523ef5165e209973df6e20b6ffe95e422388a447566261b9d77dd89a83397f81

Sharing

Copy URL Twitter E-mail

General

Target

523ef5165e209973df6e20b6ffe95e422388a447566261b9d77dd89a83397f81
Size

17.6MB
MD5

63be8a2c9b749faa4546d013650c6582
SHA1

dbff5fe9ec9fe7fa02eaecd8f1808553ae0d211e
SHA256

523ef5165e209973df6e20b6ffe95e422388a447566261b9d77dd89a83397f81
SHA512

5fe9e8791930e783244a69eb9f65cf1f6d9d5906c7a25bfde455601940ac7a418bf73646ae66792129e82ce7d388b685bd6004042cbdcdfe49dac436061c9458
SSDEEP

393216:yOSdBTmhLN0OeY/IiJJNUBrnGFWXbsK+kAki:yOSPq06/nJcBTukb6kU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/App_02029.exe

Files

523ef5165e209973df6e20b6ffe95e422388a447566261b9d77dd89a83397f81
.zip
App_02029.exe
.exe windows:4 windows x86 arch:x86

ac93743ca80c320d4c30b7fd1c9d511f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsAlloc
GetCommandLineW
GetVersionExA
GetProcAddress
GetStringTypeW
GetDriveTypeA
LoadLibraryA
QueryPerformanceFrequency
FreeEnvironmentStringsW
LCMapStringA
FileTimeToSystemTime
HeapAlloc
GetCurrentProcess
InitializeCriticalSection
MoveFileW
MultiByteToWideChar
GetModuleFileNameA
CompareStringW
GetFullPathNameA
CreateThread
ExitThread
GetACP
HeapDestroy
SetEndOfFile
GetProcessHeap
SetStdHandle
WaitForSingleObject
GetTimeZoneInformation
LeaveCriticalSection
HeapReAlloc
GetCurrentThread
FlushFileBuffers
PeekNamedPipe
SleepEx
MoveFileExA
WaitForMultipleObjects
TerminateProcess
FindClose
VirtualAlloc
ReadFile
SetEnvironmentVariableA
GetSystemDirectoryA
GetEnvironmentStringsW
GetLastError
SetFilePointer
GetStringTypeA
FreeLibrary
DeleteFileA
UnhandledExceptionFilter
GetEnvironmentVariableA
HeapFree
GetCommandLineA
GetModuleHandleA
RtlUnwind
GetVersion
ExitProcess
InterlockedDecrement
HeapCreate
GetLocalTime
GetStartupInfoA
GetEnvironmentStrings
FreeEnvironmentStringsA
VirtualFree
GetCPInfo
DeleteCriticalSection
FileTimeToLocalFileTime
GetSystemTime
FindFirstFileA
SetHandleCount
EnterCriticalSection
InterlockedIncrement
GetStdHandle
GetTickCount
GetModuleHandleW
CreateFileA
GetModuleFileNameW
FormatMessageA
Sleep
WideCharToMultiByte
GetFileAttributesA
WriteFile
GetFileSizeEx
GetCurrentProcessId
LCMapStringW
TlsGetValue
SetLastError
GetFileSize
CloseHandle
TlsSetValue
GetCurrentDirectoryA
GetCurrentThreadId
GetOEMCP
CompareStringA
GetStartupInfoW
GetFileInformationByHandle
QueryPerformanceCounter
GetFileType

user32

ShowWindow
EndPaint
GetClientRect
GetWindowRect
PostMessageW
RedrawWindow
SetWindowPos
GetMessageW
RegisterClassExW
MessageBoxA
DispatchMessageW
BeginPaint
PostQuitMessage
FillRect
TranslateMessage
SendMessageA
UpdateWindow
DefWindowProcW
CreateWindowExW
DrawTextW
LoadIconW
GetSystemMetrics

gdi32

SetTextColor
DeleteObject
SetBkMode
CreateSolidBrush

advapi32

CryptGetHashParam
CryptReleaseContext
CryptCreateHash
CryptImportKey
CryptHashData
CryptGenRandom
CryptAcquireContextA
CryptDestroyHash
CryptEncrypt
CryptDestroyKey
CloseServiceHandle

crypt32

CertCreateCertificateChainEngine
CertFindExtension
CertFreeCertificateContext
CertFreeCertificateChainEngine
CertFindCertificateInStore
CertFreeCertificateChain
PFXImportCertStore
CryptDecodeObjectEx
CertEnumCertificatesInStore
CertOpenStore
CertAddCertificateContextToStore
CryptQueryObject
CryptStringToBinaryA
CertCloseStore
CertGetCertificateChain

wldap32

ord46
ord41
ord27
ord301
ord33
ord79
ord35
ord32
ord200
ord30
ord45
ord60
ord22
ord211
ord26
ord143
ord50
ord217

ws2_32

closesocket
send
WSAGetLastError
WSACleanup
WSAStartup
recv
ntohs
getsockname
getpeername
WSASetLastError
getsockopt
setsockopt
connect
WSAIoctl
bind
htons
socket
inet_ntoa
htonl
gethostbyname
inet_addr
getservbyname
gethostbyaddr
getservbyport
accept
sendto
recvfrom
select
__WSAFDIsSet
ioctlsocket
gethostname
ntohl
listen

Sections

.text
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 204KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac93743ca80c320d4c30b7fd1c9d511f

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

crypt32

wldap32

ws2_32

Sections

.text Size: 4.6MB - Virtual size: 4.6MB

.rdata Size: 204KB - Virtual size: 200KB

.data Size: 56KB - Virtual size: 75KB

.rsrc Size: 72KB - Virtual size: 68KB

.reloc Size: 52KB - Virtual size: 49KB

.text
Size: 4.6MB - Virtual size: 4.6MB

.rdata
Size: 204KB - Virtual size: 200KB

.data
Size: 56KB - Virtual size: 75KB

.rsrc
Size: 72KB - Virtual size: 68KB

.reloc
Size: 52KB - Virtual size: 49KB