8e16598747acfa12bfed69cb08a42c92

Sharing

Copy URL Twitter E-mail

General

Target

8e16598747acfa12bfed69cb08a42c92
Size

267KB
MD5

8e16598747acfa12bfed69cb08a42c92
SHA1

bbcc110c29f4641310c6a8e20c80f7b6b1cc25ac
SHA256

01a3e5a364e8a5c3ffce3495cdd8e81a77a8cd25cd0e6e018df638a4a85792de
SHA512

2f9bfe9045a0f850db25e8bd92fe6dbed0767d6817cfa869ef3841f1d5108e2b941efcf38712b22947504ab177154f63be757c85a414b8d675d82c55920130e9
SSDEEP

6144:A7+j1NrPtqmhLOXg83y2WC3d1uf5vQiZKD1dxp/s4:AellzhLOXr3vW2MfpJZKVpB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e16598747acfa12bfed69cb08a42c92

Files

8e16598747acfa12bfed69cb08a42c92
.exe windows:4 windows x86 arch:x86

2aef63faa6c4c8e599a13e749aef952e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

netapi32

NetApiBufferFree
NetUserEnum

kernel32

lstrcmpW
CompareFileTime
lstrlenA
MultiByteToWideChar
lstrlenW
LoadLibraryW
GetLastError
lstrcpynW
FreeLibrary
InitializeCriticalSection
GetCurrentProcess
CreateDirectoryW
GetCurrentThread
GetFileAttributesW
GetModuleFileNameW
LocalAlloc
RemoveDirectoryW
GetWindowsDirectoryW
LocalFree
Sleep
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
WaitForSingleObject
CreateEventW
GetExitCodeProcess
SetEvent
GetVersionExW
ExpandEnvironmentStringsA
LoadLibraryA
OpenEventW
GetModuleHandleW
GetTempPathW
SetUnhandledExceptionFilter
GetProcAddress

user32

GetForegroundWindow
GetSystemMetrics
CopyRect
RegisterWindowMessageW
GetCursorPos
InvalidateRect
GetFocus
LoadCursorW
DestroyIcon
GetSysColor
MoveWindow
IsWindow
GetTopWindow
SetTimer
OffsetRect
PostMessageW
SetWindowPos
SendMessageW
EnableWindow

gdi32

CreateFontIndirectW
CreateRectRgn
CreateCompatibleDC
DeleteObject
CreatePatternBrush
CreateSolidBrush

advapi32

IsValidSecurityDescriptor
FreeSid
RegOpenKeyExA
RegQueryValueExA
OpenServiceW
StartServiceW
QueryServiceStatus
OpenSCManagerW
CloseServiceHandle
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RevertToSelf
AddAccessAllowedAce
SetSecurityDescriptorOwner
AllocateAndInitializeSid
InitializeAcl
ImpersonateSelf
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AccessCheck
SetSecurityDescriptorGroup
OpenThreadToken
OpenProcessToken
GetLengthSid

shell32

ShellExecuteW

msasn1

ASN1intx_free
ASN1BERDecUTF8String
ASN1BEREncMultibyteString
ASN1BEREncOpenType
ASN1open_cmp
ASN1generalizedtime_cmp
ASN1_CreateDecoderEx
ASN1BEREncCheck
ASN1BEREncRemoveZeroBits
ASN1char32string_cmp
ASN1intx_sub
ASN1BERDecNotEndOfContents

kbdbu

KbdLayerDescriptor

Sections

.edata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Ding
Size: 3KB - Virtual size: 830KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.X
Size: 512B - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.PX
Size: 512B - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 84KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.npO
Size: 4KB - Virtual size: 468KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 6KB - Virtual size: 311KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.RARlR
Size: 2KB - Virtual size: 354KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 135KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.FeesU
Size: 4KB - Virtual size: 269KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2aef63faa6c4c8e599a13e749aef952e

Headers

File Characteristics

Imports

netapi32

kernel32

user32

gdi32

advapi32

shell32

msasn1

kbdbu

Sections

.edata Size: 7KB - Virtual size: 7KB

.Ding Size: 3KB - Virtual size: 830KB

.X Size: 512B - Virtual size: 35KB

.text Size: 12KB - Virtual size: 12KB

.rdata Size: 3KB - Virtual size: 37KB

.PX Size: 512B - Virtual size: 10KB

.edata Size: 84KB - Virtual size: 161KB

.npO Size: 4KB - Virtual size: 468KB

.data Size: 6KB - Virtual size: 311KB

.RARlR Size: 2KB - Virtual size: 354KB

.edata Size: 135KB - Virtual size: 190KB

.FeesU Size: 4KB - Virtual size: 269KB

.rsrc Size: 2KB - Virtual size: 2KB

.edata
Size: 7KB - Virtual size: 7KB

.Ding
Size: 3KB - Virtual size: 830KB

.X
Size: 512B - Virtual size: 35KB

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 3KB - Virtual size: 37KB

.PX
Size: 512B - Virtual size: 10KB

.edata
Size: 84KB - Virtual size: 161KB

.npO
Size: 4KB - Virtual size: 468KB

.data
Size: 6KB - Virtual size: 311KB

.RARlR
Size: 2KB - Virtual size: 354KB

.edata
Size: 135KB - Virtual size: 190KB

.FeesU
Size: 4KB - Virtual size: 269KB

.rsrc
Size: 2KB - Virtual size: 2KB