dcf68a30264419ec0a8e62b7c6cc89d7a3972e755959793a3da6d01bfc1b5985

Sharing

Copy URL Twitter E-mail

General

Target

dcf68a30264419ec0a8e62b7c6cc89d7a3972e755959793a3da6d01bfc1b5985
Size

17.6MB
MD5

ab59b0ede701331fec756c2f973fdc2e
SHA1

ecddc421ae34d9503207fcd201234b07ed9dcf5a
SHA256

dcf68a30264419ec0a8e62b7c6cc89d7a3972e755959793a3da6d01bfc1b5985
SHA512

c8735f22bc0901f770b8411891d6c4a8a109090b96801a7953665622377fd7c9e467a0cbced906cdbfebb46a21855f81b398d2b1404f4ee23e7d877de0ff6e81
SSDEEP

393216:HWWacJtX+dnIrXiS2JeBeGshOFQi2ces0/X6GFwfAPI09Hbj:+cJN+SrXi1ssOtHes0/6owIP7Jj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/App_02029.exe

Files

dcf68a30264419ec0a8e62b7c6cc89d7a3972e755959793a3da6d01bfc1b5985
.zip
App_02029.exe
.exe windows:4 windows x86 arch:x86

ac93743ca80c320d4c30b7fd1c9d511f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsAlloc
GetCommandLineW
GetVersionExA
GetProcAddress
GetStringTypeW
GetDriveTypeA
LoadLibraryA
QueryPerformanceFrequency
FreeEnvironmentStringsW
LCMapStringA
FileTimeToSystemTime
HeapAlloc
GetCurrentProcess
InitializeCriticalSection
MoveFileW
MultiByteToWideChar
GetModuleFileNameA
CompareStringW
GetFullPathNameA
CreateThread
ExitThread
GetACP
HeapDestroy
SetEndOfFile
GetProcessHeap
SetStdHandle
WaitForSingleObject
GetTimeZoneInformation
LeaveCriticalSection
HeapReAlloc
GetCurrentThread
FlushFileBuffers
PeekNamedPipe
SleepEx
MoveFileExA
WaitForMultipleObjects
TerminateProcess
FindClose
VirtualAlloc
ReadFile
SetEnvironmentVariableA
GetSystemDirectoryA
GetEnvironmentStringsW
GetLastError
SetFilePointer
GetStringTypeA
FreeLibrary
DeleteFileA
UnhandledExceptionFilter
GetEnvironmentVariableA
HeapFree
GetCommandLineA
GetModuleHandleA
RtlUnwind
GetVersion
ExitProcess
InterlockedDecrement
HeapCreate
GetLocalTime
GetStartupInfoA
GetEnvironmentStrings
FreeEnvironmentStringsA
VirtualFree
GetCPInfo
DeleteCriticalSection
FileTimeToLocalFileTime
GetSystemTime
FindFirstFileA
SetHandleCount
EnterCriticalSection
InterlockedIncrement
GetStdHandle
GetTickCount
GetModuleHandleW
CreateFileA
GetModuleFileNameW
FormatMessageA
Sleep
WideCharToMultiByte
GetFileAttributesA
WriteFile
GetFileSizeEx
GetCurrentProcessId
LCMapStringW
TlsGetValue
SetLastError
GetFileSize
CloseHandle
TlsSetValue
GetCurrentDirectoryA
GetCurrentThreadId
GetOEMCP
CompareStringA
GetStartupInfoW
GetFileInformationByHandle
QueryPerformanceCounter
GetFileType

user32

ShowWindow
EndPaint
GetClientRect
GetWindowRect
PostMessageW
RedrawWindow
SetWindowPos
GetMessageW
RegisterClassExW
MessageBoxA
DispatchMessageW
BeginPaint
PostQuitMessage
FillRect
TranslateMessage
SendMessageA
UpdateWindow
DefWindowProcW
CreateWindowExW
DrawTextW
LoadIconW
GetSystemMetrics

gdi32

SetTextColor
DeleteObject
SetBkMode
CreateSolidBrush

advapi32

CryptGetHashParam
CryptReleaseContext
CryptCreateHash
CryptImportKey
CryptHashData
CryptGenRandom
CryptAcquireContextA
CryptDestroyHash
CryptEncrypt
CryptDestroyKey
CloseServiceHandle

crypt32

CertCreateCertificateChainEngine
CertFindExtension
CertFreeCertificateContext
CertFreeCertificateChainEngine
CertFindCertificateInStore
CertFreeCertificateChain
PFXImportCertStore
CryptDecodeObjectEx
CertEnumCertificatesInStore
CertOpenStore
CertAddCertificateContextToStore
CryptQueryObject
CryptStringToBinaryA
CertCloseStore
CertGetCertificateChain

wldap32

ord46
ord41
ord27
ord301
ord33
ord79
ord35
ord32
ord200
ord30
ord45
ord60
ord22
ord211
ord26
ord143
ord50
ord217

ws2_32

closesocket
send
WSAGetLastError
WSACleanup
WSAStartup
recv
ntohs
getsockname
getpeername
WSASetLastError
getsockopt
setsockopt
connect
WSAIoctl
bind
htons
socket
inet_ntoa
htonl
gethostbyname
inet_addr
getservbyname
gethostbyaddr
getservbyport
accept
sendto
recvfrom
select
__WSAFDIsSet
ioctlsocket
gethostname
ntohl
listen

Sections

.text
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 204KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac93743ca80c320d4c30b7fd1c9d511f

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

crypt32

wldap32

ws2_32

Sections

.text Size: 4.6MB - Virtual size: 4.6MB

.rdata Size: 204KB - Virtual size: 200KB

.data Size: 56KB - Virtual size: 75KB

.rsrc Size: 72KB - Virtual size: 68KB

.reloc Size: 52KB - Virtual size: 49KB

.text
Size: 4.6MB - Virtual size: 4.6MB

.rdata
Size: 204KB - Virtual size: 200KB

.data
Size: 56KB - Virtual size: 75KB

.rsrc
Size: 72KB - Virtual size: 68KB

.reloc
Size: 52KB - Virtual size: 49KB