ecd7494a0d6ccd2add8cfd73b3092ba0a6f1bb710e0d5f52d9c9c23b1c79e129

Sharing

Copy URL Twitter E-mail

General

Target

ecd7494a0d6ccd2add8cfd73b3092ba0a6f1bb710e0d5f52d9c9c23b1c79e129
Size

811KB
MD5

b9d500c832058cc44553e9cde5cc2e72
SHA1

e5cb4ab1ac170f24c7300fa71f0a5df7736beff7
SHA256

ecd7494a0d6ccd2add8cfd73b3092ba0a6f1bb710e0d5f52d9c9c23b1c79e129
SHA512

ab8866e1ca06aacfee5bd2c6dbc37bf2b482875d4b5179b990cd6e1ed9666443ad0f680ec3b408ee2647486c20cf2a37ed77c5d09c6819da4d8d9280cf7d0331
SSDEEP

24576:GE/44pRlDsiSBShFGoGQXJjECmhf1IezQ:GAjih9IC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ecd7494a0d6ccd2add8cfd73b3092ba0a6f1bb710e0d5f52d9c9c23b1c79e129

Files

ecd7494a0d6ccd2add8cfd73b3092ba0a6f1bb710e0d5f52d9c9c23b1c79e129
.exe windows:6 windows x86 arch:x86

20b2d62a04f714ccb3a3ad68ed090463

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

I:\vsprj\smartwatch_3302\bin\smartwatchs.pdb

Imports

kernel32

GetProcAddress
DecodePointer
HeapAlloc
LoadResource
GetWindowsDirectoryA
IsDBCSLeadByte
RaiseException
CloseHandle
HeapReAlloc
GlobalAlloc
DeleteFileA
GetSystemDirectoryA
CreateFileA
GetFileAttributesA
GetLastError
CopyFileA
GetTempPathA
MultiByteToWideChar
HeapSize
GlobalLock
WriteConsoleW
GetFullPathNameW
GetCurrentDirectoryW
SetEndOfFile
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetTimeZoneInformation
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetFileSize
DeleteCriticalSection
GetProcessHeap
MulDiv
GlobalUnlock
CreateEventA
CreateDirectoryA
lstrcmpiA
WideCharToMultiByte
GetLocaleInfoA
FreeLibrary
GetModuleHandleA
lstrcmpA
GetCurrentThreadId
WaitForSingleObject
CreateMutexA
FindClose
FindResourceA
InitializeCriticalSectionEx
LeaveCriticalSection
LoadLibraryExA
EnterCriticalSection
SetLastError
HeapFree
SizeofResource
GetModuleFileNameA
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
FreeLibraryAndExitThread
ExitThread
CreateThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
GetFileAttributesExW
WriteFile
GetModuleFileNameW
GetModuleHandleExW
ExitProcess
VirtualQuery
VirtualProtect
GetSystemInfo
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
GetFileSizeEx
GetStringTypeW
EncodePointer
LocalFree
LCMapStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
OutputDebugStringW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryW
LoadLibraryW
GetTickCount
Sleep
FormatMessageW
MoveFileExW
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
VerSetConditionMask
VerifyVersionInfoW
CreateFileW
DeleteFileW

user32

GetParent
GetWindowTextLengthA
GetDesktopWindow
UnregisterClassA
GetDlgItem
GetClientRect
SetCapture
SendMessageA
SetFocus
FindWindowA
RegisterClassExA
ReleaseCapture
InvalidateRect
CharNextA
GetWindow
GetFocus
LoadCursorA
DestroyWindow
GetDC
ReleaseDC
FillRect
ScreenToClient
GetClassNameA
wsprintfA
IsWindow
InvalidateRgn
GetClassInfoExA
RegisterWindowMessageA
RedrawWindow
SetWindowLongA
ClientToScreen
CallWindowProcA
DestroyAcceleratorTable
GetWindowTextA
IsChild
CreateAcceleratorTableA
GetWindowLongA
SetWindowTextA
MessageBoxA
GetSysColor
MoveWindow
DefWindowProcA
CreateWindowExA
BeginPaint
SetWindowPos
EndPaint

gdi32

SelectObject
CreateCompatibleDC
GetStockObject
GetDeviceCaps
DeleteDC
CreateCompatibleBitmap
BitBlt
DeleteObject
CreateSolidBrush
GetObjectA

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyA
CloseServiceHandle
RegQueryValueExA
OpenSCManagerA
RegCreateKeyExA
DeleteService
ChangeServiceConfigA
ControlService
RegSetValueExA
CryptEncrypt
RegDeleteValueA
RegEnumKeyExA
OpenServiceA
CryptAcquireContextW
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey

shell32

SHGetSpecialFolderPathA
ShellExecuteExA

ole32

CoInitialize
CoTaskMemAlloc
StringFromGUID2
CoUninitialize
CoCreateInstance
CLSIDFromProgID
OleUninitialize
CreateStreamOnHGlobal
OleInitialize
CoTaskMemRealloc
CLSIDFromString
OleLockRunning
CoInitializeEx
CoGetClassObject
CoTaskMemFree

oleaut32

LoadRegTypeLi
VariantInit
LoadTypeLi
SysFreeString
OleCreateFontIndirect
SysAllocString
SysStringLen
SysAllocStringLen
VariantClear
VarUI4FromStr

shlwapi

PathFileExistsA

bcrypt

BCryptGenRandom

ws2_32

socket
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
__WSAFDIsSet
select
ntohs
htonl
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
ioctlsocket
gethostname
setsockopt
htons
getsockopt
getsockname
getpeername
connect
bind
recv
WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
accept

wldap32

ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord117
ord41
ord208
ord73
ord216
ord14
ord46
ord219
ord145
ord301

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryW
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringW
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain

Sections

.text
Size: 614KB - Virtual size: 613KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

20b2d62a04f714ccb3a3ad68ed090463

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

bcrypt

ws2_32

wldap32

crypt32

Sections

.text Size: 614KB - Virtual size: 613KB

.rdata Size: 131KB - Virtual size: 130KB

.data Size: 7KB - Virtual size: 12KB

.rsrc Size: 30KB - Virtual size: 30KB

.reloc Size: 27KB - Virtual size: 27KB

.text
Size: 614KB - Virtual size: 613KB

.rdata
Size: 131KB - Virtual size: 130KB

.data
Size: 7KB - Virtual size: 12KB

.rsrc
Size: 30KB - Virtual size: 30KB

.reloc
Size: 27KB - Virtual size: 27KB