9c4dbde1822f6daa57718397b57c3485

Sharing

Copy URL Twitter E-mail

General

Target

9c4dbde1822f6daa57718397b57c3485
Size

106KB
MD5

9c4dbde1822f6daa57718397b57c3485
SHA1

0debb1c07c7a09f8feadb6b3104b85fd0c0fe1ad
SHA256

b68a9fa2c98a839bfc61691e6eb35adb96800cd5aaf0117d115403b016aa72c1
SHA512

eb7b3ddfc94eba582f84920761683de814e5c638162309158d7c24feedc2a645aaa2856ffa499272d92d09480ccfc9672cab9e826c2fcb7e1355e63af8ea9f99
SSDEEP

3072:cGAgPlmbDdQVRii0q/BH5lS6y/uOt8w60:cGabDdAiHq/R5lS6y/uOtl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9c4dbde1822f6daa57718397b57c3485

Files

9c4dbde1822f6daa57718397b57c3485
.exe windows:6 windows x86 arch:x86

15494ef6757e8e371f150bb8680d6fbd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Work\MobilityService\Service\Release\MobilityService.pdb

Imports

msvcr80

_CxxThrowException
_decode_pointer
memset
_except_handler4_common
_invoke_watson
_controlfp_s
_lock
__dllonexit
_unlock
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
_crt_debugger_hook
_onexit
_adjust_fdiv
__FrameUnwindFilter
printf
?what@exception@std@@UBEPBDXZ
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__initenv
exit
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
??3@YAXPAX@Z
__p__commode
_mbsicmp
strstr
__CxxQueryExceptionSize
__CxxExceptionFilter
__CxxRegisterExceptionObject
__CxxDetectRethrow
__CxxUnregisterExceptionObject
??2@YAPAXI@Z
_mbsstr
sprintf
??0exception@std@@QAE@ABV01@@Z
??_V@YAXPAX@Z
??1exception@std@@UAE@XZ

kernel32

lstrlenW
GetLastError
OutputDebugStringA
GetModuleFileNameA
CreateProcessA
CloseHandle
WTSGetActiveConsoleSessionId
LocalAlloc
InterlockedDecrement
LocalFree
InterlockedIncrement
GetCurrentProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedExchange
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess

netapi32

NetShareAdd
NetShareDel

wtsapi32

WTSFreeMemory
WTSEnumerateProcessesA

user32

FindWindowA
SendMessageA
MessageBoxA
PostMessageA

advapi32

QueryServiceStatus
DeleteService
CreateServiceA
BuildTrusteeWithSidA
SetEntriesInAclA
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
ControlService
CloseServiceHandle
StartServiceA
OpenSCManagerA
OpenServiceA

shell32

SHChangeNotify

ole32

CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoSetProxyBlanket
CoCreateInstance

oleaut32

SysFreeString
VariantCopy
SysAllocString
VariantInit
VariantClear
CreateErrorInfo
SetErrorInfo
VariantChangeType
GetErrorInfo

msvcm80

?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@P$AAVException@3@@Z
?DoDllLanguageSupportValidation@<CrtImplementationDetails>@@YAXXZ
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@@Z
?ThrowNestedModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVException@System@@0@Z
?DoCallBackInDefaultDomain@<CrtImplementationDetails>@@YAXP6GJPAX@Z0@Z
?RegisterModuleUninitializer@<CrtImplementationDetails>@@YAXP$AAVEventHandler@System@@@Z

msvcp80

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$allocator@D@std@@QAE@ABV01@@Z
??0?$allocator@_W@std@@QAE@ABV01@@Z

mscoree

_CorExeMain

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

15494ef6757e8e371f150bb8680d6fbd

Headers

File Characteristics

PDB Paths

Imports

msvcr80

kernel32

netapi32

wtsapi32

user32

advapi32

shell32

ole32

oleaut32

msvcm80

msvcp80

mscoree

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 75KB - Virtual size: 74KB

.data Size: 1KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 75KB - Virtual size: 74KB

.data
Size: 1KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB