Net-Worm[.]Win32[.]Koobface[.]kia-52d9d9d7b1f1bae90b517c536467e8449a1b10e9632967ef9f1339243a01efac

Sharing

Copy URL Twitter E-mail

General

Target

Net-Worm.Win32.Koobface.kia-52d9d9d7b1f1bae90b517c536467e8449a1b10e9632967ef9f1339243a01efac
Size

48KB
MD5

8f8f1a6412dfa04e3e55f64845492e6f
SHA1

ffdbe0d1fe9122823a057dcd9ba11d91a0fde371
SHA256

52d9d9d7b1f1bae90b517c536467e8449a1b10e9632967ef9f1339243a01efac
SHA512

a775ed0f8626e47e34e67a8d869fb56475f6572f3faedc0ea2d6f639e9c4133972908008b52acfaca8e29f0913c47378d89ddcde2109dde063828b7b5f3c3b5c
SSDEEP

768:YZ/K9shu2dc2gq+xK5rCjiSQL7hYvCKyi1oT1DZMg+g0oEeeesz03+w:UvTDgq+xK5rui/L7hktuT1+g+g0Beeez

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Net-Worm.Win32.Koobface.kia-52d9d9d7b1f1bae90b517c536467e8449a1b10e9632967ef9f1339243a01efac

Files

Net-Worm.Win32.Koobface.kia-52d9d9d7b1f1bae90b517c536467e8449a1b10e9632967ef9f1339243a01efac
.exe windows:4 windows x86 arch:x86

ebcbb771da660e3904a8abfdd9bbe511

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WideCharToMultiByte
lstrlenW
WaitForSingleObject
GetCurrentProcessId
GetTickCount
Sleep
GetVolumeInformationA
TerminateProcess
OpenProcess
MoveFileExA
WriteFile
CreateFileA
FreeLibrary
ExitProcess
GetModuleHandleA
GetVersion
GetModuleFileNameA
CreateProcessA
GetTempPathA
GetProcAddress
LoadLibraryA
MultiByteToWideChar
lstrlenA
FindClose
FindNextFileA
FindFirstFileA
ReadFile
GetFileSize
GetLastError
CreateMutexA
GetStartupInfoA
GetCurrentThreadId
DeleteFileA
CloseHandle

advapi32

RegQueryValueExA
RegOpenKeyA
RegCloseKey

msvcp60

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ

msvcrt

strlen
_strdup
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_except_handler3
wcscmp
swprintf
strncat
wcsstr
wcsncpy
wcslen
fgetc
strncpy
strncmp
fscanf
_ftol
pow
fseek
ftell
fread
fwrite
strtok
strcmp
free
exit
malloc
fprintf
fopen
fgets
atoi
fclose
strcat
time
memcpy
__CxxFrameHandler
??2@YAPAXI@Z
strstr
_stricmp
strcpy
sprintf
memset

ole32

CoMarshalInterThreadInterfaceInStream
CoCreateInstance
CoInitialize
CLSIDFromProgID

oleaut32

SysAllocStringLen
SysAllocString
SysStringLen
SysFreeString
VariantClear

shlwapi

SHSetValueA
SHDeleteKeyA
SHGetValueA
PathFileExistsA

user32

MessageBoxA
GetWindowTextA
SetForegroundWindow
GetForegroundWindow
CharToOemA

wininet

InternetGetConnectedState
InternetCrackUrlA

ws2_32

gethostbyname
WSAStartup
socket
closesocket
connect
send
recv
bind
htons

Sections

.text
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

gu_idata
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ebcbb771da660e3904a8abfdd9bbe511

Headers

File Characteristics

Imports

kernel32

advapi32

msvcp60

msvcrt

ole32

oleaut32

shlwapi

user32

wininet

ws2_32

Sections

.text Size: 28KB - Virtual size: 28KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 8KB - Virtual size: 8KB

gu_idata Size: 3KB - Virtual size: 4KB

.text
Size: 28KB - Virtual size: 28KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 8KB - Virtual size: 8KB

gu_idata
Size: 3KB - Virtual size: 4KB