3a5285c17598c8ee71e8772b5b42da98a0016b479b52c3f8bce964b80801f164

Sharing

Copy URL Twitter E-mail

General

Target

3a5285c17598c8ee71e8772b5b42da98a0016b479b52c3f8bce964b80801f164
Size

260KB
MD5

d89b6c93e8267a205d4b5951144ac98d
SHA1

cc668d75c520d2267aa253b3d92641472dea37bf
SHA256

3a5285c17598c8ee71e8772b5b42da98a0016b479b52c3f8bce964b80801f164
SHA512

e44781dab23aaedce28181dacf59fb4be5d91c4c7f93356079a1b7cbf5b0bccdaf8cc7c64baf99b5d1591affbb0b80a3f4c9ffc0bbeaab2868eaf84179e33e15
SSDEEP

3072:gjMDTfo15Y7CtI60aAc0wglz03vk4AnSOcnBHKcJpPmHOIU2Q66CnkSiQqlCEqEg:PTfo7YGuy0wWtnSOcxU6f7Cdi7oEqEg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a5285c17598c8ee71e8772b5b42da98a0016b479b52c3f8bce964b80801f164

Files

3a5285c17598c8ee71e8772b5b42da98a0016b479b52c3f8bce964b80801f164
.exe windows:4 windows x86 arch:x86

dc10ce74da3de7f2825a147192680d0b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_iob
?terminate@@YAXXZ
_onexit
__CxxFrameHandler
__dllonexit
??1type_info@@UAE@XZ
_endthreadex
_beginthreadex
_except_handler3
sprintf
isdigit
printf
perror
_errno
strerror
fflush
sscanf
calloc
strcat
toupper
fputc
wcscat
strtok
_ftol
rand
srand
__set_app_type
fseek
ftell
malloc
free
exit
strncmp
atof
memcmp
strchr
strncat
vsprintf
fprintf
system
atoi
strcpy
_memccpy
_stricmp
fgets
fopen
fread
strcmp
fclose
time
gmtime
strftime
memmove
memcpy
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
_CxxThrowException
??0exception@@QAE@ABV0@@Z
_vsnprintf
strlen
strncpy
memset
strstr
??2@YAPAXI@Z
??3@YAXPAX@Z
_purecall
_EH_prolog
_controlfp
fwrite
_strdup

msvcp60

?_Xran@std@@YAXXZ
?_Xlen@std@@YAXXZ

kernel32

GetStartupInfoA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
TlsGetValue
SetLastError
TlsFree
TlsAlloc
GetExitCodeThread
ReleaseSemaphore
CreateSemaphoreA
GetCurrentProcessId
SetThreadPriority
RaiseException
TlsSetValue
DeleteCriticalSection
InitializeCriticalSection
WaitForMultipleObjects
CreateEventA
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
DuplicateHandle
InterlockedIncrement
GetThreadPriority
EnterCriticalSection
LeaveCriticalSection
ResumeThread
WaitForSingleObject
ResetEvent
InterlockedDecrement
CreateThread
TransactNamedPipe
MultiByteToWideChar
GetLastError
GetSystemDirectoryA
CopyFileA
GetModuleFileNameA
OpenProcess
GetModuleHandleA
OutputDebugStringA
FreeConsole
AllocConsole
GetStdHandle
WriteFile
CreateNamedPipeA
WaitNamedPipeA
CreateFileA
TerminateProcess
GetTickCount
Sleep
FreeLibrary
GetProcAddress
LoadLibraryA
DeleteFileA
CreateProcessA
ExpandEnvironmentStringsA
GetComputerNameA
GetVersionExA
GlobalMemoryStatus
ReadFile
CloseHandle

user32

ExitWindowsEx
wsprintfA

advapi32

CloseServiceHandle
RegQueryValueExA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceA
OpenServiceA
ControlService
DeleteService
OpenSCManagerA
CreateServiceA
RegSetValueExA
ChangeServiceConfig2A
RegDeleteValueA
RegCreateKeyExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetUserNameA
RegOpenKeyExA
RegCloseKey

shell32

ShellExecuteA

ws2_32

WSAGetLastError
recv
send
getsockname
getpeername
ioctlsocket
gethostbyname
inet_ntoa
gethostbyaddr
ntohs
select
gethostname
htonl
sendto
setsockopt
WSASocketA
WSASetLastError
getsockopt
getservbyname
shutdown
inet_addr
__WSAFDIsSet
accept
bind
listen
closesocket
socket
htons
connect
WSACleanup
WSAIoctl
WSAStartup

mpr

WNetCancelConnection2W
WNetAddConnection2W

psapi

GetModuleBaseNameA
EnumProcessModules
EnumProcesses

dnsapi

DnsQuery_A

Sections

.text
Size: 164KB - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.diabloz
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

dc10ce74da3de7f2825a147192680d0b

Headers

File Characteristics

Imports

msvcrt

msvcp60

kernel32

user32

advapi32

shell32

ws2_32

mpr

psapi

dnsapi

Sections

.text Size: 164KB - Virtual size: 162KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 52KB - Virtual size: 60KB

.diabloz Size: 16KB - Virtual size: 16KB

.text
Size: 164KB - Virtual size: 162KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 52KB - Virtual size: 60KB

.diabloz
Size: 16KB - Virtual size: 16KB