bededb6ce1e4a39deb3859ef3ff6f400

Sharing

Copy URL

Twitter E-mail

General

Target

bededb6ce1e4a39deb3859ef3ff6f400
Size

165KB
MD5

bededb6ce1e4a39deb3859ef3ff6f400
SHA1

8aa646da9b92ac849fbab737015ae864ef7cb7b0
SHA256

c645668fe196679b7fcbf14ef05e3bb5a18f3f6b50a2f7814a454c732d0801f1
SHA512

2ce2dbaaf5cf1c25668dd4fa0ea80b2aeff59c10f7011bc45771b36b1c99eccabfc2dd18c4af46638a00c561a6197aafd9cb08e4d525567ff96419e64c80e1da
SSDEEP

3072:kgO0Uq+4zf5bNWcbGnM8J3XtitrOm9da+VOugv7GYLOeGW/X:kxiDD5bNAnMyXwJOud/VjkSMSA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bededb6ce1e4a39deb3859ef3ff6f400

Files

bededb6ce1e4a39deb3859ef3ff6f400
.exe windows:5 windows x86 arch:x86

94a7b8136f5447a631d73aa145195d8c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
ExitProcess
HeapReAlloc
LCMapStringA
WideCharToMultiByte
LCMapStringW
LoadLibraryA
GetWindowsDirectoryW
VirtualProtect
GetSystemInfo
VirtualQuery
GetLocaleInfoA
GetCPInfo
GetStringTypeA
GetStringTypeW
RtlUnwind
SetStdHandle
FlushFileBuffers
CloseHandle
HeapAlloc
HeapFree
GetVersionExA
GetStartupInfoW
GetModuleHandleA
GetCommandLineW
VirtualAlloc
GetLastError
GetUserDefaultUILanguage
SetFilePointer
SetCurrentDirectoryW

gdi32

CreateFontIndirectW
DeleteObject
CreateCompatibleDC
SelectObject
GetTextMetricsW
DeleteDC
GetObjectW

user32

DialogBoxParamW
SendDlgItemMessageA
SetClassLongA
mouse_event
IsDlgButtonChecked
EndDialog
SetForegroundWindow
AllowForegroundActivation
SetWindowPos
SetWindowLongW
GetWindowLongW
GetDlgItem
SendDlgItemMessageW
PostQuitMessage
LoadStringW
SendMessageW
LoadIconW
EnableWindow
SetWindowTextW
SetDlgItemTextW
LoadIconA

comctl32

ord17

shell32

CommandLineToArgvW
ShellExecuteW

shlwapi

UrlEscapeW
UrlUnescapeW

ntdll

RtlFreeHeap
RtlQueryEnvironmentVariable_U
NtMapViewOfSection
NtCreateSection
NtUnmapViewOfSection
NtProtectVirtualMemory
NtAllocateVirtualMemory
NtFreeVirtualMemory
NtQuerySystemInformation
NtQueryVirtualMemory
NtQueryInformationFile
RtlDoesFileExists_U
RtlUnicodeStringToInteger
RtlAllocateHeap
RtlExpandEnvironmentStrings_U
RtlAppendUnicodeStringToString
RtlStringFromGUID
NtQueryAttributesFile
NtQueryInformationProcess
RtlFormatCurrentUserKeyPath
NtCreateKey
NtSetValueKey
DbgPrint
strchr
isdigit
strspn
_vsnprintf
sprintf
RtlUpcaseUnicodeToMultiByteN
NtWriteFile
RtlAppendUnicodeToString
NtDeleteFile
NtOpenKey
NtQueryValueKey
NtClose
RtlDosPathNameToNtPathName_U
NtCreateFile
qsort
RtlCreateUnicodeString
RtlFreeUnicodeString
RtlInitUnicodeString
RtlGUIDFromString

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 109KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

94a7b8136f5447a631d73aa145195d8c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

gdi32

user32

comctl32

shell32

shlwapi

ntdll

Sections

.text Size: 50KB - Virtual size: 50KB

.data Size: 4KB - Virtual size: 9KB

.rsrc Size: 109KB - Virtual size: 111KB

.text
Size: 50KB - Virtual size: 50KB

.data
Size: 4KB - Virtual size: 9KB

.rsrc
Size: 109KB - Virtual size: 111KB