2480ba8cebfa2a502e560c748a61fc6df1483f05724d0409eac56500ce8a4301

Sharing

Copy URL Twitter E-mail

General

Target

2480ba8cebfa2a502e560c748a61fc6df1483f05724d0409eac56500ce8a4301
Size

2.5MB
MD5

b8b828c59e8294fc66e929be5b686cfb
SHA1

beb2896d8d07c46bbb5c5a19c66671408d4fedee
SHA256

2480ba8cebfa2a502e560c748a61fc6df1483f05724d0409eac56500ce8a4301
SHA512

d9bc6bb84df671117ab732d4d1910ffa82f6c4e7c72acfadf3efd23867ee5dd55854f1eceea9d0f4ece2534cab81ce4f18466a94948ff22f454b900bd1661c7c
SSDEEP

49152:NHaHof5cgsGJyPdvZOVyr50suVtCU4pcCqTqEEh/:FP//JCvZH50LVIU4pZfh/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2480ba8cebfa2a502e560c748a61fc6df1483f05724d0409eac56500ce8a4301

Files

2480ba8cebfa2a502e560c748a61fc6df1483f05724d0409eac56500ce8a4301
.exe windows:6 windows x86 arch:x86

9c1d7b85a949b53f3cdf60d4d1ddb248

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\My_Lab\TabExplorer\ExTab_temp\bin\release\extab.pdb

Imports

kernel32

ReadConsoleW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
GetFileSizeEx
HeapReAlloc
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
HeapAlloc
HeapFree
WriteConsoleW
GetFileType
SetStdHandle
GetConsoleMode
GetConsoleCP
GetModuleHandleExW
ExitThread
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
OutputDebugStringW
CreateEventW
GetUserDefaultLangID
LoadLibraryExW
lstrcmpiW
FindResourceW
LoadResource
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
SizeofResource
FreeLibrary
GetProcAddress
LoadLibraryW
Wow64RevertWow64FsRedirection
GetLogicalDriveStringsW
OpenProcess
WaitForSingleObject
RegisterWaitForSingleObject
Wow64DisableWow64FsRedirection
lstrlenW
GetVolumeInformationW
WinExec
CloseHandle
CreateMutexW
SetThreadUILanguage
GetCurrentProcessId
GetCurrentThreadId
ExitProcess
GetStartupInfoW
GetModuleHandleW
Sleep
CreateDirectoryW
CopyFileW
GetModuleFileNameW
GetTickCount
DeleteCriticalSection
ReleaseSemaphore
VirtualFree
VirtualProtect
VirtualAlloc
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
GetPrivateProfileStringW
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
InitializeCriticalSection
TerminateThread
SuspendThread
IsBadReadPtr
GetDiskFreeSpaceExW
CancelWaitableTimer
CreateWaitableTimerW
SetWaitableTimer
IsBadWritePtr
lstrcmpA
DeviceIoControl
FlushFileBuffers
SetFilePointerEx
SetEndOfFile
SetFileTime
CreateThread
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
GetLocalTime
RtlCaptureStackBackTrace
LockResource
GetVersionExW
MapViewOfFile
GetTempFileNameW
ReplaceFileW
GetFileAttributesExW
UnmapViewOfFile
GetFileAttributesW
FindClose
GetTempPathW
RemoveDirectoryW
GetLongPathNameW
FindNextFileW
WaitForMultipleObjects
LocalFree
GetCommandLineW
HeapSetInformation
GetSystemInfo
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
ResumeThread
AssignProcessToJobObject
GetStdHandle
ReadFile
GetThreadLocale
SystemTimeToFileTime
FormatMessageA
CreateProcessW
DeleteFileW
GetModuleHandleA
ReleaseMutex
CreateFileW
SetFilePointer
OutputDebugStringA
WriteFile
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
SetEvent
FlushInstructionCache
LoadLibraryExA
GlobalFree
VirtualQuery
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionEx
IsDebuggerPresent
GetCPInfo
WideCharToMultiByte
TryEnterCriticalSection
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
SwitchToThread
GetCurrentThread
GetNativeSystemInfo
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
QueryPerformanceCounter
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW

user32

IsZoomed
GetWindow
GetParent
GetWindowLongW
PostMessageW
IsWindowVisible
SetWindowPos
ShowWindow
IsWindow
FindWindowW
SetWindowLongW
IsIconic
GetIconInfo
MessageBoxW
GetSystemMetrics
GetWindowRect
GetWindowTextW
InvalidateRect
SetForegroundWindow
UpdateWindow
PtInRect
KillTimer
GetClientRect
FlashWindowEx
EndDeferWindowPos
SetParent
mouse_event
GetClassNameW
RegisterRawInputDevices
BringWindowToTop
GetMessagePos
SendMessageW
MapWindowPoints
WindowFromPoint
GetDoubleClickTime
DrawFrameControl
DrawFocusRect
FrameRect
InvertRect
InflateRect
SetCursorPos
GetCursorPos
UnregisterClassW
LoadCursorW
SetFocus
GetWindowDC
SendMessageTimeoutW
GetWindowPlacement
EnumDisplayMonitors
RedrawWindow
SetScrollInfo
SetWindowTextW
BeginPaint
EndPaint
GetKeyState
GetPropW
CreateWindowExW
CallNextHookEx
RegisterClassExW
LoadStringW
UnhookWindowsHookEx
SetPropW
SetCapture
SetWindowsHookExW
UpdateLayeredWindow
ReleaseCapture
SendInput
DefWindowProcW
CharNextW
AdjustWindowRectEx
GetClassLongW
ReleaseDC
GetLastActivePopup
MonitorFromPoint
FindWindowExW
GetDC
MonitorFromWindow
EnumChildWindows
GetMonitorInfoW
GetTopWindow
GetDesktopWindow
CharLowerW
wsprintfW
PostQuitMessage
TranslateMessage
GetQueueStatus
CallMsgFilterW
MsgWaitForMultipleObjectsEx
PeekMessageW
SetLayeredWindowAttributes
WaitMessage
DestroyWindow
GetGuiResources
DrawTextW
FillRect
DrawIconEx
CreateIconIndirect
GetSysColor
IsChild
GetActiveWindow
DispatchMessageW
LoadIconW
DestroyIcon
CallWindowProcW
RegisterClipboardFormatW
IsClipboardFormatAvailable
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
SetRectEmpty
EnableWindow
EnableMenuItem
SetRect
SetCursor
GetUpdateRect
IntersectRect
IsRectEmpty
IsWindowEnabled
TrackMouseEvent
ValidateRect
SetWindowPlacement
GetCapture
OffsetRect
NotifyWinEvent
UnionRect
SetWindowRgn
MonitorFromRect
GetFocus
GetSystemMenu
DrawEdge
GetMenuInfo
EndMenu
DrawTextExW
DestroyMenu
SetMenuInfo
SetMenuItemInfoW
GetSubMenu
TrackPopupMenu
CreatePopupMenu
GetMenuItemCount
InsertMenuItemW
GetMenuState
GetMenuItemInfoW
MapVirtualKeyW
GetClassInfoExW
ActivateKeyboardLayout
GetKeyboardLayout
GetCaretPos
GetWindowTextLengthW
CopyRect
GetWindowInfo
GetSysColorBrush
GetComboBoxInfo
RegisterWindowMessageW
GetAncestor
SystemParametersInfoW
EnumWindows
EnumThreadWindows
GetWindowRgn
GetWindowThreadProcessId
DeferWindowPos
keybd_event
SetActiveWindow
ScreenToClient
LoadAcceleratorsW
BeginDeferWindowPos
CopyAcceleratorTableW
GetAsyncKeyState
SetTimer
ClientToScreen
GetRawInputData
AttachThreadInput
GetForegroundWindow
MoveWindow

gdi32

SetBkColor
TextOutW
SetPixel
SetBkMode
SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteDC
LineTo
CreatePen
MoveToEx
GetDeviceCaps
CreateRectRgn
BitBlt
DeleteObject
GetPixel
CreatePolygonRgn
SetWorldTransform
ExtTextOutW
SetTextAlign
GetOutlineTextMetricsW
CreateFontIndirectW
GetObjectW
GetBitmapBits
StretchBlt
CreateBitmap
PtInRegion
PatBlt
SetTextColor
GetBkColor
CreateSolidBrush
EqualRgn
ExcludeClipRect
GetRgnBox
CreateCompatibleBitmap
SetLayout
SetViewportOrgEx
GetTextMetricsW
GetTextExtentPoint32W
SetMapMode
SaveDC
GetStockObject
RestoreDC
IntersectClipRect
GdiAlphaBlend
SetBrushOrgEx
AbortPath
BeginPath
CreateRectRgnIndirect
PolyBezier
PathToRegion
SetPolyFillMode
EndPath
SelectClipRgn
SetArcDirection
SetDCBrushColor
SetStretchBltMode
SetROP2
SetDCPenColor
SetGraphicsMode
GdiFlush
GetFontData
GetGlyphIndicesW
GetGlyphOutlineW

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

RegQueryInfoKeyW
RegDeleteKeyW
RegEnumKeyExW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
CreateProcessAsUserW

shell32

ShellExecuteA
SHGetFileInfoA
DragFinish
SHGetMalloc
ShellExecuteW
SHGetFileInfoW
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW
SHCreateItemFromIDList
SHGetDesktopFolder
SHAppBarMessage
SHGetSpecialFolderPathW
CommandLineToArgvW
SHFileOperationW
DragQueryFileW
Shell_NotifyIconW

ole32

DoDragDrop
OleDuplicateData
RegisterDragDrop
CoCreateInstance
CoCreateGuid
RevokeDragDrop
CoTaskMemRealloc
OleInitialize
CoTaskMemAlloc
OleUninitialize
CoTaskMemFree
CoInitialize
ReleaseStgMedium

oleaut32

LoadTypeLi
SysStringLen
SysFreeString
VariantClear
SysAllocString
VariantInit
VarUI4FromStr
LoadRegTypeLi

shlwapi

PathIsUNCA
UrlCreateFromPathW
PathGetDriveNumberW
PathRemoveExtensionW
PathIsUNCW
PathFindExtensionW
UrlCreateFromPathA
PathFindFileNameW
PathFileExistsW
PathIsURLA
PathIsURLW
PathCreateFromUrlA
PathStripPathW
PathCreateFromUrlW
PathFileExistsA
PathIsDirectoryA
PathIsDirectoryW
PathRemoveFileSpecW
PathStripToRootW
SHEnumValueW
ord176
StrStrIW
SHDeleteValueW
PathAppendW
SHSetValueW
SHGetValueW

gdiplus

GdiplusShutdown
GdipSetPenStartCap
GdipSetSmoothingMode
GdiplusStartup
GdipSetPenEndCap
GdipDeleteGraphics
GdipDeletePen
GdipCreatePen1
GdipCreateFromHDC
GdipDrawLineI

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

dbghelp

SymFromAddr
SymGetLineFromAddr64
SymSetOptions
SymInitialize

netapi32

Netbios

wininet

InternetQueryOptionW
HttpQueryInfoA
InternetReadFile
InternetSetOptionW
InternetSetStatusCallbackW
InternetCrackUrlW
HttpOpenRequestW
FtpCommandW
HttpSendRequestExW
InternetGetLastResponseInfoW
InternetWriteFile
FtpOpenFileW
InternetOpenW
InternetSetOptionA
FtpGetFileSize
InternetConnectW
HttpQueryInfoW
HttpAddRequestHeadersW
HttpSendRequestW
HttpAddRequestHeadersA
InternetReadFileExA
HttpEndRequestW
InternetCloseHandle

usp10

ScriptItemize
ScriptShape
ScriptFreeCache

psapi

GetProcessMemoryInfo

oleacc

AccessibleObjectFromWindow
ObjectFromLresult
LresultFromObject

imm32

ImmGetCompositionStringW
ImmReleaseContext
ImmGetContext

comctl32

ImageList_Destroy
ImageList_Create
ImageList_ReplaceIcon

msimg32

AlphaBlend

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 372KB - Virtual size: 371KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 431KB - Virtual size: 431KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9c1d7b85a949b53f3cdf60d4d1ddb248

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

winmm

userenv

version

dbghelp

netapi32

wininet

usp10

psapi

oleacc

imm32

comctl32

msimg32

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 372KB - Virtual size: 371KB

.data Size: 39KB - Virtual size: 66KB

.rsrc Size: 431KB - Virtual size: 431KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 372KB - Virtual size: 371KB

.data
Size: 39KB - Virtual size: 66KB

.rsrc
Size: 431KB - Virtual size: 431KB