5075DD284DDAAF3FBAC2A12C22C1EDE2FBD2AE01[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

5075DD284DDAAF3FBAC2A12C22C1EDE2FBD2AE01.exe
Size

45.7MB
MD5

e0eea50919b7696e58e3d50f07510caf
SHA1

5075dd284ddaaf3fbac2a12c22c1ede2fbd2ae01
SHA256

924e565a4239f774203cade9243d014ade46f487ee20081a21a8a15275e2643c
SHA512

e9d76042aeeaa545676ee1385b73f1302e5072dfc5195d96f234fd55a459aacee6db9942c837cd920e6e274ceee19272e7c5c83250429df0c3f2e280a6d1dc1e
SSDEEP

786432:6BdyKXTHlSMcYVR8hoCNi/LKEsUhKxsuEjCH6z0YEF82eEZmHo2BB1rAj6ux0o0W:gy/5YVibiTTsaKhEj5BMeEZmIMB1rTl6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5075DD284DDAAF3FBAC2A12C22C1EDE2FBD2AE01.exe

Files

5075DD284DDAAF3FBAC2A12C22C1EDE2FBD2AE01.exe
.exe windows:4 windows x86 arch:x86

c5a01b2048082d69708253701a996bee

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\work\NetClient\tfs\NetClient5_StableRelease\NetClient5\Nc5.Agent\install\n5iclient\Release\n5iclient.pdb

Imports

comctl32

InitCommonControlsEx

ws2_32

inet_ntoa
getpeername
closesocket
ioctlsocket
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
WSAEventSelect
WSACreateEvent
WSAStartup
WSACleanup
WSAGetLastError
WSASend
WSARecv
connect
htons
gethostbyname
inet_addr
WSASocketA
WSACloseEvent
getsockname

kernel32

GetProcAddress
FreeLibrary
GetWindowsDirectoryA
CreateDirectoryA
GetExitCodeProcess
OpenEventA
CreateProcessA
WaitForSingleObject
GetVersionExA
FindResourceA
LoadResource
LoadLibraryA
LockResource
GetCurrentProcess
CopyFileA
FindFirstFileA
lstrcmpiA
FindNextFileA
FindClose
DeleteFileA
GetLastError
CreateFileA
WriteFile
OpenProcess
TerminateProcess
CloseHandle
GetSystemDefaultLangID
Sleep
GetModuleFileNameA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetSystemDirectoryA
ReadFile
GetFileAttributesExA
GetCurrentProcessId
SetFilePointer
GetFileSize
CreateFileW
GetLocalTime
GetEnvironmentVariableA
SizeofResource
lstrlenW
lstrlenA
GetTimeZoneInformation
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
HeapFree
HeapAlloc
GetProcessHeap
WideCharToMultiByte
GetModuleHandleA
FindFirstFileW
FileTimeToSystemTime
GetFileTime
WaitForMultipleObjects
CreateProcessW
GetModuleHandleW
SetFileAttributesA
DeleteFileW
SetFileAttributesW
CopyFileW
MultiByteToWideChar
LoadLibraryW
SetLastError
ExpandEnvironmentStringsW
GetTickCount
GetCurrentThreadId
GetModuleFileNameW
RemoveDirectoryA
RemoveDirectoryW
FindNextFileW
GetSystemInfo
QueryDosDeviceW
QueryDosDeviceA
GetDiskFreeSpaceA
CreatePipe
GetEnvironmentVariableW
GlobalAlloc
GetDriveTypeW
GetWindowsDirectoryW
GetSystemDirectoryW
GetTempPathW
SetComputerNameW
GetComputerNameW
CreateDirectoryW
GetFileAttributesW
GetFileAttributesExW
GetVersionExW
GetCurrentThread
InterlockedDecrement
LocalFree
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
FileTimeToLocalFileTime
SystemTimeToTzSpecificLocalTime
OpenFileMappingA
UnmapViewOfFile
ReleaseMutex
SetEvent
OpenMutexA
MapViewOfFile
FreeResource
InterlockedIncrement
InterlockedExchange
RaiseException
RtlUnwind
ExitProcess
ExitThread
CreateThread
GetConsoleCP
GetConsoleMode
GetCommandLineA
GetStartupInfoA
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetCPInfo
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetStdHandle
FatalAppExitA
SetConsoleCtrlHandler
GetACP
GetOEMCP
IsValidCodePage
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
GetFileType
SetHandleCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
FlushFileBuffers
GetLocaleInfoA
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
SystemTimeToFileTime

user32

DispatchMessageW
CreateWindowExW
MessageBoxW
GetDC
SetWindowLongA
EndDialog
GetWindowLongA
SetWindowPos
GetWindowRect
IsWindow
GetParent
CreateDialogParamA
GetMessageW
CallWindowProcA
DefWindowProcA
InvalidateRect
DrawTextA
GetClientRect
EndPaint
CreateDialogParamW
GetDlgCtrlID
GetWindow
MoveWindow
AdjustWindowRectEx
ClientToScreen
DialogBoxParamA
RegisterClassExW
MessageBoxA
FindWindowA
wsprintfA
ExitWindowsEx
SendMessageA
DrawTextW
GetDlgItem
SetWindowTextA
LoadBitmapA
GetWindowTextW
SetWindowTextW
SetForegroundWindow
SendMessageW
DialogBoxParamW
FindWindowW
DefWindowProcW
CallWindowProcW
LoadBitmapW
GetWindowLongW
BeginPaint
SetWindowLongW
GetSystemMetrics

gdi32

TextOutW
GetTextMetricsW
GetDeviceCaps
DeleteDC
StretchBlt
SelectObject
DeleteObject
CreateFontW
SetTextColor
GetStockObject
CreateCompatibleDC
GetObjectA
GetTextExtentPointA
GetTextMetricsA
SetBkMode
GetTextExtentPoint32W
GetObjectW

advapi32

CreateProcessAsUserW
ConvertSidToStringSidW
LookupPrivilegeValueW
PrivilegeCheck
EqualSid
RegCreateKeyExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyExA
RegQueryInfoKeyA
RegEnumValueA
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegSetValueExW
RegDeleteKeyW
RegDeleteValueW
RegEnumValueW
LogonUserW
LookupAccountSidW
QueryServiceConfigA
ChangeServiceConfigA
OpenSCManagerA
OpenServiceA
CreateServiceA
DeleteService
QueryServiceStatus
StartServiceA
ControlService
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
DuplicateTokenEx
OpenThreadToken
IsValidSid
GetTokenInformation
CreateProcessAsUserA
SetTokenInformation
RevertToSelf
ImpersonateSelf

oleaut32

SetErrorInfo
GetErrorInfo
SysAllocString
VariantClear
SysFreeString
CreateErrorInfo
VariantChangeType
VariantInit

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

rpcrt4

RpcStringFreeW
UuidToStringW
UuidCreate

wininet

FtpGetFileW
FtpDeleteFileW
FtpPutFileW
FtpCreateDirectoryW
FtpRemoveDirectoryW

setupapi

SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDescriptionW

netapi32

NetWkstaGetInfo
NetApiBufferFree

winspool.drv

EnumPrintersW
EnumPortsW

comdlg32

GetOpenFileNameW

shell32

ShellExecuteW

ole32

CoUninitialize
CoInitializeEx
CoCreateInstance
CoInitialize

Sections

.text
Size: 536KB - Virtual size: 534KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 45.0MB - Virtual size: 45.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c5a01b2048082d69708253701a996bee

Headers

File Characteristics

PDB Paths

Imports

comctl32

ws2_32

kernel32

user32

gdi32

advapi32

oleaut32

version

rpcrt4

wininet

setupapi

netapi32

winspool.drv

comdlg32

shell32

ole32

Sections

.text Size: 536KB - Virtual size: 534KB

.rdata Size: 108KB - Virtual size: 105KB

.data Size: 12KB - Virtual size: 22KB

.rsrc Size: 45.0MB - Virtual size: 45.0MB

.text
Size: 536KB - Virtual size: 534KB

.rdata
Size: 108KB - Virtual size: 105KB

.data
Size: 12KB - Virtual size: 22KB

.rsrc
Size: 45.0MB - Virtual size: 45.0MB