5cfb3450db01ac8d2cf796ac2de2bc45d8c62c9ead42c14e70734dbb5f0139fb

Sharing

Copy URL Twitter E-mail

General

Target

5cfb3450db01ac8d2cf796ac2de2bc45d8c62c9ead42c14e70734dbb5f0139fb
Size

2.3MB
MD5

e73ed10761f8be9e9fb22fd3e3dc5809
SHA1

767e913f5043f3949edbdbf66b4e2855fa12f406
SHA256

5cfb3450db01ac8d2cf796ac2de2bc45d8c62c9ead42c14e70734dbb5f0139fb
SHA512

ad39944b7992272a1f0de000c96efd7212eda1efb76f121caeef30021b112280dbd3168c191f91331ebe03b394f5894637aa2299ae304ea69283af451d010404
SSDEEP

49152:d5Okhu+vMT1noRKxnFtouR7NUQgKjTcaP4iiL8MPrO0:d5Hu+0T1noRKz6uRuQjsvz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5cfb3450db01ac8d2cf796ac2de2bc45d8c62c9ead42c14e70734dbb5f0139fb

Files

5cfb3450db01ac8d2cf796ac2de2bc45d8c62c9ead42c14e70734dbb5f0139fb
.exe windows:5 windows x86 arch:x86

eaa84e02f8906dd1a1b8bacfd1ff07a0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\xwork_vs2015\RetentionSoftware\bin\ad_MiniWifi.pdb

Imports

kernel32

GetCurrentProcessId
LoadResource
SizeofResource
FindResourceW
GetCommandLineW
SetCurrentDirectoryW
WideCharToMultiByte
MultiByteToWideChar
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
GetPrivateProfileStringA
FindClose
FindFirstFileW
LocalFree
LocalAlloc
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
SetFilePointer
CloseHandle
ReadFile
GetFileAttributesW
GetComputerNameW
GetSystemDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
WritePrivateProfileStringW
GetLocalTime
GetModuleFileNameW
GetTickCount
GetPrivateProfileStringW
TerminateThread
WaitForMultipleObjects
GetTempPathW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
FreeLibrary
LoadLibraryW
GetSystemInfo
GetModuleHandleW
GetProcAddress
InterlockedDecrement
Sleep
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
GetACP
GlobalLock
GlobalUnlock
lstrlenW
ExitProcess
FreeResource
LockResource
InterlockedIncrement
GetFileSize
CreateFileW
MulDiv
lstrcpyW
FormatMessageW
VerSetConditionMask
GetCurrentProcess
GetFileType
WriteFile
SetFileTime
DuplicateHandle
SystemTimeToFileTime
DosDateTimeToFileTime
GlobalAlloc
SleepEx
WaitForSingleObject
ExpandEnvironmentStringsA
GetStdHandle
PeekNamedPipe
SetLastError
FormatMessageA
LoadLibraryA
GetModuleHandleA
GetSystemDirectoryA
VerifyVersionInfoA
FlushConsoleInputBuffer
GetCurrentThreadId
QueryPerformanceCounter
GlobalMemoryStatus
GetSystemTime
IsDebuggerPresent
OutputDebugStringW
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetCommandLineA
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetFilePointerEx
SetConsoleCtrlHandler
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
ReadConsoleW
GetConsoleCP
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
GetTimeZoneInformation
HeapReAlloc
GetFullPathNameW
SetStdHandle
FlushFileBuffers
GetFileAttributesExW
SetEndOfFile
HeapSize
FindFirstFileExW

user32

DestroyWindow
IsZoomed
CharNextW
GetActiveWindow
GetFocus
GetKeyState
SetCapture
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetClientRect
CreateCaret
GetCaretBlinkTime
SetCaretPos
ScreenToClient
MapWindowPoints
GetSysColor
IntersectRect
IsRectEmpty
PtInRect
SetWindowLongW
GetParent
GetWindow
SetWindowRgn
MonitorFromWindow
GetMonitorInfoW
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
IsWindow
GetMenu
SetPropW
GetPropW
AdjustWindowRectEx
LoadIconW
SetForegroundWindow
CreateAcceleratorTableW
InvalidateRgn
ClientToScreen
FillRect
GetGUIThreadInfo
UpdateLayeredWindow
GetWindowRgn
CharPrevW
DrawTextW
SetRect
EnableMenuItem
AppendMenuW
HideCaret
ShowCaret
GetCaretPos
IsWindowEnabled
GetWindowTextW
GetWindowTextLengthW
GetKeyboardLayout
GetKeyNameTextW
MapVirtualKeyExW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
GetMessageW
LoadCursorW
CreateWindowExW
TranslateMessage
DispatchMessageW
OffsetRect
UnionRect
InflateRect
SetCursor
GetClassNameA
SetWindowPos
FindWindowW
GetSystemMetrics
MoveWindow
GetWindowRect
PostMessageW
FindWindowExW
GetWindowLongW
SendMessageW
GetClassNameW
WindowFromPoint
EnableWindow
MessageBoxW
IsWindowVisible
GetWindowThreadProcessId
GetShellWindow
GetDesktopWindow
GetForegroundWindow
ShowWindow
IsIconic
wsprintfW
LoadImageW
GetLastInputInfo
KillTimer
ReleaseCapture
EnumChildWindows
SetFocus
DestroyMenu
TrackPopupMenu
GetCursorPos
InsertMenuW
CreatePopupMenu
PostQuitMessage
SetTimer
SetWindowTextW

advapi32

DeregisterEventSource
ReportEventA
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegOpenKeyW
RegEnumValueW
RegisterEventSourceA

shell32

CommandLineToArgvW
Shell_NotifyIconW
SHGetSpecialFolderPathW
DragQueryFileW
ShellExecuteW

ole32

ReleaseStgMedium
OleLockRunning
CLSIDFromProgID
CLSIDFromString
OleDuplicateData
DoDragDrop
RevokeDragDrop
RegisterDragDrop
CoCreateInstance
CoInitialize
CoUninitialize
CoCreateGuid
CreateStreamOnHGlobal

oleaut32

VariantChangeType
VariantCopy
VariantInit
SysAllocString
SysFreeString
VariantClear

shlwapi

PathIsDirectoryW
PathRemoveFileSpecW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

urlmon

URLDownloadToFileW
UrlMkSetSessionOption

wininet

DeleteUrlCacheEntryW

ws2_32

gethostname
WSAStartup
htonl
shutdown
gethostbyname
ioctlsocket
sendto
recvfrom
listen
accept
freeaddrinfo
getaddrinfo
WSAIoctl
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
recv
WSASetLastError
select
__WSAFDIsSet
WSAGetLastError
WSACleanup
getservbyname

gdi32

GetObjectW
SetWindowOrgEx
CreateRoundRectRgn
CreateRectRgn
PtInRegion
SelectObject
SaveDC
RestoreDC
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateDIBitmap
GetTextMetricsW
CreateDIBSection
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
RoundRect
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateEnhMetaFileW
CreateCompatibleDC
SetTextColor
GetObjectA
MoveToEx
TextOutW
CreateCompatibleBitmap
CloseEnhMetaFile
BitBlt
SetBitmapBits
GetBitmapBits
GdiFlush

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

comctl32

_TrackMouseEvent
InitCommonControlsEx
ord17

gdiplus

GdipLoadImageFromStreamICM
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipDrawImageRectI
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipFillRectangleI
GdipDrawRectangleI
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipSetPenMode
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipFree
GdipAlloc
GdiplusShutdown
GdiplusStartup
GdipLoadImageFromStream

wldap32

ord79
ord35
ord33
ord32
ord27
ord22
ord41
ord50
ord143
ord301
ord200
ord46
ord211
ord60
ord30
ord26

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 448KB - Virtual size: 447KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eaa84e02f8906dd1a1b8bacfd1ff07a0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

urlmon

wininet

ws2_32

gdi32

imm32

comctl32

gdiplus

wldap32

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 448KB - Virtual size: 447KB

.data Size: 43KB - Virtual size: 57KB

.gfids Size: 512B - Virtual size: 480B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 48KB - Virtual size: 47KB

.reloc Size: 87KB - Virtual size: 87KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 448KB - Virtual size: 447KB

.data
Size: 43KB - Virtual size: 57KB

.gfids
Size: 512B - Virtual size: 480B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 48KB - Virtual size: 47KB

.reloc
Size: 87KB - Virtual size: 87KB