bb41490603de5a3df633ff1d4226c400

Sharing

Copy URL Twitter E-mail

General

Target

bb41490603de5a3df633ff1d4226c400
Size

357KB
MD5

bb41490603de5a3df633ff1d4226c400
SHA1

bdee141ddd1da23593eca1074c63f9f5df9c8210
SHA256

a0b016f73ed08d01e03670906137e73210d756edb4e7945a4da0130e3e566311
SHA512

15a5bc4a31e9ddd568994e907d4d8c17875671e87387685364582fef3f221d7433ed0cf6b38633a2e21e2d6bfbf41dbddd7cdb35f87272fc73e252797bc15798
SSDEEP

6144:uYKNkMVa6TVQv9mxMRAhy+AVYgLZJwGS3wUnLpSpYkL72ZbMY5xLR:gFVa6CI4Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bb41490603de5a3df633ff1d4226c400

Files

bb41490603de5a3df633ff1d4226c400
.exe windows:5 windows x86 arch:x86

d2920edb09c5264690c3d6c022714e1c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
StrCmpNIW
StrToIntW
StrCmpIW
PathGetArgsW
SHDeleteValueW
SHGetValueW
StrCpyNW
PathAppendW
ChrCmpIW

advapi32

SetSecurityDescriptorDacl
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
DeregisterEventSource
RegisterEventSourceW
RegQueryValueExW
FreeSid
SetFileSecurityW
RegOpenKeyExA
InitializeSecurityDescriptor
CloseServiceHandle
OpenServiceW
OpenSCManagerW
QueryServiceConfigW
QueryServiceStatus
LsaClose
LsaOpenPolicy
LsaQueryInformationPolicy
ReportEventW
RegQueryValueExA

kernel32

GetFileSize
CreateFileW
CreateProcessW
WriteFile
GetSystemDirectoryW
GetCommandLineW
GetTimeFormatW
GetDateFormatW
GetLocalTime
GetLocaleInfoW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDiskFreeSpaceExW
GetVersionExW
FormatMessageW
CreateEventW
ResetEvent
SetEvent
WaitForSingleObject
CreateFileMappingW
MapViewOfFile
ExpandEnvironmentStringsW
GetFileAttributesW
UnmapViewOfFile
CloseHandle
ReadFile
GetCurrentProcess
FlushInstructionCache
GetCurrentThreadId
lstrcpynW
GlobalAlloc
GlobalLock
GlobalUnlock
EnterCriticalSection
GetStartupInfoW
GetModuleHandleA
RemoveDirectoryW
GetComputerNameW
GetVolumeNameForVolumeMountPointW
FindFirstFileW
FindNextFileW
FindClose
SetLastError
lstrcmpW
DeleteFileW
SetFileAttributesW
LeaveCriticalSection
GetShortPathNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
lstrlenA
GetWindowsDirectoryW
GetLastError
LoadLibraryW
GetProcAddress
FreeLibrary
HeapCreate
GetSystemInfo
GetModuleFileNameW
lstrcatW
HeapDestroy
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
GetSystemTimeAsFileTime
MultiByteToWideChar
lstrlenW
lstrcpyW

gdi32

CloseMetaFile
CreateRectRgnIndirect
CreateMetaFileW
SetWindowExtEx
DeleteMetaFile
CreateDCW
GetDeviceCaps
LPtoDP
SaveDC
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
DeleteDC
RestoreDC

user32

CharNextW
DestroyWindow
DefWindowProcW
ReleaseDC
GetDC
PtInRect
UnionRect
SetWindowLongW
GetWindowLongW
CallWindowProcW
IsWindow
GetKeyState
DestroyAcceleratorTable
InvalidateRect
EndPaint
GetClientRect
BeginPaint
IsChild
GetFocus
SetFocus
ShowWindow
GetParent
wsprintfW
LoadCursorW
GetClassInfoExW
CreateWindowExW
SetWindowPos
SendMessageW
MapWindowPoints
SystemParametersInfoW
GetWindowRect
GetWindow
LoadStringW
GetDesktopWindow
AdjustWindowRectEx
GetSystemMetrics
LoadImageW
MessageBoxW
ExitWindowsEx
SetForegroundWindow
FindWindowW
SetCursor
SetWindowRgn
OffsetRect
EqualRect
IntersectRect
wvsprintfW
RegisterClassExW

srrstr

ord5
ord2
ord10
ord3
ord6

srclient

DisableSR
SRRemoveRestorePoint
SRSetRestorePointW
EnableFIFO
DisableFIFO
EnableSR

ole32

OleSaveToStream
WriteClassStm
OleLoadFromStream
CreateDataAdviseHolder
OleRegGetMiscStatus
CreateOleAdviseHolder
OleRegGetUserType
OleRegEnumVerbs
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoRegisterClassObject
CoRevokeClassObject

oleaut32

SysStringByteLen
OleCreatePropertyFrame
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantInit
DispCallFunc
VariantChangeType
VariantClear
SysStringLen
LoadRegTypeLi
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysAllocStringByteLen
SysFreeString
SysAllocString

msvcrt

_ftol
wcscmp
wcsstr
wcschr
_wtoi
strtol
realloc
wcsncmp
_wtol
_c_exit
_exit
__CxxFrameHandler
free
malloc
??2@YAPAXI@Z
_purecall
_wcsnicmp
_except_handler3
_XcptFilter
_cexit
_controlfp
??3@YAXPAX@Z
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit

winsta

WinStationCloseServer
WinStationIsHelpAssistantSession
WinStationEnumerateW
WinStationOpenServerW
WinStationFreeMemory

Exports

Exports

??0CCounter@@QAE@XZ
??1CCounter@@QAE@XZ
??4CCounter@@QAEAAV0@ABV0@@Z
?Down@CCounter@@QAEKXZ
?GetCount@CCounter@@QAEJXZ
?Init@CCounter@@QAEKXZ
?Up@CCounter@@QAEXXZ
?WaitForZero@CCounter@@QAEKXZ

Sections

.text
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 254KB - Virtual size: 253KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d2920edb09c5264690c3d6c022714e1c

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

advapi32

kernel32

gdi32

user32

srrstr

srclient

ole32

oleaut32

msvcrt

winsta

Exports

Exports

Sections

.text Size: 94KB - Virtual size: 94KB

.data Size: 8KB - Virtual size: 14KB

.rsrc Size: 254KB - Virtual size: 253KB

.text
Size: 94KB - Virtual size: 94KB

.data
Size: 8KB - Virtual size: 14KB

.rsrc
Size: 254KB - Virtual size: 253KB