ba28f3af4416bc8110f46c5108be9c6d

Sharing

Copy URL

Twitter E-mail

General

Target

ba28f3af4416bc8110f46c5108be9c6d
Size

445KB
MD5

ba28f3af4416bc8110f46c5108be9c6d
SHA1

6be4c733314c6ca098368a9a4c5d51780c651b89
SHA256

2ba6cd1fc8d75800b969b88ac9599e2e9b18ce678f6bbaf6577dba2f9ce4ecff
SHA512

23088d9e17e7ea2f9fedd629778b9e27a7efcffe9f984d02e8bceb77baaa020a6127e068eb53f07dc94343bafc7f1250f7a22d8d2f9a4cb748bf0b070a0d4055
SSDEEP

12288:pjaUJ42ewv9W+EXpQTMuNCfgabGQwnxZd9SjYp4ZT:pjaUu2ewV2+9DfZXSj84

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ba28f3af4416bc8110f46c5108be9c6d

Files

ba28f3af4416bc8110f46c5108be9c6d
.exe windows:5 windows x86 arch:x86

1bf1a049e21c5ad14489048dc0efc9e8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfW
CharLowerW
wsprintfA
CharNextW
CloseDesktop
GetThreadDesktop
SetThreadDesktop
OpenDesktopW
SetWindowPos
MapWindowPoints
GetClientRect
GetWindowRect
GetDesktopWindow
SetProcessWindowStation
OpenWindowStationW
GetProcessWindowStation

kernel32

GetCurrentDirectoryA
GetCurrentDirectoryW
GetTempPathA
GetTempPathW
GetTempFileNameA
GetTempFileNameW
SetLastError
LoadLibraryExW
FormatMessageW
GetModuleFileNameA
CreateFileA
DeleteFileA
OutputDebugStringA
OutputDebugStringW
CreateMutexW
GetModuleHandleW
GetFileAttributesA
CreateFileMappingA
CreateProcessW
IsDBCSLeadByte
WaitForSingleObject
GetModuleHandleA
IsBadWritePtr
lstrcmpiA
MapViewOfFileEx
IsBadReadPtr
VirtualAlloc
VirtualFree
HeapFree
GetProcessHeap
HeapAlloc
SetEndOfFile
FlushFileBuffers
TlsAlloc
CompareStringW
CompareStringA
GetVersionExA
CopyFileW
MoveFileExW
FindFirstFileW
FindNextFileW
FindClose
GetFileAttributesW
CreateDirectoryW
OpenFileMappingA
GetSystemInfo
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
SetFilePointer
lstrcatW
LocalFree
WideCharToMultiByte
lstrlenA
FindResourceW
LoadResource
GetSystemDefaultUILanguage
GetExitCodeProcess
lstrcmpW
FindResourceExW
LockResource
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetLastError
GetSystemDirectoryW
DisableThreadLibraryCalls
GetModuleFileNameW
ReleaseMutex
SetFileAttributesW
GetLocalTime
DebugBreak
GetThreadContext
IsDebuggerPresent
GetWindowsDirectoryW
lstrcatA
lstrcpyA
VirtualQueryEx
GetComputerNameW
GetLongPathNameW
WriteFile
lstrlenW
lstrcpyW
ReadFile
InterlockedCompareExchange
InterlockedIncrement
GetCurrentProcess
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
CloseHandle
GetCurrentThread
lstrcpynW
FreeLibrary
MultiByteToWideChar
GetProcAddress
LoadLibraryW
ExpandEnvironmentStringsW
lstrcmpiW
GetSystemDefaultLCID
GlobalFree
GlobalAlloc
Sleep
GlobalMemoryStatusEx
GetTickCount
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
SearchPathW
CreateFileW
MoveFileW
DeleteFileW

advapi32

SaferSetLevelInformation
SaferIdentifyLevel
SaferGetLevelInformation
SaferCloseLevel
AddAccessAllowedAceEx
AddAce
GetAce
SetSecurityDescriptorControl
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegSetKeySecurity
RegGetKeySecurity
RegNotifyChangeKeyValue
RegFlushKey
RegConnectRegistryW
GetSecurityDescriptorLength
BuildTrusteeWithSidW
GetSecurityDescriptorDacl
GetAclInformation
GetEffectiveRightsFromAclW
SaferCreateLevel
RegDeleteValueW
RegCreateKeyExW
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
AllocateAndInitializeSid
AddAccessAllowedAce
FreeSid
ConvertSidToStringSidW
OpenProcessToken
InitializeSecurityDescriptor
InitializeAcl
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
OpenThreadToken
GetTokenInformation
RegQueryValueExW
GetLengthSid
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW

ole32

OleSaveToStream
WriteClassStm
OleLoadFromStream
CoGetMalloc
CLSIDFromString
CreateStreamOnHGlobal
CoSetProxyBlanket
StringFromCLSID
CoTaskMemRealloc
CoCreateInstanceEx
CoCreateInstance
StringFromGUID2
CoCreateGuid
CoGetObjectContext
CoImpersonateClient
CoRevertToSelf
CoTaskMemFree
CoTaskMemAlloc

oleaut32

SysFreeString
VariantInit
SafeArrayCreateVector
SysStringByteLen
SysAllocStringByteLen
VariantChangeType
SysAllocStringLen
VariantClear
SysAllocString
LoadRegTypeLi
LoadTypeLibEx

msvcrt

free
??1type_info@@UAE@XZ
_onexit
__dllonexit
?terminate@@YAXXZ
_adjust_fdiv
_initterm
_wstrdate
_wstrtime
_waccess
wcstombs
mbstowcs
_ltow
_wtol
towupper
_wcslwr
wcsstr
wcstol
swprintf
_ultoa
_vsnwprintf
malloc
realloc
memmove
_snprintf
wcscmp
_wcsnicmp
qsort
_i64tow
_snwprintf
_purecall
wcsncpy
wcsrchr
wcscpy
wcscat
_wcsicmp
__CxxFrameHandler
wcslen
_except_handler3
wcschr

rpcrt4

UuidFromStringW

version

VerQueryValueW

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 145KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.KAJS
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.KEJS
Size: 138KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.YQGW
Size: 138KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hags
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1bf1a049e21c5ad14489048dc0efc9e8

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

advapi32

ole32

oleaut32

msvcrt

rpcrt4

version

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 145KB - Virtual size: 148KB

.data Size: 1024B - Virtual size: 4KB

.KAJS Size: 1024B - Virtual size: 4KB

.KEJS Size: 138KB - Virtual size: 140KB

.YQGW Size: 138KB - Virtual size: 140KB

.hags Size: 1024B - Virtual size: 4KB

.rsrc Size: 12KB - Virtual size: 32KB

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 145KB - Virtual size: 148KB

.data
Size: 1024B - Virtual size: 4KB

.KAJS
Size: 1024B - Virtual size: 4KB

.KEJS
Size: 138KB - Virtual size: 140KB

.YQGW
Size: 138KB - Virtual size: 140KB

.hags
Size: 1024B - Virtual size: 4KB

.rsrc
Size: 12KB - Virtual size: 32KB