a9192849509af172296606d4e36f50d21527639c4c4fb5a3172e33dcf59e6d26

Sharing

Copy URL Twitter E-mail

General

Target

a9192849509af172296606d4e36f50d21527639c4c4fb5a3172e33dcf59e6d26
Size

72KB
MD5

92884e7925ef46eed16dcfdc5bb476a9
SHA1

23a89ea53ad63b40983a82fe77c28f00d2ca7e83
SHA256

a9192849509af172296606d4e36f50d21527639c4c4fb5a3172e33dcf59e6d26
SHA512

1b4d7a909999c9cc1c95b0aad3a246b7b211d550dbb911a6237386e8747bb987c43d862852acf903c450f2eeba70bedc4f2c163b173bc8b0d48493b92f4113b5
SSDEEP

1536:xTmYWZDMNzMhlrMOFqX6SEJt4z2WeJHlmv1:xT8ighlE04teJF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a9192849509af172296606d4e36f50d21527639c4c4fb5a3172e33dcf59e6d26

Files

a9192849509af172296606d4e36f50d21527639c4c4fb5a3172e33dcf59e6d26
.exe windows:4 windows x86 arch:x86

8764449d7ad1e179e418f999868f9ee9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
MapViewOfFile
OpenFileMappingA
GetCurrentProcessId
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetFullPathNameA
GetVersion
CreateProcessW
lstrcatW
lstrcpyW
lstrlenW
CreateFileW
GetSystemDirectoryW
GetVersionExA
ReleaseMutex
CreateMutexA
GlobalAddAtomA
CreateEventA
CreateFileMappingA
GlobalDeleteAtom
GlobalFindAtomA
SetLastError
WideCharToMultiByte
FindFirstFileW
LocalFree
FormatMessageA
UnmapViewOfFile
GetModuleFileNameW
lstrcmpW
OpenProcess
Process32Next
ProcessIdToSessionId
Process32First
CreateToolhelp32Snapshot
TerminateThread
GetExitCodeThread
ExpandEnvironmentStringsW
GetShortPathNameA
SearchPathA
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
lstrcpyA
GetSystemDirectoryA
MulDiv

user32

MsgWaitForMultipleObjects
TranslateMessage
FindWindowA
CharLowerW
PeekMessageA
DispatchMessageA
CharPrevA
MessageBoxIndirectA
GetDlgItemTextA
SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
TrackPopupMenu
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcA
LoadBitmapA
GetMessagePos
CheckDlgButton
LoadCursorA
SetCursor
GetWindowLongA
GetSysColor
SetWindowPos
IsWindowEnabled
SetClassLongA
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
RegisterClassA
SystemParametersInfoA
CreateWindowExA
EndPaint
DrawTextA
FillRect
GetClientRect
BeginPaint
DefWindowProcA
EndDialog
SendMessageA
InvalidateRect
EnableWindow
GetDC
LoadImageA
SetWindowLongA
GetDlgItem
IsWindow
FindWindowExA
SendMessageTimeoutA
wsprintfA
ShowWindow
SetForegroundWindow
PostQuitMessage
SetWindowTextA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHFileOperationA
SHGetFileInfoA
ShellExecuteW
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetFolderPathW
ShellExecuteA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExW
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
OpenProcessToken
DuplicateTokenEx
RegDeleteValueW
RegOpenKeyExW
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey

comctl32

ImageList_Destroy
ImageList_AddMasked
ImageList_Create
ord17

ole32

CLSIDFromProgID
StringFromCLSID
CoInitializeEx
CoSetProxyBlanket
CoUninitialize
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
CoInitializeSecurity

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

wininet

InternetOpenUrlA
InternetReadFile
InternetOpenA
DeleteUrlCacheEntry
HttpQueryInfoA
InternetCloseHandle

msvcrt

free
memset
rand
srand
malloc
realloc
_except_handler3
memcmp
strrchr
strlen
strstr
strcat
strcpy
rename
remove
fclose
fwrite
strncmp
fgets
strcmp
strncpy
fopen
memcpy

oleaut32

VariantClear
VariantInit

shlwapi

PathAppendW

Sections

.text
Size: 49KB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 4.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 4.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data
.rdata
.rsrc/DIALOG/102
.rsrc/DIALOG/105
.rsrc/DIALOG/106
.rsrc/DIALOG/107
.rsrc/DIALOG/111
.rsrc/GROUP_ICON/103
.rsrc/ICON/1.ico
.rsrc/ICON/2.ico
.rsrc/ICON/3.ico
.rsrc/MANIFEST/1
.xml
.text

Sharing

General

Malware Config

Signatures

Files

8764449d7ad1e179e418f999868f9ee9

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

wininet

msvcrt

oleaut32

shlwapi

Sections

.text Size: 49KB - Virtual size: 4.0MB

.rdata Size: 7KB - Virtual size: 4.1MB

.data Size: 4KB - Virtual size: 4.1MB

.ndata Size: - Virtual size: 4.2MB

.rsrc Size: 10KB - Virtual size: 4.3MB

.text
Size: 49KB - Virtual size: 4.0MB

.rdata
Size: 7KB - Virtual size: 4.1MB

.data
Size: 4KB - Virtual size: 4.1MB

.ndata
Size: - Virtual size: 4.2MB

.rsrc
Size: 10KB - Virtual size: 4.3MB