04be044ee06ea810db45c302fb351ca8bd6692d4b8f2e368c9ec56f59dff20d0

Sharing

Copy URL Twitter E-mail

General

Target

04be044ee06ea810db45c302fb351ca8bd6692d4b8f2e368c9ec56f59dff20d0
Size

263KB
MD5

edc9cf59d62fe7ea1f80f012324292f5
SHA1

3701b3ce4c79c788191d1f73617f09bf81115d43
SHA256

04be044ee06ea810db45c302fb351ca8bd6692d4b8f2e368c9ec56f59dff20d0
SHA512

35e9356c9a4928c891aa2ea4906bf92897cadfef039c91cb63d92b1e0028bfc5caba8125815930ab0660cfa85bea3d8e40e5ec7587f5e61d17dc91a8c4d38b83
SSDEEP

6144:w31hzkxD7aEk4uw8kmwZqzs3y6XwxLRSCyGXeiW:w31toqb4DFqzs3y6X+RSDWe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04be044ee06ea810db45c302fb351ca8bd6692d4b8f2e368c9ec56f59dff20d0

Files

04be044ee06ea810db45c302fb351ca8bd6692d4b8f2e368c9ec56f59dff20d0
.exe windows:5 windows x86 arch:x86

c3b65efd2aefba69ab47e999ce4a5c27

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

EqualSid
IsWellKnownSid
GetUserNameW
GetLengthSid
OpenProcessToken
GetSidSubAuthority
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
AdjustTokenPrivileges
ConvertSidToStringSidW
RegCloseKey
RegSetValueExW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
InitiateSystemShutdownExW
RegEnumKeyExW

crypt32

CertDuplicateCRLContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCRLFromStore
CryptUnprotectData
PFXImportCertStore
PFXExportCertStoreEx

gdi32

SetRectRgn
SelectObject
CreateCompatibleDC
DeleteDC
SetViewportOrgEx
SaveDC
RestoreDC
CreateDIBSection
GetDeviceCaps
GetDIBits
DeleteObject
GdiFlush
CreateCompatibleBitmap

kernel32

HeapCreate
Thread32Next
ReadFile
GetTimeZoneInformation
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
VirtualProtectEx
VirtualAllocEx
FindClose
LoadLibraryA
RemoveDirectoryW
FindNextFileW
CreateToolhelp32Snapshot
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
GetSystemTime
WriteProcessMemory
CreateThread
ExpandEnvironmentStringsW
GetDriveTypeW
GetLogicalDrives
SetThreadPriority
FileTimeToDosDateTime
InitializeCriticalSection
HeapDestroy
GlobalUnlock
EnterCriticalSection
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
GetPrivateProfileStringW
GetPrivateProfileIntW
ResetEvent
GetLocalTime
TlsGetValue
TlsSetValue
TerminateProcess
MapViewOfFile
UnmapViewOfFile
CreateRemoteThread
Process32FirstW
GetProcessId
CreateFileMappingW
Process32NextW
DuplicateHandle
GetModuleHandleA
TlsFree
GetThreadContext
SetThreadContext
TlsAlloc
MoveFileExW
GetUserDefaultUILanguage
GetEnvironmentVariableW
LocalFree
ReadProcessMemory
VirtualFreeEx
WideCharToMultiByte
Thread32First
OpenProcess
WriteFile
SetFileTime
IsBadReadPtr
GetCurrentProcessId
OpenEventW
GetProcessHeap
VirtualFree
GetCurrentThread
CreateDirectoryW
HeapFree
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
SetEndOfFile
GetNativeSystemInfo
FindFirstFileW
CreateMutexW
HeapReAlloc
LeaveCriticalSection
GetTempFileNameW
VirtualProtect
WaitForMultipleObjects
CreateEventW
VirtualAlloc
GetModuleFileNameW
GetVersionExW
GetModuleHandleW
GetComputerNameW
SetErrorMode
GetCommandLineW
SetFileAttributesW
CloseHandle
GetFileAttributesExW
lstrcmpiW
WTSGetActiveConsoleSessionId
GetProcAddress
lstrcmpiA
GetFileAttributesW
Sleep
LoadLibraryW
VirtualQueryEx
SetEvent
FreeLibrary
VirtualQuery
ExitProcess
ReleaseMutex
GetCurrentThreadId
SetLastError
GetTickCount
GlobalLock
WaitForSingleObject

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW

shlwapi

PathRemoveFileSpecW
PathRemoveBackslashW
PathQuoteSpacesW
StrStrIW
StrStrIA
PathIsURLW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathRenameExtensionW
StrCmpNIW

secur32

GetUserNameExW

user32

RegisterClipboardFormatW
BeginPaint
GetUpdateRect
RegisterClassExW
GetDCEx
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
DefDlgProcA
DefMDIChildProcA
RegisterClassW
CallWindowProcA
CallWindowProcW
DefWindowProcW
DefFrameProcW
RegisterClassA
GetKeyboardState
GetMenuItemID
ToUnicode
CharLowerBuffA
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
FindWindowA
TranslateMessage
CharLowerA
ReleaseDC
CharUpperW
SetKeyboardState
GetSubMenu
GetSystemMetrics
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
GetMenuItemCount
HiliteMenuItem
EndMenu
GetShellWindow
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
FillRect
DrawEdge
DefFrameProcA
IntersectRect
OpenWindowStationW
GetClipboardData
PostThreadMessageW
EqualRect
PrintWindow
CharLowerW
IsRectEmpty
GetWindowThreadProcessId
OpenInputDesktop
DrawIcon
GetIconInfo
EndPaint
SetWindowLongW
GetWindow
DispatchMessageW
ExitWindowsEx
CharToOemW
GetMessageA
GetWindowRect
GetMessageW
SetCapture
PostMessageW
GetParent
GetWindowInfo
GetClassLongW
GetCapture
SetCursorPos
GetWindowLongW
GetAncestor
PeekMessageW
GetUpdateRgn
RegisterClassExA
GetWindowDC
DefDlgProcW
GetDC
GetMessagePos
MapWindowPoints
SendMessageW
ReleaseCapture
IsWindow
SendMessageTimeoutW
GetCursorPos
SetWindowPos
PeekMessageA
MapVirtualKeyW

wininet

HttpAddRequestHeadersA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
HttpQueryInfoA

ws2_32

WSASetLastError
FreeAddrInfoW
socket
bind
recv
setsockopt
shutdown
getsockname
recvfrom
sendto
getpeername
WSASend
WSAEventSelect
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
closesocket
send
listen
accept
WSAGetLastError

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

Sections

.text
Size: 220KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 27KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c3b65efd2aefba69ab47e999ce4a5c27

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

crypt32

gdi32

kernel32

netapi32

oleaut32

shell32

shlwapi

secur32

user32

wininet

ws2_32

ole32

Sections

.text Size: 220KB - Virtual size: 220KB

.data Size: 27KB - Virtual size: 28KB

.reloc Size: 6KB - Virtual size: 8KB

.imports Size: 8KB - Virtual size: 8KB

.text
Size: 220KB - Virtual size: 220KB

.data
Size: 27KB - Virtual size: 28KB

.reloc
Size: 6KB - Virtual size: 8KB

.imports
Size: 8KB - Virtual size: 8KB