b2a74d074edcd27932123748f559eef2fd30318a1c116cfc5fbb20adce766968

Sharing

Copy URL

Twitter E-mail

General

Target

b2a74d074edcd27932123748f559eef2fd30318a1c116cfc5fbb20adce766968
Size

12.7MB
MD5

116b9fc1bbbf3a81683fb8b2d7a6cd12
SHA1

2ac8683a49eb439956a778781acdc1da6135c894
SHA256

b2a74d074edcd27932123748f559eef2fd30318a1c116cfc5fbb20adce766968
SHA512

a5711e6b7298c12701c61f0147d0accfb8ef9e521763ee065cd5508902e5e22ea03df32769e6ffde5f1e31b78ab4e7475d458de0c7df6937bba00a8e847c8fb6
SSDEEP

196608:2TeTtVuW3pg1jJI//1hYb0ojDIg9Cbk/V8OeRoxTESbeRoR9LQ6999:JIW3OxK1huXDGUTQALv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b2a74d074edcd27932123748f559eef2fd30318a1c116cfc5fbb20adce766968

Files

b2a74d074edcd27932123748f559eef2fd30318a1c116cfc5fbb20adce766968
.exe windows:5 windows x86 arch:x86

fb17b233dcba34b489f9ccd7dfe62c49

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetLocalTime
SystemTimeToFileTime
GetTempPathA
GetDiskFreeSpaceA
GetACP
GetThreadLocale
IsBadReadPtr
GetComputerNameA
IsValidLocale
GetSystemDirectoryA
GetWindowsDirectoryA
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoA
SetStdHandle
GetConsoleCP
HeapSize
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
IsValidCodePage
GetOEMCP
HeapReAlloc
VirtualAlloc
LCMapStringW
LCMapStringA
GetSystemInfo
SetLastError
GetExitCodeThread
DuplicateHandle
GetProcessHeap
HeapAlloc
TerminateProcess
HeapFree
GetModuleHandleA
GetModuleFileNameA
VirtualQuery
GetCurrentThreadId
GetCPInfo
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleHandleW
VirtualFree
HeapDestroy
HeapCreate
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
LockFile
UnlockFile
IsBadStringPtrW
IsBadStringPtrA
VirtualProtect
FlushInstructionCache
GetLogicalDrives
GetDriveTypeA
DeviceIoControl
ReleaseSemaphore
OpenSemaphoreA
CreateSemaphoreA
GetFileTime
GetFileSize
SetEndOfFile
FlushFileBuffers
SetFilePointer
ReadFile
WriteFile
GetSystemTimeAsFileTime
CreateDirectoryA
SetConsoleCtrlHandler
CreateFileA
GetCurrentDirectoryA
GetTickCount
GetCurrentProcess
GetCommandLineA
SetFileTime
GetCurrentProcessId
GetVersion
GetVersionExA
WaitForMultipleObjects
SetEvent
CreateEventA
MultiByteToWideChar
WideCharToMultiByte
TlsSetValue
LocalAlloc
LocalFree
TlsGetValue
TlsFree
ExitProcess
TlsAlloc
GetFileAttributesA
GetFullPathNameA
SetCurrentDirectoryA
FileTimeToSystemTime
GetTimeZoneInformation
GetSystemTime
CloseHandle
UnmapViewOfFile
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
Sleep
WaitForSingleObject
GetCurrentThread
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetLastError
GetPrivateProfileSectionA
WritePrivateProfileSectionA
AreFileApisANSI
LoadLibraryA
GetEnvironmentVariableA
FreeLibrary
GetProcAddress
OpenProcess
GetExitCodeProcess
GetProfileStringA
DeleteFileA
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetConsoleMode
IsBadWritePtr
OpenEventA

user32

GetSystemMenu
CharLowerBuffA
AppendMenuA
GetSystemMetrics
MessageBoxA
PeekMessageA
CallMsgFilterA
TranslateMessage
DispatchMessageA
DrawMenuBar
CharUpperBuffA
wsprintfA
LoadStringA

advapi32

RegOpenKeyExA
SetSecurityDescriptorDacl
OpenSCManagerA
OpenServiceA
StartServiceA
CloseServiceHandle
RegDeleteValueA
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
GetUserNameA
RegEnumValueA
RegEnumKeyExA
RegDeleteKeyA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegFlushKey
RegCloseKey

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

shell32

ShellExecuteExA

wsock32

getpeername
accept
WSAStartup
WSACleanup
__WSAFDIsSet
select
gethostname
gethostbyaddr
htons
inet_addr
gethostbyname
WSAGetLastError
ioctlsocket
connect
inet_ntoa
setsockopt
socket
listen
closesocket
shutdown
send
getsockopt
recv
recvfrom
sendto
bind

Exports

Exports

?Commit@CDlgPatternWeave@@IAEXXZ

Sections

__wibu00
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

__wibu01
Size: 752KB - Virtual size: 751KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

__wibu02
Size: 62KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6.2MB - Virtual size: 6.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

__wibu03
Size: 378KB - Virtual size: 377KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

__wibu04
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

__wibu05
Size: 53KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fb17b233dcba34b489f9ccd7dfe62c49

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

version

shell32

wsock32

Exports

Exports

Sections

__wibu00 Size: 4.1MB - Virtual size: 4.1MB

__wibu01 Size: 752KB - Virtual size: 751KB

__wibu02 Size: 62KB - Virtual size: 100KB

.rsrc Size: 6.2MB - Virtual size: 6.2MB

__wibu03 Size: 378KB - Virtual size: 377KB

__wibu04 Size: 1.2MB - Virtual size: 1.2MB

__wibu05 Size: 53KB - Virtual size: 56KB

__wibu00
Size: 4.1MB - Virtual size: 4.1MB

__wibu01
Size: 752KB - Virtual size: 751KB

__wibu02
Size: 62KB - Virtual size: 100KB

.rsrc
Size: 6.2MB - Virtual size: 6.2MB

__wibu03
Size: 378KB - Virtual size: 377KB

__wibu04
Size: 1.2MB - Virtual size: 1.2MB

__wibu05
Size: 53KB - Virtual size: 56KB