fbd8fa80e3d2ddf8574d0f19d1e81ae7b051f751

Sharing

Copy URL Twitter E-mail

General

Target

fbd8fa80e3d2ddf8574d0f19d1e81ae7b051f751
Size

2.1MB
MD5

812fda9802e34535464f7aff30830b82
SHA1

fbd8fa80e3d2ddf8574d0f19d1e81ae7b051f751
SHA256

c0360e49aaddb4f7909e295c1ad4f28ec034dab408eddd4f553f348210743d0a
SHA512

217953d3c9f6aef02c792c66430cb10e5bd32cedef869577eb60d63e77efe090ebfda44b75ab96e686387938d09c10f59a51e3b6f950facf36f1e00afb6dc8b3
SSDEEP

49152:q69zOrbmRXKdGgijFwNlRKuSGaX8y4IBAUZLYYp/Or2RhRvlx:q69emlKn8BAUZLvy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fbd8fa80e3d2ddf8574d0f19d1e81ae7b051f751

Files

fbd8fa80e3d2ddf8574d0f19d1e81ae7b051f751
.exe windows:6 windows x86 arch:x86

4ab9b21ae7260e806a6c3a133b10eadc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\source\eSecure\GEBTOOL\Win\GEBTOOL\project\ActivexWrapper\project\win\vs2017\ActivexWrapper\Release\ActivexWrapper.pdb

Imports

ws2_32

listen
socket
select
shutdown
bind
accept
__WSAFDIsSet
ioctlsocket
getpeername
inet_ntoa
WSAStartup
inet_addr
htons
ntohs
recv
WSAGetLastError
WSASetLastError
send
setsockopt
WSACleanup
closesocket

crypt32

CertOpenStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CertCloseStore
CertCreateCertificateContext

version

VerQueryValueW

secur32

GetUserNameExW

kernel32

WriteConsoleW
SetEnvironmentVariableA
SetEndOfFile
lstrlenA
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
WaitForSingleObject
ReleaseMutex
CreateMutexW
Sleep
CreateEventW
GetCurrentThreadId
CloseHandle
GetVersion
GetLocalTime
FreeResource
FindResourceW
LoadResource
SizeofResource
LocalAlloc
LockResource
LocalFree
GetLastError
FormatMessageA
GetUserDefaultLCID
WideCharToMultiByte
MultiByteToWideChar
CreateMutexA
CreateFileA
ConnectNamedPipe
WriteFile
CreateProcessA
ReadFile
CreateNamedPipeA
GetModuleFileNameA
OutputDebugStringA
GetTempPathA
GetProcAddress
GetModuleHandleA
GetFileType
GetStdHandle
GetTickCount
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
FreeLibrary
LoadLibraryA
FlushConsoleInputBuffer
SetLastError
SystemTimeToFileTime
GetSystemTime
GetACP
GetStringTypeW
OutputDebugStringW
CreateFileW
SetFilePointerEx
SetStdHandle
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
RaiseException
HeapSize
GetConsoleCP
ReadConsoleW
RtlUnwind
GetTimeZoneInformation
DeleteCriticalSection
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
FindClose
FindFirstFileExW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileInformationByHandle
PeekNamedPipe
GetFullPathNameW
GetCurrentDirectoryW
DisconnectNamedPipe
TlsAlloc
TerminateProcess
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetOEMCP
IsValidCodePage
GetModuleFileNameW
GetProcessHeap
SetConsoleMode
ReadConsoleInputA
GetConsoleMode
LeaveCriticalSection
EnterCriticalSection
SetConsoleCtrlHandler
GetCommandLineW
IsProcessorFeaturePresent
IsDebuggerPresent
AreFileApisANSI
GetModuleHandleExW
HeapFree
HeapAlloc
HeapReAlloc
EncodePointer
DecodePointer
CreateThread
ExitThread
LoadLibraryExW
ResumeThread
GetSystemTimeAsFileTime
ExitProcess

user32

CreateWindowExW
LoadStringW
DispatchMessageW
MessageBoxW
DefWindowProcW
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW
EndPaint
DestroyWindow
TranslateAcceleratorW
GetMessageW
PostQuitMessage
RegisterWindowMessageW
DialogBoxParamW
EndDialog
BeginPaint
TranslateMessage
LoadAcceleratorsW
RegisterClassExW
LoadIconW
LoadCursorW

advapi32

RegisterEventSourceA
ReportEventA
DeregisterEventSource
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetUserNameW

shell32

ShellExecuteA

ole32

CLSIDFromProgID
CoCreateInstance
CoInitializeEx
CoUninitialize

oleaut32

SysAllocString
SafeArrayGetLBound
SafeArrayGetUBound
SysFreeString
SafeArrayPutElement
SafeArrayUnaccessData
SafeArrayGetElement
VariantInit
SafeArrayCreate
SafeArrayAccessData
VariantClear

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification

Exports

Exports

_libiconv_version
iconv_canonicalize
libiconv
libiconv_close
libiconv_open
libiconv_open_into
libiconvctl
libiconvlist
locale_charset

Sections

.text
Size: 903KB - Virtual size: 902KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4ab9b21ae7260e806a6c3a133b10eadc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

crypt32

version

secur32

kernel32

user32

advapi32

shell32

ole32

oleaut32

wtsapi32

Exports

Exports

Sections

.text Size: 903KB - Virtual size: 902KB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 40KB - Virtual size: 57KB

.rsrc Size: 49KB - Virtual size: 49KB

.reloc Size: 48KB - Virtual size: 47KB

.text
Size: 903KB - Virtual size: 902KB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 40KB - Virtual size: 57KB

.rsrc
Size: 49KB - Virtual size: 49KB

.reloc
Size: 48KB - Virtual size: 47KB