92549f18380c71db151008189d94ce3c911ea3ae5aea5bdc00e6493b17248be4

Sharing

Copy URL

Twitter E-mail

General

Target

92549f18380c71db151008189d94ce3c911ea3ae5aea5bdc00e6493b17248be4
Size

12.8MB
MD5

3e05f85d00a0cf23bf9c979ae2daa13c
SHA1

29faf52b85bd65133a4e55e5da12597de0011f35
SHA256

92549f18380c71db151008189d94ce3c911ea3ae5aea5bdc00e6493b17248be4
SHA512

2027f96f347fbc6d92ba6e4245a7de7fc2135e025a9b4f04fd6ee12a78ad564a4b54a41675d19b85f5b12c60eb96d299336c50b4767e8da02172718bb9092d24
SSDEEP

196608:QAVy+anm3I+SR+FdKyzqgR5WmJDaiLojDIg9Cbk/V87eRo+TESbeRoR9iZDKo:dham3IRR+LUy7DaBD9PTQAi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
92549f18380c71db151008189d94ce3c911ea3ae5aea5bdc00e6493b17248be4

Files

92549f18380c71db151008189d94ce3c911ea3ae5aea5bdc00e6493b17248be4
.exe windows:5 windows x86 arch:x86

fb17b233dcba34b489f9ccd7dfe62c49

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetLocalTime
SystemTimeToFileTime
GetTempPathA
GetDiskFreeSpaceA
GetACP
GetThreadLocale
IsBadReadPtr
GetComputerNameA
IsValidLocale
GetSystemDirectoryA
GetWindowsDirectoryA
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoA
SetStdHandle
GetConsoleCP
HeapSize
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
IsValidCodePage
GetOEMCP
HeapReAlloc
VirtualAlloc
LCMapStringW
LCMapStringA
GetSystemInfo
SetLastError
GetExitCodeThread
DuplicateHandle
GetProcessHeap
HeapAlloc
TerminateProcess
HeapFree
GetModuleHandleA
GetModuleFileNameA
VirtualQuery
GetCurrentThreadId
GetCPInfo
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleHandleW
VirtualFree
HeapDestroy
HeapCreate
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
LockFile
UnlockFile
IsBadStringPtrW
IsBadStringPtrA
VirtualProtect
FlushInstructionCache
GetLogicalDrives
GetDriveTypeA
DeviceIoControl
ReleaseSemaphore
OpenSemaphoreA
CreateSemaphoreA
GetFileTime
GetFileSize
SetEndOfFile
FlushFileBuffers
SetFilePointer
ReadFile
WriteFile
GetSystemTimeAsFileTime
CreateDirectoryA
SetConsoleCtrlHandler
CreateFileA
GetCurrentDirectoryA
GetTickCount
GetCurrentProcess
GetCommandLineA
SetFileTime
GetCurrentProcessId
GetVersion
GetVersionExA
WaitForMultipleObjects
SetEvent
CreateEventA
MultiByteToWideChar
WideCharToMultiByte
TlsSetValue
LocalAlloc
LocalFree
TlsGetValue
TlsFree
ExitProcess
TlsAlloc
GetFileAttributesA
GetFullPathNameA
SetCurrentDirectoryA
FileTimeToSystemTime
GetTimeZoneInformation
GetSystemTime
CloseHandle
UnmapViewOfFile
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
Sleep
WaitForSingleObject
GetCurrentThread
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetLastError
GetPrivateProfileSectionA
WritePrivateProfileSectionA
AreFileApisANSI
LoadLibraryA
GetEnvironmentVariableA
FreeLibrary
GetProcAddress
OpenProcess
GetExitCodeProcess
GetProfileStringA
DeleteFileA
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetConsoleMode
IsBadWritePtr
OpenEventA

user32

GetSystemMenu
CharLowerBuffA
AppendMenuA
GetSystemMetrics
MessageBoxA
PeekMessageA
CallMsgFilterA
TranslateMessage
DispatchMessageA
DrawMenuBar
CharUpperBuffA
wsprintfA
LoadStringA

advapi32

RegOpenKeyExA
SetSecurityDescriptorDacl
OpenSCManagerA
OpenServiceA
StartServiceA
CloseServiceHandle
RegDeleteValueA
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
GetUserNameA
RegEnumValueA
RegEnumKeyExA
RegDeleteKeyA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegFlushKey
RegCloseKey

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

shell32

ShellExecuteExA

wsock32

getpeername
accept
WSAStartup
WSACleanup
__WSAFDIsSet
select
gethostname
gethostbyaddr
htons
inet_addr
gethostbyname
WSAGetLastError
ioctlsocket
connect
inet_ntoa
setsockopt
socket
listen
closesocket
shutdown
send
getsockopt
recv
recvfrom
sendto
bind

Exports

Exports

?Commit@CDlgPatternWeave@@IAEXXZ
?UpdateStatList@CDlgShuttleStat@@IAEXXZ

Sections

__wibu00
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

__wibu01
Size: 755KB - Virtual size: 755KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

__wibu02
Size: 62KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6.2MB - Virtual size: 6.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

__wibu03
Size: 379KB - Virtual size: 379KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

__wibu04
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

__wibu05
Size: 53KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fb17b233dcba34b489f9ccd7dfe62c49

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

version

shell32

wsock32

Exports

Exports

Sections

__wibu00 Size: 4.1MB - Virtual size: 4.1MB

__wibu01 Size: 755KB - Virtual size: 755KB

__wibu02 Size: 62KB - Virtual size: 100KB

.rsrc Size: 6.2MB - Virtual size: 6.2MB

__wibu03 Size: 379KB - Virtual size: 379KB

__wibu04 Size: 1.2MB - Virtual size: 1.2MB

__wibu05 Size: 53KB - Virtual size: 56KB

__wibu00
Size: 4.1MB - Virtual size: 4.1MB

__wibu01
Size: 755KB - Virtual size: 755KB

__wibu02
Size: 62KB - Virtual size: 100KB

.rsrc
Size: 6.2MB - Virtual size: 6.2MB

__wibu03
Size: 379KB - Virtual size: 379KB

__wibu04
Size: 1.2MB - Virtual size: 1.2MB

__wibu05
Size: 53KB - Virtual size: 56KB