ccdb1f57b7901326c8cac223e3d2719a

Sharing

Copy URL Twitter E-mail

General

Target

ccdb1f57b7901326c8cac223e3d2719a
Size

329KB
MD5

ccdb1f57b7901326c8cac223e3d2719a
SHA1

634f2f190f1050991e8372e66c94cb1924c2f7f2
SHA256

f64ba7d70b01e317155008b2ebb24017d792eee2f9a80efba00ca615c54ca4b5
SHA512

b3ed886c6ef0fc74adf25522da8551f7629e520e45f4d057c8e2082dcb80dfe207fe4ebe084b57ca650c5ae66b57f830919b27826309ec3b474cfc93303d8b39
SSDEEP

6144:CsJZFI/nbaordaX2HbKSmpMQ8mtpHk7t5AqOxvsyIiJX9K/tQTrNFSRmKiGNQ:C8ZQbBhP2zFEXjMk/iJXI/t4rNFSrn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ccdb1f57b7901326c8cac223e3d2719a

Files

ccdb1f57b7901326c8cac223e3d2719a
.exe windows:5 windows x86 arch:x86

47b7e6d815afec90d01060efec6ff6ce

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfW
CharLowerBuffW

msasn1

ASN1BEREncExplicitTag
ASN1BERDecCharString
ASN1intx2uint32
ASN1_CreateModule
ASN1BEREncObjectIdentifier
ASN1DecAlloc
ASN1BERDecU32Val
ASN1BERDecSkip
ASN1_Encode
ASN1EncSetError
ASN1BEREncOctetString
ASN1_FreeEncoded
ASN1BERDecBool
ASN1intxisuint32
ASN1BERDecGeneralizedTime
ASN1octetstring_free
ASN1objectidentifier_free
ASN1BEREncBitString
ASN1_FreeDecoded
ASN1ztcharstring_free
ASN1BERDecOctetString
ASN1BERDecZeroCharString
ASN1_Decode
ASN1BEREncCharString
ASN1BEREncSX
ASN1charstring_free
ASN1BEREncBool
ASN1BEREncEndOfContents
ASN1Free
ASN1DecSetError
ASN1intx_setuint32
ASN1_CloseDecoder
ASN1intx2int32
ASN1bitstring_free
ASN1BERDecPeekTag
ASN1BERDecExplicitTag
ASN1_CloseEncoder
ASN1BEREncU32
ASN1BERDecS32Val
ASN1BERDecEndOfContents
ASN1BEREncOpenType
ASN1_CreateDecoder
ASN1BERDecObjectIdentifier
ASN1BEREncS32
ASN1CEREncGeneralizedTime
ASN1intx_free
ASN1BERDecNotEndOfContents
ASN1BERDecOpenType2
ASN1BERDecBitString
ASN1BERDecSXVal
ASN1_CreateEncoder

secur32

CredUnmarshalTargetInfo
CredMarshalTargetInfo
LsaGetLogonSessionData
FreeContextBuffer
LsaFreeReturnBuffer

kernel32

MultiByteToWideChar
GetSystemTimeAsFileTime
GetProfileStringA
InterlockedIncrement
lstrlenW
DeleteCriticalSection
GetModuleFileNameW
OutputDebugStringA
VirtualAlloc
GetCurrentProcess
InterlockedExchange
RaiseException
InterlockedDecrement
OpenFileMappingW
CreateEventW
DebugBreak
GetACP
InterlockedCompareExchange
CreateFileW
CloseHandle
SetEvent
GetComputerNameW
TerminateProcess
LoadLibraryW
GetCurrentThreadId
MapViewOfFileEx
SetUnhandledExceptionFilter
GetProcAddress
LocalAlloc
CreateFileA
lstrcpyW
GetCurrentThread
lstrcmpW
InitializeCriticalSection
WriteFile
EnterCriticalSection
GetLocalTime
GetLastError
RegisterWaitForSingleObjectEx
LocalFree
UnregisterWait
ExpandEnvironmentStringsW
InterlockedExchangeAdd
GetComputerNameExW
DisableThreadLibraryCalls
GetModuleHandleW
lstrlenA
lstrcmpiA
FormatMessageW
UnmapViewOfFile
CreateFileMappingW
GetEnvironmentVariableW
QueryPerformanceCounter
LoadLibraryA
OpenEventW
Sleep
GetCurrentProcessId
GetModuleFileNameA
FreeLibrary
FileTimeToSystemTime
UnhandledExceptionFilter
LeaveCriticalSection
GetSystemInfo
GetTickCount
WideCharToMultiByte

cryptdll

MD5Update
MD5Init
CDLocateCheckSum
MD5Final
CDBuildIntegrityVect
CDFindCommonCSystemWithKey
CDLocateCSystem
CDGenerateRandomBits

advapi32

CredFree
RegisterEventSourceW
QueryServiceStatus
RegOpenKeyExW
OpenThreadToken
RegQueryInfoKeyW
RegNotifyChangeKeyValue
OpenProcessToken
RegOpenKeyW
CryptGetHashParam
QueryServiceConfigW
FreeSid
CryptGetProvParam
SystemFunction007
CryptAcquireContextW
GetTokenInformation
CryptDestroyHash
SetThreadToken
CryptCreateHash
RegDeleteValueW
CryptSetProvParam
CloseServiceHandle
CredUnmarshalCredentialW
OpenSCManagerW
RegSetValueExW
SystemFunction006
RegQueryValueExW
LookupAccountSidW
RegCreateKeyExW
RegConnectRegistryW
TraceEvent
CryptHashData
ReportEventW
RegCloseKey
RevertToSelf
GetTraceLoggerHandle
RegEnumKeyExW
RegisterTraceGuidsW
DeregisterEventSource
AllocateAndInitializeSid
CryptReleaseContext
OpenServiceW

ntdll

NtOpenThreadToken
RtlSystemTimeToLocalTime
RtlCopyUnicodeString
RtlDeregisterWait
RtlSubAuthoritySid
RtlConvertSharedToExclusive
RtlDeleteResource
RtlInitializeGenericTable
RtlDeleteCriticalSection
RtlLeaveCriticalSection
RtlOemStringToUnicodeString
RtlFreeAnsiString
RtlInitializeResource
DbgPrint
RtlFreeUnicodeString
RtlInitializeGenericTableAvl
RtlVerifyVersionInfo
RtlLookupElementGenericTableAvl
RtlAddAccessAllowedAce
RtlDowncaseUnicodeString
RtlValidSid
RtlPrefixUnicodeString
RtlCreateAcl
RtlEnterCriticalSection
RtlEqualSid
RtlGetElementGenericTable
RtlDeleteElementGenericTable
RtlCompareMemory
RtlInsertElementGenericTableAvl
NtQueryInformationToken
RtlCreateTimer
RtlEqualUnicodeString
NtAllocateVirtualMemory
RtlLengthRequiredSid
RtlDeleteTimerQueue
NtOpenProcessToken
NtWaitForSingleObject
NtCreateEvent
NtAllocateLocallyUniqueId
NtQuerySystemInformation
VerSetConditionMask
RtlUpcaseUnicodeString
RtlEqualDomainName
RtlCompareUnicodeString
RtlRunDecodeUnicodeString
RtlAppendUnicodeStringToString
NtQuerySystemTime
NtSetSecurityObject
RtlReleaseResource
RtlNtStatusToDosError
RtlInitializeSid
RtlLookupElementGenericTable
RtlTimeFieldsToTime
RtlRegisterWait
RtlCopySid
RtlInsertElementGenericTable
NtClose
NtOpenEvent
RtlSetDaclSecurityDescriptor
RtlCopyLuid
RtlIntegerToUnicodeString
RtlSubAuthorityCountSid
NtDuplicateObject
RtlCreateSecurityDescriptor
RtlInitUnicodeString
RtlUniform
RtlTimeToTimeFields
RtlEraseUnicodeString
RtlLengthSid
RtlConvertSidToUnicodeString
RtlInitializeCriticalSection
RtlAcquireResourceShared
RtlAnsiStringToUnicodeString
RtlAllocateAndInitializeSid
RtlCreateTimerQueue
RtlAcquireResourceExclusive
RtlInitAnsiString
RtlFreeSid

msvcrt

_except_handler3
_initterm
_vsnprintf
_ultoa
wcscmp
qsort
_adjust_fdiv
_stricmp
_wcsnicmp
swprintf
strchr
wcscpy
wcstoul
malloc
wcsspn
sscanf
wcslen
sprintf
strrchr
wcscat
wcsrchr
free
_wcsicmp
_strcmpi
_strnicmp

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

47b7e6d815afec90d01060efec6ff6ce

Headers

DLL Characteristics

File Characteristics

Imports

user32

msasn1

secur32

kernel32

cryptdll

advapi32

ntdll

msvcrt

Sections

.text Size: 18KB - Virtual size: 17KB

.data Size: 9KB - Virtual size: 1.4MB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 36KB - Virtual size: 36KB

.rdata Size: 264KB - Virtual size: 263KB

.text
Size: 18KB - Virtual size: 17KB

.data
Size: 9KB - Virtual size: 1.4MB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 36KB - Virtual size: 36KB

.rdata
Size: 264KB - Virtual size: 263KB