c4fdbfd6608748d7f675a83f392cd923e86a6d491395a611a3d651c3385708b8

Sharing

Copy URL

Twitter E-mail

General

Target

c4fdbfd6608748d7f675a83f392cd923e86a6d491395a611a3d651c3385708b8
Size

955KB
MD5

08a1ee50adb72b421189362d74a190a4
SHA1

4dcdb7095da34b3cef73ad721d27002c5f65f47b
SHA256

c4fdbfd6608748d7f675a83f392cd923e86a6d491395a611a3d651c3385708b8
SHA512

d31a9e9ab972e7ecd0b5a19731c4ca1a99d1e6577e921937022afaedee7345cbc4f19cdea917617c656cd408a8ab333358727f45a952a3aa7739e043d600eb62
SSDEEP

24576:d9kf/bVycYu2R581bRJIPOTCPZevlPCoL9uQ08oNWRzHt:Ihe581bvoOuQPCaXoIRzHt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c4fdbfd6608748d7f675a83f392cd923e86a6d491395a611a3d651c3385708b8

Files

c4fdbfd6608748d7f675a83f392cd923e86a6d491395a611a3d651c3385708b8
.exe windows:5 windows x86 arch:x86

329d62dcbfdc8193a1cc4332ab73842c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
lstrlenA
FindClose
WaitForSingleObject
GetModuleHandleA
OpenProcess
HeapSize
GetVolumeNameForVolumeMountPointW
GetLogicalDriveStringsW
CreateToolhelp32Snapshot
MultiByteToWideChar
Sleep
CopyFileA
GetLastError
GetFileAttributesA
CreateFileA
GetVersionExA
LockResource
DeleteFileA
Process32Next
HeapReAlloc
CloseHandle
RaiseException
GetSystemInfo
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
SetFileAttributesA
DecodePointer
HeapDestroy
GetPriorityClass
GetProcAddress
MoveFileExW
RemoveDirectoryA
DeleteCriticalSection
FindVolumeClose
GetCurrentProcessId
GetProcessHeap
SetThreadExecutionState
FindNextFileA
GetVolumePathNamesForVolumeNameW
CreateProcessA
CreateDirectoryA
FindNextVolumeW
GetDriveTypeW
LoadLibraryW
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
GetVersionExW
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExA
GetExitCodeProcess
TerminateProcess
InterlockedDecrement
WriteFile
GetCurrentProcess
FindNextFileW
GetFullPathNameW
EnterCriticalSection
HeapFree
FindFirstFileA
FindFirstVolumeW
Process32First
FindFirstFileW
QueryDosDeviceW
SizeofResource
WideCharToMultiByte
GetModuleFileNameA
GetConsoleCP
FlushFileBuffers
GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
FreeLibraryAndExitThread
ExitThread
CreateThread
DeleteFileW
RemoveDirectoryW
SetEnvironmentVariableW
SetEnvironmentVariableA
GetACP
WriteConsoleW
GetModuleFileNameW
GetFileType
GetStdHandle
ReadFile
GetModuleHandleExW
ExitProcess
VirtualQuery
VirtualProtect
VirtualAlloc
LoadLibraryExW
FreeLibrary
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
LocalFree
OutputDebugStringW
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStringTypeW
EncodePointer
GetTickCount
TlsFree
TlsSetValue
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
CreateDirectoryW
CreateFileW
FindFirstFileExW
GetFileAttributesExW
GetFileInformationByHandle
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
CopyFileW
FormatMessageW
TryEnterCriticalSection
DuplicateHandle
SwitchToThread
GetCurrentThread
SetLastError
TlsAlloc
TlsGetValue

user32

RegisterWindowMessageA
OpenClipboard
GetAsyncKeyState
GetWindowTextW
GetGUIThreadInfo
EmptyClipboard
SetForegroundWindow
RegisterClassExA
GetWindowTextLengthA
PostQuitMessage
LoadIconA
CloseClipboard
GetCursorPos
CreateWindowExA
ShowWindow
TrackPopupMenu
GetSystemMetrics
keybd_event
IsWindowVisible
SendMessageA
GetClipboardData
TranslateMessage
RegisterDeviceNotificationA
DefWindowProcA
GetForegroundWindow
GetKeyboardLayout
GetDC
LoadCursorA
DispatchMessageA
GetMessageA
GetKeyState
GetWindowThreadProcessId

gdi32

BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetDeviceCaps
DeleteDC
DeleteObject
CreateSolidBrush
GetObjectA

advapi32

RegDeleteKeyA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey

shell32

SHGetSpecialFolderPathA
ShellExecuteA
Shell_NotifyIconA
SHGetFolderPathA

ole32

CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance

oleaut32

VariantInit
SysFreeString
SysAllocString
VariantClear

shlwapi

PathFindExtensionW
PathFindExtensionA

gdiplus

GdipDisposeImage
GdiplusStartup
GdiplusShutdown
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipCreateBitmapFromScan0
GdipGetImageEncodersSize

wininet

InternetCheckConnectionA
HttpOpenRequestA
InternetQueryOptionA
InternetOpenA
InternetCloseHandle
HttpSendRequestA
InternetConnectA
InternetReadFile
InternetSetOptionA

urlmon

URLDownloadToFileA
ObtainUserAgentString

winmm

waveInStart
waveInOpen
waveInPrepareHeader
waveInClose
waveInAddBuffer

Sections

.text
Size: 628KB - Virtual size: 628KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 4.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 141KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

329d62dcbfdc8193a1cc4332ab73842c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

wininet

urlmon

winmm

Sections

.text Size: 628KB - Virtual size: 628KB

.rdata Size: 139KB - Virtual size: 139KB

.data Size: 13KB - Virtual size: 4.6MB

.rsrc Size: 141KB - Virtual size: 141KB

.reloc Size: 32KB - Virtual size: 31KB

.text
Size: 628KB - Virtual size: 628KB

.rdata
Size: 139KB - Virtual size: 139KB

.data
Size: 13KB - Virtual size: 4.6MB

.rsrc
Size: 141KB - Virtual size: 141KB

.reloc
Size: 32KB - Virtual size: 31KB