1365039baed4ec04983d16a583a332b818b2af9977807e5481310528897b02b3

Sharing

Copy URL

Twitter E-mail

General

Target

1365039baed4ec04983d16a583a332b818b2af9977807e5481310528897b02b3
Size

2.2MB
MD5

144bfc7f77a9b0b57d39e75ffda71ae1
SHA1

77ca0a359058ccabe720d310ee729ecd3e66561f
SHA256

1365039baed4ec04983d16a583a332b818b2af9977807e5481310528897b02b3
SHA512

6a4a82e59b21ede7ae722aef50ceecf264cadffe4bc61d9f94d88c96c8e1d76b86b16cdd93e9440dd1f3c905cb2a0915b8d851b73dfcbeaab6756a3d2bf1c9d0
SSDEEP

49152:19UJj87k/a4nQkh6ZISIyR7fJATyIeOgWfPfyDLmd/DIuJxThJqEB6ZmKYGCsWH5:m8D4nQkhSRtATyIe+fPf6Lmd/DI0xT5N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1365039baed4ec04983d16a583a332b818b2af9977807e5481310528897b02b3

Files

1365039baed4ec04983d16a583a332b818b2af9977807e5481310528897b02b3
.exe windows:5 windows x86 arch:x86

60892b288ccc180a39a95b6e54766716

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Faronics\morocco\Faronics_Hg\CLOUD\WebCon\Source\bin\Release\FWAWebInstaller\Win32\FWAWebInstaller.pdb

Imports

comctl32

ord17

shell32

SHGetSpecialFolderPathW
ShellExecuteExW
ord165
SHGetFolderPathW

crypt32

CryptBinaryToStringA

kernel32

DeleteVolumeMountPointW
FindNextVolumeW
RemoveDirectoryW
FindFirstVolumeW
GetVersionExW
GetFileAttributesW
GetCurrentProcessId
MoveFileExW
GetSystemWindowsDirectoryW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetTempPathW
GetPrivateProfileIntW
GetLocalTime
CreateEventW
GetSystemInfo
GetWindowsDirectoryW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SystemTimeToFileTime
FileTimeToSystemTime
CreateThread
GetCurrentThreadId
SetVolumeMountPointW
WriteConsoleW
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryW
IsValidCodePage
GetOEMCP
GetACP
GetLocaleInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
FlushFileBuffers
GetConsoleMode
GetConsoleCP
ExitProcess
HeapCreate
GetFileType
GetStdHandle
SetHandleCount
IsProcessorFeaturePresent
CreateDirectoryW
FindVolumeClose
CopyFileW
TerminateProcess
GetExitCodeProcess
SetLastError
GetUserDefaultLangID
ReadFile
SetEndOfFile
SetFilePointer
LocalFree
FindNextFileW
DeviceIoControl
LocalAlloc
FindClose
GetProcAddress
GetSystemDirectoryW
GetModuleHandleW
WaitForSingleObject
CreateProcessW
InterlockedDecrement
CloseHandle
CreateFileW
WriteFile
DeleteFileW
MoveFileW
GetLastError
lstrlenW
GetBinaryTypeW
GetModuleFileNameW
Sleep
WideCharToMultiByte
FindFirstFileW
LockResource
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
FindResourceExW
OutputDebugStringA
OutputDebugStringW
GetCurrentProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringW
RtlUnwind
GetCPInfo
GetStartupInfoW
HeapSetInformation
GetCommandLineW
GetSystemTimeAsFileTime
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
InitializeCriticalSectionAndSpinCount
RaiseException
DeleteCriticalSection
DecodePointer
EncodePointer
GetStringTypeW
InterlockedExchange
InterlockedCompareExchange
InterlockedIncrement

user32

LoadIconW
DrawFocusRect
GetDC
SetFocus
GetClientRect
TrackMouseEvent
GetParent
DialogBoxParamW
InvalidateRect
DrawTextW
EndDialog
FillRect
GetWindowRect
SetTimer
GetDesktopWindow
ShowWindow
GetWindowTextW
SystemParametersInfoW
GetDlgItem
KillTimer
SetWindowLongW
LoadBitmapW
EnableWindow
GetDlgCtrlID
SetWindowTextW
wsprintfW
MessageBoxExW
ExitWindowsEx
SendMessageW
GetSystemMetrics
CallWindowProcW
PostMessageW
MoveWindow

gdi32

SetTextColor
DeleteDC
CreateFontIndirectW
GetCurrentObject
SetBkColor
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
Rectangle
GetObjectW
CreatePen
CreateSolidBrush
BitBlt

advapi32

OpenSCManagerW
RegOpenKeyExW
RegFlushKey
RegCreateKeyA
RegQueryValueExA
RegSetValueExA
ReportEventW
DeregisterEventSource
RegisterEventSourceW
RegDeleteKeyW
RegCreateKeyExW
RegEnumValueW
SetNamedSecurityInfoW
FreeSid
SetEntriesInAclW
AllocateAndInitializeSid
SetNamedSecurityInfoA
QueryServiceStatusEx
LookupPrivilegeValueW
AdjustTokenPrivileges
GetTokenInformation
OpenProcessToken
QueryServiceConfigW
ControlService
QueryServiceStatus
StartServiceW
OpenServiceW
RegCloseKey
CloseServiceHandle
RegSetValueExW
RegEnumKeyExW
RegDeleteValueW
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExW

ole32

CoCreateInstance
CoSetProxyBlanket
CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoInitialize
CLSIDFromProgID
CoQueryProxyBlanket

oleaut32

VariantCopy
SysAllocStringByteLen
SysStringByteLen
SysStringLen
VariantChangeType
VarCmp
SysAllocString
SafeArrayGetLBound
VariantClear
VariantInit
SafeArrayGetElement
SysFreeString
SafeArrayGetUBound

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate

shlwapi

PathFileExistsW
PathCombineW

msi

ord32
ord8
ord92
ord125
ord20
ord17
ord163

winhttp

WinHttpReceiveResponse
WinHttpSetCredentials
WinHttpReadData
WinHttpCrackUrl
WinHttpOpenRequest
WinHttpOpen
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpSendRequest
WinHttpSetOption
WinHttpSetTimeouts

Sections

.text
Size: 448KB - Virtual size: 447KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

60892b288ccc180a39a95b6e54766716

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

shell32

crypt32

kernel32

user32

gdi32

advapi32

ole32

oleaut32

rpcrt4

shlwapi

msi

winhttp

Sections

.text Size: 448KB - Virtual size: 447KB

.rdata Size: 134KB - Virtual size: 133KB

.data Size: 11KB - Virtual size: 20KB

.rsrc Size: 1.6MB - Virtual size: 1.6MB

.reloc Size: 33KB - Virtual size: 32KB

.text
Size: 448KB - Virtual size: 447KB

.rdata
Size: 134KB - Virtual size: 133KB

.data
Size: 11KB - Virtual size: 20KB

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

.reloc
Size: 33KB - Virtual size: 32KB