efbe50987bd1a99b37e55e9f55d27ca98a5d543ab33ed09024324944c2c3cca6

Sharing

Copy URL Twitter E-mail

General

Target

efbe50987bd1a99b37e55e9f55d27ca98a5d543ab33ed09024324944c2c3cca6
Size

13.0MB
MD5

15a8efbffaadc86e23045e06802b08e0
SHA1

4a9eb40a1afd4ca301df0254451c85ce9510e184
SHA256

efbe50987bd1a99b37e55e9f55d27ca98a5d543ab33ed09024324944c2c3cca6
SHA512

b1a6a4744a6fc161022e95023630519f68b0e51e8f3291248f91f6dd298dafde358b929df019509034c40375a4e222477921ed044862b8e0676eed91048add8b
SSDEEP

393216:l8b9RarD9wn21OTW7Em6yDGshLJ8LevF4G:ltf9wn21OT7m6yDGsp1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
efbe50987bd1a99b37e55e9f55d27ca98a5d543ab33ed09024324944c2c3cca6

Files

efbe50987bd1a99b37e55e9f55d27ca98a5d543ab33ed09024324944c2c3cca6
.exe windows:5 windows x86 arch:x86

5608dd0feb90b01b492806facbe43456

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSACleanup
WSAStartup
shutdown
ioctlsocket
setsockopt
inet_ntoa
getsockopt
getsockname
ntohs
ntohl
htonl
closesocket
connect
htons
inet_addr
recv
select
send
socket
gethostbyname
WSAGetLastError
__WSAFDIsSet

kernel32

QueryPerformanceCounter
QueryPerformanceFrequency
SetConsoleTextAttribute
GetCurrentProcessId
WinExec
FreeLibrary
GetProcAddress
GetCurrentThread
GetLastError
SetLastError
SuspendThread
ResumeThread
CloseHandle
LoadLibraryA
GetModuleFileNameA
OutputDebugStringA
GetVersionExA
InitializeCriticalSection
Sleep
CreateThread
GetStdHandle
GetModuleHandleA
GetWindowsDirectoryA
GetVolumeInformationA
SetConsoleTitleA
GetConsoleWindow
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentThreadId
SetThreadPriority
GetThreadPriority
TerminateThread
GetExitCodeThread
WaitForSingleObject
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
ReleaseSemaphore
GetCurrentProcess
CreateSemaphoreA
MoveFileA
lstrcmpA
GetLocalTime
RtlUnwind
RaiseException
GetStringTypeW
MultiByteToWideChar
DecodePointer
EncodePointer
WideCharToMultiByte
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
ExitProcess
GetModuleHandleExW
AreFileApisANSI
ReadFile
HeapReAlloc
GetCommandLineA
GetTimeZoneInformation
ExitThread
LoadLibraryExW
GetTempPathA
GetCPInfo
GetTickCount
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CreateDirectoryW
MoveFileExW
GetPrivateProfileStringA
OutputDebugStringW
SetStdHandle
WriteConsoleW
SetEnvironmentVariableA
CreateFileW
GetExitCodeProcess
CreateProcessA
SetEndOfFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapSize
WriteFile
GetModuleFileNameW
GetConsoleCP
GetConsoleMode
IsValidCodePage
GetACP
GetOEMCP
FlushFileBuffers
GetFileType
ReadConsoleW
GetPrivateProfileIntA
lstrcpyA
GetFileAttributesExW
DeleteFileW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetFilePointerEx
IsDebuggerPresent
GetSystemTimeAsFileTime
CreateEventA
GetModuleHandleA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
HeapAlloc
HeapFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetModuleHandleW
LoadResource
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
VirtualQuery

user32

TranslateMessage
SetDlgItemTextA
BeginPaint
MessageBoxA
SendMessageA
PostQuitMessage
ShowWindow
SetWindowPos
CreateDialogParamA
EnableMenuItem
EndPaint
InvalidateRect
SetWindowTextA
GetWindowTextA
GetSystemMenu
PeekMessageA
DispatchMessageA
GetClientRect
FillRect
GetCursorPos
GetWindowRect
GetDlgItem

gdi32

DeleteObject
SetTextColor
TextOutA
MoveToEx
SetPixel
SetBkMode
SelectObject
Rectangle
LineTo
CreateSolidBrush

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA

odbc32

ord24
ord4
ord11
ord13
ord31
ord16
ord18
ord9
ord41
ord51
ord75
ord39
ord36
ord29

wininet

HttpOpenRequestA
InternetReadFile
InternetConnectA
InternetCloseHandle
InternetOpenA
HttpSendRequestA

iphlpapi

GetAdaptersInfo

icuin48

??0MessageFormat@icu_48@@QAE@ABVUnicodeString@1@AAW4UErrorCode@@@Z
??1MessageFormat@icu_48@@UAE@XZ
?format@MessageFormat@icu_48@@QBEAAVUnicodeString@2@PBVFormattable@2@HAAV32@AAVFieldPosition@2@AAW4UErrorCode@@@Z
??_7FieldPosition@icu_48@@6B@
??0Formattable@icu_48@@QAE@XZ
??1Formattable@icu_48@@UAE@XZ
?setLong@Formattable@icu_48@@QAEXH@Z
?setString@Formattable@icu_48@@QAEXABVUnicodeString@2@@Z
?getDynamicClassID@Formattable@icu_48@@UBEPAXXZ
??1FieldPosition@icu_48@@UAE@XZ

icuuc48

??1UnicodeString@icu_48@@UAE@XZ
??2UMemory@icu_48@@SAPAXI@Z
??3UMemory@icu_48@@SAXPAX@Z
?getTerminatedBuffer@UnicodeString@icu_48@@QAEPB_WXZ
??0UnicodeString@icu_48@@QAE@XZ
?resetIterator@ResourceBundle@icu_48@@QAEXXZ
?hasNext@ResourceBundle@icu_48@@QBECXZ
??0Locale@icu_48@@QAE@PBD000@Z
??1Locale@icu_48@@UAE@XZ
?setDefault@Locale@icu_48@@SAXABV12@AAW4UErrorCode@@@Z
??0ResourceBundle@icu_48@@QAE@PBDABVLocale@1@AAW4UErrorCode@@@Z
??1ResourceBundle@icu_48@@UAE@XZ
?getString@ResourceBundle@icu_48@@QBE?AVUnicodeString@2@AAW4UErrorCode@@@Z
??0UnicodeString@icu_48@@QAE@PBD@Z
?getKey@ResourceBundle@icu_48@@QBEPBDXZ
?getNext@ResourceBundle@icu_48@@QAE?AV12@AAW4UErrorCode@@@Z
?getStringEx@ResourceBundle@icu_48@@QBE?AVUnicodeString@2@PBDAAW4UErrorCode@@@Z
ucnv_open_48
ucnv_close_48
ucnv_getMaxCharSize_48
ucnv_fromUChars_48
?getDynamicClassID@ResourceBundle@icu_48@@UBEPAXXZ
??_UUMemory@icu_48@@SAPAXI@Z
??_VUMemory@icu_48@@SAXPAX@Z
?getChinese@Locale@icu_48@@SAABV12@XZ

Sections

.text
Size: - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 503KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 455KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rA8
Size: - Virtual size: 7.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.*yA
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.>}e
Size: 12.9MB - Virtual size: 12.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5608dd0feb90b01b492806facbe43456

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

gdi32

advapi32

odbc32

wininet

iphlpapi

icuin48

icuuc48

Sections

.text Size: - Virtual size: 1.8MB

.rdata Size: - Virtual size: 503KB

.data Size: - Virtual size: 455KB

.rA8 Size: - Virtual size: 7.0MB

.*yA Size: 2KB - Virtual size: 1KB

.>}e Size: 12.9MB - Virtual size: 12.9MB

.rsrc Size: 10KB - Virtual size: 10KB

.text
Size: - Virtual size: 1.8MB

.rdata
Size: - Virtual size: 503KB

.data
Size: - Virtual size: 455KB

.rA8
Size: - Virtual size: 7.0MB

.*yA
Size: 2KB - Virtual size: 1KB

.>}e
Size: 12.9MB - Virtual size: 12.9MB

.rsrc
Size: 10KB - Virtual size: 10KB