23e3b4cf2e0ad21d1ce132b2aa9a34d09c1af3e49c59bcee7916e557f7aa5b8e

Sharing

Copy URL Twitter E-mail

General

Target

23e3b4cf2e0ad21d1ce132b2aa9a34d09c1af3e49c59bcee7916e557f7aa5b8e
Size

75KB
MD5

58c3b2dafa810d6ad3bd0ea254193445
SHA1

9f90173550f02477a427bc15711764632524a3ef
SHA256

23e3b4cf2e0ad21d1ce132b2aa9a34d09c1af3e49c59bcee7916e557f7aa5b8e
SHA512

d433855c9a00c750d2895aa68e136b3ee90d02d621eb7f8615f1dc5ff66a61d8adda5d94d7fe376ec7bce12bc9349677e7b55dc074ebdb16992bd45854b5a925
SSDEEP

1536:16m39JsQ6ZsM01g5iSwRJWEyq4DSruYtM4sOgCRloJR/0JovlYsY18:1TD9e1inWE/4D+XllZJklYL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
23e3b4cf2e0ad21d1ce132b2aa9a34d09c1af3e49c59bcee7916e557f7aa5b8e

Files

23e3b4cf2e0ad21d1ce132b2aa9a34d09c1af3e49c59bcee7916e557f7aa5b8e
.exe windows:4 windows x86 arch:x86

fd405bab932fd4dbb2d2a294d2094748

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
CloseHandle
GetCurrentProcessId
FlushInstructionCache
SetLastError
lstrcmpA
FreeLibrary
IsBadReadPtr
GetVersionExA
GetSystemDirectoryA
ExitProcess
WaitForSingleObjectEx
SetEvent
OpenEventA
InterlockedIncrement
WaitForSingleObject
ExitThread
Sleep
DeleteFileA
UnmapViewOfFile
lstrcatA
OutputDebugStringA
WritePrivateProfileStringA
GetPrivateProfileSectionNamesA
GetTickCount
WriteProcessMemory
VirtualFree
VirtualAlloc
MapViewOfFileEx
CreateFileMappingA
SetThreadContext
VirtualProtectEx
GetThreadContext
CreateRemoteThread
ResumeThread
DuplicateHandle
EnterCriticalSection
CreateProcessA
FindNextFileA
FindFirstFileA
GetExitCodeThread
TerminateProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
VirtualAllocEx
VirtualFreeEx
QueryDosDeviceA
GetLogicalDriveStringsA
CreateThread
GetWindowsDirectoryA
CopyFileA
GetFileAttributesA
CreateEventA
CreateFileA
MapViewOfFile
SetFileTime
GetFileTime
RemoveDirectoryA
WideCharToMultiByte
MultiByteToWideChar
ResetEvent
OpenFile
GlobalAlloc
GlobalFree
LeaveCriticalSection
GetCurrentProcess
InitializeCriticalSection
lstrcpynA
HeapAlloc
lstrlenA
HeapReAlloc
GetLastError
lstrcpyA
HeapFree
GetProcessHeap
lstrcmpiA
VirtualQuery
VirtualProtect
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
OpenProcess
LoadLibraryA

user32

wvsprintfA
MessageBoxA
wsprintfA

advapi32

SetSecurityDescriptorDacl
OpenProcessToken
GetTokenInformation
RegSetValueExA
RegQueryInfoKeyA
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegCloseKey
InitializeSecurityDescriptor
RegCreateKeyExA
AdjustTokenPrivileges

shell32

SHGetSpecialFolderPathA

oleaut32

VariantInit
SysAllocString
SysFreeString

wininet

HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCanonicalizeUrlA
InternetOpenA
InternetSetOptionA
InternetQueryDataAvailable
InternetCrackUrlA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache
InternetQueryOptionA
HttpAddRequestHeadersA

rpcrt4

RpcStringFreeA
UuidCreate
UuidToStringA

ws2_32

WSAGetLastError
select
inet_ntoa
accept
listen
closesocket
bind
setsockopt
htonl
htons
socket
getpeername
WSAStartup
WSACleanup
inet_addr
gethostbyname
recv
send
connect
shutdown
ioctlsocket
ntohl

urlmon

ObtainUserAgentString

Exports

Exports

?unzip@@YAPAXPADPAK@Z
InstallHook
_WorkProc@4
__mp@4

Sections

.text
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fd405bab932fd4dbb2d2a294d2094748

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

oleaut32

wininet

rpcrt4

ws2_32

urlmon

Exports

Exports

Sections

.text Size: 66KB - Virtual size: 66KB

.reloc Size: 7KB - Virtual size: 8KB

.text
Size: 66KB - Virtual size: 66KB

.reloc
Size: 7KB - Virtual size: 8KB