a18147e040aeb49745f3dfb68e7c903b

Sharing

Copy URL Twitter E-mail

General

Target

a18147e040aeb49745f3dfb68e7c903b
Size

371KB
MD5

a18147e040aeb49745f3dfb68e7c903b
SHA1

52af8f13b547b8dbde1f9ee0bb13cbd09598b1b8
SHA256

45a1bb5c1e79a44add4ed0d596c36122729a1ea6a703cfa2936e273a7f3dd4c1
SHA512

ef4bd6baba1b10ae2d9a33954044cd1b823d5784460775e6fa5f74d0569e190b162475a060f479373229cf743b9f724366f112d54ba0b9ad4106695bec765bce
SSDEEP

6144:UwaRdlUkBkSc2PU9lfu7FCQNY4WJLgrvMDHY5sqRFFzmNnoPIsmfcHYra:fWm2PW4JWRNDY5lUQmGYra

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a18147e040aeb49745f3dfb68e7c903b

Files

a18147e040aeb49745f3dfb68e7c903b
.exe windows:5 windows x86 arch:x86

f2b4d4700aa29117809ade90aceb5c89

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

sqlunirl

_wvsprintf_@12
_WriteConsoleInput_@16
_tsystem
_NDdeIsValidShareName_@4
_GetTabbedTextExtent_@20
_DrawText@20
_PeekMessage@20
_SetDlgItemText@12
_OemToChar_@8
_CopyAcceleratorTable_@12
_SetWindowText@8
_DefFrameProc_@20
_RegDeleteValue_@8
_OpenWaitableTimer_@12
_LookupPrivilegeValue_@12
_GetLogicalDriveStrings_@8
_GetTimeFormat_@24
_RegisterClass_@4
_OpenBackupEventLog_@8
_EnumFonts_@16
_CallMsgFilter_@8
_QueryDosDevice_@12
_SendMessageTimeout_@28
_ChangeMenu_@20
_FormatMessage@28
_ObjectOpenAuditAlarm_@48
_GetCommandLine_@0
_RegCreateKey_@12
_FindFirstFileEx_@24
_GetMenuString_@20

kernel32

GetStringTypeExW
FindActCtxSectionStringA
QueryMemoryResourceNotification
lstrcmpiW
FindVolumeClose
LZCreateFileW
IsBadHugeWritePtr
GetVolumeNameForVolumeMountPointW
LCMapStringW
GetProcessHeap
AddConsoleAliasW
CreateToolhelp32Snapshot
VirtualLock
SetProcessAffinityMask
WaitForSingleObjectEx
GetEnvironmentVariableW
FoldStringA
DuplicateConsoleHandle
GetCurrentThread
GetProfileSectionW
RtlUnwind
EnumUILanguagesA
QueryPerformanceCounter
LocalLock
GetACP
OpenThread
GetSystemWow64DirectoryW
GetCommProperties
GetCommConfig
GetUserDefaultUILanguage
IsWow64Process
QueryActCtxW
GetConsoleAliasesLengthW
GetStringTypeW
BaseFlushAppcompatCache
AddVectoredExceptionHandler
GetEnvironmentStringsW
VirtualAlloc
GlobalFindAtomA
_llseek
LocalAlloc
EnumerateLocalComputerNamesW
GetDriveTypeW
LoadLibraryA
FindAtomW
lstrcatA

wintrust

TrustIsCertificateSelfSigned
WVTAsn1CatNameValueDecode
DriverFinalPolicy
IsCatalogFile
WVTAsn1SpcPeImageDataEncode
WintrustAddDefaultForUsage
WVTAsn1SpcFinancialCriteriaInfoDecode
HTTPSFinalProv
OpenPersonalTrustDBDialog
MsCatConstructHashTag
CryptCATPutCatAttrInfo
SoftpubLoadDefUsageCallData
WVTAsn1SpcMinimalCriteriaInfoDecode
WVTAsn1SpcSpAgencyInfoDecode
WTHelperCheckCertUsage
WintrustLoadFunctionPointers
GenericChainFinalProv
CryptCATEnumerateMember
WTHelperOpenKnownStores
WTHelperGetFileHandle
WTHelperGetProvCertFromChain
SoftpubInitialize
CryptCATGetCatAttrInfo
CryptCATPutMemberInfo
mssip32DllUnregisterServer
CryptCATCatalogInfoFromContext
CryptCATAdminRemoveCatalog
CryptCATHandleFromStore
mssip32DllRegisterServer
CryptSIPGetSignedDataMsg
WTHelperGetFileName
CryptCATPersistStore
CryptSIPRemoveSignedDataMsg
CatalogCompactHashDatabase
WVTAsn1SpcLinkDecode
WintrustGetDefaultForUsage
CryptCATVerifyMember
CryptCATAdminAddCatalog

advapi32

AddAccessDeniedAceEx
GetLengthSid
CryptSetHashParam
GetSecurityDescriptorRMControl
SaferGetLevelInformation
RegOpenKeyA
SetEntriesInAclA
ConvertSidToStringSidA
ChangeServiceConfigW
ImpersonateNamedPipeClient
CloseServiceHandle
WmiFileHandleToInstanceNameA
CryptGenKey
SystemFunction007
CryptReleaseContext
SystemFunction032
BackupEventLogA
QueryServiceLockStatusW
GetAuditedPermissionsFromAclA
LsaCreateSecret
WmiMofEnumerateResourcesW
LsaQuerySecurityObject
CryptGetDefaultProviderA
BuildTrusteeWithObjectsAndSidA
StartTraceA
SaferiCompareTokenLevels
RegDeleteValueW
CredFree
DecryptFileA
RegUnLoadKeyA
SetSecurityDescriptorRMControl
GetCurrentHwProfileW
BuildImpersonateExplicitAccessWithNameA
InitializeSecurityDescriptor
NotifyBootConfigStatus
SetEntriesInAccessListA
SystemFunction016
BuildTrusteeWithObjectsAndNameA
CommandLineFromMsiDescriptor
RegOverridePredefKey
LsaSetTrustedDomainInfoByName
RegOpenKeyExW
LsaICLookupSids

hhsetup

?SetVolume@CLocation@@QAEXPBD@Z
?SetVersion@CCollection@@QAEXK@Z
?GetOrder@CFolder@@QAEKXZ
??1CFolder@@QAE@XZ
?GetLanguage@CTitle@@QAEGXZ
?GetIdW@CLocation@@QAEPBGXZ
?SetId@CTitle@@QAEXPBD@Z
?AddFolder@CCollection@@QAEPAVCFolder@@PBDKPAKG@Z
?GetLangId@CCollection@@QAEGPBG@Z
?GetRootFolder@CCollection@@QAEPAVCFolder@@XZ
?SetFirstChildFolder@CFolder@@QAEXPAV1@@Z
?MergeKeywords@CCollection@@QAEHPAD@Z
?GetFirstTitle@CCollection@@QAEPAVCTitle@@XZ
?Open@CCollection@@QAEKPBD@Z
??0CFIFOString@@QAE@XZ
?RemoveAll@CPointerList@@QAEXXZ
?GetVersion@CCollection@@QAEKXZ
??4CTitle@@QAEAAV0@ABV0@@Z
?GetVisableRootFolder@CCollection@@QAEPAVCFolder@@XZ
?GetTail@CFIFOString@@QAEKPAPAD@Z
?GetTitleW@CFolder@@QAEPBGXZ
?AllocCopyValue@CCollection@@AAEKPAVCParseXML@@PADPAPAD@Z
??1CCollection@@QAE@XZ
?DeleteFolders@CCollection@@AAEXPAPAVCFolder@@@Z
?SetTitle@CFolder@@QAEXPBD@Z
?GetNextLocation@CLocation@@QAEPAV1@XZ
?First@CPointerList@@QAEPAUListItem@@XZ
??1CFIFOString@@QAE@XZ
?SetTitle@CLocation@@QAEXPBG@Z
?HandleLocation@CCollection@@AAEKPAVCParseXML@@PAD@Z
?HandleCollection@CCollection@@AAEKPAVCParseXML@@PAD@Z
?DeleteChildren@CCollection@@AAEXPAPAVCFolder@@@Z
?AddLocationHistory@CTitle@@QAEKKPBG00PBVCLocation@@00H@Z
?AddTitle@CCollection@@QAEPAVCTitle@@PBG0000GIPAVCLocation@@PAKH0@Z
?SetExTitlePtr@CFolder@@QAEXPAVCExTitle@@@Z
?SetPath@CLocation@@QAEXPBG@Z
?AddLocation@CCollection@@QAEPAVCLocation@@PBG000PAK@Z
?DeleteLocation@CCollection@@AAEKPAVCLocation@@@Z
?DeleteTitle@CCollection@@AAEKPAVCTitle@@@Z

msvcrt40

??5istream@@QAEAAV0@AAC@Z
_mbsnbicmp
_safe_fprem
_execlp
cos
_lsearch
sscanf
__p__winmajor
clock
getchar
??0filebuf@@QAE@ABV0@@Z
_wfopen
setvbuf
_ismbcupper
_abnormal_termination
?getline@istream@@QAEAAV1@PADHD@Z
_wtoi
_locking
_wstrtime
__CxxLongjmpUnwind
_CItanh
_daylight
__p__amblksiz
_lfind
?clog@@3Vostream_withassign@@A
tmpfile
_outp
_write
?attach@ofstream@@QAEXH@Z
??_8strstream@@7Bostream@@@
__winitenv
?set_unexpected@@YAP6AXXZP6AXXZ@Z
_mbsnset
_environ
_wutime
??0istream@@QAE@PAVstreambuf@@@Z
_flushall
??1filebuf@@UAE@XZ
strtok
_adj_fprem
_heapchk
?setbuf@ifstream@@QAEPAVstreambuf@@PADH@Z
_wunlink
??0Iostream_init@@QAE@AAVios@@H@Z
??0stdiostream@@QAE@ABV0@@Z

Sections

.text
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 418KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f2b4d4700aa29117809ade90aceb5c89

Headers

File Characteristics

Imports

sqlunirl

kernel32

wintrust

advapi32

hhsetup

msvcrt40

Sections

.text Size: 131KB - Virtual size: 131KB

.rdata Size: 120KB - Virtual size: 120KB

.data Size: 1KB - Virtual size: 418KB

.rsrc Size: 116KB - Virtual size: 116KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 131KB - Virtual size: 131KB

.rdata
Size: 120KB - Virtual size: 120KB

.data
Size: 1KB - Virtual size: 418KB

.rsrc
Size: 116KB - Virtual size: 116KB

.reloc
Size: 1024B - Virtual size: 1024B