c0b88ea211dd599713444f1f738cf7f3e70dc41d1ff7f69e57f0f3087e00a03b

Sharing

Copy URL Twitter E-mail

General

Target

c0b88ea211dd599713444f1f738cf7f3e70dc41d1ff7f69e57f0f3087e00a03b
Size

132KB
MD5

5e6ba7f144e657d27171d7a4f0e598ec
SHA1

1bba578be03ae20ab2bcf750987bfe9bb7874385
SHA256

c0b88ea211dd599713444f1f738cf7f3e70dc41d1ff7f69e57f0f3087e00a03b
SHA512

5980494463bff71785bc8eff89a76ee10a32b2bc6fe9c157cf819976eb7160975bb68d8d8d74298a16f1e8e9ff6bd2b7a788b2ef820ee929c5a91e89b65650fa
SSDEEP

3072:Wn1Kqqtm1Giilm/sb+4/inqsM9ZS/bcWYqeJxlDO:YbqIYiilelqsw3jO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0b88ea211dd599713444f1f738cf7f3e70dc41d1ff7f69e57f0f3087e00a03b

Files

c0b88ea211dd599713444f1f738cf7f3e70dc41d1ff7f69e57f0f3087e00a03b
.exe windows:4 windows x86 arch:x86

67aa1082ffb2f3df52a95ce82811f03f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\e360\Project\Rac Server Manager\Release\pdb\UtilsCmd.pdb

Imports

iphlpapi

SetIpTTL

kernel32

HeapFree
HeapAlloc
GetSystemTimeAsFileTime
HeapReAlloc
TerminateProcess
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapSize
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetModuleFileNameA
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
RtlUnwind
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
SetUnhandledExceptionFilter
GetCPInfo
GetStringTypeA
GetStringTypeW
GetOEMCP
IsBadReadPtr
IsBadCodePtr
SetStdHandle
ExitProcess
GetCurrentProcess
SetEndOfFile
FlushFileBuffers
SetFilePointer
GlobalFindAtomW
LoadLibraryA
GetVersionExA
GetModuleHandleA
GlobalFlags
GlobalAddAtomW
lstrcatW
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
EnterCriticalSection
GlobalHandle
GlobalReAlloc
LeaveCriticalSection
GetCurrentThreadId
lstrcmpW
FreeLibrary
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetVersion
WideCharToMultiByte
GetLastError
SetLastError
GlobalFree
lstrcpyW
GlobalAlloc
GlobalLock
GlobalUnlock
lstrcpynW
LocalFree
FormatMessageW
lstrlenW
LocalAlloc
Sleep
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
RaiseException
CreateFileW
GetFileSize
ReadFile
CloseHandle
WriteFile
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
SizeofResource
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetEnvironmentStrings

user32

RegisterWindowMessageW
WinHelpW
GetCapture
CreateWindowExW
GetClassInfoExW
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
LoadIconW
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
AdjustWindowRectEx
GetClassInfoW
RegisterClassW
DefWindowProcW
CallWindowProcW
SystemParametersInfoA
IsIconic
GetWindowPlacement
CopyRect
SetWindowPos
SetWindowLongW
GetDlgItem
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
PtInRect
SetWindowTextW
GetClassNameW
SetMenuItemBitmaps
GetFocus
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapW
SetWindowsHookExW
CallNextHookEx
DispatchMessageW
DestroyMenu
GetKeyState
PeekMessageW
ValidateRect
SendMessageW
MessageBoxW
GetParent
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
EnableWindow
UnhookWindowsHookEx
LoadCursorW
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
PostQuitMessage
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
EnumWindows
wsprintfW
GetWindowTextW
PostMessageW
UnregisterClassW

gdi32

Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetStockObject
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
CreateBitmap
SelectObject
DeleteObject
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
GetDeviceCaps
SetViewportOrgEx

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

CryptReleaseContext
StartServiceW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
ControlService
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptDestroyHash
CryptEncrypt
CryptDestroyKey

comctl32

ord17

shlwapi

PathRemoveExtensionW
PathFindExtensionW

ole32

CoGetClassObject
CoUninitialize
CoInitialize
CoSetProxyBlanket
CoCreateInstance

oleaut32

GetErrorInfo
SysAllocString
SysStringLen
SysFreeString
SysAllocStringByteLen
VariantInit
VariantClear
VariantChangeType

Exports

Exports

?EncryptDecryptData@CCryptUtils@@CA_NPAU_iobuf@@0@Z
?EncryptDecryptFile@CCryptUtils@@SA_NAAV_bstr_t@@0@Z
?EncryptDecryptStreamData@CCryptUtils@@SA_NPAXK@Z
?EncryptDecryptStreamFile@CCryptUtils@@SA_NAAV_bstr_t@@0@Z

Sections

.text
Size: 88KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

67aa1082ffb2f3df52a95ce82811f03f

Headers

File Characteristics

PDB Paths

Imports

iphlpapi

kernel32

user32

gdi32

winspool.drv

advapi32

comctl32

shlwapi

ole32

oleaut32

Exports

Exports

Sections

.text Size: 88KB - Virtual size: 86KB

.rdata Size: 28KB - Virtual size: 26KB

.data Size: 8KB - Virtual size: 20KB

.rsrc Size: 4KB - Virtual size: 144B

.text
Size: 88KB - Virtual size: 86KB

.rdata
Size: 28KB - Virtual size: 26KB

.data
Size: 8KB - Virtual size: 20KB

.rsrc
Size: 4KB - Virtual size: 144B