67ddd2af9a8ca3f92bda17bd990e0f3c4ab1d9bea47333fe31205eede8ecc706

Sharing

Copy URL Twitter E-mail

General

Target

67ddd2af9a8ca3f92bda17bd990e0f3c4ab1d9bea47333fe31205eede8ecc706
Size

547KB
MD5

31c2813c1fb1e42b85014b2fc3fe0666
SHA1

f15f3ca6571c60e2116c0170f36992e856e2b10a
SHA256

67ddd2af9a8ca3f92bda17bd990e0f3c4ab1d9bea47333fe31205eede8ecc706
SHA512

c88622cfbb6619db8559e293ecb5546a0cb30e36e5d7e94611cd99cac1db5dc6f7fe4b08b59e018946f4e9f006b56befa8f7e47c859510c64e7f20ef99472cf1
SSDEEP

12288:jWIkfInXzeAE58RXKPX8Igxm66xMfBhPvBLJOYPKj0a8GvVWQ/P1:jWIkwXzeB580t6x59OYPKjR1/P1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
67ddd2af9a8ca3f92bda17bd990e0f3c4ab1d9bea47333fe31205eede8ecc706

Files

67ddd2af9a8ca3f92bda17bd990e0f3c4ab1d9bea47333fe31205eede8ecc706
.exe windows:6 windows x86 arch:x86

f77c83ca4ae9757af3bec27b89c4c30f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

closesocket
setsockopt
socket
WSASetLastError
WSAIoctl
ntohs
htons
WSAStartup
WSACleanup
accept
htonl
listen
ioctlsocket
__WSAFDIsSet
select
getaddrinfo
freeaddrinfo
WSACloseEvent
ntohl
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
recvfrom
sendto
getsockopt
getsockname
getpeername
connect
bind
WSAGetLastError
send
recv
gethostname

wldap32

ord46
ord211
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord32
ord217
ord33
ord35
ord79
ord30
ord200
ord301
ord143

crypt32

CertFreeCertificateChain
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CryptStringToBinaryA
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFindExtension
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

normaliz

IdnToAscii

kernel32

WaitForMultipleObjects
InitializeSListHead
SetLastError
ReadFile
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
CloseHandle
MoveFileExA
WideCharToMultiByte
MultiByteToWideChar
UnhandledExceptionFilter
GetTickCount
QueryPerformanceCounter
LoadLibraryA
GetModuleHandleA
GetSystemDirectoryA
QueryPerformanceFrequency
GetLastError
DeleteCriticalSection
FormatMessageW
VerSetConditionMask
VerifyVersionInfoA
CreateFileA
GetFileSizeEx
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
PeekNamedPipe
Sleep
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
CreateDirectoryW
GetModuleFileNameW
LoadLibraryW
GetProcAddress
FreeLibrary
SleepEx

advapi32

CryptDestroyHash
RegOpenKeyW
RegCreateKeyW
RegSetValueExW
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyKey
CryptImportKey
CryptEncrypt
RegQueryValueExW

shell32

SHGetFolderPathW

msvcp140

??Bid@locale@std@@QAEIXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z

rpcrt4

UuidToStringA
UuidCreate

urlmon

URLDownloadToFileW

vcruntime140

memmove
strrchr
strchr
memcpy
memset
strstr
__std_exception_copy
__std_exception_destroy
__CxxFrameHandler3
memchr
__current_exception
__current_exception_context
_except_handler4_common
__std_terminate
_CxxThrowException

api-ms-win-crt-runtime-l1-1-0

exit
_beginthreadex
_errno
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
_getpid
_controlfp_s
_crt_atexit
__sys_nerr
_c_exit
_exit
_initterm_e
terminate
_initialize_onexit_table
_register_onexit_function
strerror
_cexit
_seh_filter_exe
_set_app_type
_initterm
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode
malloc
realloc
_callnewh
calloc

api-ms-win-crt-convert-l1-1-0

strtoull
strtol
strtoul
wcstombs
atoi
strtod
strtoll

api-ms-win-crt-filesystem-l1-1-0

_stat64
_unlink
_fstat64
_wremove
_access

api-ms-win-crt-utility-l1-1-0

rand
qsort

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
localeconv

api-ms-win-crt-stdio-l1-1-0

fgets
__acrt_iob_func
_set_fmode
fflush
fread
ftell
fwrite
__p__commode
fseek
fclose
_lseeki64
feof
_read
_write
_close
_open
__stdio_common_vsscanf
__stdio_common_vsprintf
fputc
fopen
fputs

api-ms-win-crt-string-l1-1-0

tolower
isupper
strspn
strncpy
strncmp
_strdup
strcspn
strpbrk

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64

api-ms-win-crt-math-l1-1-0

__setusermatherr
_dclass

Sections

.text
Size: 447KB - Virtual size: 446KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f77c83ca4ae9757af3bec27b89c4c30f

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wldap32

crypt32

normaliz

kernel32

advapi32

shell32

msvcp140

rpcrt4

urlmon

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 447KB - Virtual size: 446KB

.rdata Size: 77KB - Virtual size: 77KB

.data Size: 1024B - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 1000B

.reloc Size: 19KB - Virtual size: 19KB

.text
Size: 447KB - Virtual size: 446KB

.rdata
Size: 77KB - Virtual size: 77KB

.data
Size: 1024B - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 1000B

.reloc
Size: 19KB - Virtual size: 19KB