App_02029[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

App_02029.exe
Size

26.2MB
MD5

d2908e6b09fdc37660c37abf3859b632
SHA1

9119b00871cfe825b09e36b9fb424fd945864bcf
SHA256

42153ef3317ae35224307486d3c73979f8ee02f2499544b652a0738a30a74b2e
SHA512

3e04508f08ad9f653d4dfaade1e566baa797d4a31f4780251d8df2e667d92e4ee52cccd3f893870e02ce5b1b96c04fba3bfdd227252141da10784d1bebad786c
SSDEEP

786432:kq4slk73aoPOObePkcDzV9W8k4jLmCqilqOvEVCip88r6:5kY9W8/LmCqgIVC688r6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
App_02029.exe

Files

App_02029.exe
.exe windows:6 windows x86 arch:x86

56e27e593045b4f6f67b30951b73ea07

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW
RemoveDirectoryW
SetEvent
FormatMessageW
GetSystemInfo
Sleep
UnhandledExceptionFilter
GetEnvironmentVariableA
WaitForSingleObject
FreeLibrary
GetFileAttributesW
IsValidLocale
GetFileInformationByHandle
CreateSemaphoreW
ExitProcess
DeleteFileW
GetVersionExW
GetProcessHeap
ReleaseSRWLockExclusive
GetModuleHandleA
InterlockedPushEntrySList
GetFileAttributesExW
MoveFileExW
GetSystemDirectoryW
LCMapStringW
FileTimeToSystemTime
GlobalFree
DeleteTimerQueueTimer
VirtualFree
GetCommandLineW
LoadLibraryExW
GetCommandLineA
GetCurrentThread
VerifyVersionInfoW
GetThreadPriority
SetFileAttributesW
AcquireSRWLockExclusive
RtlUnwind
InitializeSListHead
RegisterWaitForSingleObject
SetEndOfFile
SleepEx
GetProcessAffinityMask
InitializeCriticalSectionEx
VerSetConditionMask
MoveFileW
GetDriveTypeW
SetThreadAffinityMask
HeapAlloc
ResetEvent
DecodePointer
GetProcAddress
CreateDirectoryW
GetFullPathNameW
lstrcatA
GetStdHandle
GetUserDefaultLCID
UnregisterWait
ReleaseSemaphore
InterlockedPopEntrySList
CreateTimerQueueTimer
GlobalMemoryStatus
SwitchToThread
GetCurrentThreadId
QueryPerformanceCounter
HeapReAlloc
EnterCriticalSection
ReadFile
LocalFree
GetLogicalDriveStringsW
GetTimeFormatW
GetLogicalProcessorInformation
FlushFileBuffers
MultiByteToWideChar
TlsSetValue
EncodePointer
GetACP
GetModuleHandleExW
CreateEventW
SetEnvironmentVariableW
SetPriorityClass
TerminateProcess
CreateTimerQueue
WriteFile
TryEnterCriticalSection
GetConsoleMode
GetTickCount
GetNumaHighestNodeNumber
FindClose
ChangeTimerQueueTimer
GetVersion
lstrlenA
ExitThread
VirtualProtect
FindFirstFileExW
GetStartupInfoW
GetFileSizeEx
GetTimeZoneInformation
IsProcessorFeaturePresent
IsValidCodePage
FreeLibraryAndExitThread
GetLocaleInfoW
HeapSize
SetUnhandledExceptionFilter
GetCPInfo
GetCurrentProcess
IsDebuggerPresent
TlsFree
PeekNamedPipe
QueryDepthSList
FindFirstFileW
GetModuleFileNameW
DuplicateHandle
GetDateFormatW
WriteConsoleW
WaitForSingleObjectEx
WideCharToMultiByte
InitializeCriticalSection
TlsAlloc
GetCurrentDirectoryW
GlobalAlloc
SetLastError
SystemTimeToTzSpecificLocalTime
GetConsoleOutputCP
CompareFileTime
GetCurrentProcessId
QueryPerformanceFrequency
FileTimeToLocalFileTime
EnumSystemLocalesW
VirtualAlloc
CreateThread
GlobalUnlock
TlsGetValue
SetThreadPriority
CloseHandle
GetStringTypeW
CompareStringW
FreeEnvironmentStringsW
SetFileTime
GetOEMCP
GetEnvironmentStringsW
LoadLibraryW
RaiseException
GetTickCount64
GetThreadTimes
InitializeCriticalSectionAndSpinCount
UnregisterWaitEx
SignalObjectAndWait
SetFilePointer
GetSystemTimeAsFileTime
GlobalLock
SetStdHandle
DeleteCriticalSection
HeapFree
WaitForMultipleObjects
ReadConsoleW
FindNextFileW
GetFileType
SetFilePointerEx
GetLastError
CreateFileW
LeaveCriticalSection
GetFileSize
InterlockedFlushSList

user32

MessageBoxA
SetDlgItemTextW
wsprintfA
InvalidateRect
SetWindowTextW
GetWindowTextLengthW
ScreenToClient
GetWindowLongW
LoadIconW
MoveWindow
OpenClipboard
GetFocus
SetTimer
LoadStringW
KillTimer
SetFocus
MessageBoxW
EnableWindow
IsDlgButtonChecked
GetParent
MapDialogRect
GetMonitorInfoA
LoadCursorW
SendMessageW
SystemParametersInfoW
GetKeyState
CloseClipboard
GetDlgItem
SetCursor
GetWindowTextW
EndDialog
MonitorFromWindow
GetWindowRect
SetWindowLongW
CharUpperW
DialogBoxParamW
SetClipboardData
EmptyClipboard
CheckDlgButton
PostMessageW
ShowWindow

advapi32

CryptEncrypt
CryptReleaseContext
CryptAcquireContextW
CryptHashData
CloseServiceHandle
CryptDestroyKey
CryptDestroyHash
CryptGetHashParam
CryptImportKey
CryptCreateHash

shell32

SHBrowseForFolderW
SHGetSpecialFolderPathW
SHGetFileInfoW
SHGetPathFromIDListW

ole32

CoInitialize
CoCreateInstance
CoTaskMemFree
OleInitialize
CoUninitialize

oleaut32

SysAllocString
SysFreeString
VariantClear
SysAllocStringLen
SysStringLen

bcrypt

BCryptGenRandom

crypt32

CertGetCertificateChain
CertFreeCertificateChain
CertAddCertificateContextToStore
CertFreeCertificateChainEngine
CertCloseStore
CertFindExtension
CertCreateCertificateChainEngine
CertOpenStore
CryptDecodeObjectEx
CryptQueryObject
CertFindCertificateInStore
CertGetNameStringW
CertEnumCertificatesInStore
CryptStringToBinaryW
PFXImportCertStore
CertFreeCertificateContext

wldap32

ord73
ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord145
ord219
ord46
ord14
ord216
ord208
ord41
ord117
ord26
ord27

ws2_32

recvfrom
sendto
getpeername
ioctlsocket
gethostname
WSAEventSelect
WSACreateEvent
getsockopt
send
getaddrinfo
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
socket
WSAIoctl
freeaddrinfo
closesocket
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
WSACleanup
htons
setsockopt
WSAResetEvent
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
listen
recv
WSACloseEvent

Sections

.text
Size: 6.7MB - Virtual size: 6.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 277KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

56e27e593045b4f6f67b30951b73ea07

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

bcrypt

crypt32

wldap32

ws2_32

Sections

.text Size: 6.7MB - Virtual size: 6.7MB

.rdata Size: 277KB - Virtual size: 276KB

.data Size: 13KB - Virtual size: 34KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 9KB - Virtual size: 9KB

.reloc Size: 97KB - Virtual size: 96KB

.text
Size: 6.7MB - Virtual size: 6.7MB

.rdata
Size: 277KB - Virtual size: 276KB

.data
Size: 13KB - Virtual size: 34KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 9KB - Virtual size: 9KB

.reloc
Size: 97KB - Virtual size: 96KB