9b90cdd57a29be3f0c8a01cb008b7c01

Sharing

Copy URL

Twitter E-mail

General

Target

9b90cdd57a29be3f0c8a01cb008b7c01
Size

1.2MB
MD5

9b90cdd57a29be3f0c8a01cb008b7c01
SHA1

47fa20eabea7063709c73a51e2f54014e952ccd5
SHA256

e113bcfee2335a3701a3dedba7889edc2284ce0c39b3af210622fbda98e8ca9c
SHA512

62719c07edaa8ecd679eeaae85be528cf31e8f9dd66dcd4b705be2230f98bce19eda13329e2ed3daae71c870dbabbcf8de5ce5997257973a0c334ecb6d058e09
SSDEEP

12288:kG1RLNvsH4fBWJcQWGNSWGNNGNt2OAGcJ5a2:JjLNisBWJcQWGNSWGNNGNt2OAGcJ5a2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9b90cdd57a29be3f0c8a01cb008b7c01

Files

9b90cdd57a29be3f0c8a01cb008b7c01
.exe windows:4 windows x86 arch:x86

e06a7317157082b3501a379993ebbc1e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord4621
ord4419
ord6195
ord3087
ord2574
ord4396
ord3365
ord3635
ord6051
ord1768
ord6370
ord5286
ord3397
ord3605
ord1143
ord1165
ord540
ord567
ord2294
ord3296
ord3993
ord858
ord4272
ord6921
ord6919
ord4124
ord2756
ord538
ord3614
ord3621
ord2406
ord1634
ord2634
ord3991
ord4155
ord2858
ord3658
ord755
ord470
ord641
ord3494
ord2507
ord355
ord2910
ord2810
ord823
ord535
ord6898
ord1105
ord2371
ord4215
ord2576
ord3649
ord2430
ord6266
ord1637
ord861
ord798
ord1989
ord6918
ord6920
ord5461
ord5188
ord533
ord3737
ord818
ord4270
ord3792
ord2444
ord5785
ord5273
ord6168
ord5871
ord4294
ord6211
ord6871
ord1088
ord2114
ord2631
ord556
ord3084
ord2859
ord384
ord686
ord3566
ord640
ord5781
ord1633
ord323
ord283
ord6607
ord4118
ord2088
ord2400
ord1808
ord324
ord4229
ord4474
ord6877
ord4704
ord3701
ord613
ord289
ord5276
ord6193
ord4282
ord4279
ord6597
ord2755
ord4273
ord2855
ord942
ord925
ord5679
ord922
ord4197
ord6868
ord668
ord1972
ord3176
ord3173
ord4053
ord2773
ord2762
ord356
ord6278
ord4199
ord940
ord927
ord2606
ord6655
ord3579
ord711
ord413
ord543
ord803
ord5579
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord1569
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord4347
ord5157
ord2377
ord5237
ord4401
ord1767
ord4073
ord6048
ord4992
ord4847
ord4370
ord5261
ord1131
ord2613
ord2506
ord800
ord656
ord693
ord815
ord825
ord561
ord3733
ord4418
ord4616
ord4075
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5710
ord5285
ord5303
ord4692
ord4074
ord2717
ord5298
ord5296
ord3341
ord2388
ord5193
ord1089
ord3917
ord5727
ord2504
ord2546
ord4480
ord6371
ord4269
ord3871
ord4667

msvcrt

_initterm
__wgetmainargs
_wcmdln
exit
_XcptFilter
_exit
swprintf
__setusermatherr
remove
sscanf
strstr
strncpy
atoi
_strnicmp
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
__dllonexit
_onexit
??1type_info@@UAE@XZ
_controlfp
vswprintf
__CxxFrameHandler
wcscat
wcscpy
wcsrchr
_purecall
wcscmp
_wstat
_wsplitpath
_wcsicmp
_ftol
wcsncpy
_except_handler3
_CxxThrowException
??0exception@@QAE@ABV0@@Z
rand
_wcslwr
srand
time
_wtoi
fclose
free
fwrite
sprintf
malloc
fopen
strrchr
wcslen

kernel32

GetFileAttributesW
GetFullPathNameW
WideCharToMultiByte
GetTickCount
OutputDebugStringW
GetExitCodeThread
TerminateThread
GetTempFileNameW
GetModuleHandleW
HeapFree
HeapAlloc
GetProcessHeap
SetLastError
GetLastError
GetStartupInfoW
GetFileSize
ReadFile
RemoveDirectoryW
WaitForSingleObject
SetFileAttributesW
MoveFileExW
GetPrivateProfileStringW
DeleteFileW
FreeLibrary
LoadLibraryW
GetProcAddress
GetModuleFileNameW
GetSystemDefaultLCID
GetVersionExW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CopyFileW
CloseHandle
CreateFileW
CreateDirectoryW
DeleteCriticalSection
lstrlenW
DeviceIoControl
Sleep
GetTempPathW

user32

GetParent
PostMessageW
FindWindowW
SetWindowRgn
EnumChildWindows
GetSysColor
GetClassNameW
SetActiveWindow
SetRect
ScreenToClient
PtInRect
FillRect
PeekMessageW
DestroyCursor
GetWindowRect
GetClientRect
InvalidateRect
SetCursor
SetWindowLongW
TranslateMessage
DispatchMessageW
LoadBitmapW
GetFocus
EnableWindow
CreatePopupMenu
EnableMenuItem
GetCursorPos
wsprintfW
IsIconic
GetSystemMetrics
LoadIconW
EqualRect
CopyRect
IsWindow
DrawIcon
GetSystemMenu
AppendMenuW
SetWindowPos
GetKeyState
OpenClipboard
GetPriorityClipboardFormat
GetClipboardData
CloseClipboard
SendMessageW

gdi32

BitBlt
CreateRoundRectRgn
GetStockObject
GetTextExtentPoint32W
GetObjectW
GetPixel
CreateCompatibleDC
CreateCompatibleBitmap
StretchBlt
SelectObject
CreateFontW
DeleteObject

advapi32

RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey

shell32

ShellExecuteW
DragQueryFileW
DragFinish

comctl32

ImageList_GetImageCount
ImageList_GetImageInfo
ImageList_Draw
ImageList_ReplaceIcon
_TrackMouseEvent
ImageList_AddMasked

wintrust

WinVerifyTrust

msvcp60

??1_Lockit@std@@QAE@XZ
??0logic_error@std@@QAE@ABV01@@Z
??0out_of_range@std@@QAE@ABV01@@Z
??1out_of_range@std@@UAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??0_Lockit@std@@QAE@XZ

shlwapi

PathFileExistsW

ws2_32

closesocket
recv
send
htons
getsockname
WSAStartup
WSACleanup
__WSAFDIsSet
WSAGetLastError
select
listen
WSAAsyncSelect
bind
setsockopt
accept
connect
ioctlsocket
gethostbyname
inet_addr
socket

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e06a7317157082b3501a379993ebbc1e

Headers

File Characteristics

Imports

mfc42u

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

wintrust

msvcp60

shlwapi

ws2_32

iphlpapi

Sections

.text Size: 100KB - Virtual size: 99KB

.rdata Size: 20KB - Virtual size: 17KB

.data Size: 8KB - Virtual size: 7KB

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.text
Size: 100KB - Virtual size: 99KB

.rdata
Size: 20KB - Virtual size: 17KB

.data
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 1.1MB - Virtual size: 1.1MB