c8e9e8448b3872263de42bea6e73f492

Sharing

Copy URL Twitter E-mail

General

Target

c8e9e8448b3872263de42bea6e73f492
Size

328KB
MD5

c8e9e8448b3872263de42bea6e73f492
SHA1

a0045b59c51a60d7a1908b7f7ff5a0e740d5e08c
SHA256

4f4b2bd233333bd8452497a296a7d57758ad9541782fe5c6b959af84fc8c6c1e
SHA512

a15825a73b90fb44a1775be219768a07f182e1363f159255a870be4ae1e253d337fab33c2709200f7f35542a5e4add819f46cc9de1d6bf929c3334d659334e2d
SSDEEP

6144:4QVv/NrQRGD0Xlh+M1oUZyf+eTfc/Cn/2DXZIpJr6Xm76s4HrLOQp:RR/yRGD01B0qU/2DpqFF76s4LC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c8e9e8448b3872263de42bea6e73f492

Files

c8e9e8448b3872263de42bea6e73f492
.exe windows:4 windows x86 arch:x86

c69c31f097b058887d08b053a26f3b0c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

VariantInit
VariantClear
VarR8FromI1
SysStringLen
SysFreeString
SysAllocString

ole32

CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CoSetProxyBlanket
CoInitialize
HMETAFILE_UserFree

kernel32

FindNextFileW
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDriveTypeW
GetExitCodeProcess
GetExitCodeThread
GetFileSize
GetFileTime
GetFileType
GetLocalTime
GetLocaleInfoW
GetPrivateProfileStringW
GetProcAddress
GetProcessHeap
GetSystemDefaultLangID
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetUserDefaultLangID
GetVersionExW
GetVolumeInformationW
GlobalAlloc
GlobalFree
HeapAlloc
HeapFree
FindFirstFileW
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
LeaveCriticalSection
LoadLibraryExW
LocalFree
MapViewOfFile
MoveFileW
MultiByteToWideChar
QueryPerformanceCounter
ReadFile
ReleaseMutex
RemoveDirectoryW
ResetEvent
SetEndOfFile
SetEvent
SetFileAttributesW
SetFilePointer
SetFileTime
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
UnhandledExceptionFilter
UnmapViewOfFile
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcmpW
lstrcmpiW
lstrcpynW
lstrlenA
lstrlenW
CloseHandle
FindClose
FileTimeToSystemTime
ExpandEnvironmentStringsW
EnterCriticalSection
DisableThreadLibraryCalls
DeleteFileW
DeleteCriticalSection
CreateThread
CreateProcessW
CreateMutexW
CreateFileW
CreateEventW
CreateDirectoryW
CompareStringW
CompareStringA
CompareFileTime
HeapReAlloc

user32

CharLowerA
CharNextW
CharUpperA
CharUpperW
DispatchMessageW
GetActiveWindow
GetKeyboardType
GetWindowThreadProcessId
MsgWaitForMultipleObjects
PeekMessageW
PostMessageW
SendMessageW
TranslateMessage
ExitWindowsEx

shlwapi

StrChrW
StrCmpIW
StrCmpW
StrRChrW
StrStrIW
PathStripToRootW
PathRemoveBackslashW
PathIsUNCW
PathIsRootW
PathIsRelativeW
UrlGetPartW
UrlCombineW
StrToIntW
StrToIntExW
PathFindExtensionW

shell32

SHBrowseForFolderW
SHGetFolderPathW
SHGetMalloc
SHGetPathFromIDListW
ShellExecuteW

advapi32

AdjustTokenPrivileges
AllocateAndInitializeSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
CopySid
EqualSid
FreeSid
GetLengthSid
RegEnumKeyW
RegEnumKeyExW
SetNamedSecurityInfoW
RegSetValueExW
RegQueryValueExW
RegOpenKeyW
GetSecurityDescriptorDacl
GetSecurityDescriptorOwner
GetTokenInformation
IsValidSid
LookupPrivilegeValueW
LsaClose
LsaFreeMemory
LsaNtStatusToWinError
LsaOpenPolicy
LsaQueryInformationPolicy
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW

wininet

InternetQueryOptionA
InternetGetConnectedState
InternetCrackUrlW
InternetCanonicalizeUrlW

setupapi

SetupDiOpenDevRegKey
CM_Get_DevNode_Registry_PropertyW
SetupDiOpenDeviceInfoW
SetupDiSetDeviceInstallParamsW
SetupDiSetSelectedDriverW
SetupFindFirstLineW
SetupGetStringFieldW
SetupOpenFileQueue
SetupOpenInfFileW
SetupScanFileQueueW
CM_Locate_DevNodeW
SetupCloseFileQueue
SetupCloseInfFile
SetupDiBuildDriverInfoList
SetupDiCreateDeviceInfoList
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiEnumDriverInfoW
SetupDiGetClassDevsW
SetupDiGetDeviceInstallParamsW
SetupDiGetDeviceInstanceIdW
SetupDiInstallDriverFiles
SetupDiGetDriverInstallParamsW
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status

crypt32

CryptHashPublicKeyInfo
CertGetCertificateContextProperty

Sections

.text
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c69c31f097b058887d08b053a26f3b0c

Headers

File Characteristics

Imports

oleaut32

ole32

kernel32

user32

shlwapi

shell32

advapi32

wininet

setupapi

crypt32

Sections

.text Size: 76KB - Virtual size: 76KB

.rdata Size: 208KB - Virtual size: 208KB

.data Size: 16KB - Virtual size: 168KB

.idata Size: 8KB - Virtual size: 8KB

.rsrc Size: 16KB - Virtual size: 16KB

.text
Size: 76KB - Virtual size: 76KB

.rdata
Size: 208KB - Virtual size: 208KB

.data
Size: 16KB - Virtual size: 168KB

.idata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 16KB - Virtual size: 16KB