c491a369e08aa8a76503b0284a24a5373a03030f88a00d80a7ec5a068f961f97

Sharing

Copy URL

Twitter E-mail

General

Target

c491a369e08aa8a76503b0284a24a5373a03030f88a00d80a7ec5a068f961f97
Size

612KB
MD5

e89ce3d7d26acb9cfd1a37855e2ca6ab
SHA1

6056dc7845aa35d0d4c421c9d85f0e4c3a2199f9
SHA256

c491a369e08aa8a76503b0284a24a5373a03030f88a00d80a7ec5a068f961f97
SHA512

75b85be2dcac7e8713853c3676b0f7ed989451b5de23b26f508ef8078a82f2488c1902a043809ed1f9b47e0846734c1f8829e071310fb09cc2e7025bfedd1a68
SSDEEP

6144:/7iY41Di6dCg/yAhdlThcRUenYWrhIswyHEde3gV+E4w7KYQJg3rQfAzGNW:/7dJJg/yGlEXkyHEde3gV+/w7KUG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c491a369e08aa8a76503b0284a24a5373a03030f88a00d80a7ec5a068f961f97

Files

c491a369e08aa8a76503b0284a24a5373a03030f88a00d80a7ec5a068f961f97
.exe windows:4 windows x86 arch:x86

633b52ad650e718663ff725f7600138b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

htons
setsockopt
WSAGetLastError
bind
listen
closesocket
getsockname
ntohs
gethostname
getpeername
send
inet_ntoa
htonl
gethostbyname
socket
shutdown
recv
__WSAFDIsSet
select
accept

winmm

sndPlaySoundA
waveOutUnprepareHeader
waveOutOpen
waveOutGetDevCapsA
waveOutGetNumDevs
waveOutClose
waveOutReset
waveOutWrite
waveOutPrepareHeader

mfc42

ord5789
ord5794
ord5678
ord5736
ord5579
ord5571
ord6061
ord5864
ord3596
ord640
ord6194
ord1640
ord323
ord2405
ord5785
ord2864
ord1175
ord2096
ord2408
ord5860
ord807
ord2920
ord2012
ord3289
ord4163
ord2120
ord554
ord1644
ord2919
ord939
ord940
ord941
ord5787
ord4133
ord4297
ord537
ord536
ord2452
ord2753
ord1195
ord5440
ord6383
ord5450
ord6394
ord3584
ord3721
ord795
ord543
ord803
ord4284
ord6199
ord2379
ord3089
ord2652
ord1669
ord2515
ord355
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord2621
ord1247
ord1134
ord2725
ord755
ord470
ord6270
ord4774
ord2122
ord3996
ord2862
ord3998
ord2820
ord3811
ord6907
ord6215
ord3874
ord3876
ord6877
ord4275
ord2363
ord2301
ord6007
ord6888
ord3301
ord3286
ord6675
ord5981
ord3092
ord5651
ord5873
ord3616
ord665
ord5442
ord3318
ord5186
ord350
ord354
ord2642
ord4224
ord6008
ord4000
ord4125
ord3303
ord5710
ord922
ord3287
ord1200
ord809
ord556
ord1088
ord2860
ord3797
ord2754
ord6358
ord6880
ord6605
ord926
ord2297
ord1979
ord2450
ord6157
ord1842
ord4242
ord2723
ord2390
ord3059
ord5100
ord5103
ord4467
ord4303
ord3350
ord5012
ord975
ord5472
ord3403
ord2879
ord2878
ord4151
ord4077
ord5237
ord5282
ord2649
ord1665
ord4436
ord5252
ord4427
ord366
ord674
ord4457
ord4499
ord1871
ord2092
ord5484
ord1949
ord818
ord5148
ord6128
ord3752
ord4694
ord1795
ord2575
ord4396
ord609
ord613
ord289
ord5781
ord3706
ord2411
ord2023
ord4218
ord2578
ord4398
ord3582
ord616
ord4123
ord2841
ord1997
ord913
ord2107
ord398
ord4278
ord5465
ord798
ord5194
ord533
ord3790
ord3439
ord6407
ord700
ord4189
ord3711
ord783
ord4299
ord3742
ord2112
ord6442
ord1233
ord4287
ord3138
ord2243
ord1576
ord2455
ord2580
ord4400
ord3630
ord682
ord3920
ord1176
ord3643
ord394
ord696
ord909
ord5628
ord4185
ord6876
ord3732
ord4270
ord3574
ord3370
ord2582
ord4402
ord3640
ord693
ord4243
ord6242
ord6696
ord3733
ord810
ord4271
ord3297
ord3914
ord6172
ord6021
ord6189
ord4330
ord6186
ord5756
ord6192
ord5759
ord2971
ord3619
ord1641
ord2614
ord5788
ord2567
ord2414
ord5683
ord4277
ord2763
ord4129
ord5875
ord3626
ord3693
ord3573
ord3571
ord2859
ord5606
ord2863
ord4083
ord6142
ord823
ord2438
ord3663
ord3654
ord2584
ord4220
ord1862
ord500
ord3701
ord772
ord1574
ord1099
ord686
ord384
ord4160
ord6779
ord6453
ord6334
ord3317
ord2818
ord2915
ord2764
ord5572
ord6197
ord924
ord858
ord535
ord4710
ord4234
ord2302
ord2370
ord825
ord324
ord567
ord540
ord860
ord1168
ord1146
ord641
ord656
ord800
ord3597
ord4425
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5280
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1775
ord4078
ord6052
ord2514
ord4998
ord4853
ord4376
ord5265
ord3610
ord4424
ord3402
ord5290
ord1776
ord6055
ord3127
ord2713

msvcrt

__p__commode
__p__fmode
__set_app_type
_controlfp
_setmbcp
__CxxFrameHandler
_mbsnbcpy
free
malloc
wcscpy
wcslen
_ftol
memmove
_mbscmp
vsprintf
sprintf
??0exception@@QAE@ABV0@@Z
_CxxThrowException
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
strstr
_mbsstr
fclose
fwrite
fseek
fopen
atoi
fread
_endthreadex
_purecall
_beginthreadex
strchr
_ismbcdigit
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler3
?terminate@@YAXXZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv

kernel32

MulDiv
SizeofResource
GlobalAlloc
GlobalLock
GlobalUnlock
GetTickCount
Sleep
CreateMutexA
CloseHandle
LeaveCriticalSection
EnterCriticalSection
GetLastError
DeleteCriticalSection
InitializeCriticalSection
lstrcmpiA
FindResourceA
LoadResource
LockResource
GetCPInfo
lstrlenW
lstrlenA
GetVersion
GetVersionExA
HeapCreate
HeapAlloc
HeapFree
HeapDestroy
lstrcmpA
GetModuleHandleA
GetStartupInfoA
GetFileSize
CreateFileA
lstrcpyA
LoadLibraryA
GetWindowsDirectoryA
WinExec
lstrcatA
GetModuleFileNameA
GetProcessHeap
GetPrivateProfileIntA
GetPrivateProfileStringA
GetCurrentProcess
ResumeThread
GetShortPathNameA
InterlockedDecrement
WaitForSingleObject
SetEvent
InterlockedExchange
CreateEventA
GetFileAttributesA
CreateDirectoryA
FreeLibrary

user32

ShowWindow
GetSystemMenu
GetWindowTextA
DrawStateA
DrawFocusRect
LoadMenuA
SetMenuDefaultItem
SetForegroundWindow
RegisterWindowMessageA
LoadCursorA
CopyIcon
GetWindowRect
GetParent
InflateRect
SetCursor
GetMessagePos
ScreenToClient
PtInRect
InvalidateRect
MessageBeep
SetWindowLongA
SetWindowTextA
PostMessageA
KillTimer
SetTimer
LoadImageA
IsWindowVisible
IsMenu
GetCursorPos
EnableMenuItem
IsIconic
DrawIcon
MoveWindow
IsWindow
FindWindowA
SendMessageTimeoutA
GetClientRect
GetSubMenu
GrayStringA
TabbedTextOutA
LoadBitmapA
GetSysColorBrush
GetMenuStringA
CreateMenu
CreatePopupMenu
GetMenuItemID
GetMenuState
ModifyMenuA
MessageBoxA
EnableWindow
SetRect
GetSystemMetrics
GetMenuItemInfoA
DrawEdge
FillRect
CopyRect
GetSysColor
SystemParametersInfoA
DestroyIcon
DrawIconEx
ReleaseDC
DrawTextA
GetDC
GetDesktopWindow
AppendMenuA
GetMenuItemCount
LoadIconA
GetWindowDC
CopyImage
SetWindowPos
GetWindow
CallWindowProcA
GetScrollInfo
SetParent
OffsetRect
IsRectEmpty
SetCapture
UpdateWindow
ReleaseCapture
SetWindowRgn
GetWindowRgn
GetFocus
FindWindowExA
GetWindowLongA
SendMessageA

gdi32

RoundRect
CreateFontA
PtInRegion
CreateRectRgn
SelectClipRgn
CreateDIBitmap
CreateDCA
CreateICA
ExtCreateRegion
StretchBlt
SelectPalette
RealizePalette
CreateBitmap
GetStockObject
StretchDIBits
Rectangle
Escape
ExtTextOutA
TextOutA
PatBlt
RectVisible
PtVisible
GetPixel
SetPixel
CreateDIBSection
SelectObject
BitBlt
Ellipse
GetTextExtentPoint32A
GetTextExtentPoint32W
CreateCompatibleBitmap
CreateFontIndirectA
CreatePen
GetBkMode
GetDeviceCaps
GetDIBits
GetObjectA
CreateCompatibleDC
CombineRgn
DeleteDC
DeleteObject
CreateSolidBrush

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegQueryValueExA

shell32

SHBrowseForFolderA
SHGetMalloc
SHGetPathFromIDListA
SHGetFileInfoA
ShellExecuteA
Shell_NotifyIconA

comctl32

_TrackMouseEvent
ImageList_ReplaceIcon
ImageList_AddMasked
ImageList_GetIcon
ImageList_GetImageCount
ImageList_Draw

ole32

CreateStreamOnHGlobal
CoInitialize
CoUninitialize

olepro32

ord251

msvcp60

?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
??0out_of_range@std@@QAE@ABV01@@Z
??1out_of_range@std@@UAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??0logic_error@std@@QAE@ABV01@@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0logic_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??_7out_of_range@std@@6B@

avifil32

AVIFileRelease
AVIStreamWrite
AVIFileOpenA
AVIFileCreateStreamA
AVIMakeCompressedStream
AVIStreamSetFormat
AVIStreamRelease
AVIFileInit
AVIFileExit

msvfw32

ICInfo
ICOpen
ICSendMessage
ICSeqCompressFrameStart
ICDecompress

wininet

InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle

Sections

.text
Size: 224KB - Virtual size: 223KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 324KB - Virtual size: 323KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

633b52ad650e718663ff725f7600138b

Headers

File Characteristics

Imports

ws2_32

winmm

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

olepro32

msvcp60

avifil32

msvfw32

wininet

Sections

.text Size: 224KB - Virtual size: 223KB

.rdata Size: 48KB - Virtual size: 47KB

.data Size: 12KB - Virtual size: 11KB

.rsrc Size: 324KB - Virtual size: 323KB

.text
Size: 224KB - Virtual size: 223KB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 324KB - Virtual size: 323KB