ee697566f33db739027cbe6d3c733b0e123406728cda1669728b41d5f8e6e7ec

Sharing

Copy URL Twitter E-mail

General

Target

ee697566f33db739027cbe6d3c733b0e123406728cda1669728b41d5f8e6e7ec
Size

713KB
MD5

32606e7248efa0df80ba166d02723b0f
SHA1

28b8ce6ce7635b1d4cf686237f185501e934f66f
SHA256

ee697566f33db739027cbe6d3c733b0e123406728cda1669728b41d5f8e6e7ec
SHA512

2002f82e7b30d759a0041b68a6edbec4fc13867df750e8c97b9d4d8cbbca4b744d8ed54675f6d2110e30f4e7d5082c87a40c4c4cbd187121dc76fbd7a42df007
SSDEEP

12288:rgw5ulv1AtcY8vwmCDA1viqRnQC36VslnyBD4wxoKAxd/:rghlv1AtcYDmEA1viAgVewx3AxN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ee697566f33db739027cbe6d3c733b0e123406728cda1669728b41d5f8e6e7ec

Files

ee697566f33db739027cbe6d3c733b0e123406728cda1669728b41d5f8e6e7ec
.exe windows:6 windows x86 arch:x86

2b99bd8ba4e250bc88271c196822ace9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLogicalDriveStringsA
GetDiskFreeSpaceExA
lstrcmpA
VirtualFree
RtlZeroMemory
InterlockedExchangeAdd
InterlockedIncrement
InterlockedDecrement
HeapDestroy
HeapCreate
lstrlenW
lstrcmpW
lstrcmpiW
CreateMutexA
WaitForSingleObject
ReleaseMutex
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateTimerQueue
GetSystemTimeAsFileTime
GetLocalTime
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
DeleteTimerQueueEx
HeapReAlloc
ExitProcess
GetModuleHandleA
IsBadReadPtr
GetModuleFileNameA
CreateDirectoryA
DeleteFileA
CreateProcessA
GetStartupInfoA
GetUserDefaultLCID
Sleep
WriteFile
SetFilePointer
GetFileSize
GetPrivateProfileStringA
GetTickCount
WritePrivateProfileStringA
FindClose
FindFirstFileA
FindNextFileA
CopyFileA
SetFileAttributesA
RemoveDirectoryA
FreeLibrary
GetProcAddress
Process32First
LCMapStringA
CreateFileW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapSize
SetFilePointerEx
lstrcpynA
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetFileType
DecodePointer
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
SetLastError
RaiseException
CreateToolhelp32Snapshot
WideCharToMultiByte
lstrlenA
GetCurrentThreadId
LocalSize
GetModuleHandleW
MultiByteToWideChar
HeapAlloc
GetLastError
ReadFile
CloseHandle
GetFileSizeEx
CreateFileA
CreateThread
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
GetTimeFormatA
GetDateFormatA
HeapFree
GetProcessHeap
RtlUnwind
GetCurrentProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
OpenProcess
Module32First
LCMapStringW
Process32Next
RtlMoveMemory
VirtualAlloc
LoadLibraryA
WriteConsoleW

user32

ShowWindow
RegisterClassExW
LoadCursorW
DefWindowProcW
SystemParametersInfoW
LoadIconW
CreateWindowExW
UpdateLayeredWindow
SetWindowsHookExW
TranslateMessage
DispatchMessageW
CallNextHookEx
MapVirtualKeyA
GetMessageW
CallWindowProcW
BeginPaint
GetClientRect
IntersectRect
EndPaint
GetFocus
SetFocus
SetCapture
ReleaseCapture
ScreenToClient
IsRectEmpty
IsZoomed
PtInRect
MessageBeep
MessageBoxA
wsprintfA
wvsprintfA
RemovePropA
InvalidateRect
ReleaseDC
GetDC
OffsetRect
GetWindowRect
DefWindowProcA
GetPropA
SetPropA
SetWindowLongW
GetWindowLongW
IsWindow

gdi32

DeleteDC
DeleteObject
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetObjectA
GetCurrentObject
BitBlt

advapi32

CryptHashData
CryptDestroyHash
CryptAcquireContextA
CryptGetHashParam
CryptReleaseContext
CryptDecrypt
CryptDestroyKey
CryptEncrypt
CryptDeriveKey
CryptCreateHash

ole32

CoUninitialize
CreateStreamOnHGlobal
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
OleRun
CoInitialize

oleaut32

SafeArrayAllocDescriptor
SafeArrayAllocData
RegisterTypeLi
SafeArrayGetElemsize
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit
SafeArrayGetDim
VariantTimeToSystemTime
SysAllocString
SysFreeString
SafeArrayCreate
SafeArrayDestroy
VariantClear
VariantCopy
VariantChangeType
VarR8FromCy
VarR8FromBool
LHashValOfNameSys
LoadTypeLi

ws2_32

WSAStartup
WSAGetLastError
WSACleanup

gdiplus

GdipCreateFromHDC
GdiplusStartup
GdipLoadImageFromStream
GdipDrawImageRect
GdipDisposeImage
GdiplusShutdown
GdipGetImageDimension
GdipDeleteGraphics

ntdll

RtlComputeCrc32
NtQueryInformationProcess
NtQuerySystemInformation
RtlGetCompressionWorkSpaceSize
RtlCompressBuffer
RtlDecompressBuffer

shlwapi

PathRemoveBackslashA
PathFileExistsA
StrToIntW
StrToIntExW
PathFindFileNameA
PathRemoveFileSpecA

shell32

ShellExecuteA

comdlg32

GetOpenFileNameW
GetSaveFileNameA

imm32

ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
ImmSetCandidateWindow

Sections

.text
Size: 571KB - Virtual size: 571KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 53KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2b99bd8ba4e250bc88271c196822ace9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

ws2_32

gdiplus

ntdll

shlwapi

shell32

comdlg32

imm32

Sections

.text Size: 571KB - Virtual size: 571KB

.rdata Size: 47KB - Virtual size: 46KB

.data Size: 53KB - Virtual size: 104KB

.rsrc Size: 18KB - Virtual size: 18KB

.reloc Size: 21KB - Virtual size: 21KB

.text
Size: 571KB - Virtual size: 571KB

.rdata
Size: 47KB - Virtual size: 46KB

.data
Size: 53KB - Virtual size: 104KB

.rsrc
Size: 18KB - Virtual size: 18KB

.reloc
Size: 21KB - Virtual size: 21KB