c1678ed8b0e6fcf46ef444ae1468bc85

Sharing

Copy URL Twitter E-mail

General

Target

c1678ed8b0e6fcf46ef444ae1468bc85
Size

987KB
MD5

c1678ed8b0e6fcf46ef444ae1468bc85
SHA1

36f05884ae91ccb584561f6884380a259bd9059a
SHA256

161072cea6d0a843786a0ab4c484213c07e750f848930267e59b43afbfbdc130
SHA512

9f15a736557d35dbcd4851d46e2713f0e5d87cdc8a152d8fb98a6cc0f801245e740f26dd36ee346d2e0281710425ed2e0c9f7f7521afd3291b3cd542b2f3d20f
SSDEEP

24576:jgkPnXqTXd/juSyG0uHWm91TExakK021D0HHprQZ8L:jVOd9yG0u2c1VkK/F01

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c1678ed8b0e6fcf46ef444ae1468bc85

Files

c1678ed8b0e6fcf46ef444ae1468bc85
.exe windows:5 windows x86 arch:x86

f606d4de61806b5bb24a45078ee7b42b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

M:\TWRK\406bed20d9978749\src\MicrogamingInstall\Release\MicrogamingInstall.pdb

Imports

kernel32

GetModuleFileNameW
lstrlenW
CreateDirectoryA
FindFirstFileA
FindClose
GetModuleFileNameA
FindNextFileA
lstrcpyA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
WideCharToMultiByte
CreateProcessW
OpenProcess
Sleep
CreateProcessA
lstrcmpiA
RemoveDirectoryA
CopyFileA
GetTempFileNameA
GetCurrentProcessId
GetTempPathA
DeleteFileA
GetComputerNameA
FormatMessageA
GetVolumePathNameW
CopyFileW
FormatMessageW
RemoveDirectoryW
GetModuleHandleA
ReleaseMutex
GetDiskFreeSpaceExA
GetVersionExA
DeleteFileW
SetFileAttributesW
GetPrivateProfileStringW
LoadLibraryA
CreateMutexA
GetDriveTypeA
GetVolumeInformationA
DeviceIoControl
ResetEvent
InterlockedDecrement
MoveFileExA
Process32First
TerminateProcess
GetSystemDirectoryA
GetLocalTime
Process32Next
CreateToolhelp32Snapshot
InterlockedIncrement
GetPrivateProfileIntA
InterlockedExchange
GetExitCodeThread
WaitForMultipleObjects
GetCurrentThreadId
CreateSemaphoreA
ReleaseSemaphore
GetLogicalDriveStringsA
GlobalMemoryStatusEx
GetSystemInfo
GetEnvironmentVariableA
GetFileAttributesW
GetCurrentThread
GetThreadTimes
ResumeThread
InterlockedCompareExchange
QueueUserWorkItem
OpenFileMappingA
lstrcatA
InitializeCriticalSection
CompareStringW
GetProcessHeap
SetEndOfFile
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetCurrentDirectoryW
PeekNamedPipe
GetFileInformationByHandle
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetHandleCount
GetTimeZoneInformation
LCMapStringW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapSize
HeapCreate
IsProcessorFeaturePresent
GetStdHandle
GetFileType
WriteConsoleW
MoveFileA
RaiseException
RtlUnwind
GetFullPathNameA
GetDriveTypeW
SetCurrentDirectoryA
GetCurrentDirectoryA
SetEnvironmentVariableA
FindFirstFileExA
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcpynW
GetFileAttributesA
lstrcpynA
lstrlenA
GetFileSize
LocalFree
GetProcAddress
CreateFileW
MultiByteToWideChar
LoadLibraryW
CreateDirectoryW
FreeLibrary
InterlockedPushEntrySList
WaitForSingleObject
InterlockedFlushSList
InterlockedPopEntrySList
InitializeSListHead
CloseHandle
ReadFile
WriteFile
SetFilePointer
CreateFileA
CreateThread
OutputDebugStringA
GetLastError
CreateEventA
SetEvent
SetThreadPriority
GetStartupInfoW
HeapSetInformation
GetCommandLineA
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
ExitThread
GetSystemTimeAsFileTime
ExitProcess
GetModuleHandleW
HeapAlloc
DecodePointer
EncodePointer
HeapFree
SetFileAttributesA

user32

SetFocus
MessageBoxA
SetWindowTextA
PostMessageA
RegisterClassA
ShowWindow
DefWindowProcA
CreateWindowExA
FlashWindowEx
MoveWindow
CopyRect
GetDlgCtrlID
LoadCursorA
AdjustWindowRect
EnableWindow
UpdateWindow
MapWindowPoints
LoadImageA
IsWindowVisible
GetSystemMetrics
RegisterClassW
MessageBoxW
DispatchMessageA
wsprintfW
InvalidateRect
GetMessageA
PostThreadMessageA
wsprintfA
DefWindowProcW
CreateWindowExW
CreatePopupMenu
SetLayeredWindowAttributes
GetCursorPos
SetWindowPos
SetWindowLongW
ReleaseDC
AppendMenuW
GetWindowLongW
SetWindowLongA
OffsetRect
ChildWindowFromPoint
TranslateMessage
IsDialogMessageA
SendMessageA
GetClientRect
IsWindowEnabled
LoadIconA
SetForegroundWindow
GetWindowDC
TrackPopupMenu
PeekMessageA
GetActiveWindow
wvsprintfA
SendMessageTimeoutA
DestroyWindow
GetWindowRect

gdi32

DeleteDC
CreateDIBSection
GetDIBits
DeleteObject
SelectObject
CreateCompatibleDC
GetStockObject
BitBlt

advapi32

RegCreateKeyExA
RegEnumKeyW
OpenSCManagerA
CloseServiceHandle
OpenServiceA
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueW
RegSetValueA
RegQueryValueW
RegCloseKey
GetUserNameA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
FreeSid
SetEntriesInAclW

shell32

SHGetSpecialFolderPathA
Shell_NotifyIconA
ShellExecuteA
SHGetPathFromIDListW
SHGetFolderPathW
SHGetMalloc
SHChangeNotify
SHGetSpecialFolderLocation

ole32

CoCreateInstance
OleUninitialize
OleInitialize
CLSIDFromProgID
CoTaskMemFree
StringFromIID
CoCreateGuid
CoTaskMemAlloc
CoSetProxyBlanket
CoUninitialize
CoInitialize
OleSetContainedObject
OleCreate

oleaut32

VariantTimeToSystemTime
VariantCopy
VariantChangeType
SysStringLen
SafeArrayUnaccessData
SysAllocString
SysAllocStringLen
SysFreeString
VariantClear
SafeArrayCreateVector
SafeArrayAccessData
VariantInit

wsock32

closesocket
inet_addr
htonl
socket
WSAGetLastError
ntohs
getservbyport
getservbyname
send
WSAStartup
WSACleanup
WSASetLastError
gethostbyaddr
connect
ioctlsocket
htons
gethostbyname

ws2_32

WSAAddressToStringA

wininet

InternetCrackUrlA
InternetReadFile
InternetSetOptionA
HttpOpenRequestA
HttpSendRequestA
InternetGetLastResponseInfoA
InternetCloseHandle
HttpQueryInfoA
InternetOpenUrlA
InternetCreateUrlA
InternetOpenW
InternetOpenUrlW
InternetConnectA
InternetQueryOptionA
InternetOpenA
InternetCrackUrlW

shlwapi

PathAppendA
SHDeleteKeyA
PathCanonicalizeW
PathAppendW
StrStrA
PathCanonicalizeA

psapi

GetModuleFileNameExA

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

urlmon

CoInternetGetSession

Exports

Exports

?CreateDefaultBrowserInfo@@YGPAVIDefaultBrowserInfo@@XZ
?CreateDirectXVersionInfo@@YGPAVIDirectXVersionInfo@@XZ
?CreateDisplaysDeviceInfo@@YGPAVIDisplayDevicesInfo@@XZ
?CreateFixedDriveInfo@@YGPAVIFixedDriveInfo@@XZ
?CreateFixedDrivesInfo@@YGPAVIFixedDrivesInfo@@XZ
?CreateFlashInfo@@YGPAVIFlashInfo@@XZ
?CreateIEVersionInfo@@YGPAVIIEVersionInfo@@XZ
?CreateMacAddress@@YGPAVIMacAddress@@XZ
?CreateMachineInfo@@YGPAVIMachineInfo@@XZ
?CreateMachineInfoXML@@YGPAVIMachineInfoXML@@XZ
?CreateOSInfo@@YGPAVIOSInfo@@XZ
?CreateProcessorsInfo@@YGPAVIProcessorsInfo@@XZ
?CreateRamInfo@@YGPAVIRamInfo@@XZ
?CreateSoundDevicesInfo@@YGPAVISoundDevicesInfo@@XZ
?CreateUserExperience@@YGPAVIUserExperience@@XZ
?CreateVMInfo@@YGPAVIVMInfo@@XZ

Sections

.text
Size: 446KB - Virtual size: 445KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 84KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f606d4de61806b5bb24a45078ee7b42b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wsock32

ws2_32

wininet

shlwapi

psapi

version

urlmon

Exports

Exports

Sections

.text Size: 446KB - Virtual size: 445KB

.rdata Size: 70KB - Virtual size: 70KB

.data Size: 84KB - Virtual size: 103KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 446KB - Virtual size: 445KB

.rdata
Size: 70KB - Virtual size: 70KB

.data
Size: 84KB - Virtual size: 103KB

.rsrc
Size: 4KB - Virtual size: 3KB