0db42190590687b0967f18d2c4bae9d25b10bbfb60ed555ea72046de479e6e73

Sharing

Copy URL Twitter E-mail

General

Target

0db42190590687b0967f18d2c4bae9d25b10bbfb60ed555ea72046de479e6e73
Size

688KB
MD5

af4bb36ccc065b12211ac3daf8476208
SHA1

ca9a2bae6fd10b68cc6f97403a489bcec49e794f
SHA256

0db42190590687b0967f18d2c4bae9d25b10bbfb60ed555ea72046de479e6e73
SHA512

e91437ce8915e937fd2242079b37680dd4d4b9099137547e577859557950784aa78eaab092cbd6e891ebd8d4451423ff59f3e12883af4acf3f9cd2dc4fc3f1e5
SSDEEP

12288:iqn6Lm4kx8tbf50Xc/jYfN3UQ9QUfISIRq0:i+6SDx8tSXX1EQ91iq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0db42190590687b0967f18d2c4bae9d25b10bbfb60ed555ea72046de479e6e73

Files

0db42190590687b0967f18d2c4bae9d25b10bbfb60ed555ea72046de479e6e73
.exe windows:6 windows x86 arch:x86

1fbaefe8e5e9d740add4946be14a6ae9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

mstsc.pdb

Imports

advapi32

TraceMessage
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
RegEnumValueW
RegEnumKeyExW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegSetValueExA
CredWriteW
CredReadW
GetUserNameA
CredDeleteW
CredFree
CredReadDomainCredentialsW
CredWriteDomainCredentialsW
RegQueryValueExA
RegOpenKeyExA
CredUnmarshalCredentialW
RegSetValueExW
RegCreateKeyExW
RegCreateKeyExA

kernel32

ReadFile
GetFileSize
FormatMessageW
CreateDirectoryW
FindResourceExW
MapViewOfFile
CreateFileMappingW
InterlockedCompareExchange
GetLocaleInfoW
UnmapViewOfFile
HeapSetInformation
ExpandEnvironmentStringsW
CreateProcessW
GetCommandLineW
WideCharToMultiByte
GetFileAttributesExW
FindFirstFileW
FindNextFileW
FindClose
GetTempPathW
SetFilePointer
GetVersion
GetACP
CreateEventW
CreateThread
SetEvent
InterlockedDecrement
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
TlsFree
TlsAlloc
SearchPathW
InitializeCriticalSection
FindResourceW
LoadResource
LockResource
SystemTimeToFileTime
WriteFile
lstrlenW
GetSystemTime
WaitForSingleObject
LoadLibraryA
ExpandEnvironmentStringsA
HeapAlloc
DeleteCriticalSection
GetProcessHeap
HeapFree
LeaveCriticalSection
EnterCriticalSection
DeviceIoControl
VerifyVersionInfoW
LoadLibraryExW
GetModuleFileNameW
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
OutputDebugStringA
InterlockedExchange
FreeLibrary
LoadLibraryW
InterlockedIncrement
lstrcmpiW
MulDiv
DebugBreak
GetCurrentProcess
TerminateProcess
GetStartupInfoA
MultiByteToWideChar
GetProcAddress
GetVersionExA
SetLastError
Sleep
CreateMutexW
DeleteFileW
GetModuleHandleW
CreateFileW
CloseHandle
GetLastError
GetFullPathNameW
GetFileAttributesW
CompareStringW
LocalAlloc
LocalFree
GetCurrentDirectoryW
GetVersionExW

gdi32

BitBlt
SelectObject
CreateCompatibleDC
CreateFontIndirectW
TranslateCharsetInfo
SetMapMode
SetBkMode
SetTextColor
StretchBlt
CreateCompatibleBitmap
GetObjectW
DeleteDC
UpdateColors
GetDeviceCaps
RealizePalette
EqualRgn
SelectPalette
CreatePalette
GetDIBColorTable
CreateRectRgn
CreateRectRgnIndirect
DeleteObject
SetRectRgn
GetDCOrgEx
GetClipBox
CombineRgn
GetStockObject

user32

ShowWindow
IsIconic
GetWindowPlacement
FindWindowW
SendMessageTimeoutW
SystemParametersInfoA
IsDialogMessageW
SetForegroundWindow
PostMessageW
IsWindow
SendMessageW
SetWindowTextW
EnableMenuItem
AdjustWindowRect
IntersectRect
EnableWindow
CopyRect
EqualRect
CreateMenu
ModifyMenuW
GetSystemMenu
MoveWindow
GetClientRect
SetWindowPos
IsZoomed
LoadCursorW
SetCursor
AppendMenuW
SetWindowPlacement
UnregisterClassW
GetClassInfoExW
OffsetRect
GetWindowRect
LoadIconW
GetSystemMetrics
TranslateAcceleratorW
IsChild
PostQuitMessage
DestroyWindow
DefWindowProcW
GetWindowLongW
CreateWindowExW
RegisterClassExW
BeginPaint
LoadAcceleratorsW
DialogBoxParamW
CreateDialogParamW
KillTimer
SetTimer
SystemParametersInfoW
GetClassInfoW
DefDlgProcW
RegisterClassW
MonitorFromWindow
GetMonitorInfoW
LoadStringW
SetFocus
UpdateWindow
InvalidateRect
LockWindowUpdate
IsWindowVisible
GetDlgItem
AdjustWindowRectEx
GetDesktopWindow
ShowWindowAsync
GetMenu
RedrawWindow
IsWindowEnabled
SetRect
DestroyIcon
LoadImageW
GetMessageW
TranslateMessage
DispatchMessageW
GetCursorPos
ScreenToClient
GetWindowDC
DrawIconEx
DrawTextW
MapDialogRect
GetWindow
FillRect
CheckDlgButton
IsDlgButtonChecked
SendDlgItemMessageW
CreateDialogIndirectParamW
GetDlgItemTextW
MapWindowPoints
ReleaseDC
DrawIcon
EndPaint
EndDialog
SetDlgItemTextW
GetDC
SetWindowLongW

msvcrt

_errno
_wcslwr
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
wcsrchr
srand
time
wcschr
iswspace
toupper
_wtoi
wcspbrk
towlower
_acmdln
_initterm
_amsg_exit
__setusermatherr
_adjust_fdiv
iswdigit
_wtol
??_U@YAPAXI@Z
_wcsicmp
wcstok
_wcsnicmp
towupper
_vsnprintf
free
__p__commode
__p__fmode
__set_app_type
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
_controlfp
calloc
bsearch
ungetc
_fileno
_read
__pioinfo
__badioinfo
realloc
wcstombs
isdigit
wcsncmp
wcsstr
memmove
_vsnwprintf
memset
memcpy
_purecall
malloc
wctomb
??_V@YAXPAX@Z
localeconv
isxdigit
isleadbyte
__mb_cur_max
mbtowc
iswctype

ole32

CoCreateInstance
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoInitialize

oleaut32

SysAllocStringLen
SysAllocStringByteLen
VariantInit
VariantClear
SysStringLen
SysAllocString
SysFreeString

shell32

SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
ExtractIconW

comctl32

ImageList_ReplaceIcon
ImageList_GetImageCount
InitCommonControlsEx
ImageList_Create
ord17

comdlg32

GetSaveFileNameW
GetOpenFileNameW
GetFileTitleW

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathFindExtensionW
PathAppendW
ord388

crypt32

CertFreeCertificateContext
CertFreeCertificateChain
CryptBinaryToStringW
CryptStringToBinaryW
CertDuplicateCertificateContext
CertDuplicateCertificateChain
CertGetCertificateContextProperty
CertVerifyCertificateChainPolicy
CryptMsgClose
CertOpenStore
CryptMsgUpdate
CryptMsgOpenToDecode
CryptSignMessage
CertCloseStore
CryptVerifyDetachedMessageSignature
CryptDecodeObject
CertFindExtension
CertGetCertificateChain
CertGetEnhancedKeyUsage

credui

CredUIPromptForCredentialsW
CredUIParseUserNameW

cryptui

CryptUIDlgViewCertificateW

ntdll

RtlInitializeCriticalSection
NtOpenFile
RtlInitUnicodeString
VerSetConditionMask
RtlUnwind

winhttp

WinHttpCloseHandle
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpSendRequest
WinHttpQueryOption

secur32

QuerySecurityPackageInfoW
FreeContextBuffer
GetUserNameExW

netapi32

NetGetJoinInformation
NetApiBufferFree

Sections

.text
Size: 325KB - Virtual size: 325KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 308KB - Virtual size: 307KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1fbaefe8e5e9d740add4946be14a6ae9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ole32

oleaut32

shell32

comctl32

comdlg32

shlwapi

crypt32

credui

cryptui

ntdll

winhttp

secur32

netapi32

Sections

.text Size: 325KB - Virtual size: 325KB

.data Size: 5KB - Virtual size: 9KB

.rsrc Size: 308KB - Virtual size: 307KB

.reloc Size: 49KB - Virtual size: 50KB

.text
Size: 325KB - Virtual size: 325KB

.data
Size: 5KB - Virtual size: 9KB

.rsrc
Size: 308KB - Virtual size: 307KB

.reloc
Size: 49KB - Virtual size: 50KB