19d84cf313d7ab2f02765541dc8232c3b2635d177b5ea95b5f9e3fbec3c78ab0

Sharing

Copy URL Twitter E-mail

General

Target

19d84cf313d7ab2f02765541dc8232c3b2635d177b5ea95b5f9e3fbec3c78ab0
Size

1.1MB
MD5

f29db2e48ec3d5595da620ffaa7196c2
SHA1

870c920351acdaf2451a45a6ebc05101c6f632c5
SHA256

19d84cf313d7ab2f02765541dc8232c3b2635d177b5ea95b5f9e3fbec3c78ab0
SHA512

2dd22f28ed5461c3d2c6875b8a61ec2f864fd2ef54efdc40f4b98394896106f32ab9fc727dd7cd7fa62d4916d090a71f8bdf6565766598fd078514869a3df70d
SSDEEP

24576:tkrftmV7nLDX0HFCaqTkKe0ThUfbYB220mZb2Ifp4LuHc:tukLK2T60TmYB220mZb2Ifp4G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
19d84cf313d7ab2f02765541dc8232c3b2635d177b5ea95b5f9e3fbec3c78ab0

Files

19d84cf313d7ab2f02765541dc8232c3b2635d177b5ea95b5f9e3fbec3c78ab0
.exe windows:5 windows x86 arch:x86

fe1f2e4d7152de49a56bae29cef62f97

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Build\JenkinsHome\jobs\desktop_apps_ng\workspace\build\loader\Release\loader.pdb

Imports

kernel32

CreateFileW
GetSystemTimeAsFileTime
GetCommandLineW
GetCurrentThreadId
SetEvent
DeleteFileW
CopyFileW
GetDiskFreeSpaceExW
CreateDirectoryW
RemoveDirectoryW
GetTempPathW
GetFileAttributesW
GetTickCount
GetACP
SetLastError
HeapFree
HeapSize
HeapReAlloc
HeapAlloc
GetProcessHeap
InterlockedCompareExchange
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
GetVersionExW
GetNativeSystemInfo
WaitForSingleObject
GetStartupInfoW
CreateProcessW
LocalFree
InitializeCriticalSection
FormatMessageW
FindClose
FindFirstFileExW
FindNextFileW
CreateEventA
DuplicateHandle
ReleaseSemaphore
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
InterlockedDecrement
GlobalAlloc
GlobalLock
InterlockedIncrement
GlobalUnlock
lstrcmpW
MulDiv
ReadFile
SetFilePointer
WriteFile
EncodePointer
SetThreadPriority
SignalObjectAndWait
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
DecodePointer
EnumSystemLocalesW
IsValidLocale
GetConsoleCP
FlushFileBuffers
GetFileType
ReadConsoleW
GetConsoleMode
GetCurrentThread
FreeLibraryAndExitThread
CreateThread
GetStdHandle
GetModuleHandleExW
ExitProcess
LoadLibraryExW
InterlockedFlushSList
RtlUnwind
GetModuleHandleA
GetLogicalProcessorInformation
OpenEventA
GetUserDefaultLCID
Sleep
SetFilePointerEx
SetEndOfFile
LeaveCriticalSection
GetModuleFileNameW
EnterCriticalSection
GetPhysicallyInstalledSystemMemory
GetModuleHandleW
CreateEventW
GetExitCodeProcess
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryW
GetFileSize
GetStringTypeW
TryEnterCriticalSection
InitializeSListHead
GetCurrentProcessId
FormatMessageA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
OutputDebugStringW
GetCPInfo
GetLocaleInfoW
LCMapStringW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
DeleteCriticalSection
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
GetThreadPriority
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
SwitchToThread

user32

RegisterClassExW
PeekMessageW
TranslateMessage
DispatchMessageW
SetWindowLongW
DestroyWindow
GetWindowLongW
SetTimer
KillTimer
UnregisterClassW
GetCursorPos
SendMessageW
PostThreadMessageW
wsprintfW
DefWindowProcW
GetDesktopWindow
MsgWaitForMultipleObjects
GetWindowTextLengthW
GetWindow
GetFocus
GetDC
SetWindowPos
SetWindowRgn
FillRect
ScreenToClient
GetSystemMetrics
SetWindowTextW
ShowWindow
IsWindow
InvalidateRgn
RedrawWindow
ClientToScreen
DestroyAcceleratorTable
IsChild
GetSysColor
MoveWindow
CreateAcceleratorTableW
SetFocus
CharNextW
GetClassNameW
SetCapture
GetClientRect
GetDlgItem
PostQuitMessage
SystemParametersInfoW
GetParent
RegisterWindowMessageW
ReleaseCapture
InvalidateRect
ReleaseDC
BeginPaint
EndPaint
GetWindowTextW
CallWindowProcW
CreateWindowExW
GetClassInfoExW
LoadCursorW

gdi32

BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetStockObject
CreateRoundRectRgn
GetDeviceCaps
DeleteDC
GetObjectW
DeleteObject
CreateSolidBrush

shell32

SHGetFolderPathW
CommandLineToArgvW

ole32

OleUninitialize
CoCreateInstance
CoAddRefServerProcess
CoTaskMemFree
CoCreateGuid
CoGetClassObject
CoTaskMemAlloc
StringFromGUID2
CLSIDFromProgID
CreateStreamOnHGlobal
CLSIDFromString
OleLockRunning
CoReleaseServerProcess
OleInitialize
StringFromCLSID

oleaut32

DispCallFunc
VariantChangeType
LoadRegTypeLi
VariantInit
LoadTypeLi
SysStringByteLen
OleCreateFontIndirect
SysAllocString
VariantCopy
SysStringLen
SysAllocStringLen
VariantClear
SysFreeString
SysAllocStringByteLen

advapi32

CryptDestroyKey
CryptVerifySignatureW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptReleaseContext
RegSetValueExW
RegNotifyChangeKeyValue
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
CryptAcquireContextW

shlwapi

PathFindFileNameW

ws2_32

ntohl

Sections

.text
Size: 408KB - Virtual size: 408KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 480KB - Virtual size: 479KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe1f2e4d7152de49a56bae29cef62f97

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

shlwapi

ws2_32

Sections

.text Size: 408KB - Virtual size: 408KB

.rdata Size: 140KB - Virtual size: 140KB

.data Size: 29KB - Virtual size: 34KB

.rsrc Size: 480KB - Virtual size: 479KB

.reloc Size: 31KB - Virtual size: 30KB

.text
Size: 408KB - Virtual size: 408KB

.rdata
Size: 140KB - Virtual size: 140KB

.data
Size: 29KB - Virtual size: 34KB

.rsrc
Size: 480KB - Virtual size: 479KB

.reloc
Size: 31KB - Virtual size: 30KB