da380a3ce036f4ef699d5cf004eb7ff134c40a4a1848e76d3e8d79ffe95d063d

Sharing

Copy URL

Twitter E-mail

General

Target

da380a3ce036f4ef699d5cf004eb7ff134c40a4a1848e76d3e8d79ffe95d063d
Size

1.1MB
MD5

f6324b899292c2e889e616e91847fa58
SHA1

b30b35f9c3151d1d42a9787b20867b1a277714ac
SHA256

da380a3ce036f4ef699d5cf004eb7ff134c40a4a1848e76d3e8d79ffe95d063d
SHA512

a5878caf92c5f9e3db0fda366f31f44bcca163e30163404a5198424a12703cf442608d7ba7c659ac5c90e2da5117197a3797f42ec53544e9af8259cf2db69222
SSDEEP

24576:wkrftCV7nLDX0HoCaqTkK80TcUfbYB22kmpb24f54MvMl:wuwL72TQ0TBYB22kmpb24f54l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da380a3ce036f4ef699d5cf004eb7ff134c40a4a1848e76d3e8d79ffe95d063d

Files

da380a3ce036f4ef699d5cf004eb7ff134c40a4a1848e76d3e8d79ffe95d063d
.exe windows:5 windows x86 arch:x86

fe1f2e4d7152de49a56bae29cef62f97

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Build\JenkinsHome\jobs\desktop_apps_ng\workspace\build\loader\Release\loader.pdb

Imports

kernel32

CreateFileW
GetSystemTimeAsFileTime
GetCommandLineW
GetCurrentThreadId
SetEvent
DeleteFileW
CopyFileW
GetDiskFreeSpaceExW
CreateDirectoryW
RemoveDirectoryW
GetTempPathW
GetFileAttributesW
GetTickCount
GetACP
SetLastError
HeapFree
HeapSize
HeapReAlloc
HeapAlloc
GetProcessHeap
InterlockedCompareExchange
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
GetVersionExW
GetNativeSystemInfo
WaitForSingleObject
GetStartupInfoW
CreateProcessW
LocalFree
InitializeCriticalSection
FormatMessageW
FindClose
FindFirstFileExW
FindNextFileW
CreateEventA
DuplicateHandle
ReleaseSemaphore
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
InterlockedDecrement
GlobalAlloc
GlobalLock
InterlockedIncrement
GlobalUnlock
lstrcmpW
MulDiv
ReadFile
SetFilePointer
WriteFile
EncodePointer
SetThreadPriority
SignalObjectAndWait
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
DecodePointer
EnumSystemLocalesW
IsValidLocale
GetConsoleCP
FlushFileBuffers
GetFileType
ReadConsoleW
GetConsoleMode
GetCurrentThread
FreeLibraryAndExitThread
CreateThread
GetStdHandle
GetModuleHandleExW
ExitProcess
LoadLibraryExW
InterlockedFlushSList
RtlUnwind
GetModuleHandleA
GetLogicalProcessorInformation
OpenEventA
GetUserDefaultLCID
Sleep
SetFilePointerEx
SetEndOfFile
LeaveCriticalSection
GetModuleFileNameW
EnterCriticalSection
GetPhysicallyInstalledSystemMemory
GetModuleHandleW
CreateEventW
GetExitCodeProcess
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryW
GetFileSize
GetStringTypeW
TryEnterCriticalSection
InitializeSListHead
GetCurrentProcessId
FormatMessageA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
OutputDebugStringW
GetCPInfo
GetLocaleInfoW
LCMapStringW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
DeleteCriticalSection
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
GetThreadPriority
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
SwitchToThread

user32

RegisterClassExW
PeekMessageW
TranslateMessage
DispatchMessageW
SetWindowLongW
DestroyWindow
GetWindowLongW
SetTimer
KillTimer
UnregisterClassW
GetCursorPos
SendMessageW
PostThreadMessageW
wsprintfW
DefWindowProcW
GetDesktopWindow
MsgWaitForMultipleObjects
GetWindowTextLengthW
GetWindow
GetFocus
GetDC
SetWindowPos
SetWindowRgn
FillRect
ScreenToClient
GetSystemMetrics
SetWindowTextW
ShowWindow
IsWindow
InvalidateRgn
RedrawWindow
ClientToScreen
DestroyAcceleratorTable
IsChild
GetSysColor
MoveWindow
CreateAcceleratorTableW
SetFocus
CharNextW
GetClassNameW
SetCapture
GetClientRect
GetDlgItem
PostQuitMessage
SystemParametersInfoW
GetParent
RegisterWindowMessageW
ReleaseCapture
InvalidateRect
ReleaseDC
BeginPaint
EndPaint
GetWindowTextW
CallWindowProcW
CreateWindowExW
GetClassInfoExW
LoadCursorW

gdi32

BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetStockObject
CreateRoundRectRgn
GetDeviceCaps
DeleteDC
GetObjectW
DeleteObject
CreateSolidBrush

shell32

SHGetFolderPathW
CommandLineToArgvW

ole32

OleUninitialize
CoCreateInstance
CoAddRefServerProcess
CoTaskMemFree
CoCreateGuid
CoGetClassObject
CoTaskMemAlloc
StringFromGUID2
CLSIDFromProgID
CreateStreamOnHGlobal
CLSIDFromString
OleLockRunning
CoReleaseServerProcess
OleInitialize
StringFromCLSID

oleaut32

DispCallFunc
VariantChangeType
LoadRegTypeLi
VariantInit
LoadTypeLi
SysStringByteLen
OleCreateFontIndirect
SysAllocString
VariantCopy
SysStringLen
SysAllocStringLen
VariantClear
SysFreeString
SysAllocStringByteLen

advapi32

CryptDestroyKey
CryptVerifySignatureW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptReleaseContext
RegSetValueExW
RegNotifyChangeKeyValue
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
CryptAcquireContextW

shlwapi

PathFindFileNameW

ws2_32

ntohl

Sections

.text
Size: 408KB - Virtual size: 408KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 544KB - Virtual size: 543KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe1f2e4d7152de49a56bae29cef62f97

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

shlwapi

ws2_32

Sections

.text Size: 408KB - Virtual size: 408KB

.rdata Size: 140KB - Virtual size: 140KB

.data Size: 29KB - Virtual size: 34KB

.rsrc Size: 544KB - Virtual size: 543KB

.reloc Size: 31KB - Virtual size: 30KB

.text
Size: 408KB - Virtual size: 408KB

.rdata
Size: 140KB - Virtual size: 140KB

.data
Size: 29KB - Virtual size: 34KB

.rsrc
Size: 544KB - Virtual size: 543KB

.reloc
Size: 31KB - Virtual size: 30KB