c20bff6c8bcf3ab1e08b64208870fbdc

Sharing

Copy URL Twitter E-mail

General

Target

c20bff6c8bcf3ab1e08b64208870fbdc
Size

205KB
MD5

c20bff6c8bcf3ab1e08b64208870fbdc
SHA1

f0c0077063699292e7a9e3400ee5474446f20e0c
SHA256

2b78790747df9708ca626316e683e7e9a942584abd1c612925db809f394f3563
SHA512

b57e200eb97093ad0dd658435e144eada32b4377dead18fbd827db1bbc4ad3cbd111597b82d744458bdd3d836babb728536c80d711f2008fd9555539b0b4f7ff
SSDEEP

3072:c0BBegh3390qfGA3fbTets6Re5nGXLkchQvrsOOEYwjjDAz42ekdLmEAEznn:HBPR3DfGAHePs5G7kOQvoOOER840LA6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c20bff6c8bcf3ab1e08b64208870fbdc

Files

c20bff6c8bcf3ab1e08b64208870fbdc
.exe windows:4 windows x86 arch:x86

14ad02344740d4404484437ec5e9e03c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\src\upgrdhlp\upgrdhlp.pdb

Imports

kernel32

FindFirstFileA
GetDriveTypeA
FindNextFileA
TerminateProcess
OpenProcess
GetSystemDirectoryA
WideCharToMultiByte
MultiByteToWideChar
SetCurrentDirectoryA
GetFullPathNameA
GetCurrentDirectoryA
DeleteFileA
RemoveDirectoryA
CreateDirectoryA
GetModuleFileNameA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
IsBadReadPtr
SetEnvironmentVariableA
GetDiskFreeSpaceA
CompareStringA
SetFilePointer
VirtualProtect
InitializeCriticalSection
GetLocaleInfoA
VirtualQuery
InterlockedExchange
SetUnhandledExceptionFilter
LCMapStringW
GetVersion
GetSystemInfo
InterlockedDecrement
InterlockedIncrement
FreeLibrary
LoadLibraryA
CreateMutexA
GetLastError
ReleaseMutex
WaitForSingleObject
CloseHandle
WinExec
CreateProcessA
GetCurrentProcess
WritePrivateProfileStringA
MoveFileExA
GetWindowsDirectoryA
FindClose
SetErrorMode
GetVersionExA
CompareStringW
GetProcAddress
GetShortPathNameA
ExitProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
HeapAlloc
HeapFree
HeapReAlloc
SetFileAttributesA
GetFileAttributesA
MoveFileA
GetACP
GetOEMCP
GetCPInfo
RtlUnwind
RaiseException
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
HeapSize
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
IsBadWritePtr
GetStringTypeA
GetStringTypeW
LCMapStringA
SetEnvironmentVariableW

user32

CharPrevA
CharNextA
GetSystemMetrics
SetWindowTextA
LoadIconA
SendMessageA
BringWindowToTop
SendDlgItemMessageA
InvalidateRect
UpdateWindow
EndDialog
SystemParametersInfoA
GetParent
GetWindowRect
SetWindowPos
IsWindow
CreateDialogParamA
GetSysColor
MessageBoxA
ExitWindowsEx
FindWindowA
RegisterClassA
CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
DestroyWindow
PostQuitMessage
KillTimer
SetTimer
PostMessageA
DefWindowProcA

advapi32

RegEnumKeyExA
RegQueryValueExA
RegEnumKeyA
RegDeleteKeyA
RegSetValueA
RegOpenKeyA
RegQueryValueA
RegDeleteValueA
RegOpenKeyExA
RegCreateKeyA
RegSetValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

gdi32

SetBkColor
DeleteObject
CreateSolidBrush
SetTextColor

comctl32

ord17

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

14ad02344740d4404484437ec5e9e03c

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

gdi32

comctl32

Sections

.text Size: 72KB - Virtual size: 71KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 4KB - Virtual size: 9KB

.rsrc Size: 104KB - Virtual size: 104KB

.text
Size: 72KB - Virtual size: 71KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 4KB - Virtual size: 9KB

.rsrc
Size: 104KB - Virtual size: 104KB