f9ebc61b854288886938746223e55d5a5b7887164ae329fe368eb2e7a17b3416

Sharing

Copy URL Twitter E-mail

General

Target

f9ebc61b854288886938746223e55d5a5b7887164ae329fe368eb2e7a17b3416
Size

17.6MB
MD5

429143f0073fcfe14e0bd4e578822df4
SHA1

ba5ec3c91f2142840a28bfcdffdddf238b2c1ccc
SHA256

f9ebc61b854288886938746223e55d5a5b7887164ae329fe368eb2e7a17b3416
SHA512

c28fb8343d9fbea29f53679a5644821b1a6ac329556b4aeb1024885372a7ef47da936f0d8d893ba17bb5c45be4be958d89d47d44f3a2338bb6bb1827a0b77751
SSDEEP

196608:XND4obisKzgKUK85HRn/fb3mw+v1NTKzsaFTXaSBWHi/MS0p6b831MgMFmDjuqBs:X9NKUKeR/j3C3qpXa2oS0cCMgAysM4QA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/App_02029.exe

Files

f9ebc61b854288886938746223e55d5a5b7887164ae329fe368eb2e7a17b3416
.zip
App_02029.exe
.exe windows:4 windows x86 arch:x86

ac93743ca80c320d4c30b7fd1c9d511f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsAlloc
GetCommandLineW
GetVersionExA
GetProcAddress
GetStringTypeW
GetDriveTypeA
LoadLibraryA
QueryPerformanceFrequency
FreeEnvironmentStringsW
LCMapStringA
FileTimeToSystemTime
HeapAlloc
GetCurrentProcess
InitializeCriticalSection
MoveFileW
MultiByteToWideChar
GetModuleFileNameA
CompareStringW
GetFullPathNameA
CreateThread
ExitThread
GetACP
HeapDestroy
SetEndOfFile
GetProcessHeap
SetStdHandle
WaitForSingleObject
GetTimeZoneInformation
LeaveCriticalSection
HeapReAlloc
GetCurrentThread
FlushFileBuffers
PeekNamedPipe
SleepEx
MoveFileExA
WaitForMultipleObjects
TerminateProcess
FindClose
VirtualAlloc
ReadFile
SetEnvironmentVariableA
GetSystemDirectoryA
GetEnvironmentStringsW
GetLastError
SetFilePointer
GetStringTypeA
FreeLibrary
DeleteFileA
UnhandledExceptionFilter
GetEnvironmentVariableA
HeapFree
GetCommandLineA
GetModuleHandleA
RtlUnwind
GetVersion
ExitProcess
InterlockedDecrement
HeapCreate
GetLocalTime
GetStartupInfoA
GetEnvironmentStrings
FreeEnvironmentStringsA
VirtualFree
GetCPInfo
DeleteCriticalSection
FileTimeToLocalFileTime
GetSystemTime
FindFirstFileA
SetHandleCount
EnterCriticalSection
InterlockedIncrement
GetStdHandle
GetTickCount
GetModuleHandleW
CreateFileA
GetModuleFileNameW
FormatMessageA
Sleep
WideCharToMultiByte
GetFileAttributesA
WriteFile
GetFileSizeEx
GetCurrentProcessId
LCMapStringW
TlsGetValue
SetLastError
GetFileSize
CloseHandle
TlsSetValue
GetCurrentDirectoryA
GetCurrentThreadId
GetOEMCP
CompareStringA
GetStartupInfoW
GetFileInformationByHandle
QueryPerformanceCounter
GetFileType

user32

ShowWindow
EndPaint
GetClientRect
GetWindowRect
PostMessageW
RedrawWindow
SetWindowPos
GetMessageW
RegisterClassExW
MessageBoxA
DispatchMessageW
BeginPaint
PostQuitMessage
FillRect
TranslateMessage
SendMessageA
UpdateWindow
DefWindowProcW
CreateWindowExW
DrawTextW
LoadIconW
GetSystemMetrics

gdi32

SetTextColor
DeleteObject
SetBkMode
CreateSolidBrush

advapi32

CryptGetHashParam
CryptReleaseContext
CryptCreateHash
CryptImportKey
CryptHashData
CryptGenRandom
CryptAcquireContextA
CryptDestroyHash
CryptEncrypt
CryptDestroyKey
CloseServiceHandle

crypt32

CertCreateCertificateChainEngine
CertFindExtension
CertFreeCertificateContext
CertFreeCertificateChainEngine
CertFindCertificateInStore
CertFreeCertificateChain
PFXImportCertStore
CryptDecodeObjectEx
CertEnumCertificatesInStore
CertOpenStore
CertAddCertificateContextToStore
CryptQueryObject
CryptStringToBinaryA
CertCloseStore
CertGetCertificateChain

wldap32

ord46
ord41
ord27
ord301
ord33
ord79
ord35
ord32
ord200
ord30
ord45
ord60
ord22
ord211
ord26
ord143
ord50
ord217

ws2_32

closesocket
send
WSAGetLastError
WSACleanup
WSAStartup
recv
ntohs
getsockname
getpeername
WSASetLastError
getsockopt
setsockopt
connect
WSAIoctl
bind
htons
socket
inet_ntoa
htonl
gethostbyname
inet_addr
getservbyname
gethostbyaddr
getservbyport
accept
sendto
recvfrom
select
__WSAFDIsSet
ioctlsocket
gethostname
ntohl
listen

Sections

.text
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 204KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac93743ca80c320d4c30b7fd1c9d511f

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

crypt32

wldap32

ws2_32

Sections

.text Size: 4.6MB - Virtual size: 4.6MB

.rdata Size: 204KB - Virtual size: 200KB

.data Size: 56KB - Virtual size: 75KB

.rsrc Size: 72KB - Virtual size: 68KB

.reloc Size: 52KB - Virtual size: 49KB

.text
Size: 4.6MB - Virtual size: 4.6MB

.rdata
Size: 204KB - Virtual size: 200KB

.data
Size: 56KB - Virtual size: 75KB

.rsrc
Size: 72KB - Virtual size: 68KB

.reloc
Size: 52KB - Virtual size: 49KB