengthSid
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
AdjustTokenPrivileges
RegUnLoadKeyA
RegLoadKeyA
OpenProcessToken
DeregisterEventSource
ReportEventA
RegisterEventSourceA
GetTokenInformation
SetNamedSecurityInfoA
GetNamedSecurityInfoA
UnlockServiceDatabase
ChangeServiceConfigA
QueryServiceConfigA
AbortSystemShutdownA

gdi32

StretchBlt
GetDIBits
CreateCompatibleDC
DeleteObject
CreateFontIndirectA
GetDeviceCaps
BitBlt
SelectObject

userenv

ord119
ord121
ord138

rpcrt4

UuidFromStringA

Sections

.text
Size: 569KB - Virtual size: 568KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 504KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 117KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cfead1252e1d7e9f635df9d114f15eb4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shell32

comctl32

user32

msvcrt

ntdll

imagehlp

mpr

version

psapi

ole32

oleaut32

winspool.drv

crypt32

advapi32

gdi32

userenv

rpcrt4

Sections

.text Size: 569KB - Virtual size: 568KB

.data Size: 8KB - Virtual size: 504KB

.rsrc Size: 117KB - Virtual size: 196KB

.text
Size: 569KB - Virtual size: 568KB

.data
Size: 8KB - Virtual size: 504KB

.rsrc
Size: 117KB - Virtual size: 196KB