8bfa86ebada1d5f5b76a3931ccbc0953

Sharing

Copy URL Twitter E-mail

General

Target

8bfa86ebada1d5f5b76a3931ccbc0953
Size

176KB
MD5

8bfa86ebada1d5f5b76a3931ccbc0953
SHA1

0b3b9f16d8914cdfa0e0df48e1f381cab8933a4a
SHA256

3a527bb8b95ad434845a8fe7e598084470414c9093faeae70c4d9b0e8e18dce9
SHA512

cf8f40370a5196b22e86b4ed8e09091d71e39b82d11056efe0764f3f4c1cbec1e34359c865cc613045a0644241aff6272b4adc696395ea94e4c8adf56de6a274
SSDEEP

3072:AbnGCG2I2/Bi8IebOIGo6+o0OrwIEOYf7XqXjDTBfOvuQwjF16+j6t3i1J:A67H2pi8/6M3XqTDTB2vuQKF16m6t3i/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8bfa86ebada1d5f5b76a3931ccbc0953

Files

8bfa86ebada1d5f5b76a3931ccbc0953
.exe windows:4 windows x86 arch:x86

a92fc195481b5da280d8e65f826a0c20

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSARecv
WSASend
WSAGetLastError
WSAWaitForMultipleEvents
WSAResetEvent
WSAGetOverlappedResult
send
inet_addr
gethostbyname
connect
ioctlsocket
select
htons
recv
__WSAFDIsSet
inet_ntoa
gethostname
WSASocketA
WSACloseEvent
WSACreateEvent
WSAStartup
closesocket
WSACleanup

advapi32

RevertToSelf
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
LookupPrivilegeValueA
AdjustTokenPrivileges
CreateProcessAsUserA
OpenProcessToken
RegisterEventSourceA
ReportEventA
DeregisterEventSource
ImpersonateLoggedOnUser
RegEnumValueA
DuplicateTokenEx
GetKernelObjectSecurity
GetSecurityDescriptorDacl
SetEntriesInAclA
MakeAbsoluteSD
SetSecurityDescriptorDacl
SetKernelObjectSecurity
FreeSid
AllocateAndInitializeSid
BuildTrusteeWithSidA
RegOpenKeyA
GetUserNameA

shell32

ShellExecuteA

mfc42

ord2448
ord1575
ord825
ord668
ord1980
ord2770
ord356
ord537
ord800
ord535
ord860
ord540
ord798
ord1997
ord6407
ord2818
ord3337
ord3811
ord5194
ord533
ord823
ord665
ord1187
ord939
ord858
ord2915
ord4129
ord5683
ord1979
ord6385
ord5773
ord3318
ord5186
ord354
ord5856
ord4278
ord2764
ord941
ord3178
ord4058
ord2781
ord5572
ord6877
ord3663
ord5450
ord5834
ord6394
ord2841
ord2044
ord2107
ord2820
ord6283
ord2614
ord4277
ord2763

msvcrt

strcpy
malloc
free
_ftol
exit
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
strncmp
strncpy
strrchr
memmove
atoi
_strlwr
strstr
_mbscmp
realloc
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
_strupr
strcmp
getenv
_flushall
system
__CxxFrameHandler
_except_handler3
_vsnprintf
sprintf
strcat
wcslen
memset
strlen
printf
_stricmp
_strcmpi
_strnicmp
_CxxThrowException
__dllonexit
memcpy
_callnewh
??0exception@@QAE@ABV0@@Z

kernel32

GetModuleHandleW
DuplicateHandle
ExitProcess
CreateMutexA
GetExitCodeThread
GetCurrentThreadId
LocalAlloc
WinExec
GlobalMemoryStatus
GetLogicalDrives
GetWindowsDirectoryA
lstrcmpiA
GetComputerNameA
GetVolumeInformationA
InterlockedDecrement
GlobalFree
GlobalAlloc
SetLastError
DeviceIoControl
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemInfo
LoadLibraryA
FreeLibrary
lstrlenW
lstrcmpA
WideCharToMultiByte
GetLocalTime
GetProcAddress
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
ReadProcessMemory
VirtualFreeEx
GetTempPathA
GetTickCount
GetExitCodeProcess
GetCurrentProcess
GetStartupInfoA
CreateToolhelp32Snapshot
Process32First
Process32Next
RemoveDirectoryA
CreateDirectoryA
SetFileAttributesA
MoveFileA
SetFilePointer
CreateFileA
GetFileSize
lstrcatA
FindFirstFileA
FindNextFileA
FindClose
GetDriveTypeA
lstrcpyA
GetDiskFreeSpaceExA
CreatePipe
SetStdHandle
GetSystemWindowsDirectoryA
GetTempFileNameA
DeleteFileA
InitializeCriticalSection
WaitForMultipleObjectsEx
DeleteCriticalSection
OpenProcess
MoveFileExA
ReadFile
EnterCriticalSection
LeaveCriticalSection
WriteFile
FreeConsole
AllocConsole
SetCurrentDirectoryA
CopyFileA
CreateThread
TerminateProcess
GetConsoleScreenBufferInfo
ReadConsoleOutputA
ReadConsoleOutputCharacterA
GetStdHandle
WriteConsoleInputA
TerminateThread
CloseHandle
CreateEventA
WaitForSingleObject
SetEvent
GetModuleFileNameA
GetVersionExA
GetSystemDirectoryA
GetLastError
FormatMessageA
lstrlenA
LocalFree
OutputDebugStringA
SetErrorMode
GetCommandLineA
GetModuleHandleA
SetUnhandledExceptionFilter
Sleep
CreateProcessA

user32

GetDC
GetDesktopWindow
IsRectEmpty
GetCursor
PostMessageA
CloseDesktop
OpenDesktopA
GetThreadDesktop
keybd_event
mouse_event
SetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
CloseWindowStation
EnumDisplayDevicesA
ReleaseDC
GetProcessWindowStation
GetKeyNameTextA
CallNextHookEx
SetWindowsHookExA
GetMessageA
TranslateMessage
DispatchMessageA
UnhookWindowsHookEx
InternalGetWindowText
wsprintfA
EnumChildWindows
GetWindowLongA
GetWindowThreadProcessId
GetForegroundWindow
GetKeyState
RegisterWindowMessageA
SendMessageTimeoutA
OpenWindowStationA
GetSystemMetrics
GetClassNameA
SetProcessWindowStation
GetFocus
GetAsyncKeyState

gdi32

CreateCompatibleDC
DeleteDC
SelectObject
BitBlt
CreateCompatibleBitmap
GetObjectA
GetStockObject
SelectPalette
RealizePalette
GetDIBits
DeleteObject
CreateDCA
GetDeviceCaps

ole32

CoUninitialize
CoInitialize
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket

oleaut32

SysFreeString
VariantClear
SysAllocString
VariantInit
VariantChangeType

msvcp60

??0Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?nothrow@std@@3Unothrow_t@1@B
??1Init@ios_base@std@@QAE@XZ

shlwapi

SHDeleteKeyA

imm32

ImmGetCompositionStringA
ImmGetContext
ImmReleaseContext

iphlpapi

GetAdaptersInfo

winmm

waveOutGetNumDevs
waveOutGetDevCapsA

wininet

InternetGetConnectedState
InternetReadFile
InternetCheckConnectionA
InternetCloseHandle
InternetOpenUrlA
InternetOpenA

Sections

.text
Size: 100KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a92fc195481b5da280d8e65f826a0c20

Headers

File Characteristics

Imports

ws2_32

advapi32

shell32

mfc42

msvcrt

kernel32

user32

gdi32

ole32

oleaut32

msvcp60

shlwapi

imm32

iphlpapi

winmm

wininet

Sections

.text Size: 100KB - Virtual size: 97KB

.rdata Size: 32KB - Virtual size: 30KB

.data Size: 36KB - Virtual size: 1.0MB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 100KB - Virtual size: 97KB

.rdata
Size: 32KB - Virtual size: 30KB

.data
Size: 36KB - Virtual size: 1.0MB

.rsrc
Size: 4KB - Virtual size: 1KB