c468c22eb4e0f921e88543c02749f185

Sharing

Copy URL Twitter E-mail

General

Target

c468c22eb4e0f921e88543c02749f185
Size

138KB
MD5

c468c22eb4e0f921e88543c02749f185
SHA1

c240c7a06f9919d1ce211635687eeea260195718
SHA256

7917d62b1a37541c4fa44f91f756ae23db1beb981c79f660757d7bca34aa11ef
SHA512

e8e73d1a2554af51ad11809e81170eb610f0fa1e3de1bd767e8bfadaf0d02e91fe906e3746feeb74a4aaf7f012e761c44f030d7c64c40ff04744f4240234068d
SSDEEP

3072:J1BUToKvgB++1wC7NI9FlyE1uuzPgUA/n6oRF9s5LTrnbDCZx0QHhMt:JE82gBT1M9FlyHubgUtYF9s5LTrnQS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c468c22eb4e0f921e88543c02749f185

Files

c468c22eb4e0f921e88543c02749f185
.exe windows:5 windows x86 arch:x86

2af9c6f16c50f0240a123b3f1fe2032b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenProcess
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetThreadContext
SetThreadContext
VirtualAlloc
GetProcessId
TlsGetValue
TlsSetValue
TerminateProcess
GetEnvironmentVariableW
FileTimeToDosDateTime
GetTempFileNameW
HeapReAlloc
FindFirstFileW
SetEndOfFile
CreateProcessW
HeapAlloc
SystemTimeToFileTime
SetFilePointerEx
HeapFree
GetProcessHeap
IsBadReadPtr
SetFileTime
VirtualQueryEx
WriteFile
LocalFree
WideCharToMultiByte
CreateRemoteThread
HeapDestroy
HeapCreate
Thread32Next
ReadFile
GetTimeZoneInformation
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetFileSizeEx
OpenMutexW
VirtualProtectEx
VirtualAllocEx
FindClose
RemoveDirectoryW
FindNextFileW
VirtualProtect
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
GetPrivateProfileIntW
GetPrivateProfileStringW
WriteProcessMemory
GetCurrentProcessId
DuplicateHandle
OpenEventW
VirtualFreeEx
VirtualFree
GetComputerNameW
SetErrorMode
GetCommandLineW
SetFileAttributesW
WTSGetActiveConsoleSessionId
WaitForMultipleObjects
GetUserDefaultUILanguage
GetModuleFileNameW
MoveFileExW
GetVersionExW
GetNativeSystemInfo
CreateThread
GetLocalTime
GetFileAttributesExW
GetModuleHandleW
GetSystemTime
ResetEvent
SetLastError
GetLastError
ReadProcessMemory
LoadLibraryA
GetProcAddress
lstrcmpiA
CreateFileW
GetFileAttributesW
Sleep
LoadLibraryW
CreateDirectoryW
FreeLibrary
ExitProcess
ReleaseMutex
ExpandEnvironmentStringsW
TlsFree
CloseHandle
TlsAlloc
CreateEventW
CreateFileMappingW
SetThreadPriority
GetCurrentThread
SetEvent
WaitForSingleObject
UnmapViewOfFile
MapViewOfFile
CreateMutexW
GetCurrentThreadId
lstrcmpiW
EnterCriticalSection
GlobalUnlock
LeaveCriticalSection
InitializeCriticalSection
GetTickCount
Thread32First
GlobalLock

user32

ReleaseCapture
GetMessagePos
CharLowerW
DrawIcon
GetIconInfo
GetCursorPos
CharToOemW
GetSystemMetrics
ExitWindowsEx
RegisterClassExA
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
GetSubMenu
DefDlgProcW
DefFrameProcA
OpenInputDesktop
PeekMessageA
GetDC
GetMenu
RegisterClassExW
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
SetWindowPos
GetMenuState
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
GetMenuItemCount
GetTopWindow
GetAncestor
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharLowerA
CharUpperW
SetWindowLongW
GetWindow
DispatchMessageW
FillRect
DrawEdge
IntersectRect
EqualRect
PrintWindow
MapVirtualKeyW
GetWindowRect
PostMessageW
GetParent
GetWindowInfo
GetClassLongW
SendMessageTimeoutW
IsWindow
PeekMessageW
MapWindowPoints
GetWindowLongW
MenuItemFromPoint
IsRectEmpty
GetDCEx
EndPaint
GetMessageA
ToUnicode
GetClipboardData
GetUpdateRgn
GetMessageW
GetWindowDC
SetCapture
DefDlgProcA
PostThreadMessageW
DefMDIChildProcA
HiliteMenuItem
RegisterClassW
SendMessageW
CallWindowProcA
EndMenu
CallWindowProcW
DefWindowProcW
DefFrameProcW
GetWindowThreadProcessId
RegisterClassA
GetShellWindow
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
BeginPaint
GetUpdateRect
GetCapture
SetCursorPos
ReleaseDC
GetKeyboardState
TranslateMessage
OpenWindowStationW
GetUserObjectInformationW
SetThreadDesktop
CloseDesktop
OpenDesktopW
GetProcessWindowStation
CreateWindowStationW
CharLowerBuffA

advapi32

InitiateSystemShutdownExW
EqualSid
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
ConvertSidToStringSidW
IsWellKnownSid
GetLengthSid
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegSetValueExW
CryptHashData

shlwapi

StrStrIA
PathRemoveFileSpecW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathRemoveBackslashW
PathQuoteSpacesW
PathRenameExtensionW
StrStrIW
StrCmpNIW
PathIsURLW

shell32

ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

SetViewportOrgEx
GdiFlush
CreateDIBSection
SetRectRgn
SaveDC
RestoreDC
DeleteDC
GetDeviceCaps
DeleteObject
SelectObject
GetDIBits
CreateCompatibleBitmap
CreateCompatibleDC

ws2_32

select
getaddrinfo
recvfrom
getpeername
send
closesocket
WSASend
accept
WSAEventSelect
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
shutdown
setsockopt
bind
socket
WSASetLastError
listen
getsockname
sendto
recv
freeaddrinfo
WSAGetLastError

crypt32

CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData
PFXExportCertStoreEx

wininet

InternetQueryOptionA
InternetSetOptionA
InternetQueryOptionW
InternetOpenA
HttpOpenRequestA
InternetCrackUrlA
InternetConnectA
InternetCloseHandle
HttpSendRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFile
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpQueryInfoA
HttpSendRequestExA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2af9c6f16c50f0240a123b3f1fe2032b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 130KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 130KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB