5f6d05aa251ab9fdf33edd91f3352a748824db6ae22da7a65c6d75a3c5546296

Sharing

Copy URL

Twitter E-mail

General

Target

5f6d05aa251ab9fdf33edd91f3352a748824db6ae22da7a65c6d75a3c5546296
Size

2.7MB
MD5

242c745398751db47bd5300930a4f682
SHA1

e10c07fa6f22f9dc704f53d4f8d48a0426f92aeb
SHA256

5f6d05aa251ab9fdf33edd91f3352a748824db6ae22da7a65c6d75a3c5546296
SHA512

dae20cefe1a2fbeb857ab2cac9a0c0fb3bb3fd2778d83d9718e00dafafad2c94829f573bed0a029d4f779de4a8fb33f3c5ed33e1d68576926e6cbd53db59cf88
SSDEEP

24576:7zKTRprFWo4jSa+vGuyL8av257x4puQRGKdjGSKgQc:6Drwvjqny057x4puIdsBc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5f6d05aa251ab9fdf33edd91f3352a748824db6ae22da7a65c6d75a3c5546296

Files

5f6d05aa251ab9fdf33edd91f3352a748824db6ae22da7a65c6d75a3c5546296
.exe windows:4 windows x86 arch:x86

14305e4e9b66d2ff18f12c0d833d6c27

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

keyproapp

KeyProUartConfigure
KeyProLevelRequest

winmm

mciGetErrorStringA
mciSendCommandA

mfc42

ord433
ord465
ord857
ord668
ord2770
ord356
ord464
ord539
ord463
ord850
ord4129
ord5856
ord858
ord922
ord665
ord354
ord2820
ord3811
ord939
ord924
ord5683
ord5572
ord2919
ord5265
ord4376
ord4998
ord2514
ord6052
ord1775
ord4425
ord3597
ord2411
ord2023
ord4218
ord2578
ord4398
ord3402
ord3582
ord2582
ord4402
ord3370
ord3640
ord693
ord616
ord641
ord324
ord2362
ord2299
ord2370
ord2302
ord4234
ord2915
ord6334
ord5981
ord6696
ord6907
ord3998
ord6215
ord3996
ord2864
ord4710
ord4853
ord5710
ord4224
ord3874
ord3302
ord2379
ord5280
ord5216
ord936
ord932
ord3610
ord686
ord384
ord4243
ord3286
ord6453
ord2408
ord6007
ord3301
ord6143
ord4278
ord6662
ord2100
ord3797
ord6675
ord2862
ord2097
ord2380
ord2860
ord2089
ord6888
ord6905
ord656
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord839
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord1168
ord6438
ord2621
ord1134
ord765
ord781
ord808
ord2841
ord2107
ord5651
ord3130
ord3676
ord350
ord3396
ord3731
ord3708
ord3698
ord1146
ord2121
ord2623
ord2096
ord3337
ord1205
ord4160
ord2863
ord755
ord470
ord6197
ord5861
ord3173
ord690
ord2393
ord3215
ord6059
ord389
ord5953
ord6663
ord1979
ord5442
ord3318
ord5186
ord926
ord6385
ord353
ord2803
ord6283
ord6136
ord3767
ord6134
ord3317
ord1175
ord2140
ord4204
ord2642
ord3499
ord2515
ord355
ord6010
ord3097
ord1567
ord268
ord1158
ord941
ord5308
ord4779
ord5811
ord5482
ord2032
ord4447
ord4863
ord5797
ord5479
ord1995
ord967
ord3717
ord791
ord287
ord523
ord4335
ord1638
ord4411
ord4919
ord6139
ord4975
ord1138
ord5809
ord1105
ord610
ord2294
ord2289
ord1842
ord2723
ord2390
ord3059
ord5100
ord5103
ord4467
ord4303
ord3350
ord5012
ord975
ord5472
ord3403
ord2879
ord2878
ord4151
ord4077
ord5237
ord5282
ord2649
ord1665
ord4436
ord5252
ord4427
ord366
ord674
ord4242
ord4277
ord1656
ord5575
ord434
ord2141
ord4033
ord6394
ord5450
ord6383
ord5440
ord6880
ord3092
ord4299
ord5875
ord6199
ord4275
ord2414
ord3663
ord3626
ord567
ord1641
ord2243
ord795
ord3721
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1776
ord4078
ord6055
ord3573
ord3619
ord541
ord535
ord801
ord537
ord6883
ord2818
ord823
ord1200
ord825
ord540
ord860
ord800
ord5307
ord1576

msvcrt

?terminate@@YAXXZ
_except_handler3
??1type_info@@UAE@XZ
_ftol
sscanf
clock
atof
exit
atoi
strtoul
strtod
memmove
_endthreadex
__dllonexit
strncmp
strstr
strncpy
isalnum
_setmbcp
_CxxThrowException
wcslen
_onexit
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_beginthreadex
__CxxFrameHandler
_mbscmp
sprintf
printf
free
malloc
isprint
isspace
tolower
_controlfp

kernel32

TerminateThread
FlushFileBuffers
PurgeComm
DeleteCriticalSection
InitializeCriticalSection
CreateEventA
CreateDirectoryA
GetCurrentDirectoryA
GetPrivateProfileStringA
GetVersionExA
GetCurrentProcess
SetPriorityClass
CreateFileA
DeviceIoControl
CloseHandle
InterlockedIncrement
lstrlenA
MultiByteToWideChar
GetLastError
InterlockedDecrement
LocalFree
SetupComm
GetCommModemStatus
ClearCommBreak
ClearCommError
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
ReadFile
SetEvent
WaitCommEvent
ResetEvent
GetPrivateProfileIntA
GetTickCount
SetThreadPriority
SetCommState
GetCommState
ReleaseMutex
CreateMutexA
LoadLibraryA
VirtualProtectEx
GetModuleHandleW
FreeLibrary
GetProcAddress
CreateThread
DeleteFileA
SuspendThread
CreateProcessA
CopyFileA
WritePrivateProfileStringA
ResumeThread
FindClose
FindFirstFileA
GetComputerNameA
GetExitCodeProcess
WideCharToMultiByte
GetExitCodeThread
WaitForMultipleObjects
GetModuleHandleA
GetStartupInfoA
SetCommMask
Sleep
SetCommTimeouts
WriteFile
GetOverlappedResult
GetCommTimeouts

user32

SetWindowLongA
RedrawWindow
LockWindowUpdate
GetSubMenu
IsWindowVisible
GetDlgItem
SetWindowPos
GetWindowLongA
EnableMenuItem
IsRectEmpty
IsIconic
SendMessageA
EnableWindow
SetRectEmpty
CopyRect
GetClientRect
GetSystemMetrics
DrawIcon
GetSystemMenu
AppendMenuA
IntersectRect
LoadIconA
MsgWaitForMultipleObjects
PeekMessageA
DispatchMessageA
FindWindowA
GetWindowPlacement
SetWindowPlacement
GetMenu
GetWindowRect
MessageBoxA
GetSysColor
wsprintfA
KillTimer
GetCursorPos
ScreenToClient
GetParent
SetTimer
IsWindow
PostMessageA
PostThreadMessageA
SetForegroundWindow

gdi32

GetStockObject
CreateFontA

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExA

shell32

SHFileOperationA
SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteExA
ShellExecuteA

comctl32

ImageList_ReplaceIcon

ole32

OleRun
CLSIDFromString
CoInitialize
CoCreateInstance
CoUninitialize
CLSIDFromProgID

oleaut32

VariantInit
SafeArrayAccessData
SafeArrayUnaccessData
GetActiveObject
VariantCopy
VariantChangeType
SysAllocString
SysStringByteLen
SysAllocStringByteLen
VariantClear
SysFreeString
GetErrorInfo

msvcp60

?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Xlen@std@@YAXXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

wsock32

recv
closesocket
connect
htons
send
WSACleanup
socket
WSAStartup
inet_addr
gethostbyname
gethostname
ioctlsocket

skinhu

SkinH_Attach

Sections

.text
Size: 740KB - Virtual size: 736KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

14305e4e9b66d2ff18f12c0d833d6c27

Headers

File Characteristics

Imports

keyproapp

winmm

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

oleaut32

msvcp60

wsock32

skinhu

Sections

.text Size: 740KB - Virtual size: 736KB

.rdata Size: 88KB - Virtual size: 87KB

.data Size: 44KB - Virtual size: 46KB

.rsrc Size: 1.8MB - Virtual size: 1.8MB

.text
Size: 740KB - Virtual size: 736KB

.rdata
Size: 88KB - Virtual size: 87KB

.data
Size: 44KB - Virtual size: 46KB

.rsrc
Size: 1.8MB - Virtual size: 1.8MB