99a16ceba9490f9c88554f56eddcd5d4

Sharing

Copy URL Twitter E-mail

General

Target

99a16ceba9490f9c88554f56eddcd5d4
Size

124KB
MD5

99a16ceba9490f9c88554f56eddcd5d4
SHA1

17120a046a3e9a6b70f33f09bb22d0b5e8d4c36e
SHA256

c6bdcf35eb2791be3365dac260d9163bfb60662c58402718ec681803ff73af34
SHA512

5015ea4be9b511c6b34a631db9d076f3d66ef644034e7c626ac4e709a97ad69816127294f40041f3a332e4190d9372d51a3da9c77b1d5bc92d5f2b0553c19f1a
SSDEEP

3072:/F3hR+XVkP1SCPPufoV5QdL3qnWYRj948er:/FRR+XeP1SCPPpOqpT7e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
99a16ceba9490f9c88554f56eddcd5d4

Files

99a16ceba9490f9c88554f56eddcd5d4
.exe windows:5 windows x86 arch:x86

b32626e5d5583101655d03ec988ed3c6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\climb\Connect\piece\ExperienceExercise.pdb

Imports

kernel32

InitializeCriticalSectionAndSpinCount
GetFileType
HeapCreate
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringW
MultiByteToWideChar
GetStringTypeW
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetModuleFileNameW
GetStdHandle
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
RtlUnwind
HeapSize
LoadLibraryW
ExitProcess
GetTimeZoneInformation
WideCharToMultiByte
HeapFree
HeapAlloc
GetProcAddress
GetCurrentThreadId
SetLastError
GetModuleHandleW
TlsFree
DecodePointer
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RaiseException
GetStartupInfoW
SetEnvironmentVariableA
HeapSetInformation
GetCommandLineA
GetTimeFormatA
CompareStringW
GetSystemTime
CloseHandle
GetVersionExA
DeleteCriticalSection
VirtualProtect
GetModuleHandleA
ResetEvent
VirtualProtectEx
CopyFileA
VirtualAlloc
GetLastError
GetStartupInfoA
CreateDirectoryA
GetSystemDirectoryA
CreateProcessA
Sleep
GetVolumeInformationA
OpenProcess
WriteFile
GetDateFormatA
VirtualFree
GetTickCount
QueryPerformanceCounter
LoadResource
SetEndOfFile
FindResourceA
GetFileSize
CreateFileA

user32

InsertMenuItemA
GetDlgItemInt
GetClassNameA
SetCursor
LoadImageA
GetClassInfoExA
CallNextHookEx
IsWindowEnabled
DrawIcon
EnumWindows
GetDC
SetDlgItemInt
GetWindowTextA
GetAsyncKeyState
CheckMenuRadioItem
GetMessagePos
FindWindowA
UpdateWindow
DispatchMessageA
ShowWindow
EnumChildWindows
DefWindowProcA
ReleaseDC
GetWindowLongA

gdi32

TextOutA
StartPage
CreateFontIndirectA
Rectangle
StartDocA
Escape
ExtTextOutA
RestoreDC

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA
EnumPrintersA
GetPrinterA

comctl32

ImageList_GetImageCount
ImageList_Create
ImageList_EndDrag
ImageList_GetDragImage

comdlg32

GetOpenFileNameA
GetSaveFileNameA
ChooseColorA
GetFileTitleA

ole32

CoRevokeClassObject
CoInitialize
OleInitialize
OleSetContainedObject
CoUninitialize
OleUninitialize

ws2_32

gethostname
WSAStartup
WSAConnect
getsockname
shutdown
WSASocketA
gethostbyname
WSACreateEvent
socket
WSACleanup
sendto
setsockopt

wininet

InternetCanonicalizeUrlA
HttpQueryInfoA
InternetOpenUrlA
InternetConnectA
InternetQueryDataAvailable
InternetWriteFile
InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA
InternetOpenA

shlwapi

PathFindNextComponentA
PathFindFileNameA
PathIsFileSpecA

advapi32

InitializeSecurityDescriptor
RegSetValueExA
RegisterServiceCtrlHandlerA
RegQueryValueExA
RegDeleteKeyA
OpenServiceA
OpenProcessToken
StartServiceCtrlDispatcherA
DeleteService
OpenThreadToken
SetEntriesInAclA
RegCloseKey
RegEnumKeyA
RegOpenKeyA
FreeSid
OpenSCManagerA
AllocateAndInitializeSid
QueryServiceStatus
RegOpenKeyExA
RegCreateKeyExA
LookupPrivilegeValueA
GetTokenInformation

winmm

mciGetErrorStringA
timeBeginPeriod
mciSendCommandA
timeEndPeriod

crypt32

CertVerifyCertificateChainPolicy
CertFreeCertificateContext
CertAddCertificateContextToStore
CertCloseStore
CertGetCertificateChain
CertCreateSelfSignCertificate
CertCreateCertificateContext
CertDeleteCertificateFromStore
CertAddEncodedCertificateToStore
CertFreeCertificateChain
CryptHashCertificate

Sections

.text
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b32626e5d5583101655d03ec988ed3c6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

winspool.drv

comctl32

comdlg32

ole32

ws2_32

wininet

shlwapi

advapi32

winmm

crypt32

Sections

.text Size: 85KB - Virtual size: 84KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 4KB - Virtual size: 41KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 85KB - Virtual size: 84KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 4KB - Virtual size: 41KB

.rsrc
Size: 1KB - Virtual size: 1KB