a7ad2ad672a42bbf64e494527965d265f0257535fba44a98f465114a9cd9955a

Sharing

Copy URL Twitter E-mail

General

Target

a7ad2ad672a42bbf64e494527965d265f0257535fba44a98f465114a9cd9955a
Size

1.9MB
MD5

57dd15eaa8d0a225c7312e3f3dc006e7
SHA1

46fe20c7e6b0b26d4e34140e23adc91f24d7c79e
SHA256

a7ad2ad672a42bbf64e494527965d265f0257535fba44a98f465114a9cd9955a
SHA512

ee622e1a34dd22a7ae3a9d72d7dcf34b66fc0291e84280a888735564c2a104c487db004e3d06e022c3db5522dbd62605dab7fe82342206ba0acf3cca88007452
SSDEEP

24576:iNh4WfnZtc72waTrchc2cccccpccccccccccocccccccccccTcccccccccchccc/:nWBHW3skctz/pHRIUIzXYUdcq3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a7ad2ad672a42bbf64e494527965d265f0257535fba44a98f465114a9cd9955a

Files

a7ad2ad672a42bbf64e494527965d265f0257535fba44a98f465114a9cd9955a
.exe windows:5 windows x86 arch:x86

3fa89cb5f090afc90792b6651158cb04

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_except_handler3
wcstoul
wcstol
wcsstr
wcsspn
wcsrchr
wcspbrk
wcsncpy
wcsncmp
wcslen
wcscspn
wcscpy
wcscmp
wcschr
wcscat
tolower
strstr
strpbrk
strncpy
strncmp
strlen
strcpy
strcmp
strchr
srand
rand
memset
memcpy
memcmp
malloc
labs
iswspace
iswalnum
isspace
isprint
isalpha
isalnum
free
atoi
abs

comctl32

_TrackMouseEvent
ord17
InitCommonControlsEx

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

kernel32

CreateFileMappingW
CreateFileW
CreateMutexW
CreateProcessW
CreateRemoteThread
CreateThread
DeleteCriticalSection
DeleteFileW
DeviceIoControl
EnterCriticalSection
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileW
FindNextFileW
FindResourceExW
FindResourceW
FlushFileBuffers
FlushInstructionCache
FreeLibrary
FreeResource
GetACP
GetCommandLineW
GetCurrentDirectoryW
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetExitCodeThread
GetFileAttributesW
GetLastError
GetLocaleInfoA
GetLocalTime
GetLogicalDriveStringsW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetSystemPowerStatus
GetProcessHeap
GetProcessTimes
GetStartupInfoW
GetSystemDirectoryW
GetSystemInfo
Module32FirstW
GetSystemTimeAsFileTime
GetTempPathW
GetThreadContext
GetThreadLocale
GetThreadPriority
GetTickCount
GetVersionExA
GetVersionExW
GetWindowsDirectoryW
GlobalAlloc
GlobalDeleteAtom
GlobalFree
GlobalGetAtomNameW
GlobalLock
GlobalUnlock
HeapAlloc
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalAlloc
LocalFileTimeToFileTime
LocalFree
LockResource
lstrcmpiW
lstrcpyW
lstrlenA
lstrlenW
MapViewOfFile
Process32FirstW
MoveFileExW
MoveFileW
MultiByteToWideChar
OpenEventW
OpenFileMappingW
OpenMutexW
OpenProcess
OutputDebugStringA
OutputDebugStringW
Process32NextW
QueryDosDeviceW
QueryPerformanceCounter
RaiseException
ReadFile
ReadProcessMemory
ReleaseMutex
RemoveDirectoryW
ResetEvent
ResumeThread
SetCurrentDirectoryW
SetEndOfFile
SetEvent
SetFileAttributesW
SetFilePointer
SetFileTime
SetLastError
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
SizeofResource
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TerminateThread
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualAllocEx
VirtualFree
VirtualFreeEx
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitNamedPipeW
WideCharToMultiByte
CreateFileA
WriteFile
WritePrivateProfileSectionW
WritePrivateProfileStringW
WriteProcessMemory
IsValidCodePage
GetCommandLineA
GetStartupInfoA
CreateEventW
CreateDirectoryW
CreateToolhelp32Snapshot
CopyFileW
CloseHandle
ExitProcess
GetProcAddress
WinExec

user32

WindowFromPoint
wsprintfW
PostThreadMessageW
PostQuitMessage
PostMessageW
PeekMessageW
OffsetRect
MoveWindow
MapWindowPoints
KillTimer
IsWindowVisible
IsWindowEnabled
IsIconic
IsDialogMessageW
IsChild
InvalidateRect
IntersectRect
InflateRect
GetWindowThreadProcessId
GetWindowRect
GetWindowLongW
GetSystemMetrics
GetScrollPos
GetParent
GetNextDlgTabItem
GetMessageW
GetKeyState
GetForegroundWindow
GetFocus
GetDlgItem
GetDlgCtrlID
GetDesktopWindow
UpdateWindow
GetCursorPos
GetClientRect
GetClassInfoExW
GetActiveWindow
FindWindowW
FindWindowExW
FindWindowA
UnregisterClassA
PtInRect
UnhookWindowsHookEx
TranslateMessage
SystemParametersInfoW
ExitWindowsEx
EqualRect
EnumDisplaySettingsW
EndPaint
EnableWindow
DrawTextW
DrawIconEx
DispatchMessageW
DestroyWindow
DestroyIcon
DefWindowProcW
CreateWindowExW
CopyRect
ClientToScreen
CharNextW
CharLowerW
CallWindowProcW
CallNextHookEx
BringWindowToTop
BeginPaint
AttachThreadInput
LoadBitmapW
LoadImageW
LoadIconW
LoadCursorW
ShowWindow
SetWindowTextW
SetWindowsHookExW
SetWindowRgn
SetWindowPos
SetWindowLongW
SetTimer
SetRectEmpty
SetForegroundWindow
SetFocus
SetCursor
SetCapture
SetActiveWindow
SendMessageW
ScreenToClient
ReleaseDC
ReleaseCapture
RegisterWindowMessageW
RegisterClassExW
GetDC

gdi32

SetStretchBltMode
SetTextColor
SaveDC
StretchBlt
RestoreDC
RectInRegion
Rectangle
OffsetRgn
MoveToEx
SetBkMode
GetViewportOrgEx
GetTextExtentPoint32W
GetTextColor
GetStockObject
GetObjectW
GetCurrentObject
GetClipRgn
ExtTextOutW
ExtSelectClipRgn
DeleteObject
DeleteDC
SetBkColor
SelectObject
LineTo
SelectClipRgn
CreateRoundRectRgn
CreateRectRgnIndirect
CreateRectRgn
CreatePen
CreateFontIndirectW
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBitmap
CombineRgn
SetViewportOrgEx
BitBlt

winspool.drv

EnumPrintersW
DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

RegEnumKeyExW
RegQueryValueExW
RegQueryValueExA
RegQueryInfoKeyW
RegOpenKeyW
RegOpenKeyExW
RegOpenKeyExA
RegSetValueExW
SetSecurityDescriptorDacl
SetSecurityDescriptorSacl
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
OpenProcessToken
LookupPrivilegeValueW
InitializeSecurityDescriptor
GetTokenInformation
GetSecurityDescriptorSacl
DuplicateTokenEx
CreateProcessAsUserW
CloseServiceHandle
ChangeServiceConfigW
AdjustTokenPrivileges
RegEnumKeyExA

shell32

Shell_NotifyIconW
ShellExecuteExW
ShellExecuteW
StrStrIA
StrStrIW
CommandLineToArgvW

ole32

CoUninitialize
CreateStreamOnHGlobal
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance

shlwapi

PathQuoteSpacesW
PathFindFileNameW
PathFindExtensionW
PathFileExistsW
PathAppendW
PathAddBackslashW
PathRemoveBackslashW
PathRemoveArgsW
PathRemoveFileSpecA
PathRemoveFileSpecW
PathStripPathW
PathUnquoteSpacesW
SHGetValueW
StrToIntA
StrToIntW
PathAppendA

ws2_32

WSAStartup
WSACleanup

Sections

.text
Size: 428KB - Virtual size: 424KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 4KB - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 448KB - Virtual size: 448KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.5507a
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3fa89cb5f090afc90792b6651158cb04

Headers

File Characteristics

Imports

msvcrt

comctl32

version

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

shlwapi

ws2_32

Sections

.text Size: 428KB - Virtual size: 424KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 12.1MB

.data1 Size: 4KB - Virtual size: 500B

.rsrc Size: 448KB - Virtual size: 448KB

.5507a Size: 3.1MB - Virtual size: 3.1MB

.text
Size: 428KB - Virtual size: 424KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 12.1MB

.data1
Size: 4KB - Virtual size: 500B

.rsrc
Size: 448KB - Virtual size: 448KB

.5507a
Size: 3.1MB - Virtual size: 3.1MB