c500fbfd813760490341902154bb6331

Sharing

Copy URL Twitter E-mail

General

Target

c500fbfd813760490341902154bb6331
Size

204KB
MD5

c500fbfd813760490341902154bb6331
SHA1

ab9af7abb8d072edbd2c26de6ba519b654555e39
SHA256

e3ab4aa1d67d6cacf40239702a995459e7f0f2b9d89d77932162eb65c4b0e8ea
SHA512

b5866fe5a25b95b9b35509126542ac291778e6fcfb2d72e67be4ad5eb771fa718b49d38c2a9a728ef9fb0bb77e105969158dbbf7d4f261fc7626cbd372d1097f
SSDEEP

6144:+jg80wiD/EeHRJETxNbOF/Gtr8HBSaKCX0d2WgIt5lr:2aTJETxN6FetrTaHX4zp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c500fbfd813760490341902154bb6331

Files

c500fbfd813760490341902154bb6331
.exe windows:4 windows x86 arch:x86

68339a03b96a0b6d412d26e89e1b1f1b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

shell32

SHGetSpecialFolderPathW
SHGetSpecialFolderPathA

kernel32

OutputDebugStringA
CreateFiberEx
DeleteCriticalSection
GetComputerNameA
InterlockedExchange
CompareStringA
LocalAlloc
CreateMutexA
CloseHandle
LoadLibraryA
GetTempPathA
GetModuleHandleA
VirtualQuery
GetWindowsDirectoryA
GetThreadPriority
GetSystemDirectoryA
_llseek
GetLastError
GetDevicePowerState
ResetEvent
CreateThread
IsBadWritePtr
DeleteFileA
CreateDirectoryA
LocalFree
DefineDosDeviceA
CreateFileA
IsBadReadPtr
WriteFile
FlushInstructionCache
GetCurrentThreadId
GetACP
SetEvent
GetModuleFileNameA
InitializeCriticalSection
VirtualAlloc
GetFileAttributesA
EnterCriticalSection
GlobalMemoryStatus
GetCurrentThread
InterlockedIncrement
LoadLibraryExA
LeaveCriticalSection
EnumResourceNamesW
GetVersion
lstrlenA
ReadFile
CreateEventA
FreeLibrary
WaitForSingleObject
WaitForMultipleObjects
SetThreadPriority
CreateProcessA
GetLocalTime
CreateSemaphoreA
GetPrivateProfileStringA
FlushFileBuffers
GetDiskFreeSpaceA
GetSystemTime
Sleep
VirtualFree
GetVersionExA
InterlockedDecrement
GetLocaleInfoA
QueryPerformanceCounter
QueryDosDeviceA
GetSystemInfo
SetLastError
DeviceIoControl
GetTickCount
GetCurrentProcessId
ReleaseMutex

gdi32

CreateDIBitmap

user32

GetQueueStatus
PeekMessageA
DispatchMessageA
RealGetWindowClassA
ShowWindow
CreateDialogParamA
ReleaseDC
wsprintfA
RegisterWindowMessageA
GetDesktopWindow
MsgWaitForMultipleObjects
DestroyWindow
PostThreadMessageA
GetDC
wvsprintfA

ole32

StringFromGUID2
BindMoniker
CoTaskMemAlloc
GetRunningObjectTable
CoCreateInstance
StgIsStorageFile
StgOpenStorage
CoTaskMemFree
CreateItemMoniker
StgCreateDocfile
CreateBindCtx
CoUninitialize
CoInitialize

iphlpapi

GetBestInterface
GetAdaptersInfo
SendARP

wininet

InternetCloseHandle
InternetReadFile
InternetOpenUrlA
InternetOpenA

advapi32

GetUserNameA
RegEnumValueA
RegSetValueExA
CryptHashData
CryptCreateHash
RegCreateKeyExA
CryptDestroyHash
CryptGetHashParam
CryptEncrypt
CryptImportKey
CryptReleaseContext
RegEnumKeyExA
CryptDestroyKey
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueA
RegCloseKey

setupapi

SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

winmm

timeGetTime
timeSetEvent

Sections

.text
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

68339a03b96a0b6d412d26e89e1b1f1b

Headers

File Characteristics

Imports

shell32

kernel32

gdi32

user32

ole32

iphlpapi

wininet

advapi32

setupapi

winmm

Sections

.text Size: 175KB - Virtual size: 175KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 23KB - Virtual size: 22KB

.tls Size: 512B - Virtual size: 228KB

.text
Size: 175KB - Virtual size: 175KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 23KB - Virtual size: 22KB

.tls
Size: 512B - Virtual size: 228KB