a2985cffbd6a630f1ee833b8c72d7e3dbf8ce51ccf74fd9987fec62af1dd39e5

Sharing

Copy URL Twitter E-mail

General

Target

a2985cffbd6a630f1ee833b8c72d7e3dbf8ce51ccf74fd9987fec62af1dd39e5
Size

17.6MB
MD5

28b5e3f53a2e80b950d8b72e08800ce0
SHA1

9f06828a484501debc4457f2c00867b53d755427
SHA256

a2985cffbd6a630f1ee833b8c72d7e3dbf8ce51ccf74fd9987fec62af1dd39e5
SHA512

920ea85d7411a61f7870188c31f696d8bdcfc01f3952ea3a12bff46f0d2c9e9de519cdd8b7cdfaf14a4ffdcc2f7e4bb2beaac6e9dff79e8b6b6b741618b6c2d7
SSDEEP

393216:dOSdBTmhLN0OeY/IiJJNUBrnGFWXbsK+kAkt:dOSPq06/nJcBTukb6kb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/App_02029.exe

Files

a2985cffbd6a630f1ee833b8c72d7e3dbf8ce51ccf74fd9987fec62af1dd39e5
.zip
App_02029.exe
.exe windows:4 windows x86 arch:x86

ac93743ca80c320d4c30b7fd1c9d511f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsAlloc
GetCommandLineW
GetVersionExA
GetProcAddress
GetStringTypeW
GetDriveTypeA
LoadLibraryA
QueryPerformanceFrequency
FreeEnvironmentStringsW
LCMapStringA
FileTimeToSystemTime
HeapAlloc
GetCurrentProcess
InitializeCriticalSection
MoveFileW
MultiByteToWideChar
GetModuleFileNameA
CompareStringW
GetFullPathNameA
CreateThread
ExitThread
GetACP
HeapDestroy
SetEndOfFile
GetProcessHeap
SetStdHandle
WaitForSingleObject
GetTimeZoneInformation
LeaveCriticalSection
HeapReAlloc
GetCurrentThread
FlushFileBuffers
PeekNamedPipe
SleepEx
MoveFileExA
WaitForMultipleObjects
TerminateProcess
FindClose
VirtualAlloc
ReadFile
SetEnvironmentVariableA
GetSystemDirectoryA
GetEnvironmentStringsW
GetLastError
SetFilePointer
GetStringTypeA
FreeLibrary
DeleteFileA
UnhandledExceptionFilter
GetEnvironmentVariableA
HeapFree
GetCommandLineA
GetModuleHandleA
RtlUnwind
GetVersion
ExitProcess
InterlockedDecrement
HeapCreate
GetLocalTime
GetStartupInfoA
GetEnvironmentStrings
FreeEnvironmentStringsA
VirtualFree
GetCPInfo
DeleteCriticalSection
FileTimeToLocalFileTime
GetSystemTime
FindFirstFileA
SetHandleCount
EnterCriticalSection
InterlockedIncrement
GetStdHandle
GetTickCount
GetModuleHandleW
CreateFileA
GetModuleFileNameW
FormatMessageA
Sleep
WideCharToMultiByte
GetFileAttributesA
WriteFile
GetFileSizeEx
GetCurrentProcessId
LCMapStringW
TlsGetValue
SetLastError
GetFileSize
CloseHandle
TlsSetValue
GetCurrentDirectoryA
GetCurrentThreadId
GetOEMCP
CompareStringA
GetStartupInfoW
GetFileInformationByHandle
QueryPerformanceCounter
GetFileType

user32

ShowWindow
EndPaint
GetClientRect
GetWindowRect
PostMessageW
RedrawWindow
SetWindowPos
GetMessageW
RegisterClassExW
MessageBoxA
DispatchMessageW
BeginPaint
PostQuitMessage
FillRect
TranslateMessage
SendMessageA
UpdateWindow
DefWindowProcW
CreateWindowExW
DrawTextW
LoadIconW
GetSystemMetrics

gdi32

SetTextColor
DeleteObject
SetBkMode
CreateSolidBrush

advapi32

CryptGetHashParam
CryptReleaseContext
CryptCreateHash
CryptImportKey
CryptHashData
CryptGenRandom
CryptAcquireContextA
CryptDestroyHash
CryptEncrypt
CryptDestroyKey
CloseServiceHandle

crypt32

CertCreateCertificateChainEngine
CertFindExtension
CertFreeCertificateContext
CertFreeCertificateChainEngine
CertFindCertificateInStore
CertFreeCertificateChain
PFXImportCertStore
CryptDecodeObjectEx
CertEnumCertificatesInStore
CertOpenStore
CertAddCertificateContextToStore
CryptQueryObject
CryptStringToBinaryA
CertCloseStore
CertGetCertificateChain

wldap32

ord46
ord41
ord27
ord301
ord33
ord79
ord35
ord32
ord200
ord30
ord45
ord60
ord22
ord211
ord26
ord143
ord50
ord217

ws2_32

closesocket
send
WSAGetLastError
WSACleanup
WSAStartup
recv
ntohs
getsockname
getpeername
WSASetLastError
getsockopt
setsockopt
connect
WSAIoctl
bind
htons
socket
inet_ntoa
htonl
gethostbyname
inet_addr
getservbyname
gethostbyaddr
getservbyport
accept
sendto
recvfrom
select
__WSAFDIsSet
ioctlsocket
gethostname
ntohl
listen

Sections

.text
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 204KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac93743ca80c320d4c30b7fd1c9d511f

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

crypt32

wldap32

ws2_32

Sections

.text Size: 4.6MB - Virtual size: 4.6MB

.rdata Size: 204KB - Virtual size: 200KB

.data Size: 56KB - Virtual size: 75KB

.rsrc Size: 72KB - Virtual size: 68KB

.reloc Size: 52KB - Virtual size: 49KB

.text
Size: 4.6MB - Virtual size: 4.6MB

.rdata
Size: 204KB - Virtual size: 200KB

.data
Size: 56KB - Virtual size: 75KB

.rsrc
Size: 72KB - Virtual size: 68KB

.reloc
Size: 52KB - Virtual size: 49KB