cef13b63ee3fdd083b7fe0eee8939c3f4a6753fa61b811e3d7591461656bb65a

Sharing

Copy URL Twitter E-mail

General

Target

cef13b63ee3fdd083b7fe0eee8939c3f4a6753fa61b811e3d7591461656bb65a
Size

1.7MB
MD5

ca66c18569e0f9f3ce0eccef3971a12a
SHA1

34ae2d597cc3ada5a0acae74f9a43c6d19b4f5e9
SHA256

cef13b63ee3fdd083b7fe0eee8939c3f4a6753fa61b811e3d7591461656bb65a
SHA512

23bd0b027c0ca139907b47e1067684f50c5e3dfd9d2c599f2e0262b8c332fba53d0bac702e57dfd06d81db2934160d61bd2155764038a7cc428b2bab1ebe2833
SSDEEP

24576:0EE3XxfnDZoZO/wYcUPJK8yN/7Jg5yYUmXy5PSFESef:0EEZDZoZO/wYcUPJgNDJg58mXy5P9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cef13b63ee3fdd083b7fe0eee8939c3f4a6753fa61b811e3d7591461656bb65a

Files

cef13b63ee3fdd083b7fe0eee8939c3f4a6753fa61b811e3d7591461656bb65a
.exe windows:5 windows x86 arch:x86

07124dd05504cd8d18cc917fd65465e1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

user32

GetWindowRect
GetWindow
GetWindowThreadProcessId
EnumThreadWindows
InternalGetWindowText
GetForegroundWindow
GetLastInputInfo
GetDesktopWindow

ole32

CoTaskMemFree
CoCreateInstance
CoInitializeEx

oleaut32

SysAllocStringLen
SysFreeString

kernel32

MultiByteToWideChar
WideCharToMultiByte
OpenProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStdHandle
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindClose
GetFileAttributesW
GetFileAttributesExW
GetFileSize
GetFullPathNameW
GetLongPathNameW
SetFileTime
WriteFile
GetTempPathW
MoveFileExW
SetFilePointer
GetLogicalDriveStringsW
QueryDosDeviceW
CreateProcessW
GetLocalTime
GetSystemDirectoryW
GetWindowsDirectoryW
GetVersionExW
UnmapViewOfFile
FreeLibrary
GetModuleFileNameW
LocalAlloc
LoadLibraryA
GetSystemWow64DirectoryW
GetVolumeInformationA
FileTimeToSystemTime
SystemTimeToFileTime
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Thread32First
Thread32Next
Module32FirstW
CreateEventA
LocalFree
VirtualAlloc
VirtualFree
GetLocaleInfoW
CreateFileW
ReadFile
GetEnvironmentVariableW
GetCommandLineW
CreateMutexW
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapSize
SetStdHandle
WaitForSingleObjectEx
LCMapStringW
GetFileType
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
HeapFree
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
HeapReAlloc
HeapAlloc
MapViewOfFile
GetTickCount
DuplicateHandle
CloseHandle
Sleep
WaitForSingleObject
ReleaseMutex
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
ExitProcess
GetCurrentProcess
GetProcAddress
GetModuleHandleA
GetCPInfo
OutputDebugStringW
RtlUnwind
SetEvent
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameA
GetACP
GetNativeSystemInfo
ResetEvent
TlsAlloc
CreateEventW
SetLastError
LeaveCriticalSection
EnterCriticalSection
GetStringTypeW

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

ws2_32

getaddrinfo
WSAEventSelect
WSAStartup
gethostname
gethostbyname
socket
shutdown
send
freeaddrinfo
recv
htonl
ntohl
listen
inet_addr
htons
getpeername
connect
closesocket
bind
accept
WSAGetLastError
select
ntohs

shell32

SHGetFolderPathW

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorA
SetEntriesInAclW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegCreateKeyExW
RegCloseKey
GetUserNameW
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSecurityDescriptorSacl
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
OpenProcessToken
CryptGenRandom
CryptAcquireContextW

Sections

.text
Size: 633KB - Virtual size: 632KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 960KB - Virtual size: 966KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

07124dd05504cd8d18cc917fd65465e1

Headers

DLL Characteristics

File Characteristics

Imports

user32

ole32

oleaut32

kernel32

iphlpapi

version

ws2_32

shell32

advapi32

Sections

.text Size: 633KB - Virtual size: 632KB

.rdata Size: 125KB - Virtual size: 124KB

.data Size: 960KB - Virtual size: 966KB

.reloc Size: 29KB - Virtual size: 29KB

.text
Size: 633KB - Virtual size: 632KB

.rdata
Size: 125KB - Virtual size: 124KB

.data
Size: 960KB - Virtual size: 966KB

.reloc
Size: 29KB - Virtual size: 29KB