ac74bd4a127d538573d775b1d1d2357a

Sharing

Copy URL

Twitter E-mail

General

Target

ac74bd4a127d538573d775b1d1d2357a
Size

93KB
MD5

ac74bd4a127d538573d775b1d1d2357a
SHA1

c642b94ada429893a6698353e2706881820c11b0
SHA256

6f4d295944d8bbd8fe8d645211cd3640c413b477efa74054c825df9acc786d23
SHA512

0fb8365573dbdc8f9defbaedcc3b2bcbed51bb739bd784b544d18319333d1c7d83dfce41668f6fc4efa46baa40f7e10412564668f2cfebba93088e2af83a88c1
SSDEEP

1536:awH80lr3QF/GTqg8HLhobQLAfm5b8HLljs2mwEhstzWrYw:zvlr39Og8HlKQLAfMmLljJmwEixWrL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ac74bd4a127d538573d775b1d1d2357a

Files

ac74bd4a127d538573d775b1d1d2357a
.exe windows:5 windows x86 arch:x86

608b524939a4ae825f572a36fd684373

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThread
GetProcessHeap
IsBadReadPtr
SetFileTime
VirtualQueryEx
WriteFile
OpenProcess
Thread32First
WideCharToMultiByte
ReadProcessMemory
HeapDestroy
HeapCreate
Thread32Next
ReadFile
GetTimeZoneInformation
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
SetLastError
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
FindClose
LoadLibraryA
GetEnvironmentVariableW
FindNextFileW
HeapFree
CreateToolhelp32Snapshot
GetFileTime
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
CreateThread
ExpandEnvironmentStringsW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLocalTime
SetThreadPriority
GetThreadContext
SetThreadContext
GetProcessId
GetNativeSystemInfo
CreateRemoteThread
Process32FirstW
Process32NextW
GetPrivateProfileStringW
GetPrivateProfileIntW
GlobalLock
GlobalUnlock
ResetEvent
GetUserDefaultUILanguage
GetTickCount
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
MoveFileExW
GetSystemTime
GetTempFileNameW
VirtualProtect
FileTimeToDosDateTime
WriteProcessMemory
LocalFree
GetCurrentProcessId
DuplicateHandle
OpenEventW
GetFileAttributesExW
GetModuleFileNameW
GetVersionExW
VirtualFreeEx
VirtualFree
GetModuleHandleW
WaitForSingleObject
GetComputerNameW
SetErrorMode
GetCommandLineW
WaitForMultipleObjects
CreateEventW
SetFileAttributesW
CloseHandle
lstrcmpiW
WTSGetActiveConsoleSessionId
GetProcAddress
lstrcmpiA
CreateFileW
GetFileAttributesW
Sleep
LoadLibraryW
SetEvent
CreateDirectoryW
FreeLibrary
ExitProcess
RemoveDirectoryW

user32

LoadImageW
MsgWaitForMultipleObjects
CharLowerBuffA
GetCursorPos
CharToOemW
ExitWindowsEx
GetIconInfo
CharLowerA
PeekMessageW
DrawIcon
ToUnicode
GetClipboardData
TranslateMessage
GetKeyboardState
CharLowerW
DispatchMessageW
CharUpperW

advapi32

CryptCreateHash
LookupPrivilegeValueW
SetNamedSecurityInfoW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CreateProcessAsUserW
RegQueryValueExW
CryptReleaseContext
RegCreateKeyExW
GetTokenInformation
GetSidSubAuthorityCount
OpenThreadToken
CryptAcquireContextW
GetSidSubAuthority
OpenProcessToken
CryptGetHashParam
GetLengthSid
IsWellKnownSid
EqualSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
ConvertSidToStringSidW
InitiateSystemShutdownExW

shlwapi

PathRemoveFileSpecW
StrCmpNIW
PathRenameExtensionW
PathRemoveBackslashW
UrlUnescapeA
wvnsprintfW
PathIsDirectoryW
PathFindFileNameW
PathAddBackslashW
SHDeleteValueW
PathSkipRootW
SHDeleteKeyW
PathCombineW
PathAddExtensionW
PathUnquoteSpacesW
PathMatchSpecW
StrCmpNIA
wvnsprintfA
PathQuoteSpacesW
PathIsURLW

shell32

ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

CLSIDFromString
StringFromGUID2

ws2_32

recv
select
getaddrinfo
recvfrom
send
getpeername
listen
WSAIoctl
connect
WSAStartup
WSAGetLastError
shutdown
setsockopt
bind
socket
WSASetLastError
closesocket
freeaddrinfo
WSAEventSelect
getsockname
accept
sendto

crypt32

CertCloseStore
PFXExportCertStoreEx
PFXImportCertStore
CertDeleteCertificateFromStore
CertOpenSystemStoreW
CertEnumCertificatesInStore
CertDuplicateCertificateContext

wininet

InternetQueryDataAvailable
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpAddRequestHeadersA
InternetQueryOptionA
InternetOpenA
HttpOpenRequestA
InternetSetOptionA
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
InternetCloseHandle
HttpSendRequestA
HttpSendRequestW
InternetReadFile
InternetReadFileExA
HttpSendRequestExW
HttpQueryInfoA
HttpSendRequestExA

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

608b524939a4ae825f572a36fd684373

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

ws2_32

crypt32

wininet

netapi32

Sections

.text Size: 87KB - Virtual size: 87KB

.data Size: 512B - Virtual size: 7KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 87KB - Virtual size: 87KB

.data
Size: 512B - Virtual size: 7KB

.reloc
Size: 4KB - Virtual size: 3KB