d2081fd5c76bc5bd0fd00c44382b62ddf1ed24a245efa552e1022e265a985dc5

Sharing

Copy URL Twitter E-mail

General

Target

d2081fd5c76bc5bd0fd00c44382b62ddf1ed24a245efa552e1022e265a985dc5
Size

1.6MB
MD5

74bfa3e7809ee6c9e18de3caa13d9042
SHA1

942d8bede77a3434a60575f498cb54212390ba11
SHA256

d2081fd5c76bc5bd0fd00c44382b62ddf1ed24a245efa552e1022e265a985dc5
SHA512

38d52d5946afbacfab8c399520a87f655cf0411d96a2d64ed260a350d8f3e179a55fbc3171493fd3bdff38b175de0b6a851827eba52ffaeb4d1b98a63b8ed989
SSDEEP

24576:n/LLlxX1LzseOSw1vsqjnhMgeiCl7G0nehbGZpbD:/L1GpDmg27RnWGj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d2081fd5c76bc5bd0fd00c44382b62ddf1ed24a245efa552e1022e265a985dc5

Files

d2081fd5c76bc5bd0fd00c44382b62ddf1ed24a245efa552e1022e265a985dc5
.exe windows:5 windows x86 arch:x86

bccdaa9888134cf1ca42259ef1662433

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\BUILD_442000\BUILD\SYSCore\release\mfehidin.pdb

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

setupapi

SetupCloseInfFile
SetupInstallServicesFromInfSectionW
SetupInstallFromInfSectionW
SetupOpenInfFileW
SetupInitDefaultQueueCallbackEx
SetupFindNextLine
SetupCopyOEMInfW
SetupDefaultQueueCallbackW
SetupFindFirstLineW
SetupGetStringFieldW

cabinet

ord23
ord20
ord22

kernel32

InterlockedIncrement
InterlockedDecrement
SetErrorMode
GetStdHandle
SetEndOfFile
CreateDirectoryW
GetCurrentDirectoryW
MoveFileW
CopyFileExW
GetTickCount
TerminateProcess
GetSystemInfo
GetVersionExA
InterlockedCompareExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TlsAlloc
TlsSetValue
TlsGetValue
DebugBreak
InitializeCriticalSectionAndSpinCount
GetFileAttributesExW
GetSystemWindowsDirectoryW
QueryDosDeviceW
GetLogicalDriveStringsW
GetCurrentDirectoryA
VirtualProtect
IsBadReadPtr
HeapAlloc
HeapFree
RtlUnwind
DeleteFileA
HeapReAlloc
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
GetModuleHandleA
ExitProcess
GetModuleFileNameA
GetProcessHeap
TlsFree
HeapSize
GetCPInfo
GetACP
GetOEMCP
GetTimeZoneInformation
LCMapStringA
MultiByteToWideChar
SetLastError
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
VirtualQuery
FlushFileBuffers
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetTempPathA
GetTempFileNameA
GetFileAttributesExA
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetModuleHandleW
GetWindowsDirectoryW
ReadFile
GetEnvironmentVariableW
GetLocalTime
GetCurrentThreadId
FindFirstFileW
RemoveDirectoryW
FindClose
DeleteFileW
FindNextFileW
GetSystemDirectoryW
GetModuleFileNameW
Sleep
CreateProcessW
WaitForSingleObject
GetSystemTimeAsFileTime
GetShortPathNameW
MoveFileExW
GetFileAttributesW
SetFileAttributesW
LoadLibraryA
WideCharToMultiByte
GetFullPathNameA
DeviceIoControl
CloseHandle
CreateFileW
GetLastError
LoadLibraryW
GetProcAddress
FreeLibrary
LocalAlloc
LocalFree
SetConsoleCtrlHandler
GetCurrentProcess
GetExitCodeProcess
SetCurrentDirectoryW
GetFullPathNameW
CreateMutexW
LoadLibraryExW
GetVersionExW
CreateDirectoryA
SetFilePointer
WriteFile
LCMapStringW
CreateFileA
GetVersion
OutputDebugStringA

advapi32

CryptReleaseContext
GetExplicitEntriesFromAclW
IsValidSid
EqualSid
LookupPrivilegeValueW
AdjustTokenPrivileges
BuildTrusteeWithSidW
SetEntriesInAclW
FreeSid
AllocateAndInitializeSid
RegEnumValueW
CryptAcquireContextW
CryptGetProvParam
RegSetValueExW
RegCreateKeyExW
OpenProcessToken
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegQueryValueExW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
ControlService
QueryServiceStatus
StartServiceW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyW
RegSetValueW
RegOpenKeyW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
ChangeServiceConfig2W
CreateServiceW
OpenSCManagerW
OpenServiceW
ChangeServiceConfigW
CloseServiceHandle
StartTraceW
EnableTrace
ControlTraceW
TraceEvent
GetSecurityDescriptorDacl

shell32

SHGetFolderPathW

shlwapi

SHGetValueW
SHSetValueW
wnsprintfW
SHDeleteKeyW

ole32

CoInitialize
CoCreateInstance

oleaut32

VariantInit
SysStringLen
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysAllocStringLen

crypt32

CertOpenStore
CertFindCertificateInStore
CertVerifySubjectCertificateContext
CryptAcquireCertificatePrivateKey
CertGetCertificateChain
CryptSignMessage
CertFreeCertificateChain
CertFreeCertificateContext
CertCloseStore
CryptVerifyDetachedMessageSignature

sfc

SfcIsFileProtected

Sections

.text
Size: 313KB - Virtual size: 312KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bldvar
Size: 512B - Virtual size: 19B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bccdaa9888134cf1ca42259ef1662433

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

setupapi

cabinet

kernel32

advapi32

shell32

shlwapi

ole32

oleaut32

crypt32

sfc

Sections

.text Size: 313KB - Virtual size: 312KB

.rdata Size: 82KB - Virtual size: 82KB

.data Size: 49KB - Virtual size: 58KB

.bldvar Size: 512B - Virtual size: 19B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1.2MB - Virtual size: 1.8MB

.text
Size: 313KB - Virtual size: 312KB

.rdata
Size: 82KB - Virtual size: 82KB

.data
Size: 49KB - Virtual size: 58KB

.bldvar
Size: 512B - Virtual size: 19B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1.2MB - Virtual size: 1.8MB