SMOAOC[.]rar | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

SMOAOC.rar
Size

1.2MB
MD5

2355140ed2c1f561fb510ea37ac3b84a
SHA1

298a07ca7d03e7e151a64dec0e762a4410d6b85a
SHA256

5a2a897daa356537a34d98e47b241b164b5fc885f1892d728803ba6fc7e19fc2
SHA512

6712768030856c63f7595e624aff4a60d3017e6198de8a3e93b0455f6425c0f34b110f17e9c02e6c5d68cd9d408fef19b29edbc1965054a627074c25764b211d
SSDEEP

24576:wthW2lnYSuJtRVxTsKPh5Onpbm8O+KH9LpzkoQrob2eb7yUw00GPPb278WRJYuNm:uhJlnYSuJtTfL+b6hdeoQcP0Grp1Im

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/SMOAOC/EBI.01
unpack001/SMOAOC/EBI.02
unpack001/SMOAOC/EBI.exe

Files

SMOAOC.rar
.rar
SMOAOC/EBI.00
SMOAOC/EBI.01
.dll windows:5 windows x86 arch:x86

77acbef224767be6310523635453a9a0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcess
FreeLibrary
lstrcatW
LoadLibraryW
GetSystemDirectoryW
GetCurrentThreadId
GetCurrentProcessId
RtlUnwind
GetLastError
HeapFree
HeapAlloc
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
lstrlenW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
RaiseException
InitializeCriticalSectionAndSpinCount
LoadLibraryA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
CreateFileA
CloseHandle
FlushFileBuffers
GetModuleHandleW
GetProcAddress
GetEnvironmentStrings
WideCharToMultiByte

user32

PostMessageW
keybd_event
ToUnicodeEx
GetKeyboardState
AttachThreadInput
IsWindow
ActivateKeyboardLayout
GetKeyboardLayout
GetWindowThreadProcessId
GetForegroundWindow
GetFocus
GetKeyboardLayoutNameW
GetKeyState
GetAsyncKeyState
MapVirtualKeyW

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

Exports

Exports

_fai11@0
_fcl7@0
_fep5@0
_fer4@4
_fhv12@4
_fvk6@4
_fxj13@0
_fyy10@4

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SMOAOC/EBI.02
.dll windows:5 windows x86 arch:x86

e4384b92607e603ecb92e9c788677258

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WideCharToMultiByte
GetProcAddress
GetModuleHandleW
lstrlenW
GetModuleHandleA
lstrcmpW
GetCurrentThreadId
GetCommandLineA
GetLastError
HeapFree
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
VirtualAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WriteFile
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
HeapSize

Exports

Exports

flu2
fqp3

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SMOAOC/EBI.exe
.exe windows:5 windows x86 arch:x86

b763e88d4358435a7040b077515f2404

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathStripPathW
PathFindExtensionW
PathRenameExtensionW
PathRemoveFileSpecW
PathFindFileNameW
PathFileExistsW
PathMatchSpecW
StrFormatByteSizeW
StrCpyW
UrlIsW
StrCmpIW
StrDupW
PathRemoveExtensionW
PathAddBackslashW
StrCatW

psapi

EnumProcessModules
EnumProcesses
GetModuleFileNameExW

ws2_32

htons
getservbyname
WSAStartup
inet_addr
socket
WSASetLastError
shutdown
gethostbyname
ioctlsocket
connect
WSAGetLastError
getpeername
inet_ntoa
closesocket
__WSAFDIsSet
select
recv
send
WSACleanup
gethostname

comctl32

ImageList_GetImageCount
ImageList_Destroy
ImageList_AddMasked
ImageList_Create
CreatePropertySheetPageW
ImageList_DrawIndirect
ImageList_Draw
ImageList_GetIconSize
PropertySheetW
_TrackMouseEvent
DestroyPropertySheetPage
InitCommonControlsEx
ImageList_ReplaceIcon

shell32

SHGetSpecialFolderLocation
Shell_NotifyIconW
SHChangeNotify
ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
ExtractIconW
DoEnvironmentSubstW
SHGetSpecialFolderPathW
ShellExecuteW

wininet

InternetGetLastResponseInfoW
InternetOpenW
InternetConnectW
FtpSetCurrentDirectoryW
FtpDeleteFileW
FtpRemoveDirectoryW
FtpCreateDirectoryW
FtpPutFileW
InternetCloseHandle

mpr

WNetCancelConnection2W
WNetAddConnection2W

winmm

waveInGetDevCapsW
waveInStart
waveInUnprepareHeader
waveInPrepareHeader
waveInAddBuffer
waveInStop
waveInClose
mixerGetLineInfoW
mixerGetLineControlsW
mixerSetControlDetails
waveInGetNumDevs
waveInOpen

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

ReadConsoleInputA
SetConsoleMode
FindFirstFileA
GetDriveTypeA
GetFullPathNameA
GetCurrentDirectoryA
SetStdHandle
FlushConsoleInputBuffer
GetVersionExA
GlobalMemoryStatus
IsProcessorFeaturePresent
InterlockedCompareExchange
SetEnvironmentVariableA
CompareStringA
GetProcessHeap
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
InterlockedExchange
InitializeCriticalSectionAndSpinCount
IsValidLocale
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
WideCharToMultiByte
GetProcAddress
GetModuleHandleW
lstrlenW
GetLastError
MultiByteToWideChar
FreeResource
GetUserDefaultLangID
EnumResourceLanguagesW
GetLocaleInfoW
ReadFile
CloseHandle
CreateFileW
GetFileSize
FindNextFileW
FindClose
SetLastError
GetFullPathNameW
FindFirstFileW
FileTimeToSystemTime
FileTimeToLocalFileTime
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
FlushInstructionCache
GetCurrentProcess
FreeLibrary
GetVersion
LoadLibraryW
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
LoadLibraryExW
GetModuleFileNameW
GlobalFree
GlobalUnlock
CompareStringW
CreateDirectoryW
lstrcpyW
WriteFile
lstrcpynW
GetVersionExW
DeleteFileW
lstrcmpW
GlobalLock
GetDateFormatW
CreateMutexW
EnumResourceNamesW
LocalReAlloc
LocalAlloc
LocalFree
SetFilePointer
EndUpdateResourceW
UpdateResourceW
BeginUpdateResourceW
GetTimeFormatW
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetWindowsDirectoryW
MoveFileExW
FormatMessageW
lstrcatW
SetProcessPriorityBoost
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetEnvironmentVariableW
GetShortPathNameW
ExitProcess
SetFileAttributesW
GetCurrentProcessId
RemoveDirectoryW
GetSystemTimeAsFileTime
VirtualFree
VirtualAlloc
VirtualFreeEx
ReadProcessMemory
WriteProcessMemory
VirtualAllocEx
OpenProcess
GlobalSize
MoveFileW
WaitForSingleObject
TerminateThread
GetTickCount
QueryDosDeviceW
GetVolumeInformationW
OutputDebugStringA
RtlUnwind
HeapFree
HeapAlloc
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
CreateThread
GetStartupInfoW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetModuleHandleA
HeapCreate
HeapDestroy
HeapSize
Sleep
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
VirtualQuery
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
SetConsoleCtrlHandler
LoadLibraryA
GetLocaleInfoA
LCMapStringA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA

user32

CallWindowProcW
PostQuitMessage
GetWindowRect
InvalidateRect
GetParent
CopyRect
InflateRect
OffsetRect
FillRect
DrawFocusRect
DrawTextW
DrawFrameControl
GetMonitorInfoW
MonitorFromPoint
TrackPopupMenu
GetWindowDC
ReleaseDC
GetClassLongW
GetSystemMetrics
SetRectEmpty
GetSysColor
GetWindowTextW
GetWindowTextLengthW
GetClientRect
ScreenToClient
UpdateWindow
IsWindowEnabled
SetCapture
SetFocus
GetDlgCtrlID
IsWindow
SetWindowPos
PtInRect
SetCursor
GetCursorPos
BeginPaint
EndPaint
ReleaseCapture
GetCapture
GetFocus
GetClassNameW
GetSysColorBrush
SetWindowTextW
GetDlgItemTextW
SetDlgItemTextW
MapWindowPoints
MonitorFromWindow
GetWindow
EndDialog
GetDlgItem
SetTimer
OpenClipboard
EnableWindow
LoadImageW
DestroyMenu
LoadMenuW
ModifyMenuW
GetSubMenu
GetDlgItemInt
SetDlgItemInt
MessageBeep
GetActiveWindow
IsWindowVisible
ShowScrollBar
RedrawWindow
FrameRect
GetMenu
AdjustWindowRectEx
ShowWindow
CreateIconFromResource
LookupIconIdFromDirectory
KillTimer
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
MoveWindow
ScrollWindow
SetForegroundWindow
FindWindowW
GetKeyNameTextW
MapVirtualKeyW
CharUpperW
wsprintfW
BroadcastSystemMessageW
RegisterWindowMessageW
DdeUninitialize
DdeFreeStringHandle
DdeDisconnect
DdeAccessData
DdeClientTransaction
DdeGetLastError
DdeConnect
DdeCreateStringHandleW
DdeInitializeW
EnumWindows
GetAncestor
GetWindowThreadProcessId
SendMessageTimeoutW
EnumChildWindows
GetDesktopWindow
ChangeClipboardChain
SetClipboardViewer
GetForegroundWindow
GetLastInputInfo
GetDoubleClickTime
CreatePopupMenu
InsertMenuItemW
SetMenu
GetMenuItemCount
GetMenuItemInfoW
SetMenuItemInfoW
TrackPopupMenuEx
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
IsMenu
GetMenuItemID
DrawEdge
WindowFromPoint
GetMessagePos
CharLowerW
GetKeyState
UnregisterClassA
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxA
DestroyIcon
RegisterHotKey
UnregisterHotKey
SendMessageW
MessageBoxW
GetDC
PostMessageW
GetWindowLongW
CreateWindowExW
RegisterClassExW
DestroyWindow
CharNextW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
DefWindowProcW
LoadCursorW
GetClassInfoExW
SetWindowLongW
SystemParametersInfoW
DialogBoxIndirectParamW

gdi32

RealizePalette
GetDIBits
GetTextExtentPoint32W
GetCurrentObject
LineTo
MoveToEx
CreateDIBitmap
TextOutW
CreateDIBSection
RoundRect
CreateBitmap
DeleteObject
SetBkColor
SetBrushOrgEx
CreateSolidBrush
CreatePen
Polygon
CombineRgn
CreateRectRgnIndirect
SetPolyFillMode
SetBkMode
ExcludeClipRect
SelectObject
CreatePatternBrush
PatBlt
ExtTextOutW
CreateCompatibleBitmap
GetTextMetricsW
BitBlt
CreateCompatibleDC
GetDeviceCaps
CreateFontW
GetStockObject
GetObjectW
CreateFontIndirectW
DeleteDC
SetTextColor

comdlg32

GetSaveFileNameW
GetOpenFileNameW

ole32

CoInitializeEx
CoUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoInitialize

oleaut32

VarUI4FromStr
SysFreeString
VariantInit
VarCmp
VariantClear

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 394KB - Virtual size: 393KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 82KB - Virtual size: 287KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 993KB - Virtual size: 993KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

77acbef224767be6310523635453a9a0

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 56KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 512B - Virtual size: 4B

.reloc Size: 6KB - Virtual size: 5KB

e4384b92607e603ecb92e9c788677258

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 35KB - Virtual size: 34KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 1024B - Virtual size: 528B

.reloc Size: 5KB - Virtual size: 4KB

b763e88d4358435a7040b077515f2404

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

psapi

ws2_32

comctl32

shell32

wininet

mpr

winmm

version

kernel32

user32

gdi32

comdlg32

ole32

oleaut32

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 394KB - Virtual size: 393KB

.data Size: 82KB - Virtual size: 287KB

.rsrc Size: 993KB - Virtual size: 993KB

.text
Size: 56KB - Virtual size: 56KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 512B - Virtual size: 4B

.reloc
Size: 6KB - Virtual size: 5KB

.text
Size: 35KB - Virtual size: 34KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 1024B - Virtual size: 528B

.reloc
Size: 5KB - Virtual size: 4KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 394KB - Virtual size: 393KB

.data
Size: 82KB - Virtual size: 287KB

.rsrc
Size: 993KB - Virtual size: 993KB