e13e0995b1839aff2016dfbbffa0b599

Sharing

Copy URL Twitter E-mail

General

Target

e13e0995b1839aff2016dfbbffa0b599
Size

616KB
MD5

e13e0995b1839aff2016dfbbffa0b599
SHA1

a72d0eb2ff9964d120ed99ddc54670aa391ea186
SHA256

a1368ef2bcf1cc3a7328158914fb129c4804638250639f4b6322accec4dc6b92
SHA512

899ac00003afc554c0668f4c997a4e2f80267d4dd8d88148fcb724aac1e82873ea99c3938daabacc0174d9b7726b7e5fe3d0d78d755a92b6a9d7b811357d12e0
SSDEEP

12288:8mRF5T6y3IQyUVH3dyHEde3gV+/w7KUG:88F16y3IQnVX0wWX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e13e0995b1839aff2016dfbbffa0b599

Files

e13e0995b1839aff2016dfbbffa0b599
.exe windows:4 windows x86 arch:x86

c6a5f7801a66377ce7faef4d282a887e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

htons
setsockopt
WSAGetLastError
bind
listen
closesocket
getsockname
ntohs
gethostname
getpeername
send
inet_ntoa
htonl
gethostbyname
socket
shutdown
recv
__WSAFDIsSet
select
accept

winmm

sndPlaySoundA
waveOutUnprepareHeader
waveOutOpen
waveOutGetDevCapsA
waveOutGetNumDevs
waveOutClose
waveOutReset
waveOutWrite
waveOutPrepareHeader

mfc42

ord5789
ord5794
ord5678
ord5736
ord5579
ord5571
ord6061
ord5864
ord3596
ord640
ord6194
ord1640
ord323
ord2405
ord5785
ord2864
ord1175
ord2096
ord2408
ord5860
ord807
ord2920
ord2012
ord3289
ord4163
ord2120
ord554
ord1644
ord939
ord940
ord941
ord5787
ord4133
ord4297
ord537
ord536
ord2452
ord2753
ord1195
ord5440
ord6383
ord5450
ord6394
ord3584
ord3721
ord795
ord543
ord803
ord4284
ord6199
ord2379
ord3089
ord2652
ord1669
ord2515
ord355
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord2621
ord1247
ord1134
ord2725
ord755
ord470
ord6270
ord1200
ord4774
ord2122
ord3996
ord2862
ord3998
ord2820
ord3811
ord6907
ord6215
ord3874
ord3876
ord6877
ord4275
ord2363
ord2301
ord6007
ord6888
ord3301
ord3286
ord6675
ord5981
ord3092
ord5873
ord3127
ord3616
ord665
ord5442
ord3318
ord5186
ord350
ord354
ord2642
ord4224
ord6008
ord4000
ord4125
ord3303
ord5710
ord922
ord3287
ord809
ord556
ord1088
ord2860
ord3797
ord2754
ord6358
ord6880
ord6605
ord926
ord2297
ord1979
ord2450
ord6157
ord1842
ord4242
ord2723
ord2390
ord3059
ord5100
ord5103
ord4467
ord4303
ord3350
ord5012
ord975
ord5472
ord3403
ord2879
ord2878
ord4151
ord4077
ord5237
ord5282
ord2649
ord1665
ord4436
ord5252
ord4427
ord366
ord674
ord4457
ord4499
ord1871
ord2092
ord5484
ord1949
ord818
ord5148
ord6128
ord3752
ord4694
ord1795
ord2575
ord4396
ord609
ord613
ord289
ord5781
ord3706
ord2411
ord2023
ord4218
ord2578
ord4398
ord3582
ord616
ord4123
ord2841
ord1997
ord913
ord2107
ord398
ord4278
ord5465
ord798
ord5194
ord533
ord3790
ord3439
ord6407
ord700
ord4189
ord3711
ord783
ord4299
ord3742
ord2112
ord6442
ord1233
ord4287
ord3138
ord2243
ord2713
ord1576
ord2580
ord4400
ord3630
ord682
ord3920
ord1176
ord3643
ord394
ord696
ord909
ord5628
ord4185
ord6876
ord3732
ord4270
ord3574
ord3370
ord2582
ord4402
ord3640
ord693
ord4243
ord6242
ord6696
ord3733
ord810
ord4271
ord3297
ord3914
ord6172
ord6021
ord6189
ord4330
ord6186
ord5756
ord6192
ord5759
ord2971
ord3619
ord1641
ord2614
ord5788
ord2567
ord2414
ord5683
ord4277
ord2763
ord4129
ord5875
ord3626
ord3693
ord3573
ord3571
ord2859
ord5606
ord2863
ord4083
ord6142
ord823
ord2438
ord3663
ord3654
ord2584
ord4220
ord1862
ord500
ord3701
ord772
ord1574
ord1099
ord686
ord384
ord4160
ord6779
ord6453
ord6334
ord3317
ord2818
ord2915
ord2764
ord5572
ord6197
ord924
ord858
ord535
ord4710
ord4234
ord2302
ord2370
ord825
ord324
ord567
ord540
ord860
ord1168
ord1146
ord641
ord656
ord800
ord3597
ord4425
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5280
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1775
ord4078
ord6052
ord2514
ord4998
ord4853
ord4376
ord5265
ord3610
ord4424
ord3402
ord5290
ord1776
ord6055
ord5651
ord2455

msvcrt

__p__commode
__p__fmode
__set_app_type
_controlfp
_setmbcp
__CxxFrameHandler
_mbsnbcpy
free
malloc
wcscpy
wcslen
_ftol
memmove
_mbscmp
vsprintf
sprintf
??0exception@@QAE@ABV0@@Z
_CxxThrowException
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
strstr
_mbsstr
fclose
fwrite
fseek
fopen
atoi
fread
_endthreadex
_purecall
_beginthreadex
strchr
_ismbcdigit
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler3
?terminate@@YAXXZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv

kernel32

MulDiv
SizeofResource
GlobalAlloc
GlobalLock
GlobalUnlock
GetTickCount
Sleep
CreateMutexA
CloseHandle
LeaveCriticalSection
EnterCriticalSection
GetLastError
DeleteCriticalSection
InitializeCriticalSection
lstrcmpiA
FindResourceA
LoadResource
LockResource
GetCPInfo
lstrlenW
lstrlenA
GetVersion
GetVersionExA
HeapCreate
HeapAlloc
HeapFree
HeapDestroy
lstrcmpA
GetModuleHandleA
GetStartupInfoA
GetFileSize
CreateFileA
lstrcpyA
LoadLibraryA
GetWindowsDirectoryA
WinExec
lstrcatA
GetModuleFileNameA
GetProcessHeap
GetPrivateProfileIntA
GetPrivateProfileStringA
GetCurrentProcess
ResumeThread
GetShortPathNameA
InterlockedDecrement
WaitForSingleObject
SetEvent
InterlockedExchange
CreateEventA
GetFileAttributesA
CreateDirectoryA
FreeLibrary

user32

ShowWindow
GetSystemMenu
GetWindowTextA
DrawStateA
DrawFocusRect
LoadMenuA
SetMenuDefaultItem
SetForegroundWindow
RegisterWindowMessageA
LoadCursorA
CopyIcon
GetWindowRect
GetParent
InflateRect
SetCursor
GetMessagePos
ScreenToClient
PtInRect
InvalidateRect
MessageBeep
SetWindowLongA
SetWindowTextA
PostMessageA
KillTimer
SetTimer
LoadImageA
IsWindowVisible
IsMenu
GetCursorPos
EnableMenuItem
IsIconic
DrawIcon
MoveWindow
IsWindow
FindWindowA
SendMessageTimeoutA
GetClientRect
GrayStringA
GetSubMenu
TabbedTextOutA
LoadBitmapA
GetSysColorBrush
GetMenuStringA
CreateMenu
CreatePopupMenu
GetMenuItemID
GetMenuState
ModifyMenuA
MessageBoxA
EnableWindow
SetRect
GetSystemMetrics
GetMenuItemInfoA
DrawEdge
FillRect
CopyRect
GetSysColor
SystemParametersInfoA
DestroyIcon
DrawIconEx
ReleaseDC
DrawTextA
GetDC
GetDesktopWindow
AppendMenuA
GetMenuItemCount
LoadIconA
GetWindowDC
CopyImage
SetWindowPos
GetWindow
CallWindowProcA
GetScrollInfo
SetParent
OffsetRect
IsRectEmpty
SetCapture
UpdateWindow
ReleaseCapture
SetWindowRgn
GetWindowRgn
GetFocus
FindWindowExA
GetWindowLongA
SendMessageA

gdi32

RoundRect
CreateFontA
PtInRegion
CreateRectRgn
SelectClipRgn
CreateDIBitmap
CreateDCA
CreateICA
ExtCreateRegion
StretchBlt
SelectPalette
RealizePalette
CreateBitmap
GetStockObject
StretchDIBits
Rectangle
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
PatBlt
GetPixel
SetPixel
CreateDIBSection
SelectObject
BitBlt
Ellipse
GetTextExtentPoint32A
GetTextExtentPoint32W
CreateCompatibleBitmap
CreateFontIndirectA
CreatePen
GetBkMode
GetDeviceCaps
GetDIBits
GetObjectA
CreateCompatibleDC
CombineRgn
DeleteDC
DeleteObject
CreateSolidBrush

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegQueryValueExA

shell32

SHBrowseForFolderA
SHGetMalloc
SHGetPathFromIDListA
SHGetFileInfoA
ShellExecuteA
Shell_NotifyIconA

comctl32

_TrackMouseEvent
ImageList_ReplaceIcon
ImageList_AddMasked
ImageList_GetIcon
ImageList_GetImageCount
ImageList_Draw

ole32

CreateStreamOnHGlobal
CoInitialize
CoUninitialize

olepro32

ord251

msvcp60

?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
??0out_of_range@std@@QAE@ABV01@@Z
??1out_of_range@std@@UAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??0logic_error@std@@QAE@ABV01@@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0logic_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??_7out_of_range@std@@6B@

avifil32

AVIFileRelease
AVIStreamWrite
AVIFileOpenA
AVIFileCreateStreamA
AVIMakeCompressedStream
AVIStreamSetFormat
AVIStreamRelease
AVIFileInit
AVIFileExit

msvfw32

ICInfo
ICOpen
ICSendMessage
ICSeqCompressFrameStart
ICDecompress

wininet

InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle

Sections

.text
Size: 228KB - Virtual size: 224KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 324KB - Virtual size: 323KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c6a5f7801a66377ce7faef4d282a887e

Headers

File Characteristics

Imports

ws2_32

winmm

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

olepro32

msvcp60

avifil32

msvfw32

wininet

Sections

.text Size: 228KB - Virtual size: 224KB

.rdata Size: 48KB - Virtual size: 47KB

.data Size: 12KB - Virtual size: 10KB

.rsrc Size: 324KB - Virtual size: 323KB

.text
Size: 228KB - Virtual size: 224KB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 12KB - Virtual size: 10KB

.rsrc
Size: 324KB - Virtual size: 323KB