88107a83d21d5d2d01a99d34ef8e241eff81731a2e629b6816be66aa8d9ead3f

Sharing

Copy URL Twitter E-mail

General

Target

88107a83d21d5d2d01a99d34ef8e241eff81731a2e629b6816be66aa8d9ead3f
Size

13.3MB
MD5

31a4ff29a3997d44a1568608e93d5047
SHA1

8eaba3cae0350b5fabcba9366c5001c1c9d93198
SHA256

88107a83d21d5d2d01a99d34ef8e241eff81731a2e629b6816be66aa8d9ead3f
SHA512

ae449356866903256bd7f6a3eeaa27b4a5fb7d93b645b26fc3faf132c126b7115305bf74eeb4d344f2bfe99a4b44a643fa2f5d2978d90e8d81b7ccff2710de7c
SSDEEP

196608:ZniYk+Vbh1BJXgTgAuK+cDW1Jw5cv65BrbanYLIIABtDHzK8lt04:ZiYd7HwWeE65BrOngvABpHO94

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
88107a83d21d5d2d01a99d34ef8e241eff81731a2e629b6816be66aa8d9ead3f

Files

88107a83d21d5d2d01a99d34ef8e241eff81731a2e629b6816be66aa8d9ead3f
.exe windows:5 windows x86 arch:x86

7d808c9862c6ee304689e6e51655a4f7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\works\10780_ext\UniAccess3_1\src\UniAccessAgent\Prometheus2\lva_setup_exe\Release\lva_setup_exe.pdb

Imports

wldap32

ord301
ord147
ord133
ord79
ord145
ord167
ord127
ord27
ord26
ord117
ord41
ord208
ord216
ord14
ord46
ord219
ord142

kernel32

FindClose
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
CreateDirectoryW
RemoveDirectoryW
GetFileAttributesExW
FindFirstFileW
FindNextFileW
CopyFileW
MoveFileExW
GetLogicalDrives
GetDriveTypeW
ReleaseMutex
CreateMutexA
GetVersionExW
OpenFileMappingW
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
SystemTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetVolumeInformationW
LockResource
LoadResource
SizeofResource
LoadLibraryExW
FindResourceW
GetCommandLineW
lstrcmpiA
OpenEventA
GetVolumeNameForVolumeMountPointW
HeapReAlloc
SleepEx
QueryPerformanceCounter
CompareFileTime
GetEnvironmentVariableA
IsBadReadPtr
GetStdHandle
PeekNamedPipe
VerSetConditionMask
VerifyVersionInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
GetModuleHandleExW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
ConvertFiberToThread
ConvertThreadToFiber
GetSystemTime
GetACP
SetConsoleCtrlHandler
SystemTimeToTzSpecificLocalTime
ExitProcess
GetTimeZoneInformation
FreeLibraryAndExitThread
ExitThread
CreateThread
RtlUnwind
OutputDebugStringW
GetCPInfo
LCMapStringW
CompareStringW
SwitchToThread
EncodePointer
GetStringTypeW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetEndOfFile
LocalAlloc
MoveFileW
DeleteFileW
GetUserDefaultUILanguage
IsValidCodePage
GetLocaleInfoW
QueryDosDeviceW
GetCurrentDirectoryW
GetTempPathW
GetSystemDirectoryW
GetEnvironmentVariableW
GetModuleFileNameW
LoadLibraryW
TryEnterCriticalSection
SetLastError
DuplicateHandle
ResumeThread
SuspendThread
FormatMessageW
GetFullPathNameW
ExpandEnvironmentStringsW
GetLongPathNameW
GetModuleHandleA
TerminateProcess
FlushFileBuffers
CreateProcessW
SetFileAttributesW
GetFileAttributesW
CreateMutexW
MultiByteToWideChar
DeviceIoControl
GetNativeSystemInfo
LocalFree
CreateSemaphoreW
ReleaseSemaphore
SetFilePointerEx
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoA
GetFileType
WideCharToMultiByte
CreateEventW
WaitForMultipleObjects
FreeLibrary
LoadLibraryA
InterlockedCompareExchange
CreateIoCompletionPort
GetProcessHeap
HeapAlloc
GetQueuedCompletionStatus
HeapFree
CancelIo
GetTickCount
InterlockedIncrement
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetExitCodeProcess
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
GetDiskFreeSpaceExW
Sleep
OpenProcess
GetCurrentProcess
GetSystemWindowsDirectoryW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
InterlockedDecrement
EnterCriticalSection
CreateEventA
ResetEvent
WriteConsoleW
SetEvent
WaitForSingleObject
GetFileSizeEx
GetFileTime
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
CloseHandle
CreateFileA
GetLastError
CreateFileW
SetFilePointer
WriteFile
ReadFile
GetConsoleCP
GetDateFormatW
GetTimeFormatW
EnumSystemLocalesW
SetStdHandle
FindFirstFileExW
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
HeapSize

user32

TranslateAcceleratorW
ClientToScreen
SetTimer
DispatchMessageW
ShowWindow
InvalidateRect
ReleaseDC
BeginPaint
EndPaint
MessageBoxW
SendMessageW
LoadStringW
LoadAcceleratorsW
RegisterClassExW
ScreenToClient
CreateWindowExW
SetWindowPos
GetDC
DefWindowProcW
LoadIconW
UpdateLayeredWindow
PeekMessageW
GetCursorPos
LoadCursorW
UpdateWindow
KillTimer
PostQuitMessage
SystemParametersInfoW
PtInRect
GetUserObjectInformationW
TranslateMessage
SetCursor
GetMessageW
GetClientRect
RegisterDeviceNotificationW
UnregisterDeviceNotification
GetProcessWindowStation
MsgWaitForMultipleObjects

gdi32

SetBkMode
DeleteDC
CreateCompatibleDC
CreateDIBSection
SelectObject
DeleteObject

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
StartServiceW
QueryServiceStatusEx
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfigW
SetSecurityInfo
AddAccessAllowedAce
RegSetValueExW
RegCreateKeyExW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SetNamedSecurityInfoW
GetNamedSecurityInfoW
ConvertSecurityDescriptorToStringSecurityDescriptorW
SetFileSecurityW
GetSecurityDescriptorSacl
SetSecurityDescriptorControl
GetSecurityDescriptorControl
AddAccessAllowedAceEx
AddAce
InitializeAcl
GetUserNameW
ConvertStringSidToSidW
DuplicateTokenEx
CreateProcessWithLogonW
CreateProcessAsUserW
GetLengthSid
IsValidSid
SetTokenInformation
AllocateAndInitializeSid
LogonUserW
FreeSid
GetTokenInformation
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
GetAclInformation
GetAce
EqualSid
GetFileSecurityW
InitializeSecurityDescriptor
LookupAccountNameW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegQueryValueExA
ConvertSidToStringSidW
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW

shell32

ShellExecuteExW
SHFileOperationW

ws2_32

getnameinfo
WSAEventSelect
WSAGetLastError
closesocket
setsockopt
ioctlsocket
inet_ntoa
ntohs
send
getsockname
shutdown
WSAStringToAddressA
recv
__WSAFDIsSet
htons
getsockopt
connect
socket
inet_addr
select
listen
bind
accept
htonl
ntohl
gethostname
WSAStartup
WSACleanup
getaddrinfo
freeaddrinfo
recvfrom
sendto
getpeername
WSASetLastError
WSAIoctl
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents

gdiplus

GdipDrawImageI
GdipCreatePen1
GdipSetStringFormatAlign
GdipDeletePen
GdipCreateBitmapFromFile
GdipGetImageWidth
GdipGetFontSize
GdipDeleteStringFormat
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipCloneBrush
GdipCreateFromHDC
GdipSetPenLineJoin
GdipSetImageAttributesWrapMode
GdipDrawPath
GdipFree
GdipCreateImageAttributes
GdipAddPathStringI
GdipFillPath
GdipGetFontStyle
GdipCreateSolidFill
GdipCreateFont
GdipSetStringFormatLineAlign
GdipCreatePath
GdipSetSmoothingMode
GdipDisposeImage
GdipDeletePath
GdipDisposeImageAttributes
GdipAlloc
GdipDeleteBrush
GdipCloneImage
GdipDrawImageRectRect
GdipCreateFontFamilyFromName
GdipGetFamily
GdipGetImageHeight
GdipDeleteFontFamily
GdipCreateStringFormat
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromScan0

comctl32

_TrackMouseEvent

rpcrt4

UuidCreate
RpcStringFreeA
UuidToStringA

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

crypt32

CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertOpenStore
CertOpenSystemStoreW
CertGetEnhancedKeyUsage
CertDuplicateCertificateContext
CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CertGetIntendedKeyUsage

setupapi

SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
CM_Get_Device_ID_List_SizeW
CM_Get_Device_Interface_ListW
CM_Get_Device_Interface_List_SizeW
SetupDiRemoveDevice
CM_Get_Device_IDW
CM_Get_Device_ID_ListW
CM_Get_DevNode_Status

dnsapi

DnsQuery_W
DnsFree

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Exports

Exports

CloseZipU
FormatZipMessageU
GetZipItem
OpenZip
SetUnzipBaseDir
UnzipItem

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 643KB - Virtual size: 642KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 512B - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 794KB - Virtual size: 793KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

lva.x64
Size: 181.4MB - Virtual size: 181.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

lva.man
Size: 739KB - Virtual size: 738KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

lva.ini
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7d808c9862c6ee304689e6e51655a4f7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wldap32

kernel32

user32

gdi32

advapi32

shell32

ws2_32

gdiplus

comctl32

rpcrt4

userenv

crypt32

setupapi

dnsapi

version

Exports

Exports

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 643KB - Virtual size: 642KB

.data Size: 34KB - Virtual size: 58KB

Shared Size: 512B - Virtual size: 1B

.rsrc Size: 794KB - Virtual size: 793KB

.reloc Size: 96KB - Virtual size: 95KB

lva.x64 Size: 181.4MB - Virtual size: 181.4MB

lva.man Size: 739KB - Virtual size: 738KB

lva.ini Size: 3KB - Virtual size: 2KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 643KB - Virtual size: 642KB

.data
Size: 34KB - Virtual size: 58KB

Shared
Size: 512B - Virtual size: 1B

.rsrc
Size: 794KB - Virtual size: 793KB

.reloc
Size: 96KB - Virtual size: 95KB

lva.x64
Size: 181.4MB - Virtual size: 181.4MB

lva.man
Size: 739KB - Virtual size: 738KB

lva.ini
Size: 3KB - Virtual size: 2KB