bb52cfd922171b6b9aceebe1aec61c5a

Sharing

Copy URL Twitter E-mail

General

Target

bb52cfd922171b6b9aceebe1aec61c5a
Size

102KB
MD5

bb52cfd922171b6b9aceebe1aec61c5a
SHA1

5585d48750119990fe2b4281e54c563dbcb8df93
SHA256

23a26d3049eb8788ec10c15dfd1c020c5f4f1ee1f8d82a3cdd9198d7c26c9273
SHA512

dbc4b2ddb9456c4784622f4e74ab5a27cb2cad32e0eaf52174f1de2d450cf783a35b26a5d991f282a0e1b02571109fae1abf693c375253e9a60b2742a1f33365
SSDEEP

3072:RbWW8ZPMDCXdrhmMVQTyrM5y2DlzyM9TPUqxtpog:RbWbzXdrhnVQTyQ5y2DlV9TPYg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bb52cfd922171b6b9aceebe1aec61c5a

Files

bb52cfd922171b6b9aceebe1aec61c5a
.exe windows:4 windows x86 arch:x86

d24f1ec99ceabef626ab448e3c941717

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

EnumProcessModules
GetModuleFileNameExW
GetModuleBaseNameW

comctl32

InitCommonControlsEx
ImageList_Create
ImageList_SetBkColor
ImageList_ReplaceIcon

ws2_32

recv
send
connect
htons
gethostbyname
socket
WSAStartup

shlwapi

StrToIntA
wvnsprintfA
PathFindExtensionW
StrStrW
PathSkipRootW
StrStrA
PathRemoveExtensionW
PathStripPathW
PathStripToRootW
PathRemoveFileSpecW

kernel32

GetCommandLineW
ExitProcess
CreateFileA
LoadLibraryA
lstrcpyA
CloseHandle
GetCurrentProcess
lstrcpyW
lstrlenW
lstrcmpiW
GetLongPathNameW
ReadFile
CreateFileW
WriteFile
GetModuleHandleA
MultiByteToWideChar
GlobalAlloc
GlobalFree
lstrcmpA
RemoveDirectoryW
DeleteFileW
SetFileAttributesW
GetFileAttributesW
GetShortPathNameW
MoveFileW
GetVersionExA
GlobalUnlock
GlobalLock
GlobalReAlloc
FindClose
FindNextFileW
lstrcmpW
FindFirstFileW
lstrlenA
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
TerminateProcess
MoveFileExW
DuplicateHandle
Process32NextW
Module32NextW
OpenProcess
Module32FirstW
Process32FirstW
CreateToolhelp32Snapshot
QueryDosDeviceA
GetProcAddress
GetModuleFileNameW
CreateThread

user32

GetDlgItem
UpdateWindow
InvalidateRect
ShowWindow
GetSysColor
MoveWindow
GetClientRect
ClientToScreen
CharUpperW
wsprintfA
DestroyCursor
SetWindowLongA
SetCapture
SetCursor
LoadCursorA
PtInRect
ReleaseCapture
GetSystemMetrics
SendDlgItemMessageA
DialogBoxParamA
GetDlgItemTextW
LoadIconA
DestroyIcon
SetDlgItemTextA
SetDlgItemTextW
SetWindowTextA
PostMessageA
GetWindowRect
GetWindowPlacement
EndDialog
SetWindowPlacement
GetDC
SendMessageA
DrawTextA
wsprintfW
MessageBoxA
CallWindowProcA

gdi32

GetObjectA
CreateFontIndirectA
SelectObject

advapi32

RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExW
RegSetValueExA
RegQueryValueExA

shell32

SHGetPathFromIDListW
SHBrowseForFolderW
SHGetMalloc
SHFileOperationW
ExtractIconExW
ShellExecuteExW
CommandLineToArgvW
ShellExecuteA

ole32

CoInitialize
CoUninitialize

Sections

.text
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tc
Size: 26KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d24f1ec99ceabef626ab448e3c941717

Headers

DLL Characteristics

File Characteristics

Imports

psapi

comctl32

ws2_32

shlwapi

kernel32

user32

gdi32

advapi32

shell32

ole32

Sections

.text Size: 71KB - Virtual size: 70KB

.data Size: 512B - Virtual size: 20KB

.rsrc Size: 4KB - Virtual size: 3KB

.tc Size: 26KB - Virtual size: 28KB

.text
Size: 71KB - Virtual size: 70KB

.data
Size: 512B - Virtual size: 20KB

.rsrc
Size: 4KB - Virtual size: 3KB

.tc
Size: 26KB - Virtual size: 28KB