c928dbcd0cb57b009d48a20417d9e89c

Sharing

Copy URL

Twitter E-mail

General

Target

c928dbcd0cb57b009d48a20417d9e89c
Size

1.2MB
MD5

c928dbcd0cb57b009d48a20417d9e89c
SHA1

162640d99a33c17eb00d1e87cd157a55e17d3d48
SHA256

e89159d80f961248e92a9e3d9cb24616f794e2fa3f2812dd4f40c63ed9da3582
SHA512

ebb1f4a4def45358682d588bca3f00ca96685d401e0f30970a967377cc445eb1dfccdb51eee82feaa6557cf672b939f711af58f302d778f4674856a965b74f1f
SSDEEP

24576:02wA85UezPCZ+ESiJ7mREp753LT+G8hysS/v1l:lwA7ezESc9p9T+Ql

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c928dbcd0cb57b009d48a20417d9e89c

Files

c928dbcd0cb57b009d48a20417d9e89c
.exe windows:5 windows x86 arch:x86

ca2c30e23fbf0f92c528d7635b8247cc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

recv
socket
sendto
__WSAFDIsSet
closesocket
getsockopt
WSASetLastError
ioctlsocket
getprotobyname
send
WSAGetLastError
htons
gethostbyname
WSAStartup
recvfrom
shutdown
ntohs
inet_addr
connect
bind
select
inet_ntoa
getservbyname
WSACleanup

winhttp

WinHttpOpen
WinHttpReadData
WinHttpReceiveResponse
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpConnect
WinHttpCrackUrl
WinHttpSendRequest
WinHttpSetStatusCallback
WinHttpQueryDataAvailable

version

VerQueryValueA

kernel32

WideCharToMultiByte
RaiseException
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
WaitForSingleObject
SetEvent
CreateEventA
SetThreadPriority
MultiByteToWideChar
lstrlenW
EnterCriticalSection
LeaveCriticalSection
GetLastError
InterlockedIncrement
InterlockedDecrement
lstrlenA
lstrcmpiA
IsDBCSLeadByte
FreeLibrary
LoadLibraryExA
GetModuleHandleA
GetModuleFileNameA
TerminateProcess
OpenProcess
GetCurrentProcessId
DeleteFileA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetFileAttributesExA
Sleep
FindClose
FindNextFileA
FindFirstFileA
GetWindowsDirectoryA
MoveFileExA
GetFileAttributesA
TryEnterCriticalSection
GetVersionExA
GetCurrentProcess
ResetEvent
HeapFree
GetProcessHeap
FlushInstructionCache
GetCurrentThreadId
SetLastError
lstrcmpA
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
SetFilePointer
ReadFile
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetHandleCount
HeapCreate
GetStdHandle
WriteFile
IsValidCodePage
GetOEMCP
GetCPInfo
GetDateFormatA
GetTimeFormatA
FindResourceExA
SetStdHandle
RemoveDirectoryA
GetFileType
PeekNamedPipe
GetTimeZoneInformation
GetStartupInfoA
GetCommandLineA
SetEnvironmentVariableA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualProtect
CreateThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
GetSystemTimeAsFileTime
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapAlloc
HeapDestroy
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GlobalFree
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
FindNextFileW
ResumeThread
TlsFree
TlsAlloc
DuplicateHandle
GetProcessAffinityMask
GetThreadPriority
WaitForMultipleObjects
InterlockedExchangeAdd
TlsSetValue
GetCurrentThread
TlsGetValue
SetThreadContext
FindResourceA
LoadResource
LockResource
SizeofResource
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
SetEndOfFile
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CreateFileW
CompareStringW
GetThreadContext
GetFileInformationByHandle
CreateFileA
MoveFileA
WritePrivateProfileStringA
SetFileAttributesA
GetShortPathNameA
FindFirstFileW
GetFullPathNameA
LoadLibraryA
GetProcAddress
HeapCompact
CreateDirectoryA
ExitProcess

user32

PostMessageA
SetTimer
KillTimer
MessageBoxA
SendMessageA
ExitWindowsEx
RegisterWindowMessageA
SetForegroundWindow
SetWindowLongA
DefWindowProcA
CallWindowProcA
LoadMenuA
DestroyMenu
SetMenuDefaultItem
GetMonitorInfoA
MonitorFromPoint
UnregisterClassA
TrackPopupMenu
GetWindowLongA
CharNextA
GetSubMenu
GetCursorPos
LoadImageA
GetSystemMetrics
CharLowerA
CreateWindowExA
SetWindowTextA
MoveWindow
GetWindowRect
GetClientRect
SetFocus
GetParent
IsWindow
GetClassInfoExA
ShowWindow
PostQuitMessage
InvalidateRgn
GetWindowTextLengthA
GetWindowTextA
IsWindowEnabled
EnableWindow
CreateAcceleratorTableA
GetFocus
GetWindow
DestroyAcceleratorTable
BeginPaint
EndPaint
FillRect
ReleaseCapture
GetClassNameA
GetDlgItem
IsChild
SetCapture
RedrawWindow
LoadCursorA
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
SetWindowPos
GetSysColor
RegisterClassExA
GetDesktopWindow
DestroyWindow
GetMessageA
TranslateMessage
DispatchMessageA
SetLayeredWindowAttributes

gdi32

BitBlt
GetStockObject
GetObjectA
CreateSolidBrush
GetDeviceCaps
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject

advapi32

RegDeleteKeyA
RegEnumKeyA
RegQueryValueExA
RegFlushKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA

shell32

ShellExecuteExW
Shell_NotifyIconA

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoSetProxyBlanket
CoUninitialize
CoInitialize
CoInitializeSecurity
StringFromGUID2
OleLockRunning
CoGetClassObject
CLSIDFromProgID
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CLSIDFromString

oleaut32

VariantCopy
LoadTypeLi
GetErrorInfo
SysFreeString
SysAllocString
VariantInit
VariantClear
VarUI4FromStr
VariantChangeType
SysAllocStringLen
SysStringLen
VarBstrCat
SysStringByteLen
OleCreateFontIndirect
LoadRegTypeLi

iphlpapi

GetNetworkParams

shlwapi

StrStrA

Sections

.text
Size: 697KB - Virtual size: 696KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 356KB - Virtual size: 356KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ca2c30e23fbf0f92c528d7635b8247cc

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

winhttp

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

iphlpapi

shlwapi

Sections

.text Size: 697KB - Virtual size: 696KB

.rdata Size: 356KB - Virtual size: 356KB

.data Size: 47KB - Virtual size: 65KB

.rsrc Size: 101KB - Virtual size: 101KB

.text
Size: 697KB - Virtual size: 696KB

.rdata
Size: 356KB - Virtual size: 356KB

.data
Size: 47KB - Virtual size: 65KB

.rsrc
Size: 101KB - Virtual size: 101KB