a42d64bf7a8cc24e49da3be6544c0f1c

Sharing

Copy URL Twitter E-mail

General

Target

a42d64bf7a8cc24e49da3be6544c0f1c
Size

580KB
MD5

a42d64bf7a8cc24e49da3be6544c0f1c
SHA1

bf3fa17041b152b4b2f89df0317fe7799bd966d5
SHA256

6057b8494cdc504549c087450b5c4d0e24246a13524465c0a547286816a5ece4
SHA512

34eef15ef95b3288b8fde4123e622b1d04a7bf70bf9f47c2d354d75e90bfd383e49c42f3f1177ebd2be66f4a4eecb48668cee7a91a942ad345f84aa5b342f497
SSDEEP

12288:smOSSPAWkQDl3+ND8hRTScTWYU9KMy/vkqpctmOASvoWKrTq6uRtRmPz:heY1QDlqD8hvT69hyXkgctmO4WR6Ei

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a42d64bf7a8cc24e49da3be6544c0f1c

Files

a42d64bf7a8cc24e49da3be6544c0f1c
.exe windows:5 windows x86 arch:x86

f826a48a91e12587dc916c9291b4021e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

H:\source\source.YV\80306\Release_wdautoex_9\WX\Desktop_x86_32\Release\WdAutoEx.pdb

Imports

comctl32

ord17

mpr

WNetEnumResourceW
WNetGetUniversalNameW
WNetOpenEnumW
WNetCloseEnum

uxtheme

SetWindowTheme

kernel32

DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
WideCharToMultiByte
MultiByteToWideChar
InterlockedExchangeAdd
InterlockedIncrement
GetLastError
LoadLibraryW
GetFileInformationByHandle
GetLogicalDriveStringsW
GetVolumeInformationW
WriteFile
ReadFile
SetFilePointer
LockFile
LockFileEx
UnlockFile
UnlockFileEx
FlushFileBuffers
SetEndOfFile
SetFileValidData
SetErrorMode
SetFileTime
SetLastError
GetFileTime
SystemTimeToFileTime
FileTimeToSystemTime
CreateFileW
Sleep
DeleteFileW
GetFileAttributesW
CreateDirectoryW
RemoveDirectoryW
FindFirstFileW
FindClose
SetFileAttributesW
FindFirstFileExW
FindNextFileW
GetTempPathW
GetCurrentDirectoryW
GetTempFileNameW
GetFullPathNameW
GetDriveTypeW
QueryDosDeviceW
FreeLibrary
OpenProcess
TerminateProcess
HeapSize
InitializeCriticalSection
CompareStringW
CompareStringA
GetPrivateProfileStringW
GetTimeZoneInformation
GetVersionExW
GetCurrentProcess
CreateProcessW
LCMapStringW
GetPrivateProfileIntW
SetEnvironmentVariableW
GetExitCodeProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
HeapReAlloc
SetStdHandle
WriteConsoleW
DecodePointer
GetStringTypeW
HeapAlloc
HeapFree
GetACP
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
GetStdHandle
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
LocalFree
LockResource
LoadResource
FindResourceW
FormatMessageW
GetProcAddress
GetModuleHandleW
CloseHandle
SetEnvironmentVariableA
GetProcessHeap
GetModuleFileNameW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
RaiseException
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId

user32

GetDlgItemTextW
IsDlgButtonChecked
CheckDlgButton
GetDlgItem
SetDlgItemTextW
SetWindowPos
GetParent
DialogBoxParamW
EndDialog
IsWindow
MessageBoxW
CharUpperBuffW
CharUpperW
SendDlgItemMessageW
LoadStringW
FillRect
DestroyWindow
ReleaseDC
DrawTextW
GetDC
UpdateWindow
ShowWindow
SendMessageW
GetClientRect
GetSystemMetrics
CreateWindowExW
RegisterClassW
LoadIconW
DefWindowProcW
SetWindowTextW

gdi32

GetStockObject
SetROP2
LineTo
MoveToEx
CreatePen
DeleteObject
SelectObject
CreateFontIndirectW
SetTextColor
SetBkMode
CreateSolidBrush

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

shell32

SHGetPathFromIDListW
ShellExecuteExW
ShellExecuteW
SHBrowseForFolderW

ole32

OleInitialize

Exports

Exports

CommandeComposante

Sections

.text
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f826a48a91e12587dc916c9291b4021e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

mpr

uxtheme

kernel32

user32

gdi32

advapi32

shell32

ole32

Exports

Exports

Sections

.text Size: 175KB - Virtual size: 175KB

.rdata Size: 71KB - Virtual size: 71KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 91KB - Virtual size: 90KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 175KB - Virtual size: 175KB

.rdata
Size: 71KB - Virtual size: 71KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 91KB - Virtual size: 90KB

.reloc
Size: 8KB - Virtual size: 8KB