557b68812c476b76e26727bc8be4f21f29efd933082566137937dcb73f15c5cc

Sharing

Copy URL

Twitter E-mail

General

Target

557b68812c476b76e26727bc8be4f21f29efd933082566137937dcb73f15c5cc
Size

4.8MB
MD5

3b6173f6271d014a1a39c29fcd4c7287
SHA1

418d88b3e98f28216ffd379712710f0c44806652
SHA256

557b68812c476b76e26727bc8be4f21f29efd933082566137937dcb73f15c5cc
SHA512

7493199080c3dbecaf5074d16a92fcdb4147891bae62d9e3fb271f0e747e22251d07a354c004e97292c4e8bad56ec9b7bd9d08bcb1a3de7822f8473e4d7ccf1c
SSDEEP

49152:BSMdV1n0EL+jiqKCObNlidMP7oxwZ8z2krQyPp/yxH931NbCtOOGmh68cc8RcXrH:vRwdQ7s3iEp/yxH93HXOPvccX4+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
557b68812c476b76e26727bc8be4f21f29efd933082566137937dcb73f15c5cc

Files

557b68812c476b76e26727bc8be4f21f29efd933082566137937dcb73f15c5cc
.exe windows:6 windows x86 arch:x86

5caf1a3fdefec1b6b0fd4e80e3c1c6ff

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetUserNameW
RegGetValueW
OpenProcessToken
OpenThreadToken
AccessCheck
AllocateAndInitializeSid
CheckTokenMembership
CopySid
FreeSid
GetLengthSid
GetTokenInformation
ImpersonateSelf
IsValidSid
MapGenericMask
RevertToSelf
LookupAccountSidW
LookupAccountNameW
SetEntriesInAclW
GetEffectiveRightsFromAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
BuildTrusteeWithSidW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
EqualSid

mpr

WNetGetUniversalNameW
WNetGetUserW
WNetGetConnectionW

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize

shell32

SHGetFolderPathW
SHFileOperationW
SHGetFileInfoW
CommandLineToArgvW
ord680

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wtsapi32

WTSEnumerateProcessesW
WTSFreeMemory
WTSEnumerateSessionsA
WTSQuerySessionInformationW

secur32

GetUserNameExW

iphlpapi

GetAdaptersInfo

dbghelp

StackWalk
SymSetOptions
SymGetOptions
UnDecorateSymbolName
SymGetModuleInfo
SymInitialize
SymFunctionTableAccess
SymLoadModule
SymGetSymFromAddr
SymUnDName

user32

LoadStringW
LoadStringA
GetDesktopWindow
wsprintfA

kernel32

ReadConsoleW
SetStdHandle
OutputDebugStringW
GetConsoleMode
GetConsoleCP
HeapReAlloc
EnumSystemLocalesW
IsValidLocale
GetLocaleInfoW
FlushFileBuffers
GetEnvironmentStringsW
GetFileType
LoadLibraryExW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
FreeEnvironmentStringsW
SetEnvironmentVariableA
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStringTypeW
GetCPInfo
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
HeapSize
SetLastError
GetCommandLineA
ResumeThread
ExitThread
CreateThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCommandLineW
LocalFree
FreeConsole
GetStdHandle
OutputDebugStringA
GetLastError
AllocConsole
WriteConsoleW
GetTickCount
CompareStringW
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetCurrentDirectoryW
GetSystemDirectoryW
GetWindowsDirectoryW
GetUserDefaultLangID
VerSetConditionMask
Sleep
GetCurrentProcess
GetVersion
GetSystemInfo
GetComputerNameExW
GetVersionExA
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
VerifyVersionInfoW
GetACP
GetCurrentThread
GetThreadContext
VirtualQueryEx
FreeLibrary
lstrcpynA
lstrcpyA
lstrcatA
LoadLibraryA
LoadLibraryW
CloseHandle
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
CreateFileW
FindClose
FindFirstFileW
GetFileAttributesW
GetFileSizeEx
LockFile
ReadFile
SetFilePointerEx
UnlockFile
WriteFile
CreateDirectoryW
DeleteFileW
GetDriveTypeW
GetFileInformationByHandle
GetVolumePathNameW
RemoveDirectoryW
SetFileAttributesW
SetFileTime
GetTempPathW
HeapAlloc
HeapFree
GetProcessHeap
GetBinaryTypeW
CopyFileW
MoveFileW
MoveFileExW
FileTimeToSystemTime
SystemTimeToFileTime
FindFirstFileExW
FindNextFileW
ReleaseMutex
CreateMutexA
FormatMessageA
OpenMutexA
GetComputerNameW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
OpenFileMappingA
FormatMessageW
GlobalMemoryStatusEx
GetCurrentThreadId
TerminateProcess
GetExitCodeProcess
CreateProcessW
SetPriorityClass
OpenProcess
GetFileSize
SetFilePointer
FoldStringW
MultiByteToWideChar
WideCharToMultiByte
GetLocaleInfoA
GetSystemDefaultLCID
GetCurrentProcessId
GetModuleHandleW
CreateToolhelp32Snapshot
Process32First
Process32Next
K32GetModuleFileNameExW
CreateFileA
FindFirstFileA
FindNextFileA
GetStringTypeExW
LCMapStringW
LCMapStringA
GetUserDefaultLCID
GetStringTypeExA
EncodePointer
DecodePointer
RtlUnwind
RaiseException
IsDebuggerPresent
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 303KB - Virtual size: 302KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 347KB - Virtual size: 347KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5caf1a3fdefec1b6b0fd4e80e3c1c6ff

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

mpr

ole32

shell32

version

wtsapi32

secur32

iphlpapi

dbghelp

user32

kernel32

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 303KB - Virtual size: 302KB

.data Size: 68KB - Virtual size: 85KB

.rsrc Size: 347KB - Virtual size: 347KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 303KB - Virtual size: 302KB

.data
Size: 68KB - Virtual size: 85KB

.rsrc
Size: 347KB - Virtual size: 347KB