af6b3bb1a9658a5c9df6a212858876cb8fa5f83ae173ef5bca8f3aad23e9a694[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

af6b3bb1a9658a5c9df6a212858876cb8fa5f83ae173ef5bca8f3aad23e9a694.exe
Size

879KB
MD5

28fc6f65223c0074684be1809e1fe072
SHA1

877dd6b2f312c9fcd19a385dd0f34a0a7d2c4278
SHA256

af6b3bb1a9658a5c9df6a212858876cb8fa5f83ae173ef5bca8f3aad23e9a694
SHA512

03cb11f95e48a7e822272d80163031953eeb47b0a6da4db0b5b7873134c4cf245306257e6e92ec2fb549a58a33fa5e36fb12e29540c2ed89433d51b288448416
SSDEEP

12288:PFIG1MAVo6stZcQDPELcK1RZBoQ/3tm7awFdCKwxcA:VMAVjstZcQDMPRLB/t8FdCKkcA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af6b3bb1a9658a5c9df6a212858876cb8fa5f83ae173ef5bca8f3aad23e9a694.exe

Files

af6b3bb1a9658a5c9df6a212858876cb8fa5f83ae173ef5bca8f3aad23e9a694.exe
.exe windows:4 windows x86 arch:x86

63a927fdcc044653e1c0fb8b77840e74

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MulDiv
GetCurrentThreadId
SetLastError
FreeLibrary
LoadLibraryExA
GetModuleHandleA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
SetStdHandle
SetFilePointer
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
LCMapStringW
LCMapStringA
GetOEMCP
GetCPInfo
TlsFree
TlsSetValue
lstrcmpA
TlsGetValue
GetFileType
SetHandleCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStdHandle
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapCreate
HeapDestroy
GetStartupInfoA
GetCommandLineA
HeapReAlloc
VirtualQuery
GetSystemInfo
VirtualProtect
RtlUnwind
GetSystemTimeAsFileTime
LocalFree
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcAddress
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
FlushInstructionCache
IsDBCSLeadByte
CreateThread
TerminateThread
lstrcmpiA
lstrlenA
InterlockedDecrement
InterlockedIncrement
lstrlenW
MoveFileExA
GlobalLock
GlobalUnlock
GetCurrentProcess
SetProcessWorkingSetSize
FindFirstFileA
FindNextFileA
FindClose
WideCharToMultiByte
DeleteFileA
GetVolumeInformationA
GetVersionExA
GetFileSize
ReadFile
CreateFileA
GetLastError
WriteFile
MultiByteToWideChar
CloseHandle
GlobalAlloc
FindResourceA
LoadResource
SizeofResource
LockResource
FreeResource
lstrcpynA
GetDateFormatA
GetTimeFormatA
GetTimeZoneInformation
Sleep
GetModuleFileNameA
SetCurrentDirectoryA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
TlsAlloc

user32

InvalidateRgn
SetCapture
IsChild
SetWindowLongA
GetWindowLongA
CreateWindowExA
DestroyWindow
SetWindowPos
ShowWindow
SendMessageA
LoadIconA
ReleaseDC
FillRect
GetDC
SetTimer
EnableWindow
GetDlgItem
SetDlgItemTextA
GetParent
SendDlgItemMessageA
GetClassNameA
ReleaseCapture
CallWindowProcA
DestroyAcceleratorTable
GetWindow
GetFocus
GetDesktopWindow
IsWindow
GetClassInfoExA
LoadCursorA
RegisterClassExA
CreateAcceleratorTableA
PostMessageA
GetWindowRect
InsertMenuItemA
FindWindowA
GetKeyState
SetWindowTextA
GetSystemMetrics
SetActiveWindow
EndPaint
BeginPaint
LoadImageA
GetClientRect
PtInRect
RedrawWindow
SetLayeredWindowAttributes
KillTimer
CharLowerA
OffsetRect
InflateRect
GetUpdateRect
SetFocus
GetWindowDC
CreatePopupMenu
ScreenToClient
ClientToScreen
GetWindowTextA
GetWindowTextLengthA
RegisterWindowMessageA
SystemParametersInfoA
GetScrollInfo
SetCursor
GetDlgItemInt
GetDlgCtrlID
UpdateWindow
DialogBoxParamA
CheckMenuItem
GetMenuItemID
TrackMouseEvent
PostQuitMessage
DispatchMessageA
TranslateMessage
GetMessageA
LoadStringA
MessageBoxA
MoveWindow
GetWindowInfo
GetSysColor
SetForegroundWindow
TrackPopupMenu
DefWindowProcA
ValidateRect
GetSysColorBrush
GetMenuItemRect
FrameRect
CharNextA
EndDialog
DestroyMenu
CopyRect
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
UnregisterClassA
LockWindowUpdate
MessageBeep
GetCursorPos
SetScrollInfo
GetWindowPlacement
RegisterHotKey
UnregisterHotKey
InvalidateRect
DrawTextA
GetMenuItemCount

gdi32

CreateRectRgn
GetTextExtentPoint32A
GetStockObject
GetTextMetricsA
TextOutA
SetTextAlign
CreateDIBitmap
Polygon
CreatePen
SelectClipRgn
EndPage
CreatePatternBrush
Rectangle
SetTextColor
GetCurrentObject
EndDoc
GetTextExtentExPointA
GetDeviceCaps
StartDocA
BitBlt
CreateRoundRectRgn
DeleteObject
SelectObject
CreateFontA
GetObjectA
DeleteDC
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
StretchBlt
StartPage
SetBkMode
SetStretchBltMode

comdlg32

GetOpenFileNameA
PrintDlgA

advapi32

RegDeleteKeyA
GetUserNameA
RegEnumKeyExA
RegQueryInfoKeyA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegDeleteValueA

shell32

SHGetSpecialFolderPathA
ShellExecuteA
DragFinish
DragQueryFileA
Shell_NotifyIconA

ole32

CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
CoInitializeEx
CoInitializeSecurity
CoUninitialize
CoSetProxyBlanket
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CreateStreamOnHGlobal
CLSIDFromString
OleInitialize
OleUninitialize

oleaut32

VarUI4FromStr
VariantClear
SysStringByteLen
GetErrorInfo
SysAllocStringLen
VariantInit
OleCreateFontIndirect
LoadRegTypeLi
SysAllocString
SysFreeString
SysStringLen
LoadTypeLi

ws2_32

closesocket
connect
htonl
htons
socket
gethostbyname
recv
send
setsockopt
WSAStartup
WSACleanup

gdiplus

GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateHBITMAPFromBitmap
GdipDisposeImage
GdiplusShutdown
GdiplusStartup
GdipAlloc
GdipCloneImage
GdipFree

winmm

PlaySoundA

comctl32

InitCommonControlsEx

msimg32

TransparentBlt

libeay32

ord227
ord223

ssleay32

ord87
ord59
ord75
ord43
ord341
ord74
ord183
ord127
ord130
ord78
ord108
ord12
ord58

Sections

.text
Size: 239KB - Virtual size: 238KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 70KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 503KB - Virtual size: 502KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63a927fdcc044653e1c0fb8b77840e74

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

ws2_32

gdiplus

winmm

comctl32

msimg32

libeay32

ssleay32

Sections

.text Size: 239KB - Virtual size: 238KB

.rdata Size: 66KB - Virtual size: 66KB

.data Size: 70KB - Virtual size: 1.2MB

.rsrc Size: 503KB - Virtual size: 502KB

.text
Size: 239KB - Virtual size: 238KB

.rdata
Size: 66KB - Virtual size: 66KB

.data
Size: 70KB - Virtual size: 1.2MB

.rsrc
Size: 503KB - Virtual size: 502KB