STUB (1)[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

STUB (1).rar
Size

77KB
MD5

a2ffb066b5fd10afc30813c681134375
SHA1

81cae683ae4fa812fa60820a540ea50e5b2d6e67
SHA256

22e2bb12d14d31eb60f339e63b44165efb6d619f0a77106c5bc4a74db21cec1f
SHA512

3707d8ea9cf13513308a63f553b93a82494e9d489b4bf251a216d681acd6bbae54b121582fa6f2a763f60b18f3f650ed88197d686b3e11d1da0e01dddfa9307c
SSDEEP

1536:sQP8rDKWbL7U6DZa+G0Z5bLAmLPWKEuKZ2f6Yv8sYlfNo:srfbL7U6DZa+G0DLAmLCkYNNo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/STUB.EXE

Files

STUB (1).rar
.rar

Password: 123
STUB.EXE
.exe windows:5 windows x64 arch:x64

Password: 123

9f92dbcd19461bb5732666a7e6decc6a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

LocalAlloc
LoadLibraryW
TerminateProcess
GetCurrentProcess
SetEvent
OpenEventW
CreateFileW
DeleteFileW
CreateProcessW
WriteFile
lstrlenA
lstrcpyW
CopyFileW
SystemTimeToFileTime
GetLocalTime
ReleaseMutex
CreateDirectoryW
lstrlenW
VirtualFreeEx
SetThreadContext
GetThreadContext
VirtualProtectEx
WriteProcessMemory
VirtualAllocEx
lstrcpyA
GetProcAddress
GetModuleHandleW
CreateThread
lstrcmpA
VirtualFree
ResetEvent
ReadFile
GetFileSize
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentProcessId
OpenProcess
GetNativeSystemInfo
GetModuleHandleA
VirtualProtect
VirtualAlloc
LoadLibraryA
GetTickCount64
GetComputerNameExW
GetModuleFileNameW
GetTickCount
FlushFileBuffers
HeapReAlloc
LCMapStringW
WriteConsoleW
SetStdHandle
HeapSize
MultiByteToWideChar
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LeaveCriticalSection
EnterCriticalSection
GetConsoleMode
GetConsoleCP
SetFilePointer
GetSystemTimeAsFileTime
QueryPerformanceCounter
HeapCreate
GetVersion
HeapSetInformation
DeleteCriticalSection
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
HeapAlloc
GetStringTypeW
HeapFree
FlsAlloc
LocalFree
ExitProcess
OpenMutexW
CloseHandle
CreateMutexW
GetLastError
CreateEventW
GetTempPathW
lstrcmpiW
GetCommandLineW
GetWindowsDirectoryW
GetSystemDirectoryW
WaitForSingleObject
ResumeThread
Sleep
GetUserGeoID
WaitForMultipleObjects
GetCurrentThreadId
SetLastError
FlsFree
FlsSetValue
FlsGetValue
EncodePointer
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DecodePointer
GetStartupInfoW
GetCommandLineA
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
RaiseException

ws2_32

WSAStartup
closesocket
shutdown
setsockopt
WSACleanup
recv
gethostname
socket
WSACreateEvent
inet_addr
gethostbyname
htons
connect
WSACloseEvent
WSAEnumNetworkEvents
WSAGetLastError
WSAEventSelect
WSAWaitForMultipleEvents
send

shlwapi

StrStrIW
StrCmpNIA
wnsprintfW

user32

MessageBoxW
wsprintfW
DestroyWindow
wsprintfA
LoadImageW
GetCursorPos
SetForegroundWindow
CreatePopupMenu
AppendMenuW
PostMessageW
DestroyMenu
DefWindowProcW
RegisterClassW
CreateWindowExW
GetMessageW
TranslateMessage
DispatchMessageW
UnregisterClassW
TrackPopupMenu

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetNamedSecurityInfoW
CheckTokenMembership
FreeSid
RegSetValueExW
AllocateAndInitializeSid
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyW
RegDeleteValueW
RegCloseKey
RegDeleteKeyExW
RegDeleteKeyW
GetUserNameW

ole32

CoInitialize
CoCreateGuid
StringFromGUID2
CoTaskMemFree
CoInitializeEx
CoUninitialize

shell32

Shell_NotifyIconW
SHGetKnownFolderPath
ord680
SHFileOperationW
ShellExecuteExW
ShellExecuteW
CommandLineToArgvW

Sections

.text
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 77KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: 123

Password: 123

9f92dbcd19461bb5732666a7e6decc6a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ws2_32

shlwapi

user32

advapi32

ole32

shell32

Sections

.text Size: 143KB - Virtual size: 142KB

.rdata Size: 26KB - Virtual size: 25KB

.data Size: 77KB - Virtual size: 87KB

.pdata Size: 5KB - Virtual size: 5KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 21KB - Virtual size: 20KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 143KB - Virtual size: 142KB

.rdata
Size: 26KB - Virtual size: 25KB

.data
Size: 77KB - Virtual size: 87KB

.pdata
Size: 5KB - Virtual size: 5KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 21KB - Virtual size: 20KB

.reloc
Size: 2KB - Virtual size: 1KB