54564ea38f84582ce1b69065d05ec0ad3d96d2d80468cce9f63b8fcde227fb6f

Sharing

Copy URL Twitter E-mail

General

Target

54564ea38f84582ce1b69065d05ec0ad3d96d2d80468cce9f63b8fcde227fb6f
Size

1.1MB
MD5

19e5250d258403e7b957710b16fdc539
SHA1

c612b70469b57a666a4deeb787661c417ff72858
SHA256

54564ea38f84582ce1b69065d05ec0ad3d96d2d80468cce9f63b8fcde227fb6f
SHA512

3737647f1aa5a553f2d316e7fb1cf68deb1ebdc48b34cad1a681f8b7e39fdfce0d11dc5c67ad686b03389a4e0c14418ae392d09a8796261bc9feed6be3c66473
SSDEEP

24576:wkrftCV7nLDX0HoCaqTkK80TcUfbYB22kmpb24f54MvMl:wuwL72TQ0TBYB22kmpb24f54l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
54564ea38f84582ce1b69065d05ec0ad3d96d2d80468cce9f63b8fcde227fb6f

Files

54564ea38f84582ce1b69065d05ec0ad3d96d2d80468cce9f63b8fcde227fb6f
.exe windows:5 windows x86 arch:x86

fe1f2e4d7152de49a56bae29cef62f97

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Build\JenkinsHome\jobs\desktop_apps_ng\workspace\build\loader\Release\loader.pdb

Imports

kernel32

CreateFileW
GetSystemTimeAsFileTime
GetCommandLineW
GetCurrentThreadId
SetEvent
DeleteFileW
CopyFileW
GetDiskFreeSpaceExW
CreateDirectoryW
RemoveDirectoryW
GetTempPathW
GetFileAttributesW
GetTickCount
GetACP
SetLastError
HeapFree
HeapSize
HeapReAlloc
HeapAlloc
GetProcessHeap
InterlockedCompareExchange
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
GetVersionExW
GetNativeSystemInfo
WaitForSingleObject
GetStartupInfoW
CreateProcessW
LocalFree
InitializeCriticalSection
FormatMessageW
FindClose
FindFirstFileExW
FindNextFileW
CreateEventA
DuplicateHandle
ReleaseSemaphore
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
InterlockedDecrement
GlobalAlloc
GlobalLock
InterlockedIncrement
GlobalUnlock
lstrcmpW
MulDiv
ReadFile
SetFilePointer
WriteFile
EncodePointer
SetThreadPriority
SignalObjectAndWait
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
DecodePointer
EnumSystemLocalesW
IsValidLocale
GetConsoleCP
FlushFileBuffers
GetFileType
ReadConsoleW
GetConsoleMode
GetCurrentThread
FreeLibraryAndExitThread
CreateThread
GetStdHandle
GetModuleHandleExW
ExitProcess
LoadLibraryExW
InterlockedFlushSList
RtlUnwind
GetModuleHandleA
GetLogicalProcessorInformation
OpenEventA
GetUserDefaultLCID
Sleep
SetFilePointerEx
SetEndOfFile
LeaveCriticalSection
GetModuleFileNameW
EnterCriticalSection
GetPhysicallyInstalledSystemMemory
GetModuleHandleW
CreateEventW
GetExitCodeProcess
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryW
GetFileSize
GetStringTypeW
TryEnterCriticalSection
InitializeSListHead
GetCurrentProcessId
FormatMessageA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
OutputDebugStringW
GetCPInfo
GetLocaleInfoW
LCMapStringW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
DeleteCriticalSection
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
GetThreadPriority
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
SwitchToThread

user32

RegisterClassExW
PeekMessageW
TranslateMessage
DispatchMessageW
SetWindowLongW
DestroyWindow
GetWindowLongW
SetTimer
KillTimer
UnregisterClassW
GetCursorPos
SendMessageW
PostThreadMessageW
wsprintfW
DefWindowProcW
GetDesktopWindow
MsgWaitForMultipleObjects
GetWindowTextLengthW
GetWindow
GetFocus
GetDC
SetWindowPos
SetWindowRgn
FillRect
ScreenToClient
GetSystemMetrics
SetWindowTextW
ShowWindow
IsWindow
InvalidateRgn
RedrawWindow
ClientToScreen
DestroyAcceleratorTable
IsChild
GetSysColor
MoveWindow
CreateAcceleratorTableW
SetFocus
CharNextW
GetClassNameW
SetCapture
GetClientRect
GetDlgItem
PostQuitMessage
SystemParametersInfoW
GetParent
RegisterWindowMessageW
ReleaseCapture
InvalidateRect
ReleaseDC
BeginPaint
EndPaint
GetWindowTextW
CallWindowProcW
CreateWindowExW
GetClassInfoExW
LoadCursorW

gdi32

BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetStockObject
CreateRoundRectRgn
GetDeviceCaps
DeleteDC
GetObjectW
DeleteObject
CreateSolidBrush

shell32

SHGetFolderPathW
CommandLineToArgvW

ole32

OleUninitialize
CoCreateInstance
CoAddRefServerProcess
CoTaskMemFree
CoCreateGuid
CoGetClassObject
CoTaskMemAlloc
StringFromGUID2
CLSIDFromProgID
CreateStreamOnHGlobal
CLSIDFromString
OleLockRunning
CoReleaseServerProcess
OleInitialize
StringFromCLSID

oleaut32

DispCallFunc
VariantChangeType
LoadRegTypeLi
VariantInit
LoadTypeLi
SysStringByteLen
OleCreateFontIndirect
SysAllocString
VariantCopy
SysStringLen
SysAllocStringLen
VariantClear
SysFreeString
SysAllocStringByteLen

advapi32

CryptDestroyKey
CryptVerifySignatureW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptReleaseContext
RegSetValueExW
RegNotifyChangeKeyValue
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
CryptAcquireContextW

shlwapi

PathFindFileNameW

ws2_32

ntohl

Sections

.text
Size: 408KB - Virtual size: 408KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 544KB - Virtual size: 543KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe1f2e4d7152de49a56bae29cef62f97

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

shlwapi

ws2_32

Sections

.text Size: 408KB - Virtual size: 408KB

.rdata Size: 140KB - Virtual size: 140KB

.data Size: 29KB - Virtual size: 34KB

.rsrc Size: 544KB - Virtual size: 543KB

.reloc Size: 31KB - Virtual size: 30KB

.text
Size: 408KB - Virtual size: 408KB

.rdata
Size: 140KB - Virtual size: 140KB

.data
Size: 29KB - Virtual size: 34KB

.rsrc
Size: 544KB - Virtual size: 543KB

.reloc
Size: 31KB - Virtual size: 30KB