c50ddba5bf1a76045c0a28210865ca55

Sharing

Copy URL

Twitter E-mail

General

Target

c50ddba5bf1a76045c0a28210865ca55
Size

344KB
MD5

c50ddba5bf1a76045c0a28210865ca55
SHA1

7f252c452ca41db03f85d4ea47088f71aba12981
SHA256

5618ba11c856db4cb56f40ea99f653833a3b8dd993a18927c31f0720da4d1570
SHA512

c4b1c33402d992d552b18a595449a43ea3ef713d6e7722b5aad3a63467d6f21b7bb157d10f764d5ace3a57210bfc8926192b34517716575eee10ad223cfe3d16
SSDEEP

6144:dJpmAbDDG+ICeNZtokPxvQ6WjXepwj6ZooT0WP0hH7bNP4Y/npfA:J3bDw3okNfYSZlQVN9fA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c50ddba5bf1a76045c0a28210865ca55

Files

c50ddba5bf1a76045c0a28210865ca55
.exe windows:5 windows x86 arch:x86

939b3895484451d92bf45036e6dc5801

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

nwprovau.pdb

Imports

msvcrt

_except_handler3
wcslen
_ftol
wcschr
wcstoul
atoi
strtoul
_onexit
__dllonexit
_adjust_fdiv
_vsnwprintf
_wtol
strcmp
_wfopen
malloc
_stricmp
_errno
fprintf
tolower
wcscpy
memset
_vsnprintf
??3@YAXPAX@Z
?terminate@@YAXXZ
??1type_info@@UAE@XZ
free
realloc
_msize
_purecall
wcsncmp
_strcmpi
_strnicmp
_beginthreadex
wcstol
rand
srand
fclose
_initterm
memmove
memchr
_strdup
strncmp
_memicmp
strchr
__CxxFrameHandler
_wcsnicmp
_wcsicmp
isspace
isdigit
isalpha
toupper
iswdigit
wcsrchr
wcsncpy
_CxxThrowException
memcmp
_snprintf
qsort
wcsstr
bsearch
_i64tow
_wtoi64
iswspace
_wtoi
wcscmp
_snwprintf
_ultoa
_ui64toa
_i64toa
_fpclass
_gcvt
_itoa
strtod
_HUGE
??2@YAPAXI@Z

ntdll

NtReleaseSemaphore
NtRemoveIoCompletion
NtFlushBuffersFile
VerSetConditionMask
NtQueryObject
NtQuerySystemInformation

kernel32

GetCurrentProcess
CreateThread
LocalFileTimeToFileTime
SystemTimeToFileTime
GetLocalTime
GetSystemDefaultLCID
GetTimeFormatW
GetDateFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetExitCodeProcess
GetModuleFileNameW
FreeLibraryAndExitThread
GetExitCodeThread
GetModuleHandleA
CreateProcessW
WriteFile
GetCurrentProcessId
DeleteFileA
GetModuleHandleW
lstrlenA
GetSystemPowerStatus
FormatMessageW
GetPrivateProfileStringW
GetSystemInfo
GetVersionExA
GetFileAttributesA
GetModuleFileNameA
GetStdHandle
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
UnmapViewOfFile
VirtualAlloc
IsBadReadPtr
MapViewOfFile
CreateFileMappingA
GetVersion
GetFileAttributesExW
LoadLibraryW
GetCommandLineW
ExpandEnvironmentStringsW
CopyFileW
MultiByteToWideChar
CreateDirectoryW
WaitForSingleObject
DuplicateHandle
CompareFileTime
RaiseException
LCMapStringW
WideCharToMultiByte
DeleteTimerQueueEx
DeleteTimerQueueTimer
CreateMutexA
CreateTimerQueueTimer
CreateTimerQueue
CompareStringW
EnumUILanguagesW
SetLastError
WaitForMultipleObjects
ResetEvent
AddAtomA
GetCurrentThreadId
FindResourceExA
FreeEnvironmentStringsA
GetTickCount
Sleep
GetCurrentDirectoryA
GetSystemDefaultUILanguage
GetLocaleInfoW
CreateEventW
LocalFree
FindNextFileA
GetSystemTime
GetCurrentThread
InterlockedDecrement
InterlockedIncrement
GetFileSize
ReadFile
GetSystemTimeAsFileTime
WaitForMultipleObjectsEx
InterlockedExchangeAdd
GetPrivateProfileIntW
lstrlenW
CreateFileW
InterlockedCompareExchange
InitializeCriticalSection
SetCurrentDirectoryA
FindFirstFileW
lstrcmpW
RemoveDirectoryW
DeleteFileW
FindNextFileW
FindClose
GetEnvironmentVariableW
OpenEventW
SetEvent
GetSystemDefaultLangID
CloseHandle
SetEnvironmentVariableW
GetSystemDirectoryW
GetFileAttributesW
SetFileAttributesW
GetProcAddress
FreeLibrary
GetLastError
GetVersionExW
GetTempFileNameA
GetThreadLocale
GetLocaleInfoA
GetConsoleOutputCP
GetACP
GetUserDefaultLangID
InterlockedExchange
CreateSemaphoreW
LeaveCriticalSection
EnterCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
GetComputerNameExW
VerifyVersionInfoW
GetCommandLineA
OpenMutexW
GetUserDefaultUILanguage
GetTimeZoneInformation
FindFirstFileA
SystemTimeToTzSpecificLocalTime
MoveFileExW
EnumResourceNamesW
EnumResourceLanguagesW
SizeofResource
FindResourceExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
CompareStringA
GetFileTime
LocalAlloc
LoadLibraryA
CopyFileA
DosDateTimeToFileTime
SetFileTime
GetEnvironmentVariableA
CreateFileA
VirtualFree
GetBinaryTypeA
ExpandEnvironmentStringsA
GetSystemDirectoryA
CreateProcessA
GetFullPathNameA
CreateEventA
SleepEx
GlobalAlloc
LoadResource
LockResource
GetSystemWindowsDirectoryW
GetSystemWindowsDirectoryA
CreateDirectoryA
GetFileType
GetVolumePathNameW
GlobalFree
FindResourceW
GetOEMCP
FlushFileBuffers
HeapCreate
CreateFileMappingW
SetFilePointer
GlobalMemoryStatusEx
SetEndOfFile
ReleaseMutex
CreateMutexW
GetDriveTypeW
LoadLibraryExW
InitializeCriticalSectionAndSpinCount

user32

GetDC
TranslateMessage
DispatchMessageA
DefWindowProcA
DispatchMessageW
PostThreadMessageW
LoadCursorA
GetActiveWindow
LoadIconA
CharLowerA
GetCapture
CharUpperA
LoadMenuA
CountClipboardFormats
DestroyWindow
FindWindowExA
OpenWindowStationW
GetUserObjectInformationW
ExitWindowsEx
CharNextW
CharUpperW
CloseWindowStation
GetMessageW
LoadBitmapA
UnregisterClassA
GetSystemMetrics
GetInputState
GetCaretBlinkTime
PostQuitMessage
LoadStringW

advapi32

RegOpenCurrentUser
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitiateSystemShutdownExW
LookupPrivilegeValueW
AdjustTokenPrivileges
StartServiceW
RegCloseKey
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
RegisterServiceCtrlHandlerExW
SetServiceStatus
CloseServiceHandle
DeleteService
ControlService
OpenServiceW
OpenSCManagerW
ChangeServiceConfig2W
ChangeServiceConfigW
CreateServiceW
FreeSid
AllocateAndInitializeSid
RegDeleteValueW
CopySid
GetLengthSid
IsValidSid
CheckTokenMembership
DuplicateTokenEx
GetTokenInformation
OpenThreadToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
EqualSid
RevertToSelf
ImpersonateSelf
ConvertSidToStringSidW
LsaClose
LsaFreeMemory
LsaQueryInformationPolicy
LsaNtStatusToWinError
LsaOpenPolicy
RegSetValueExW
RegQueryValueExW
ConvertStringSidToSidW
CryptReleaseContext
RegEnumKeyExA
CryptAcquireContextA
RegOpenKeyExA
RegQueryValueExA
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegOpenKeyW
GetUserNameW
InitializeAcl
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
CryptGenRandom
RegCreateKeyExW
SetThreadToken
QueryServiceStatus
MakeAbsoluteSD
OpenProcessToken
CreateRestrictedToken
CreateProcessAsUserW
ImpersonateLoggedOnUser
QueryServiceStatusEx
RegEnumValueA
QueryServiceConfigW
AddAccessAllowedAce

ole32

CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2
CoCreateGuid
CoCreateInstance
CoRevertToSelf
CoImpersonateClient
CoRegisterClassObject
CoDisableCallCancellation
CoEnableCallCancellation
CoDisconnectObject
CoRevokeClassObject
CoTaskMemRealloc
CoSetProxyBlanket
CoQueryProxyBlanket
CoCancelCall
CoResumeClassObjects
CoSwitchCallContext
StringFromIID

advpack

ExtractFiles
RunSetupCommand
ExecuteCab
GetVersionFromFileEx
RegInstall

shfolder

SHGetFolderPathW

userenv

UnregisterGPNotification
DestroyEnvironmentBlock
CreateEnvironmentBlock
RegisterGPNotification

ws2_32

WSASocketW
WSAIoctl

esent

JetEscrowUpdate
JetGetTableColumnInfo
JetSetCurrentIndex
JetSeek
JetSetIndexRange
JetMakeKey
JetOpenTable
JetSetColumns
JetUpdate
JetGotoBookmark
JetRollback
JetCommitTransaction
JetBeginTransaction
JetIndexRecordCount
JetDelete
JetRetrieveColumns
JetCreateTable
JetMove
JetGetColumnInfo
JetCloseTable
JetAttachDatabase
JetOpenDatabase
JetCreateDatabase
JetEndSession
JetBeginSession
JetCloseDatabase
JetTerm2
JetInit
JetSetSystemParameter
JetPrepareUpdate
JetCreateIndex2
JetAddColumn
JetDetachDatabase
JetDeleteTable

rpcrt4

UuidCreate
RpcBindingFree
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
NdrClientCall2
UuidToStringW
RpcStringFreeW
UuidFromStringW

wtsapi32

WTSQuerySessionInformationW
WTSEnumerateSessionsW
WTSFreeMemory

setupapi

SetupFindNextLine
SetupOpenInfFileW
SetupCloseInfFile
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupGetLineTextW
SetupFindFirstLineW
SetupGetLineCountW
SetupGetIntField
SetupGetStringFieldW
SetupGetFieldCount
SetupInstallFromInfSectionW
SetupDefaultQueueCallbackW
CM_Get_DevNode_Status
CM_Locate_DevNodeW
SetupDiGetDeviceInstanceIdW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiOpenDeviceInfoW
SetupDiCreateDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDevRegKey
SetupCloseFileQueue
SetupTermDefaultQueueCallback
SetupCommitFileQueueW
SetupInstallFilesFromInfSectionW
SetupInitDefaultQueueCallbackEx
SetupOpenFileQueue
SetupDiGetDriverInstallParamsW
SetupDiEnumDriverInfoW
SetupDiBuildDriverInfoList

winsta

WinStationQueryInformationW

winhttp

WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetDefaultProxyConfiguration
WinHttpQueryAuthSchemes
WinHttpOpen
WinHttpSetOption
WinHttpCloseHandle
WinHttpCreateUrl
WinHttpCrackUrl
WinHttpSendRequest
WinHttpQueryHeaders
WinHttpSetCredentials
WinHttpAddRequestHeaders
WinHttpReadData
WinHttpConnect
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpReceiveResponse

wintrust

WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WinVerifyTrust
WTHelperProvDataFromStateData

crypt32

CryptUnprotectData
CryptHashPublicKeyInfo
CertGetCertificateContextProperty

mspatcha

ApplyPatchToFileByHandles

sfc

SfcIsFileProtected

version

VerQueryValueW

Sections

.text
Size: 128KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 208KB - Virtual size: 249KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 365B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

939b3895484451d92bf45036e6dc5801

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

user32

advapi32

ole32

advpack

shfolder

userenv

ws2_32

esent

rpcrt4

wtsapi32

setupapi

winsta

winhttp

wintrust

crypt32

mspatcha

sfc

version

Sections

.text Size: 128KB - Virtual size: 125KB

.data Size: 208KB - Virtual size: 249KB

.tls Size: 512B - Virtual size: 365B

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 128KB - Virtual size: 125KB

.data
Size: 208KB - Virtual size: 249KB

.tls
Size: 512B - Virtual size: 365B

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 5KB - Virtual size: 5KB