c2e252867b43f57022020339e0847d79

Sharing

Copy URL Twitter E-mail

General

Target

c2e252867b43f57022020339e0847d79
Size

198KB
MD5

c2e252867b43f57022020339e0847d79
SHA1

5b0c111c40e85c4acf2abf5f614d939d5c3c7dc9
SHA256

105aa992e8af0b615342123311050529114946a3eba88e13a75c6f08d2c8311b
SHA512

7a289b46f2af35096498cefaf96927efc4b63859ff79a9e4a38f583e94a10516ef29257dc97b44d01868efbe5a1e0bd0e15481614f08543c280c0bc6cc138408
SSDEEP

3072:HM9SXlBIFmpX2Msp4/2YFHNtc6JsHJY2CzrxVKKDxUel:s9bFmpm5Y5MUzrxVKL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c2e252867b43f57022020339e0847d79

Files

c2e252867b43f57022020339e0847d79
.exe windows:4 windows x86 arch:x86

be1c97a67fcc79a052cb8aace39181a3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\newqq\AdWin\Release\AdWin.pdb

Imports

kernel32

ReleaseMutex
FindClose
FindFirstFileA
SetFileTime
SystemTimeToFileTime
CreateFileA
GetProcAddress
LoadLibraryA
FreeLibrary
LocalFree
MapViewOfFile
UnmapViewOfFile
ExitProcess
WideCharToMultiByte
lstrlenW
MultiByteToWideChar
MoveFileExA
lstrlenA
VirtualFreeEx
GetExitCodeThread
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
GetCurrentProcess
InterlockedDecrement
CloseHandle
TlsAlloc
DeleteCriticalSection
GetFileType
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
IsBadCodePtr
InitializeCriticalSection
GetCPInfo
GetOEMCP
IsBadWritePtr
GetTimeZoneInformation
InterlockedExchange
DeleteFileA
CopyFileA
CreateMutexA
GetModuleFileNameA
Sleep
GetSystemDirectoryA
GetWindowsDirectoryA
GetTempPathA
GetCurrentThreadId
GetLastError
FormatMessageA
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
FindNextFileA
SetFilePointer
ReadFile
LCMapStringW
LCMapStringA
HeapSize
SetHandleCount
HeapReAlloc
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
WriteFile
EnterCriticalSection
LeaveCriticalSection
SetUnhandledExceptionFilter
VirtualFree
HeapCreate
HeapDestroy
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
RaiseException
RtlUnwind
GetSystemTimeAsFileTime
IsBadReadPtr
TerminateProcess
GetFileAttributesA
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
SetLastError

user32

CreateWindowExA
DefWindowProcA
PostQuitMessage
EndPaint
BeginPaint
MessageBoxA
PostThreadMessageA
PostMessageA
TranslateMessage
DispatchMessageA
GetMessageA
UpdateWindow
RegisterClassExA
EnumChildWindows
EnumWindows
GetClassNameA
GetWindowThreadProcessId
SetWindowTextA
SystemParametersInfoA
SetWindowPos
FindWindowA
KillTimer
SetTimer
ShowWindow

advapi32

RegCloseKey
RegEnumKeyA
RegEnumValueA
RegQueryInfoKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetSecurityInfo
SetEntriesInAclA
SetSecurityInfo
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA

shell32

SHGetFolderPathA
ShellExecuteA

ole32

CoCreateGuid
CoInitializeEx
CoCreateInstance

oleaut32

SysFreeString
SysAllocString
VariantClear
GetErrorInfo
VariantInit

netapi32

Netbios

wininet

HttpQueryInfoA
InternetOpenUrlA
InternetSetOptionA
InternetCloseHandle
InternetOpenA
InternetReadFile

userenv

GetProfilesDirectoryA

urlmon

CreateURLMoniker

Sections

.data
Size: 197KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

be1c97a67fcc79a052cb8aace39181a3

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

netapi32

wininet

userenv

urlmon

Sections

.data Size: 197KB - Virtual size: 197KB

.data
Size: 197KB - Virtual size: 197KB