b938be095aa28d390c84d80a4d577288

Sharing

Copy URL Twitter E-mail

General

Target

b938be095aa28d390c84d80a4d577288
Size

313KB
MD5

b938be095aa28d390c84d80a4d577288
SHA1

d7063e19a8b22eb58e407f4ff0a8e0342c772abe
SHA256

03d305bff1d0ca96a7f4cfef97ee4268b94fa712700b6d3e5bf7a0c1af6ee8e6
SHA512

bcba639864bb4b92f2b5dd48f2f830a55d97abaa0e26c0c32cb815759beadb715c3e0746922e824b2433fc903659e45f9fd48a38bcf333e32b3ec60a84309247
SSDEEP

6144:V4eC+/kdIIxVyue4APuEU0OUZ9rjF4ctbLgSAhpil4:V2+/kZm1OUZ9rjRtbLgSAhpE4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b938be095aa28d390c84d80a4d577288

Files

b938be095aa28d390c84d80a4d577288
.exe windows:4 windows x86 arch:x86

e70146d9dfedfa01122d019b93f2cbe5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsA
StrDupA
SHDeleteKeyA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

netapi32

NetScheduleJobEnum
NetScheduleJobDel

mfc42

ord602
ord795
ord609
ord2621
ord1134
ord2575
ord4396
ord3574
ord3721
ord3619
ord3693
ord3402
ord3567
ord1146
ord1168
ord2642
ord6888
ord800
ord4160
ord540
ord2863
ord2414
ord1641
ord4224
ord6215
ord6199
ord2379
ord755
ord470
ord3092
ord6880
ord6197
ord6453
ord5572
ord2915
ord6283
ord6282
ord860
ord823
ord551
ord3811
ord548
ord1105
ord4220
ord2584
ord3654
ord2438
ord6270
ord1644
ord5861
ord3610
ord541
ord535
ord656
ord801
ord3663
ord3626
ord815
ord561
ord3738
ord4622
ord5714
ord5289
ord5307
ord4698
ord4079
ord2725
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord4673
ord6675
ord3302
ord4476
ord2645
ord3998
ord6907
ord4710
ord3996
ord4234
ord2302
ord693
ord324
ord567
ord641
ord3640
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord3370
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4402
ord1776
ord4078
ord6055
ord2582
ord3597
ord4425
ord5280
ord4407
ord1775
ord6052
ord2514
ord4998
ord4853
ord4376
ord5265
ord825
ord5981
ord1576

msvcrt

_XcptFilter
_exit
_onexit
__dllonexit
_acmdln
__getmainargs
_initterm
__setusermatherr
strncpy
_except_handler3
wcslen
wcsncpy
wcscpy
wcstombs
strtol
_adjust_fdiv
rand
fseek
fread
ftell
malloc
fwrite
free
atoi
strtok
exit
printf
strrchr
fgets
strchr
strstr
sprintf
fopen
fputs
fclose
__CxxFrameHandler
__p__commode
__p__fmode
__set_app_type
srand
_strdup
_strcmpi
_strupr
_strlwr
_setmbcp
_controlfp

kernel32

MoveFileA
GetCurrentProcess
GetVersion
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
TerminateProcess
DeleteFileA
WritePrivateProfileStringA
LocalAlloc
GetProcessHeap
HeapAlloc
HeapFree
LoadLibraryA
GetSystemDirectoryA
GetEnvironmentVariableA
CreateDirectoryA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
CreateFileA
ReadFile
CloseHandle
GetFileSize
GetLastError
CopyFileA
GetComputerNameA
SetEvent
CreateEventA
ReadProcessMemory
VirtualQueryEx
GetSystemInfo
DuplicateHandle
CreatePipe
GetStdHandle
WriteFile
GetModuleHandleA
GetStartupInfoA
GetPrivateProfileSectionNamesA
GetModuleFileNameA
GetPrivateProfileStringA
GetVersionExA
WinExec
Sleep
SetFileAttributesA
MoveFileExA
GetFileAttributesA
SearchPathA
FindNextFileA
FindFirstFileA
GetShortPathNameA
MultiByteToWideChar
GetTempPathA
FreeLibrary
SetFilePointer
GetProcAddress
GetTickCount
GetLongPathNameA
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
GetSystemTime
WaitForSingleObject
CreateProcessA
GetFileTime
GetWindowsDirectoryA
GetPrivateProfileIntA

user32

GetWindowRect
IsIconic
GetSystemMetrics
DrawIcon
GetClientRect
MessageBoxA
wsprintfA
SetCursor
LoadCursorA
GetCursorPos
AppendMenuA
LoadIconA
SendMessageA
EnableWindow
GetSubMenu
LoadMenuA
KillTimer
GetSystemMenu

gdi32

CreateSolidBrush
CreateFontA

advapi32

AdjustTokenPrivileges
GetSidLengthRequired
InitializeSid
RegOpenKeyExA
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAceEx
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity
FreeSid
RegQueryInfoKeyA
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
RegSetValueExA
RegCloseKey
LookupPrivilegeValueA
OpenProcessToken
RegEnumValueA
RegEnumKeyA
QueryServiceConfigA
CloseServiceHandle
OpenServiceA
GetServiceKeyNameA
OpenSCManagerA
ChangeServiceConfigA
ControlService
SetNamedSecurityInfoA
SetSecurityDescriptorOwner
GetTokenInformation
RegEnumKeyExA

shell32

ShellExecuteExA

ole32

CoInitialize
CoCreateInstance

Sections

.text
Size: 104KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e70146d9dfedfa01122d019b93f2cbe5

Headers

File Characteristics

Imports

shlwapi

version

netapi32

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ole32

Sections

.text Size: 104KB - Virtual size: 100KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 16KB - Virtual size: 20KB

.rsrc Size: 20KB - Virtual size: 16KB

.text
Size: 104KB - Virtual size: 100KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 16KB - Virtual size: 20KB

.rsrc
Size: 20KB - Virtual size: 16KB