cca69e9547c04b7d79b21aa88aa66847

Sharing

Copy URL Twitter E-mail

General

Target

cca69e9547c04b7d79b21aa88aa66847
Size

58KB
MD5

cca69e9547c04b7d79b21aa88aa66847
SHA1

3a1c5dd52ad89d48c373c65d83b6090baa0d51d7
SHA256

40ddf4f4f83723a68b819787bfdee6eeaf8edb740ec4815bac1219ed56d24066
SHA512

fe7ec11fe60459e006239da6701272ceeaabab26d482138101f2bec633721209ee4cb69b76f1972ba18787c3a7e46a1b2ed8771da003bba0439a7d260dde582e
SSDEEP

1536:FmHhSprL2s2a9riUbE95gjL3kYVC3XkkCq/dcUaITX+:FR1Lz1U5gfkYVCWq/dcUaITX+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cca69e9547c04b7d79b21aa88aa66847

Files

cca69e9547c04b7d79b21aa88aa66847
.exe windows:4 windows x86 arch:x86

a362fbc4cd6f38b03b8e0a585781f50f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA

shlwapi

StrStrIA
StrStrA
wnsprintfA

ws2_32

setsockopt
recv
send
socket
connect
htons
getsockname
recvfrom
sendto
WSAStartup
getsockopt
inet_ntoa
closesocket

kernel32

MultiByteToWideChar
GlobalAlloc
GlobalFree
lstrcmpW
GetSystemTime
GetCurrentProcessId
OpenEventA
SetEvent
GetCommandLineA
GetVersion
MapViewOfFile
CreateFileMappingA
ExitProcess
ExitThread
Sleep
GetCurrentThreadId
CloseHandle
CreateThread
CreateMutexA
OpenMutexA
lstrcmpA
lstrlenW
IsBadReadPtr
lstrcmpiA
GetTickCount
HeapCreate
HeapAlloc
HeapReAlloc
HeapFree
IsBadWritePtr
WaitForSingleObject
ReleaseMutex
SystemTimeToFileTime
GetTimeZoneInformation
GetLastError
UnmapViewOfFile

user32

GetDC
wsprintfA
CharLowerA

dnsapi

DnsQuery_A
DnsExtractRecordsFromMessage_W
DnsRecordListFree

gdiplus

GdipGetFontCollectionFamilyCount
GdipNewPrivateFontCollection
GdipPrivateAddMemoryFont
GdipDeleteFont
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipDeleteGraphics
GdipSaveImageToStream
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusStartup
GdiplusShutdown
GdipCreateSolidFill
GdipGetImageGraphicsContext
GdipGetDC
GdipReleaseDC
GdipDrawLineI
GdipFillRectangleI
GdipDrawString
GdipDrawImageI
GdipCloneFontFamily
GdipGetFontCollectionFamilyList
GdipDeletePrivateFontCollection
GdipCreateFont
GdipCloneBitmapAreaI
GdipCloneBrush
GdipCloneImage
GdipDeletePen
GdipCreatePen1
GdipFree
GdipAlloc
GdipDeleteBrush
GdipDisposeImage

gdi32

GetTextExtentPoint32A

ole32

CreateStreamOnHGlobal

msvcr71

atoi

Sections

.text
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 21.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a362fbc4cd6f38b03b8e0a585781f50f

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shlwapi

ws2_32

kernel32

user32

dnsapi

gdiplus

gdi32

ole32

msvcr71

Sections

.text Size: 55KB - Virtual size: 54KB

.data Size: 2KB - Virtual size: 21.7MB

.text
Size: 55KB - Virtual size: 54KB

.data
Size: 2KB - Virtual size: 21.7MB