0c595e1a4b72bec6ba3e89e91091e5e1825e723ea87543da998ca41100875f71

Sharing

Copy URL Twitter E-mail

General

Target

0c595e1a4b72bec6ba3e89e91091e5e1825e723ea87543da998ca41100875f71
Size

3.3MB
MD5

2c457b27c7493a7c267e64feb8f5769d
SHA1

b2a5e3182287cc953b01f5724cf0f3a9a4535339
SHA256

0c595e1a4b72bec6ba3e89e91091e5e1825e723ea87543da998ca41100875f71
SHA512

f140251c189325597fed240bfb47afc7dc5f5e3d7f7fbc7ce3274d99b65d85b0602465ed86379f29f7ccae0c4888eb69a1f77edec5c9a09da3d0782339021bde
SSDEEP

24576:lv7pbOZ18nQEoANjh3et3kLlaJLRKI8RxXGf85U8fC4je:lv218BPj5eiLlaJLRKp9Gf85Uz4S

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c595e1a4b72bec6ba3e89e91091e5e1825e723ea87543da998ca41100875f71

Files

0c595e1a4b72bec6ba3e89e91091e5e1825e723ea87543da998ca41100875f71
.exe windows:5 windows x86 arch:x86

38cb4b2e15c3a6b92743cdcaa120c7c0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mc8041a

MC8041A_Close
MC8041A_WriteWord
MC8041A_ReadWord
MC8041A_ReadByte
MC8041A_Open
MC8041A_WriteByte

unlha32

ord1

mil

ord150
ord202
ord213
ord197
ord212
ord109
ord116
ord145
ord143
ord106
ord129
ord146
ord158
ord912
ord153
ord802
ord157
ord201
ord123
ord136
ord152
ord142
ord275
ord102
ord100
ord101
ord273
ord215
ord110
ord156
ord114
ord147
ord274
ord138
ord276

milpat

ord129
ord110
ord103
ord109
ord201
ord125
ord117
ord118
ord111
ord105
ord106
ord107
ord115
ord116
ord102
ord113
ord112
ord120
ord122

milim

ord101
ord128
ord107
ord103

milmeas

ord107
ord111
ord113
ord112
ord101
ord105
ord106

milblob

ord101
ord105
ord108
ord104
ord114
ord102
ord115
ord107
ord100

milcal

ord103

mfc100

ord2538
ord11318
ord10915
ord868
ord978
ord5627
ord3621
ord5539
ord3373
ord13348
ord4498
ord4144
ord7491
ord7927
ord11940
ord6054
ord11924
ord11939
ord3694
ord4130
ord12720
ord12096
ord12095
ord3404
ord2183
ord4340
ord374
ord943
ord3421
ord796
ord2505
ord12967
ord2207
ord4790
ord5830
ord12344
ord12438
ord11439
ord11626
ord6835
ord9399
ord888
ord6112
ord9281
ord5098
ord11787
ord11153
ord11184
ord9449
ord7355
ord4078
ord11180
ord11172
ord5238
ord3409
ord13481
ord13484
ord13482
ord13485
ord13480
ord13483
ord7144
ord11413
ord13181
ord10922
ord14075
ord1732
ord7091
ord11806
ord3618
ord3676
ord8486
ord13299
ord7073
ord13301
ord11421
ord11420
ord2163
ord4724
ord13767
ord11726
ord7510
ord7584
ord1288
ord13045
ord4345
ord12672
ord1890
ord6637
ord1900
ord1244
ord3963
ord1854
ord3234
ord6076
ord2826
ord10030
ord6961
ord10852
ord7178
ord1480
ord7837
ord13135
ord13129
ord7876
ord919
ord3429
ord2613
ord7861
ord3741
ord2744
ord8224
ord5784
ord3755
ord2838
ord8231
ord6090
ord3390
ord2184
ord5776
ord2611
ord1263
ord9475
ord1479
ord1483
ord6678
ord7581
ord1266
ord3254
ord11067
ord8137
ord10360
ord3620
ord2974
ord2973
ord2752
ord5532
ord12531
ord2416
ord8235
ord8305
ord5803
ord381
ord946
ord3737
ord5775
ord1011
ord2409
ord13280
ord3431
ord2614
ord7862
ord3743
ord2776
ord8227
ord5857
ord915
ord3738
ord2742
ord5534
ord12535
ord2881
ord2878
ord7349
ord2417
ord14059
ord14061
ord14060
ord14058
ord14062
ord14045
ord13972
ord13973
ord8222
ord11025
ord3395
ord10883
ord13294
ord8070
ord11154
ord6217
ord9994
ord8351
ord2847
ord12644
ord11190
ord11188
ord1496
ord1503
ord1509
ord1507
ord1514
ord4373
ord4410
ord4381
ord4393
ord4389
ord4385
ord4415
ord4406
ord4377
ord4419
ord4398
ord4364
ord4368
ord4401
ord3991
ord13980
ord3984
ord2661
ord13302
ord7074
ord13300
ord6128
ord10672
ord12482
ord5253
ord2338
ord11060
ord3484
ord2945
ord2944
ord2846
ord11103
ord4622
ord4903
ord5095
ord8439
ord4881
ord5123
ord265
ord1482
ord1315
ord7322
ord306
ord1294
ord5242
ord305
ord2626
ord6836
ord6694
ord337
ord7933
ord4785
ord11882
ord3970
ord12962
ord2406
ord1929
ord788
ord1210
ord7206
ord869
ord12440
ord1267
ord300
ord12868
ord7211
ord12430
ord1012
ord3744
ord8228
ord5302
ord5858
ord2061
ord11744
ord5207
ord4625
ord4774
ord4606
ord5444
ord6897
ord6898
ord6888
ord4772
ord7357
ord9286
ord8304
ord5777
ord895
ord5774
ord3439
ord316
ord4283
ord1448
ord1982
ord901
ord5837
ord310
ord2063
ord11781
ord7487
ord5175
ord968
ord5821
ord2067
ord11107
ord6970
ord7515
ord10007
ord1296
ord3977
ord1316
ord1313
ord13219
ord8465
ord4782
ord12128
ord7871
ord8554
ord422
ord2088

msvcr100

_strupr
_setmbcp
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
?terminate@@YAXXZ
_CIasin
_CIpow
rename
_CItan
_CIatan
atol
_spawnl
strchr
memmove
??0exception@std@@QAE@XZ
_purecall
_CIatan2
vfprintf
fputs
strtod
_CIacos
_CIsqrt
abort
fscanf
strtol
strrchr
_splitpath
fread
ferror
strtok
atoi
memset
_CIcos
_CIsin
srand
rand
memcpy
ceil
fputws
fseek
ftell
fopen_s
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
free
malloc
__iob_func
exit
fwrite
atof
sprintf
fopen
fprintf
fclose
fgets
_time64
__CxxFrameHandler3
_localtime64_s
strftime
_unlink

kernel32

Sleep
CopyFileA
CloseHandle
GetWindowsDirectoryA
CreateMutexA
ResumeThread
GetExitCodeThread
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleFileNameA
CreateEventA
EncodePointer
GetModuleHandleA
InterlockedExchange
InterlockedCompareExchange
HeapSetInformation
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
GetLastError
GetPrivateProfileIntA
WaitForSingleObject
ReleaseMutex
GetTickCount
DeleteFileA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentProcess
DecodePointer
GetPrivateProfileStringA
CreateDirectoryA
SetEvent
WritePrivateProfileStringA

user32

SetTimer
SendMessageA
SetForegroundWindow
KillTimer
LoadBitmapW
SetRectEmpty
IsRectEmpty
EqualRect
SetScrollRange
SetScrollPos
LoadIconW
IntersectRect
GetDlgCtrlID
GetPropA
EnableWindow
GetLastActivePopup
GetWindow
GetDesktopWindow
IsIconic
ReleaseDC
GetDC
LoadStringA
MessageBoxA
FrameRect
ExitWindowsEx
GetSysColor
PostMessageA
GetClientRect
FillRect
InvalidateRect
ScreenToClient
GetDlgItem
LoadBitmapA
GetWindowRect
PtInRect
RedrawWindow

gdi32

GetStockObject
CreateFontA
Arc
BitBlt
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
Rectangle
Ellipse
CreatePen
DeleteObject
CreateSolidBrush
GetTextMetricsA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA

shell32

SHGetPathFromIDListA
SHBrowseForFolderA

shlwapi

PathRemoveFileSpecA

ole32

CoTaskMemFree

oleaut32

SysFreeString

msvcp100

?_Xlength_error@std@@YAXPBD@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z

netapi32

Netbios

winmm

timeBeginPeriod
timeEndPeriod
timeSetEvent
timeKillEvent

Sections

.text
Size: 567KB - Virtual size: 566KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 145KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

38cb4b2e15c3a6b92743cdcaa120c7c0

Headers

DLL Characteristics

File Characteristics

Imports

mc8041a

unlha32

mil

milpat

milim

milmeas

milblob

milcal

mfc100

msvcr100

kernel32

user32

gdi32

advapi32

shell32

shlwapi

ole32

oleaut32

msvcp100

netapi32

winmm

Sections

.text Size: 567KB - Virtual size: 566KB

.rdata Size: 83KB - Virtual size: 82KB

.data Size: 3KB - Virtual size: 4.4MB

.idata Size: 12KB - Virtual size: 11KB

.rsrc Size: 2.5MB - Virtual size: 2.5MB

.reloc Size: 145KB - Virtual size: 148KB

.text
Size: 567KB - Virtual size: 566KB

.rdata
Size: 83KB - Virtual size: 82KB

.data
Size: 3KB - Virtual size: 4.4MB

.idata
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 2.5MB - Virtual size: 2.5MB

.reloc
Size: 145KB - Virtual size: 148KB