bf9a2b49384aa33c08572e6f1a5d9228

Sharing

Copy URL Twitter E-mail

General

Target

bf9a2b49384aa33c08572e6f1a5d9228
Size

729KB
MD5

bf9a2b49384aa33c08572e6f1a5d9228
SHA1

dcc42d012718a9621b1de554ae91765820963c07
SHA256

e52ef762b2a7997a6444d6dcfb50510fbdbf04c5a62cd61ba57f5c237569f459
SHA512

3878772f8e3e5f96196b6d054fbb662991bd1228c932d3ad20dfd866d86e609bd0af2cab88ca27e67b0e2df00d3122ac3fc4299a0d7db45de61c5c8f76cf2773
SSDEEP

12288:v5HiA2A1mTeeaE55VqneduHrM8upLbgkTFbRaZY:xHn1mTeeaqvcedGM8upLbgkTKZY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bf9a2b49384aa33c08572e6f1a5d9228

Files

bf9a2b49384aa33c08572e6f1a5d9228
.exe .vbs windows:5 windows x86 arch:x86 polyglot

63552784f1df2d8a60108b001d324574

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

PDB Paths

D:\binaries.x86fre\SCP_WPA\update.PDB

Imports

advapi32

GetLengthSid
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyExA
FreeSid
RegSetKeySecurity
EnumServicesStatusExA
OpenServiceW
InitiateSystemShutdownA
AbortSystemShutdownA
RegOpenKeyExW
GetFileSecurityA
LockServiceDatabase
QueryServiceConfigA
ChangeServiceConfigA
UnlockServiceDatabase
GetNamedSecurityInfoA
SetNamedSecurityInfoA
GetTokenInformation
RegisterEventSourceA
ReportEventA
DeregisterEventSource
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
OpenProcessToken
RegLoadKeyA
RegUnLoadKeyA
AdjustTokenPrivileges
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExA
CopySid
GetAclInformation
SetFileSecurityW
AddAce
RegQueryInfoKeyA
RegSaveKeyA
RegFlushKey
EnumDependentServicesA
InitializeAcl
AddAccessAllowedAce
SetFileSecurityA
QueryServiceStatus
GetServiceDisplayNameA
RegOpenKeyA
RegDeleteValueA
OpenSCManagerA
OpenServiceA
StartServiceA
ControlService
CloseServiceHandle
AllocateAndInitializeSid
InitializeSecurityDescriptor

comctl32

PropertySheetW
CreatePropertySheetPageW

crypt32

CertSetCertificateContextProperty
CertOpenStore
CertCloseStore
CertFreeCertificateContext
CertCreateCertificateContext
CertAddCertificateContextToStore
CryptEncodeObject

gdi32

GetDeviceCaps
CreateFontIndirectA
DeleteObject
CreateCompatibleDC
GetDIBits
SelectObject
StretchBlt
BitBlt

imagehlp

EnumerateLoadedModules64

kernel32

VirtualAllocEx
CreateRemoteThread
OpenProcess
InterlockedIncrement
GetFullPathNameW
GetFileSizeEx
OpenEventA
CompareStringA
SearchPathA
GetLocalTime
lstrlenW
GetDriveTypeW
lstrcpynW
lstrcpyW
SearchPathW
ExpandEnvironmentStringsW
GetVersionExW
GetTempFileNameW
CopyFileW
ReleaseMutex
GetModuleFileNameW
GetSystemDefaultLangID
DuplicateHandle
CreateProcessW
OpenFileMappingA
RaiseException
GlobalFree
GlobalUnlock
GlobalHandle
GlobalLock
GlobalAlloc
FreeLibrary
DeleteFileA
GetWindowsDirectoryA
GetLastError
GetProcAddress
LoadLibraryA
GetSystemDirectoryW
CreateDirectoryA
GetFileAttributesA
FormatMessageA
lstrcmpiA
HeapDestroy
MultiByteToWideChar
FindClose
FindNextFileA
FindFirstFileA
ExpandEnvironmentStringsA
GetDriveTypeA
CloseHandle
UnmapViewOfFile
HeapCreate
CreateFileMappingA
GetFileSize
CreateFileA
SetLastError
LocalFree
LocalAlloc
GetVersionExA
SetFileAttributesA
MoveFileExA
CopyFileA
GetTempFileNameA
GetSystemDirectoryA
InterlockedCompareExchange
HeapFree
WriteFile
SetFilePointer
HeapAlloc
GetProcessHeap
WriteProcessMemory
GetLocaleInfoA
GetThreadLocale
Sleep
InitializeCriticalSection
GetEnvironmentVariableA
VirtualAlloc
GetModuleFileNameA
SetCurrentDirectoryA
WritePrivateProfileStringA
VirtualFree
GetFileAttributesExA
DeviceIoControl
FileTimeToSystemTime
FileTimeToLocalFileTime
LeaveCriticalSection
EnterCriticalSection
RemoveDirectoryA
SetEvent
WaitForMultipleObjects
SetThreadPriority
CreateThread
CreateEventA
GetTickCount
ReadFile
FormatMessageW
GetModuleHandleA
FileTimeToDosDateTime
GetFileInformationByHandle
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
WaitForSingleObject
CreateMutexA
GetCommandLineW
GetCommandLineA
SetErrorMode
GetVolumeInformationW
GetWindowsDirectoryW
lstrcmpA
GetVolumeInformationA
GetFullPathNameA
ExitProcess
SetUnhandledExceptionFilter
SetEnvironmentVariableA
GetSystemInfo
lstrlenA
FreeResource
LockResource
LoadResource
FindResourceA
LoadLibraryExA
GetTempPathA
GetCurrentProcess
GetDiskFreeSpaceExA
GetDiskFreeSpaceA
GetCompressedFileSizeA
GetComputerNameA
ReleaseSemaphore
SetEndOfFile
InterlockedDecrement
GetCurrentThread
GetExitCodeThread
CreateSemaphoreA
MoveFileA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
GetStartupInfoA
CreateEventW
QueryDosDeviceA
DefineDosDeviceA
lstrcpynA
LoadLibraryW
FindFirstFileW
lstrcmpiW
GetPrivateProfileStringA
FindNextFileW
MapViewOfFileEx
CreateProcessA
GetExitCodeProcess
FlushFileBuffers
FlushViewOfFile
CreateFileW
DeleteFileW
GetFileTime
DelayLoadFailureHook
WideCharToMultiByte
MapViewOfFile
GetVersion
InitializeCriticalSectionAndSpinCount
VirtualProtect
GetSystemTime
TlsSetValue
TlsGetValue
TlsAlloc
TlsFree
DeleteCriticalSection

mpr

WNetGetUniversalNameA
WNetGetUserA

msvcrt

_initterm
__getmainargs
_acmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
realloc
atoi
_memicmp
_local_unwind2
wcstoul
wcsstr
rename
_wcsicmp
ctime
_vsnwprintf
wcscat
_tempnam
remove
_lseek
_close
_write
_read
_open
_errno
_wcsdup
strncat
vsprintf
memmove
strncmp
_mbsupr
strcspn
isdigit
wcsrchr
wcscmp
wcsncat
wcsncpy
toupper
strspn
atol
__setusermatherr
isspace
_ultoa
_wtoi64
_wcslwr
strtok
_itow
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
__CxxFrameHandler
??3@YAXPAX@Z
??0exception@@QAE@ABV0@@Z
_CxxThrowException
fclose
??2@YAPAXI@Z
fopen
fprintf
wcschr
_ltoa
??1type_info@@UAE@XZ
?terminate@@YAXXZ
strtoul
getenv
calloc
_strdup
strstr
_mbslwr
_strcmpi
memchr
_strnicmp
wcslen
swprintf
wcscpy
_snwprintf
_snprintf
_itoa
strncpy
__set_app_type
_controlfp
_adjust_fdiv
__p__fmode
_except_handler3
strchr
__p__commode
_stricmp
sprintf
strrchr
mbstowcs
malloc
free
strpbrk
_vsnprintf

ntdll

RtlTimeToTimeFields
NtQuerySystemTime
RtlFreeUnicodeString
RtlInitUnicodeString
NtClose
NtAdjustPrivilegesToken
NtOpenProcessToken
NtQueryInformationProcess
RtlCharToInteger
LdrAccessResource
LdrFindResource_U
NtQuerySystemInformation
NtShutdownSystem
RtlRaiseStatus
RtlFreeHeap
RtlAllocateHeap
RtlCreateUnicodeString
NtYieldExecution
NtSetSystemInformation
NtCreateSection
NtOpenFile
NtOpenSection
NtOpenDirectoryObject
RtlCompareUnicodeString
NtCreateFile
RtlDosPathNameToNtPathName_U
LdrUnloadDll
NtFreeVirtualMemory
NtQueryInformationThread
NtWaitForSingleObject
RtlCreateUserThread
NtWriteVirtualMemory
NtAllocateVirtualMemory
RtlEqualUnicodeString
NtOpenProcess
LdrGetProcedureAddress
LdrLoadDll
RtlDestroyHeap
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlGetAce
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
RtlAllocateAndInitializeSid
RtlCreateHeap
DbgPrint
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
RtlInitAnsiString
RtlAnsiStringToUnicodeString

ole32

CoCreateInstance
CoUninitialize
CoInitialize
CoInitializeEx

oleaut32

SysFreeString

psapi

GetModuleFileNameExA

rpcrt4

UuidFromStringA

shell32

SHGetSpecialFolderPathA
SHChangeNotify
SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA

shlwapi

PathGetArgsA
PathUnquoteSpacesA

updspapi

UpdSpFindFirstLineW
UpdSpGetMultiSzFieldW
UpdSpGetTargetPathW
UpdSpStringTableEnum
UpdSpStringTableDestroy
UpdSpStringTableInitialize
UpdSpStringTableInitializeEx
UpdSpStringTableAddString
UpdSpStringTableAddStringEx
UpdSpStringTableLookUpString
UpdSpStringTableLookUpStringEx
UpdSpSetDynamicStringA
UpdSpCopyErrorA
UpdSpPromptForDiskA
UpdSpInitDefaultQueueCallbackEx
UpdSpIterateCabinetA
UpdSpGetLineCountW
UpdSpGetLineByIndexW
UpdSpGetStringFieldW
UpdSpCommitFileQueueA
UpdSpOpenFileQueue
UpdSpGetSourceInfoA
UpdSpGetSourceFileLocationA
UpdSpCloseFileQueue
UpdSpDefaultQueueCallbackW
UpdSpDefaultQueueCallbackA
UpdSpDecompressOrCopyFileA
UpdSpGetTargetPathA
UpdSpInstallFromInfSectionA
UpdSpQueueCopyA
UpdSpGetIntField
UpdSpGetBinaryField
UpdSpScanFileQueueA
UpdSpGetLineTextW
UpdSpOpenInfFileA
UpdSpCloseInfFile
UpdSpSetDirectoryIdA
UpdSpInstallFilesFromInfSectionA
UpdSpGetLineByIndexA
UpdSpGetStringFieldA
UpdSpFindFirstLineA
UpdSpGetLineTextA
UpdSpGetFieldCount
UpdSpFindNextLine
UpdSpGetLineCountA
UpdSpFindNextMatchLineW

user32

GetMessageA
PostThreadMessageA
DispatchMessageA
GetDlgItem
SetWindowTextW
RedrawWindow
SetWindowLongA
MessageBoxA
LoadStringW
GetWindowLongA
GetWindowTextA
OpenWindowStationA
EnumWindowStationsA
wvsprintfW
LoadStringA
GetSystemMetrics
MessageBoxW
DefWindowProcA
CreateWindowExA
RegisterClassA
GetWindow
PostMessageA
EnumChildWindows
SetDlgItemTextW
GetWindowThreadProcessId
FindWindowExA
GetClientRect
CloseDesktop
EnumWindows
SetThreadDesktop
GetThreadDesktop
OpenDesktopA
CloseWindowStation
EnumDesktopsA
SetProcessWindowStation
LoadBitmapA
IsDlgButtonChecked
SetTimer
CheckDlgButton
KillTimer
ReleaseDC
GetDC
SetFocus
GetDesktopWindow
DialogBoxParamA
EndDialog
SetWindowTextA
SetForegroundWindow
TranslateMessage
SystemParametersInfoA
EnableWindow
ShowWindow
SetDlgItemTextA
SendMessageA
DestroyWindow
PostQuitMessage
GetProcessWindowStation

version

VerQueryValueA
GetFileVersionInfoSizeA
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
GetFileVersionInfoA

winspool.drv

GetPrinterDriverDirectoryA

Sections

.text
Size: 607KB - Virtual size: 607KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 503KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 117KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

63552784f1df2d8a60108b001d324574

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

comctl32

crypt32

gdi32

imagehlp

kernel32

mpr

msvcrt

ntdll

ole32

oleaut32

psapi

rpcrt4

shell32

shlwapi

updspapi

user32

version

winspool.drv

Sections

.text Size: 607KB - Virtual size: 607KB

.data Size: 4KB - Virtual size: 503KB

.rsrc Size: 117KB - Virtual size: 188KB

.text
Size: 607KB - Virtual size: 607KB

.data
Size: 4KB - Virtual size: 503KB

.rsrc
Size: 117KB - Virtual size: 188KB