c72dac7ff3ac3383a4f7ad51fb57fa5e

Sharing

Copy URL

Twitter E-mail

General

Target

c72dac7ff3ac3383a4f7ad51fb57fa5e
Size

340KB
MD5

c72dac7ff3ac3383a4f7ad51fb57fa5e
SHA1

dd35e4aeffca42b6dfde2231dc9a6c4601caf72a
SHA256

a11a21c4560620f77acaa94b8be634427b32586390f42af91339b35e1c46cad7
SHA512

806f67082b2f5791f90473fac9f8817b66ca55d1dc1f0d58b3f9c7c39c771fa1e585fae6d6cdeebf9cf7cd4118bf2dd1d0bb95289738fec13f24e854d06a38e9
SSDEEP

6144:1Tdo3TeHVK1mEt2LAtlQMFCI8CntPAvDdifmQOUa3RJuwlwDFr362ZFLPIGgLsr:hK3q1At2EAMFCIztPALdhJRJPyDFr36s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c72dac7ff3ac3383a4f7ad51fb57fa5e

Files

c72dac7ff3ac3383a4f7ad51fb57fa5e
.exe windows:5 windows x86 arch:x86

e6eeba611096acae1ec55db5c14bcbe4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord4213
ord2570
ord4392
ord3577
ord3605

ole32

ReleaseStgMedium
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
GetHGlobalFromStream
CoTaskMemAlloc
StringFromGUID2
StringFromCLSID
CoTaskMemFree
CoCreateInstance

advapi32

RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
InitializeSecurityDescriptor
CopySid
GetLengthSid
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
RegDeleteKeyW
RegEnumKeyExW
LsaOpenPolicy
LsaLookupNames
GetSidSubAuthorityCount
GetSidSubAuthority
LsaFreeMemory
LsaOpenAccount
LsaCreateAccount
LsaGetSystemAccessAccount
LsaSetSystemAccessAccount
LsaClose
GetSecurityDescriptorLength
GetSecurityDescriptorControl
AllocateAndInitializeSid
MakeSelfRelativeSD
FreeSid
MapGenericMask
ControlService
StartServiceW
EnumDependentServicesW
ChangeServiceConfigW
QueryServiceStatusEx
RevertToSelf
IsWellKnownSid
RegConnectRegistryW
QueryServiceStatus
GetUserNameW
RegDeleteValueW
EnumServicesStatusW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
AddAccessAllowedAce
InitializeAcl
SetSecurityDescriptorDacl

shlwapi

ord437

gdi32

DeleteObject

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fhj5
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fhj50
Size: 512B - Virtual size: 222B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fhj51
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fhj52
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fhj53
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fhj54
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fhj55
Size: 512B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fhj56
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fhj57
Size: 512B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fhj58
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fhj59
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.1231
Size: 512B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.JAKS
Size: 512B - Virtual size: 246B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.GAHS
Size: 512B - Virtual size: 198B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.HAJS
Size: 512B - Virtual size: 458B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.HnJS
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SKALS
Size: 512B - Virtual size: 242B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SKAkS
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SfAkS
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e6eeba611096acae1ec55db5c14bcbe4

Headers

DLL Characteristics

File Characteristics

Imports

mfc42u

ole32

advapi32

shlwapi

gdi32

Sections

.text Size: 9KB - Virtual size: 9KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 2KB - Virtual size: 2KB

.fhj5 Size: 512B - Virtual size: 196B

.fhj50 Size: 512B - Virtual size: 222B

.fhj51 Size: 512B - Virtual size: 228B

.fhj52 Size: 148KB - Virtual size: 147KB

.fhj53 Size: 148KB - Virtual size: 147KB

.fhj54 Size: 512B - Virtual size: 212B

.fhj55 Size: 512B - Virtual size: 214B

.fhj56 Size: 512B - Virtual size: 216B

.fhj57 Size: 512B - Virtual size: 214B

.fhj58 Size: 512B - Virtual size: 212B

.fhj59 Size: 512B - Virtual size: 212B

.1231 Size: 512B - Virtual size: 214B

.JAKS Size: 512B - Virtual size: 246B

.GAHS Size: 512B - Virtual size: 198B

.HAJS Size: 512B - Virtual size: 458B

.HnJS Size: 512B - Virtual size: 168B

.SKALS Size: 512B - Virtual size: 242B

.SKAkS Size: 512B - Virtual size: 260B

.SfAkS Size: 512B - Virtual size: 260B

.rsrc Size: 16KB - Virtual size: 16KB

.reloc Size: 512B - Virtual size: 276KB

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 2KB - Virtual size: 2KB

.fhj5
Size: 512B - Virtual size: 196B

.fhj50
Size: 512B - Virtual size: 222B

.fhj51
Size: 512B - Virtual size: 228B

.fhj52
Size: 148KB - Virtual size: 147KB

.fhj53
Size: 148KB - Virtual size: 147KB

.fhj54
Size: 512B - Virtual size: 212B

.fhj55
Size: 512B - Virtual size: 214B

.fhj56
Size: 512B - Virtual size: 216B

.fhj57
Size: 512B - Virtual size: 214B

.fhj58
Size: 512B - Virtual size: 212B

.fhj59
Size: 512B - Virtual size: 212B

.1231
Size: 512B - Virtual size: 214B

.JAKS
Size: 512B - Virtual size: 246B

.GAHS
Size: 512B - Virtual size: 198B

.HAJS
Size: 512B - Virtual size: 458B

.HnJS
Size: 512B - Virtual size: 168B

.SKALS
Size: 512B - Virtual size: 242B

.SKAkS
Size: 512B - Virtual size: 260B

.SfAkS
Size: 512B - Virtual size: 260B

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 512B - Virtual size: 276KB