ca97a09326da1508a947e0dbeeb83023

Sharing

Copy URL Twitter E-mail

General

Target

ca97a09326da1508a947e0dbeeb83023
Size

21KB
MD5

ca97a09326da1508a947e0dbeeb83023
SHA1

789cb8b27db3b58dc85df7324e7cdd5a22f5c2f3
SHA256

d8e674f99561946790ecc8d3b233496170e9a9080fbca5af71a59d920cf6c4bb
SHA512

47fe5f4b87d6c682c11a5fb73daa05eb24c5927fa43bd2c0ff7afa745efe56bb7dad8c5f6871906ecb050299f5020bd31beb08c811250ea7ffbbf37140b243b9
SSDEEP

384:S9tXMPs4BgVnBIfidx8f/KL7aGW7g98tX/3ynZJizrscaeuXaP615lWZA:gXMPs4BgVnBIfidw/EmGl98XvcbgYcaf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ca97a09326da1508a947e0dbeeb83023

Files

ca97a09326da1508a947e0dbeeb83023
.exe windows:4 windows x86 arch:x86

b59189c43b01a47f06fed69de6c86d0b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
DeleteFileA
MoveFileA
DeleteFileW
GetWindowsDirectoryW
WaitForSingleObject
GlobalMemoryStatusEx
QueryPerformanceCounter
QueryPerformanceFrequency
SetThreadPriority
SetPriorityClass
GetThreadPriority
GetCurrentThread
GetPriorityClass
GetCurrentProcess
lstrcpynA
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleA
Sleep
lstrcpyW
MoveFileExA
CopyFileA
GetSystemDirectoryA
FreeResource
SizeofResource
LoadResource
FindResourceA
CreateFileA
Process32Next
lstrcmpiA
Process32First
GetProcAddress
GetLastError
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
DeviceIoControl
GetFullPathNameW
CreateFileW
ExitProcess
InitializeCriticalSection
TerminateProcess
GetSystemInfo
GetVersionExA
GetCurrentProcessId
GetTickCount
TerminateThread
ExitThread
lstrcpyA
WriteFile
PeekNamedPipe
SleepEx
ReadFile
ExpandEnvironmentStringsA
GetFileAttributesA
CloseHandle
CreatePipe
GetStartupInfoA
CreateProcessA
CreateThread
GetTempPathA

user32

wsprintfA
ExitWindowsEx
wsprintfW

advapi32

StartServiceCtrlDispatcherA
RegOpenKeyA
RegQueryValueExA
RegDeleteValueA
RegCloseKey
ControlService
CloseServiceHandle
DeleteService
OpenServiceA
OpenSCManagerA
StartServiceA
RegSetValueExA
CreateServiceA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetServiceStatus
RegDeleteKeyW
RegSetValueExW
RegCreateKeyW
RegisterServiceCtrlHandlerA

msvcrt

__p__commode
_exit
??1type_info@@UAE@XZ
_controlfp
__set_app_type
__p__fmode
_CxxThrowException
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
??3@YAXPAX@Z
_except_handler3
??2@YAPAXI@Z
memcpy
rand
srand
time
atoi
malloc
wcstombs
__CxxFrameHandler
_XcptFilter

ws2_32

gethostname
gethostbyname
inet_ntoa
inet_addr
htonl
socket
setsockopt
sendto
recv
send
htons
WSAStartup
closesocket
connect
WSASocketA

wininet

HttpEndRequestA
InternetOpenUrlA
InternetOpenA
InternetSetOptionA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
InternetCloseHandle

ntdll

ZwLoadDriver

netapi32

NetUserAdd
NetLocalGroupAddMembers

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b59189c43b01a47f06fed69de6c86d0b

Headers

File Characteristics

Imports

kernel32

user32

advapi32

msvcrt

ws2_32

wininet

ntdll

netapi32

Sections

.text Size: 13KB - Virtual size: 13KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 1KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 13KB - Virtual size: 13KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB