ad4b68b329dcb565c38b7672e565311e

Sharing

Copy URL

Twitter E-mail

General

Target

ad4b68b329dcb565c38b7672e565311e
Size

688KB
MD5

ad4b68b329dcb565c38b7672e565311e
SHA1

0a934b507f6cf1b811d8be82a492346b5601115e
SHA256

779e49bafaec6f82da13a1ad87a9e1ad3053345ad5de205becf0a5971ce24d4e
SHA512

27699245541a339e69274869ac9f8845479d9e7c799a43c49350d1b75fe86824a503e4739ba03b19a2f81113aacaa45753bba30cf816d884463f47b45341a88e
SSDEEP

12288:GZBuRG7ZfkNJE7ealJjw9f+PPzz+QDKqV1JGPXNRE+bN7I5pRI6gAzR8EU58W98q:GgKtPPvWU1S9ZbN7I5clov+8W98UI1tS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad4b68b329dcb565c38b7672e565311e

Files

ad4b68b329dcb565c38b7672e565311e
.exe windows:4 windows x86 arch:x86

79c7e3f41e8d4c494e4310eb37a48598

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\PETSE\EPBEEAQY\XHYSZDK\JAMJDNMKT\CLOVPRWL.PDB

Imports

advapi32

RegReplaceKeyW
RegSetValueExA
RegQueryMultipleValuesA
AbortSystemShutdownA
RegConnectRegistryA
CryptVerifySignatureA
StartServiceA
CryptDuplicateHash
CryptSetProvParam
CryptVerifySignatureW
RegDeleteValueA
RegQueryValueExA
CryptGenRandom
CryptGenKey
LogonUserA
RegDeleteValueW
LookupPrivilegeDisplayNameW
RegDeleteKeyA
CryptSignHashW
RegEnumValueW
RegCreateKeyExW
RegQueryMultipleValuesW
LookupPrivilegeNameW

shell32

RealShellExecuteW
SHGetSpecialFolderLocation
CommandLineToArgvW

comctl32

CreateToolbarEx
ImageList_DragMove
InitCommonControlsEx
ImageList_GetIcon
ImageList_DragLeave
CreatePropertySheetPageA
ImageList_GetFlags

wininet

InternetCombineUrlA
ResumeSuspendedDownload
InternetFindNextFileA
InternetAlgIdToStringW
InternetCreateUrlW
FtpCreateDirectoryW
HttpSendRequestA

user32

RegisterClassExA
DeleteMenu
FindWindowExA
ReplyMessage
CreateWindowExA
ValidateRect
BeginDeferWindowPos
GetWindowContextHelpId
CheckMenuRadioItem
ShowWindow
GetTabbedTextExtentW
MapDialogRect
DefWindowProcA
GetSubMenu
DestroyWindow
IsCharLowerA
LoadStringA
IsChild
CreateIconIndirect
CharToOemBuffW
GetMessageA
GetMenuBarInfo
EnableScrollBar
GetComboBoxInfo
RealChildWindowFromPoint
RegisterClassA
MessageBoxA
GetMessageW
SetUserObjectInformationA
GetNextDlgTabItem
CloseWindowStation
GetDialogBaseUnits

kernel32

FreeEnvironmentStringsW
GetCPInfo
GetLastError
GetDateFormatA
GetTimeZoneInformation
GetTickCount
HeapFree
HeapDestroy
GetCommandLineW
RtlUnwind
OpenMutexA
WaitCommEvent
GetStartupInfoA
TlsSetValue
GetStartupInfoW
WriteFile
GetStdHandle
HeapReAlloc
HeapAlloc
SetLastError
GetLocaleInfoW
TlsAlloc
GetModuleHandleA
QueryPerformanceCounter
RtlFillMemory
GetModuleFileNameA
HeapValidate
GetCurrentProcessId
InitializeCriticalSection
GetStringTypeW
LeaveCriticalSection
GetVersionExW
GetOEMCP
LCMapStringA
GetSystemInfo
CloseHandle
VirtualAlloc
CreateMutexA
TlsFree
GetModuleFileNameW
MultiByteToWideChar
GetStringTypeA
GetDriveTypeA
LoadLibraryA
ExpandEnvironmentStringsA
SetHandleCount
IsValidLocale
OutputDebugStringA
TlsGetValue
LCMapStringW
GetACP
GetEnvironmentStringsW
VirtualProtect
GetEnvironmentStrings
GetSystemTimeAsFileTime
SetFilePointer
GetCommandLineA
GetUserDefaultLCID
DeleteCriticalSection
CompareStringW
InterlockedExchange
GetLocaleInfoA
IsBadWritePtr
GetTimeFormatA
EnterCriticalSection
ReadFile
GetCurrentThread
EnumSystemLocalesA
DebugBreak
WideCharToMultiByte
GetProcAddress
SetStdHandle
GetCurrentProcess
IsValidCodePage
ExitProcess
InterlockedIncrement
GlobalReAlloc
GetFileType
VirtualQuery
SetConsoleCtrlHandler
GetVersionExA
UnhandledExceptionFilter
TerminateProcess
IsBadReadPtr
FlushFileBuffers
HeapCreate
InterlockedDecrement
VirtualFree
FreeEnvironmentStringsA
SetEnvironmentVariableA
GetCurrentThreadId
CompareStringA

comdlg32

PageSetupDlgW
GetSaveFileNameW
ChooseFontA

Sections

.text
Size: 276KB - Virtual size: 273KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 276KB - Virtual size: 272KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

79c7e3f41e8d4c494e4310eb37a48598

Headers

File Characteristics

PDB Paths

Imports

advapi32

shell32

comctl32

wininet

user32

kernel32

comdlg32

Sections

.text Size: 276KB - Virtual size: 273KB

.rdata Size: 276KB - Virtual size: 272KB

.data Size: 108KB - Virtual size: 113KB

.rsrc Size: 24KB - Virtual size: 22KB

.text
Size: 276KB - Virtual size: 273KB

.rdata
Size: 276KB - Virtual size: 272KB

.data
Size: 108KB - Virtual size: 113KB

.rsrc
Size: 24KB - Virtual size: 22KB