d3beb926f14e18e666fcb7485a6b205ffd633203bafb23462c6bc84c92056c05

Sharing

Copy URL Twitter E-mail

General

Target

d3beb926f14e18e666fcb7485a6b205ffd633203bafb23462c6bc84c92056c05
Size

3.3MB
MD5

d0ae8a692736bc3387549c4da2505564
SHA1

bddefd1560c8006f1de4b63043ce09d3e84befa3
SHA256

d3beb926f14e18e666fcb7485a6b205ffd633203bafb23462c6bc84c92056c05
SHA512

082f5d34e771a23918546fe99a1024f0063aca8fc1e8145a017931c37824fdac3b08e6b5ca6e75d428db2a9a6cfded18642171f7551f21435452a6ded4fce493
SSDEEP

49152:vxwkiSsKeYqJJtJ79rrBBJcgfssxPDz5X5/iMKXP:KIsKxqJJr79hz9Rz5tizXP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d3beb926f14e18e666fcb7485a6b205ffd633203bafb23462c6bc84c92056c05

Files

d3beb926f14e18e666fcb7485a6b205ffd633203bafb23462c6bc84c92056c05
.exe windows:5 windows x86 arch:x86

5b8e7cb4b62f8ce6fd8cf8ceb5490520

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

OpenProcessToken
CreateProcessAsUserW
RegCloseKey
RegDeleteKeyW
RegEnumKeyW
RegOpenKeyW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyW
RegDeleteValueW
RegSetValueExW
ChangeServiceConfig2W
CloseServiceHandle
ControlService
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
StartServiceW
RevertToSelf
EqualSid
GetLengthSid
InitializeAcl
GetAclInformation
AddAce
GetAce
AddAccessAllowedAce
InitializeSecurityDescriptor
GetSecurityDescriptorControl
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
SetFileSecurityW
GetFileSecurityW
LookupAccountNameW
RegCreateKeyExW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
DuplicateTokenEx
GetSidSubAuthorityCount
GetSidSubAuthority
SetTokenInformation
ImpersonateLoggedOnUser
LookupAccountSidW
GetTokenInformation

ole32

CoInitializeEx
CoCreateInstance
CoTaskMemFree
CoInitialize
CoUninitialize

shell32

SHChangeNotify
SHGetFolderPathW
SHGetSpecialFolderPathW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
ShellExecuteExW

shlwapi

PathFileExistsW
SHSetValueW
SHDeleteKeyW
SHDeleteValueW
SHGetValueW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

user32

PostMessageW
FindWindowW
wsprintfA
wsprintfW
LoadStringW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW

kernel32

Process32NextW
GetPrivateProfileStringW
WritePrivateProfileStringW
VirtualAlloc
VirtualFree
VirtualProtect
HeapAlloc
HeapFree
GetProcessHeap
SetLastError
GetNativeSystemInfo
lstrlenW
LoadLibraryA
IsBadReadPtr
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
OpenFileMappingW
CreateThread
TerminateThread
GetExitCodeThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateEventW
GetSystemWow64DirectoryW
GetCurrentProcessId
LocalAlloc
LocalFree
GetCurrentProcess
GetLastError
GetModuleHandleW
FindClose
FindFirstFileW
FindNextFileW
GetLogicalDriveStringsW
OutputDebugStringW
CopyFileW
MoveFileExW
GetLocalTime
GetModuleFileNameW
GetFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetVersionExW
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
TerminateProcess
QueryPerformanceCounter
Process32FirstW
GetSystemTimeAsFileTime
InitializeSListHead
GetLongPathNameW
GetExitCodeProcess
WriteFile
GetTickCount
GetTempPathW
GetFileAttributesW
DeleteFileW
GetEnvironmentVariableW
CreateDirectoryW
RemoveDirectoryW
SetFileAttributesW
GlobalAlloc
GlobalFree
ReadProcessMemory
lstrcpyW
CreateProcessW
QueryDosDeviceW
DecodePointer
HeapReAlloc
HeapSize
RaiseException
GetFileSize
ReadFile
MultiByteToWideChar
WideCharToMultiByte
GetSystemInfo
ReleaseMutex
CreateMutexW
GetVolumeInformationW
GetWindowsDirectoryW
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceW
OutputDebugStringA
SetPriorityClass
GetFullPathNameW
GetCurrentDirectoryW
FreeLibraryAndExitThread
ExitThread
GetDriveTypeW
GetCurrentThreadId
CreateToolhelp32Snapshot
FreeLibrary
SystemTimeToFileTime
GetSystemTime
ReadConsoleA
SetConsoleMode
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
DeleteFiber
SwitchToFiber
VerifyVersionInfoA
GetSystemDirectoryA
GetModuleHandleA
VerSetConditionMask
ExpandEnvironmentStringsA
PeekNamedPipe
WaitForMultipleObjects
SleepEx
FormatMessageA
CreateFileW
GetSystemDirectoryW
LoadLibraryW
CloseHandle
DeviceIoControl
Sleep
OpenProcess
GetPrivateProfileIntW
GetProcAddress
SwitchToThread
SetEndOfFile
FlushFileBuffers
GetConsoleCP
SetStdHandle
SetConsoleCtrlHandler
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetFileType
WriteConsoleW
GetStringTypeW
GetACP
GetStdHandle
GetModuleHandleExW
ExitProcess
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
RtlUnwind

oleaut32

SysAllocString
SysFreeString
SysStringLen

crypt32

CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CryptMsgClose
CertGetNameStringW
CryptQueryObject

psapi

EnumProcessModules
GetProcessImageFileNameW
GetModuleFileNameExW

wininet

InternetReadFile
HttpQueryInfoW
InternetOpenUrlW
InternetOpenW
InternetSetOptionW
InternetQueryOptionW
InternetCloseHandle

wldap32

ord26
ord143
ord46
ord211
ord60
ord50
ord41
ord22
ord301
ord27
ord32
ord33
ord35
ord79
ord30
ord200

ws2_32

WSAStartup
getaddrinfo
WSACleanup
recv
send
WSAGetLastError
__WSAFDIsSet
select
WSASetLastError
bind
WSAIoctl
gethostname
ioctlsocket
listen
accept
closesocket
connect
getpeername
getsockname
getsockopt
htons
ntohs
freeaddrinfo
recvfrom
setsockopt
sendto
socket

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 568KB - Virtual size: 568KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 21KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 827KB - Virtual size: 828KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5b8e7cb4b62f8ce6fd8cf8ceb5490520

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

ole32

shell32

shlwapi

userenv

user32

kernel32

oleaut32

crypt32

psapi

wininet

wldap32

ws2_32

version

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 568KB - Virtual size: 568KB

.data Size: 21KB - Virtual size: 44KB

.rsrc Size: 827KB - Virtual size: 828KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 568KB - Virtual size: 568KB

.data
Size: 21KB - Virtual size: 44KB

.rsrc
Size: 827KB - Virtual size: 828KB