39964668e9c50a213c0423d0a27193eec34760e9bdebb2e22aef12dac8038d00

Sharing

Copy URL Twitter E-mail

General

Target

39964668e9c50a213c0423d0a27193eec34760e9bdebb2e22aef12dac8038d00
Size

7.4MB
MD5

de5176427452976a0aff7cbd9140133c
SHA1

f1113e6dc3a25775dca07af6be984f6292f43a5c
SHA256

39964668e9c50a213c0423d0a27193eec34760e9bdebb2e22aef12dac8038d00
SHA512

db92171b212ff6e3eedc85f5233798eae4cdd8619bedd56ae61a31f5802ea92b6a040654719864abe9d922389296ccdc23708c3b9f5e2f3e154d94cf8d998ae8
SSDEEP

98304:DrS1ga8O4uo0Jw9nG4w/WWxNTugic3qvBRBrRa6QrmCSrzo7jRHsjnNv:D+5JSG4w56CqJR5RdQvc0SNv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
39964668e9c50a213c0423d0a27193eec34760e9bdebb2e22aef12dac8038d00

Files

39964668e9c50a213c0423d0a27193eec34760e9bdebb2e22aef12dac8038d00
.exe windows:4 windows x86 arch:x86

9d27b5ff1dad84bba2c7cd58821864c9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetLocalTime
SystemTimeToFileTime
GetTempPathA
GetDiskFreeSpaceA
GetACP
GetThreadLocale
IsBadReadPtr
GetComputerNameA
IsValidLocale
GetWindowsDirectoryA
GetSystemDirectoryA
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoA
SetStdHandle
GetConsoleCP
HeapSize
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
IsValidCodePage
GetOEMCP
HeapReAlloc
VirtualAlloc
LCMapStringW
LCMapStringA
GetSystemInfo
SetLastError
GetExitCodeThread
DuplicateHandle
GetProcessHeap
HeapAlloc
TerminateProcess
HeapFree
GetModuleHandleA
GetModuleFileNameA
VirtualQuery
GetCurrentThreadId
GetCPInfo
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleHandleW
VirtualFree
HeapDestroy
HeapCreate
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
LockFile
UnlockFile
IsBadStringPtrW
IsBadStringPtrA
VirtualProtect
FlushInstructionCache
GetLogicalDrives
GetDriveTypeA
DeviceIoControl
ReleaseSemaphore
OpenSemaphoreA
CreateSemaphoreA
GetFileTime
GetFileSize
SetEndOfFile
FlushFileBuffers
SetFilePointer
ReadFile
WriteFile
GetSystemTimeAsFileTime
CreateDirectoryA
SetConsoleCtrlHandler
CreateFileA
GetCurrentDirectoryA
GetTickCount
GetCurrentProcess
GetCommandLineA
SetFileTime
GetCurrentProcessId
GetVersion
GetVersionExA
WaitForMultipleObjects
SetEvent
CreateEventA
MultiByteToWideChar
WideCharToMultiByte
TlsSetValue
LocalAlloc
LocalFree
TlsGetValue
TlsFree
ExitProcess
TlsAlloc
GetFileAttributesA
GetFullPathNameA
SetCurrentDirectoryA
FileTimeToSystemTime
GetTimeZoneInformation
GetSystemTime
CloseHandle
UnmapViewOfFile
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
Sleep
WaitForSingleObject
GetCurrentThread
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetLastError
GetPrivateProfileSectionA
WritePrivateProfileSectionA
AreFileApisANSI
LoadLibraryA
GetEnvironmentVariableA
FreeLibrary
GetProcAddress
OpenProcess
GetExitCodeProcess
GetProfileStringA
DeleteFileA
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetConsoleMode
IsBadWritePtr
OpenEventA

user32

GetSystemMenu
CharLowerBuffA
AppendMenuA
GetSystemMetrics
MessageBoxA
PeekMessageA
CallMsgFilterA
TranslateMessage
DispatchMessageA
DrawMenuBar
CharUpperBuffA
wsprintfA
LoadStringA

advapi32

RegOpenKeyExA
SetSecurityDescriptorDacl
OpenSCManagerA
OpenServiceA
StartServiceA
CloseServiceHandle
RegDeleteValueA
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
GetUserNameA
RegEnumValueA
RegEnumKeyExA
RegDeleteKeyA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegFlushKey
RegCloseKey

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

shell32

ShellExecuteExA

wsock32

getpeername
accept
WSAStartup
WSACleanup
__WSAFDIsSet
select
gethostname
gethostbyaddr
htons
inet_addr
gethostbyname
WSAGetLastError
ioctlsocket
connect
inet_ntoa
setsockopt
socket
listen
closesocket
shutdown
send
getsockopt
recv
recvfrom
sendto
bind

Exports

Exports

??0CStyleMaNameBaseOP@@AAE@XZ
??0CStyleMaNameBaseOP@@QAE@ABV0@@Z
??1CStyleMaNameBaseOP@@EAE@XZ
??4CStyleMaNameBaseOP@@QAEAAV0@ABV0@@Z
??_7CStyleMaNameBaseOP@@6B@

Sections

__wibu00
Size: 5.0MB - Virtual size: 5.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

__wibu01
Size: 504KB - Virtual size: 502KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

__wibu02
Size: 152KB - Virtual size: 210KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 552KB - Virtual size: 548KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

__wibu03
Size: 1.2MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9d27b5ff1dad84bba2c7cd58821864c9

Headers

File Characteristics

Imports

kernel32

user32

advapi32

version

shell32

wsock32

Exports

Exports

Sections

__wibu00 Size: 5.0MB - Virtual size: 5.0MB

__wibu01 Size: 504KB - Virtual size: 502KB

__wibu02 Size: 152KB - Virtual size: 210KB

.rsrc Size: 552KB - Virtual size: 548KB

__wibu03 Size: 1.2MB - Virtual size: 1.3MB

__wibu00
Size: 5.0MB - Virtual size: 5.0MB

__wibu01
Size: 504KB - Virtual size: 502KB

__wibu02
Size: 152KB - Virtual size: 210KB

.rsrc
Size: 552KB - Virtual size: 548KB

__wibu03
Size: 1.2MB - Virtual size: 1.3MB