0a312c85ae310e00a97782de39be3b0d318cff77e3d9db9519f34534bf39fe08

Sharing

Copy URL

Twitter E-mail

General

Target

0a312c85ae310e00a97782de39be3b0d318cff77e3d9db9519f34534bf39fe08
Size

286KB
MD5

7c44f2c7c4bc31210529002b26dcb708
SHA1

5be952c5c3d32d992249d703ed7b6e088c75ff6c
SHA256

0a312c85ae310e00a97782de39be3b0d318cff77e3d9db9519f34534bf39fe08
SHA512

42c9bacbf706666e24c22d656c10db23c37e26ed05fe133f939c90c3e13815edc5f57c1b9405062f5bf9cf247248f2820ee06b7fa908540dad6989547ff7bc32
SSDEEP

6144:ceMi6qigWnInGEBLgCgJfum9hVpB9AKCNaLU7FlNi0dKCz4jXb6yHdq2UY6ijmis:EixknIGYUb9lPAKCNhlNi0kCUbb6yHIT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/1e0215f67fb7b02bc44f33bf6a5b884c3061cbeb38e0150b559635458951fa53.exe

Files

0a312c85ae310e00a97782de39be3b0d318cff77e3d9db9519f34534bf39fe08
.zip

Password: infected
1e0215f67fb7b02bc44f33bf6a5b884c3061cbeb38e0150b559635458951fa53.exe
.exe windows:4 windows x86 arch:x86

cd46b7aed718803156f54c0576fe8371

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlUnwind
HeapFree
GetStartupInfoA
GetCommandLineA
ExitProcess
RaiseException
HeapAlloc
TerminateProcess
HeapSize
HeapReAlloc
GetACP
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
FlushFileBuffers
SetFilePointer
ReadFile
InterlockedExchange
SetErrorMode
WritePrivateProfileStringA
GetOEMCP
GetCPInfo
GetProcessVersion
GlobalFlags
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalAlloc
GetLastError
LocalFree
GlobalFree
GetModuleFileNameA
GlobalAlloc
lstrcmpA
GetCurrentThread
MultiByteToWideChar
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
GlobalLock
GlobalUnlock
MulDiv
SetLastError
FindResourceA
LoadResource
LockResource
GetCurrentThreadId
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
GetModuleHandleA
WriteFile
CloseHandle
WinExec
lstrcpyA
GetWindowsDirectoryA
LoadLibraryA
FreeLibrary
lstrcatA
GetVersion
LoadLibraryExW
LoadLibraryExA
GetProcAddress
SizeofResource
GetCurrentProcess
lstrcpynA
lstrlenA
FreeEnvironmentStringsA
Sleep

user32

UpdateWindow
PostMessageA
IsDialogMessageA
SetWindowTextA
ShowWindow
IsWindowEnabled
GetNextDlgTabItem
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
TabbedTextOutA
DrawTextA
GrayStringA
LoadStringA
PostQuitMessage
ValidateRect
TranslateMessage
GetMessageA
CreateDialogIndirectParamA
EndDialog
GetClassNameA
GetSysColorBrush
DestroyMenu
SendDlgItemMessageA
MapWindowPoints
DispatchMessageA
GetFocus
SetActiveWindow
SetFocus
AdjustWindowRectEx
IsWindowVisible
GetTopWindow
MessageBoxA
WinHelpA
wsprintfA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetDlgItem
GetWindowTextLengthA
GetWindowTextA
GetDlgCtrlID
GetKeyState
DefWindowProcA
DestroyWindow
CreateWindowExA
SetWindowsHookExA
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
GetWindow
SetWindowPos
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
LoadCursorA
CopyIcon
GetDC
ReleaseDC
IsWindow
GetMessagePos
PtInRect
SetTimer
MessageBeep
SetWindowLongA
KillTimer
GetSystemMenu
LoadIconA
EnableWindow
FillRect
GetWindowRect
GetClientRect
SetCursor
GetWindowLongA
DrawStateA
CopyRect
FrameRect
InflateRect
GetSysColor
OffsetRect
DrawFocusRect
PeekMessageA
SendMessageA
GetCursorPos
ScreenToClient
GetActiveWindow
GetParent
GetCapture
SetCapture
ClientToScreen
WindowFromPoint
ReleaseCapture
InvalidateRect
GetIconInfo
RedrawWindow
LoadImageA
DestroyCursor
CallNextHookEx
UnregisterClassA

gdi32

SetBkMode
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
MoveToEx
LineTo
SetBkColor
SaveDC
GetDeviceCaps
CreatePen
CreateSolidBrush
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
RestoreDC
SetTextColor
DeleteDC
GetObjectA
GetStockObject
BitBlt
GetClipBox
SetStretchBltMode
SetDIBitsToDevice
GetTextExtentPoint32A
CreateFontIndirectA
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
CreateBitmap

comdlg32

GetOpenFileNameA
GetSaveFileNameA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueA
RegCloseKey

shell32

ShellExecuteA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetMalloc

comctl32

ord17

Sections

.text
Size: 120KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 232KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

cd46b7aed718803156f54c0576fe8371

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

Sections

.text Size: 120KB - Virtual size: 118KB

.rdata Size: 32KB - Virtual size: 28KB

.data Size: 8KB - Virtual size: 21KB

.rsrc Size: 232KB - Virtual size: 228KB

.text
Size: 120KB - Virtual size: 118KB

.rdata
Size: 32KB - Virtual size: 28KB

.data
Size: 8KB - Virtual size: 21KB

.rsrc
Size: 232KB - Virtual size: 228KB