1ad387769e3db9f7f37d1d8d50770db44279d0b7f71ed68ea12e6c2227989d33

Sharing

Copy URL Twitter E-mail

General

Target

1ad387769e3db9f7f37d1d8d50770db44279d0b7f71ed68ea12e6c2227989d33
Size

2.5MB
MD5

08c5413fc00c4f55b2b36a2dbf83b905
SHA1

ef5cd14763026cdd6b10701bac3eb082bf9231d7
SHA256

1ad387769e3db9f7f37d1d8d50770db44279d0b7f71ed68ea12e6c2227989d33
SHA512

34b530031ae4b1b17f22f20ccf82a62a4a6101d7df165990b3c5ca3927d02c19fef328cc107677b1b06bf4a0294d4974eef9cb90b6560d63ea3366b7ace00887
SSDEEP

49152:UT7Qs13XHMRdgIaAbDiPH7PDPVChqHIk8x77AA:CF13XYdg6DiPbPDPVChfkk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1ad387769e3db9f7f37d1d8d50770db44279d0b7f71ed68ea12e6c2227989d33

Files

1ad387769e3db9f7f37d1d8d50770db44279d0b7f71ed68ea12e6c2227989d33
.exe windows:4 windows x86 arch:x86

e29afbfb52dc8426384a65d4695b86ec

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

t:\pptview\x86\ship\0\pptview.pdb

Imports

msvcr80

_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_fpreset
rand
wcsstr
wcstod
_wcsnicmp
iswspace
wcschr
memmove
_wtoi
_configthreadlocale
_CIasin
_CIacos
_CIsinh
_CIcosh
_CItanh
floor
_CIexp
_CIlog
_CIsqrt
_CIatan
_CItan
_finite
_CIpow
_CIcos
_CIsin
_wcsicmp
strncmp
ceil
wcsncmp
_set_purecall_handler
_CxxThrowException
memset
memcpy
__setusermatherr
_CIfmod
vswprintf_s
_vscwprintf
_fpclass
_CIatan2
__p__commode
__p__fmode
_encode_pointer
__set_app_type
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_crt_debugger_hook
_invoke_watson
_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__CxxFrameHandler3
_adjust_fdiv

kernel32

FindFirstFileW
GetTempPathW
WriteFile
GetModuleFileNameA
FreeLibrary
LoadLibraryExW
ResetEvent
WaitForMultipleObjects
SetEvent
GetCurrentThread
SetThreadPriority
CreateEventW
ResumeThread
CreateThread
GetPrivateProfileStringA
Sleep
GetUserDefaultLCID
lstrcmpW
LocalFree
GetLocalTime
GetFullPathNameW
FindResourceExA
EnumCalendarInfoA
GetUserDefaultLangID
GetLocaleInfoW
GetLocaleInfoA
EnumTimeFormatsA
EnumDateFormatsA
EnumTimeFormatsW
EnumDateFormatsW
GetSystemDefaultLCID
IsValidCodePage
GetOEMCP
VirtualProtect
FindClose
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcessHeap
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
lstrlenW
DeleteFileW
SetErrorMode
GetStartupInfoW
CreateProcessW
GetTempFileNameW
GetCurrentProcess
SetProcessWorkingSetSize
WaitForSingleObject
GetTickCount
CreateEventA
GetCurrentThreadId
GetCommandLineW
CreateFileW
GetFileSize
ReadFile
SetFilePointer
GetCurrentDirectoryW
GetLongPathNameW
SetCurrentDirectoryW
CloseHandle
GetVersionExA
OutputDebugStringA
GetModuleFileNameW
SetLastError
GetLastError
LoadLibraryW
LoadLibraryA
GetACP
WideCharToMultiByte
MultiByteToWideChar
lstrcmpiA
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetVersion
FindResourceW
SizeofResource
LoadResource
LockResource
GetStringTypeExW
GetSystemDefaultLangID
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
MulDiv
GlobalAlloc
GlobalSize
RaiseException
GlobalUnlock
GlobalLock
GlobalFree
GlobalMemoryStatus
IsValidLocale
TlsAlloc
FormatMessageW
TlsSetValue
TlsGetValue
TlsFree
FoldStringW
GetStringTypeW
CompareStringW
HeapSize
HeapFree
HeapAlloc
LocalAlloc
QueryPerformanceCounter

gdi32

LPtoDP
CreateBitmap
CreateCompatibleBitmap
GetTextAlign
DeleteMetaFile
DeleteEnhMetaFile
CopyMetaFileA
GetMetaFileW
CopyEnhMetaFileA
SetStretchBltMode
StretchDIBits
CreateFontA
EnumFontFamiliesExA
GetBitmapBits
TextOutW
GetGlyphOutlineW
GetCharABCWidthsA
GetKerningPairsA
Escape
GetViewportExtEx
GetWindowExtEx
CreatePen
IntersectClipRect
RestoreDC
GetEnhMetaFileW
GetTextFaceA
GetFontData
CreateFontIndirectW
CreateHalftonePalette
EndPage
StartPage
EndDoc
StartDocW
GetCharWidthA
GetCharWidthW
GetTextCharset
ExtTextOutW
StretchBlt
OffsetViewportOrgEx
CreateDIBSection
CreateCompatibleDC
GetClipBox
MoveToEx
LineTo
GetCurrentObject
AnimatePalette
Pie
GdiFlush
Rectangle
Polygon
Ellipse
GetViewportOrgEx
SetTextAlign
SetBkMode
SetTextColor
EnumMetaFile
EnumEnhMetaFile
PlayMetaFileRecord
PlayEnhMetaFileRecord
CreateSolidBrush
BitBlt
CreateDCW
SetMapMode
SetWindowOrgEx
DeleteDC
GetRasterizerCaps
GetObjectW
CreatePalette
GetSystemPaletteUse
GetSystemPaletteEntries
GetPaletteEntries
UpdateColors
GetRgnBox
SelectPalette
RealizePalette
GetTextColor
SelectClipRgn
GetStockObject
SetBkColor
ExtTextOutA
CreateRectRgn
OffsetRgn
CreateRectRgnIndirect
CombineRgn
SetViewportOrgEx
GetTextMetricsA
GetDeviceCaps
SelectObject
CreateFontIndirectA
GetObjectA
DeleteObject
EnumFontFamiliesExW
GetOutlineTextMetricsW
GetTextMetricsW
GetTextFaceW
GetTextCharsetInfo
SaveDC

advapi32

RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegSetValueExW
CryptGenRandom
RegQueryValueExW

ole32

CoCreateInstance
OleLockRunning
StgOpenStorageOnILockBytes
GetHGlobalFromStream
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
GetHGlobalFromILockBytes
CreateStreamOnHGlobal
StgOpenStorage
CoInitialize
CoUninitialize
StringFromGUID2

oleaut32

SysFreeString
VariantInit
SysAllocString
SysStringLen
VariantCopy
SysAllocStringLen
GetErrorInfo
VarR8FromStr
VariantChangeTypeEx
VariantClear

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

mpr

WNetGetConnectionW

Exports

Exports

_MsoDeletePx@12
_MsoEmptyPx@4
_MsoFCompactPx@8
_MsoFGrowPx@8
_MsoFInitPx@12
_MsoFInsertPx@12
_MsoFIsDefault@8
_MsoFIsNinch@8
_MsoFIsValidOpid@4
_MsoFIsValidValue@8
_MsoFLookupPx@16
_MsoFRemovePx@12
_MsoFResizePx@12
_MsoGetPropSetDefault@8
_MsoIAppendPx@8
_MsoPopinfoGet@4
_MsoPopsinfoGet@4

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 319KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 21B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 640KB - Virtual size: 644KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e29afbfb52dc8426384a65d4695b86ec

Headers

File Characteristics

PDB Paths

Imports

msvcr80

kernel32

gdi32

advapi32

ole32

oleaut32

version

urlmon

mpr

Exports

Exports

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.data Size: 39KB - Virtual size: 319KB

.tls Size: 512B - Virtual size: 21B

.rsrc Size: 131KB - Virtual size: 130KB

.reloc Size: 640KB - Virtual size: 644KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 39KB - Virtual size: 319KB

.tls
Size: 512B - Virtual size: 21B

.rsrc
Size: 131KB - Virtual size: 130KB

.reloc
Size: 640KB - Virtual size: 644KB