c9b9b15bbb88be367094ee7cd794f3ac

Sharing

Copy URL

Twitter E-mail

General

Target

c9b9b15bbb88be367094ee7cd794f3ac
Size

150KB
MD5

c9b9b15bbb88be367094ee7cd794f3ac
SHA1

3d9facd2b78b27f197d52ee737f69f6b09b18620
SHA256

057ef557d2ec3831df1530b63c80c3e7d04b52d0c3bbad91cb44362272f74f64
SHA512

9946e027b7d1fc671822a691765fd1aef81dd24949c2d2c1661a7bb912826e055a66b6daadf91e6ff2860f3d79b549187089a52b68a90e1a4a60a671a8536c96
SSDEEP

3072:N2uemtj1cmCQwdl/k8fmGPKqWDfvmC0/x9QV5Tpwk:N2GB1Y/j1PKGC8x9S

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c9b9b15bbb88be367094ee7cd794f3ac

Files

c9b9b15bbb88be367094ee7cd794f3ac
.exe windows:5 windows x86 arch:x86

7ce58c614424969fa40fd2edf46c67a6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeLibrary
SetFileTime
SetHandleCount
GetStringTypeW
RemoveDirectoryA
HeapFree
InterlockedExchange
GetCurrentDirectoryA
GetModuleFileNameA
FormatMessageA
GlobalFree
DuplicateHandle
lstrcatA
WriteConsoleW
LockResource
LoadLibraryW
GetOEMCP
GetCommandLineA
LocalLock
GetCPInfo
MulDiv
GetFileTime
SetPriorityClass
GetCurrentThread
LocalReAlloc
FileTimeToSystemTime
lstrcmpW
GetModuleFileNameW
LocalFree
CompareStringW
CreateEventA
SystemTimeToFileTime
SetFileAttributesA
HeapAlloc
SetCurrentDirectoryA
GetProfileIntA
ConvertDefaultLocale
QueryPerformanceFrequency
ResetEvent
LoadLibraryExA
GetShortPathNameA
MultiByteToWideChar
GetFileInformationByHandle
GetCurrentProcess
CreateProcessA
InterlockedIncrement
GetCurrentDirectoryW
UnlockFile
FlushFileBuffers
TlsAlloc
RtlUnwind
FindFirstChangeNotificationA
FileTimeToDosDateTime
GlobalUnlock
SearchPathA
SetFilePointer
CreateDirectoryA
GlobalReAlloc
DeleteCriticalSection
IsValidCodePage
FindResourceExA
GetPrivateProfileIntA
GetVersionExA
CompareStringA
EnumResourceLanguagesA
LCMapStringW
SetEvent
GlobalFlags
GetModuleHandleW
GetSystemDefaultUILanguage
lstrcmpiA
GetStdHandle
GetFileSizeEx
Sleep
LocalUnlock
HeapCreate
LocalAlloc
SuspendThread
OpenFile
ExpandEnvironmentStringsA
WinExec
GetPrivateProfileStringA
GetSystemTimeAsFileTime
CompareFileTime
HeapQueryInformation
FileTimeToLocalFileTime
CreateFileMappingA
LocalFileTimeToFileTime
GetACP
GetFileType
GetTempFileNameA
SetEndOfFile
GetVolumeInformationA
DosDateTimeToFileTime
InitializeCriticalSectionAndSpinCount
TlsFree
GetSystemDirectoryW
InterlockedDecrement
GetFileAttributesExA
ResumeThread
FindCloseChangeNotification
WriteFile
WritePrivateProfileStringA
GetConsoleCP
GetDriveTypeA
CreateFileW
GetDriveTypeW
lstrcpyA
FreeEnvironmentStringsW
SetUnhandledExceptionFilter
TlsSetValue
TlsGetValue
FreeResource
GlobalAddAtomA
GlobalLock
GlobalDeleteAtom
lstrcpynA
CreateFileA
MoveFileA
UnhandledExceptionFilter
FindResourceA
GetFullPathNameA
GetWindowsDirectoryA
IsDebuggerPresent
FindNextChangeNotification
HeapSize
GetLastError
CloseHandle
GetUserDefaultLangID
MapViewOfFile
QueryPerformanceCounter
HeapSetInformation
GetStartupInfoW
LeaveCriticalSection
GetTimeZoneInformation
GetProcAddress
lstrlenA
SetThreadPriority
FindResourceExW
GetNumberFormatA
SetStdHandle
GlobalHandle
InitializeCriticalSection
CreateThread
WideCharToMultiByte
GetDiskFreeSpaceA
GetLocalTime
lstrlenW
GlobalGetAtomNameA
EnterCriticalSection
SetErrorMode
GetLocaleInfoA
RaiseException
SizeofResource
GetStringTypeExA
GetEnvironmentStringsW
GetSystemInfo
TerminateProcess
GetConsoleMode
LockFile
GetThreadLocale
GetFileAttributesA
GlobalSize
IsProcessorFeaturePresent
SetLastError
lstrcmpA
GetUserDefaultUILanguage
DeleteFileA
LoadResource
GetCurrentThreadId
SetEnvironmentVariableA
CopyFileA
GetProcessHeap
WaitForSingleObject
GetFileSize
GetTempPathA
LoadLibraryA
FindResourceW
WaitForMultipleObjects
FindAtomW
VirtualProtect
GetModuleHandleA
GlobalFindAtomA
GetTickCount
GetCurrentProcessId

user32

EnumChildWindows
DrawTextW
CallWindowProcW
DispatchMessageW
MessageBeep
GetMenuItemCount
PostQuitMessage
GetMenuItemInfoW
CreatePopupMenu
GetFocus
GetWindowThreadProcessId
GetCursorPos
KillTimer
GetMonitorInfoW
TranslateMessage
IsWindow
SendMessageW
SetWindowTextW
GetClassNameW
TranslateAcceleratorW
CharNextW
SetCursor
LoadImageW
SetTimer
LoadCursorW
ShowWindow
MonitorFromWindow
PtInRect
ScreenToClient
SetFocus
InvalidateRect
GetWindowLongW
SetWindowLongW
GetClientRect
GetParent
UnregisterClassA
PeekMessageW
TrackPopupMenuEx
MapWindowPoints
AppendMenuW
GetMessageW
MonitorFromPoint
ReleaseDC
EnumWindows
DestroyWindow
SetForegroundWindow
LoadStringA
LoadIconA
IsWindowEnabled
CharLowerW
GetKeyboardLayout
IsWindowUnicode
GetDesktopWindow
EnableWindow
PostMessageW
GetWindowTextW
DefWindowProcW
UpdateLayeredWindow
DestroyMenu
LoadMenuW
TrackMouseEvent
GetWindowRect
RemoveMenu
GetWindowDC
GetWindow
LoadStringW
SetWindowPos
DestroyCursor

gdi32

CloseFigure
BeginPath
AnimatePalette

advapi32

StartServiceCtrlDispatcherW
RevertToSelf
BuildExplicitAccessWithNameW
RegisterEventSourceW
RegOpenKeyA
SetServiceStatus
RegQueryValueExW
RegCloseKey
ReportEventW
QueryServiceStatusEx
CreateProcessAsUserW
ControlService
DeleteService
RegCreateKeyExW
RegCreateKeyW
GetNamedSecurityInfoW
OpenServiceW
GetTokenInformation
OpenSCManagerW
SetNamedSecurityInfoW
DeregisterEventSource
SetEntriesInAclW
RegSetValueExW
CloseServiceHandle
ChangeServiceConfigW
RegisterServiceCtrlHandlerExW
OpenProcessToken
RegOpenKeyExW
DuplicateTokenEx
CreateServiceW
EnumDependentServicesW
RegEnumKeyW
SetTokenInformation
StartServiceW

shell32

SHGetSpecialFolderPathW
SHEmptyRecycleBinW

ole32

CoInitialize

shlwapi

PathFindFileNameW
PathFileExistsW
PathAppendW
PathQuoteSpacesW
PathCombineW
PathRemoveFileSpecW
StrStrIW

version

VerQueryValueW

oledlg

OleUIBusyW
ord8

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory

psapi

GetModuleFileNameExW
GetModuleInformation

msvcrt

_CIsin
_CIcos
exit
_except_handler3
free
malloc
__set_app_type

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7ce58c614424969fa40fd2edf46c67a6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

version

oledlg

wtsapi32

psapi

msvcrt

Sections

.text Size: 68KB - Virtual size: 67KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 26KB - Virtual size: 69KB

.rsrc Size: 29KB - Virtual size: 29KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 68KB - Virtual size: 67KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 26KB - Virtual size: 69KB

.rsrc
Size: 29KB - Virtual size: 29KB

.reloc
Size: 8KB - Virtual size: 7KB