7da3c0cb15b2c259b91c85122db4769401a9313693f04f41f0993175ecc65887

Sharing

Copy URL Twitter E-mail

General

Target

7da3c0cb15b2c259b91c85122db4769401a9313693f04f41f0993175ecc65887
Size

444KB
MD5

c14d2d372183856e5664bfe34a7a18fd
SHA1

fad05f96bf1ae4af8e4989de0de49c3678dee494
SHA256

7da3c0cb15b2c259b91c85122db4769401a9313693f04f41f0993175ecc65887
SHA512

8caa18243572799551bd0e86b82567513c2f14e04a27fe74ede1e7f7c03b5d340d2ec00a0f3ab84eeefe1e6f13f44b1776993f2fc809d8c487564745d60754f3
SSDEEP

6144:yVx38miGhHRKdw9weFJqlN58uTMmKQZAWpb4ST+rnvF8dVWP:yrzJHAgvuomKQlph+Lt8w

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7da3c0cb15b2c259b91c85122db4769401a9313693f04f41f0993175ecc65887

Files

7da3c0cb15b2c259b91c85122db4769401a9313693f04f41f0993175ecc65887
.exe windows:6 windows x86 arch:x86

bcce0d2b7ed723cd121dc97cc8a48b0c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

SearchIndexer.pdb

Imports

advapi32

RegCloseKey
RegSetValueExW
RegCreateKeyExW
EventWrite
RegOpenKeyExW
RegSetKeyValueW
RegGetValueW
RegEnumKeyExW
RegDeleteValueW
OpenProcessToken
RegQueryValueExW
EventRegister
EventUnregister
EventEnabled
RegQueryInfoKeyW
InitializeAcl
InitializeSecurityDescriptor
CopySid
GetLengthSid
IsValidSid
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
GetTokenInformation
AddAce
GetAce
GetAclInformation
AddAccessAllowedAce
StartServiceCtrlDispatcherW
SetSecurityDescriptorDacl
OpenThreadToken
LookupAccountNameW
SetServiceStatus
RegisterServiceCtrlHandlerExW
SetFileSecurityW
ImpersonateLoggedOnUser
GetSecurityDescriptorLength
MakeSelfRelativeSD
GetSidSubAuthority
RevertToSelf
MakeAbsoluteSD
InitializeSid
GetSidLengthRequired
AddAccessDeniedAce
LookupAccountSidW
CreateWellKnownSid
SetTokenInformation
IsValidAcl
DeregisterEventSource
RegisterEventSourceW
ReportEventW
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegDeleteKeyTransactedW
GetSecurityDescriptorControl
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
RegCreateKeyTransactedW
RegOpenKeyTransactedW
CheckTokenMembership

kernel32

InterlockedCompareExchange
DelayLoadFailureHook
HeapSetInformation
GetCurrentProcessId
SetPriorityClass
SetEnvironmentVariableW
CreateMutexW
Sleep
MultiByteToWideChar
LoadLibraryW
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapFree
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetCurrentProcess
GetNLSVersion
OutputDebugStringW
GetModuleFileNameW
LoadLibraryExW
InterlockedDecrement
InterlockedIncrement
GetSystemDirectoryW
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
WideCharToMultiByte
GetSystemDefaultLCID
CompareStringW
lstrcmpiW
FreeLibrary
lstrlenW
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
GetDriveTypeW
GetVolumeInformationW
SetLastError
GetVolumePathNamesForVolumeNameW
SetErrorMode
GetLastError
CloseHandle
LoadLibraryExA
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GetSystemPreferredUILanguages
ResolveLocaleName
LocaleNameToLCID
CreateFileMappingW
ReleaseMutex
MapViewOfFile
CopyFileA
DeleteFileA
FlushViewOfFile
GetLocalTime
CreateFileA
FormatMessageW
UnmapViewOfFile
LCMapStringW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetTimeFormatW
LocalFree
CreateFileW
lstrcmpW
CompareFileTime
RemoveDirectoryW
FindFirstFileW
GetCommandLineW
DeleteFileW
SearchPathW
MoveFileW
CopyFileW
GetFileAttributesW
SetFileAttributesW
GetVersionExA
HeapDestroy
HeapAlloc
HeapReAlloc
HeapSize
InterlockedExchange
lstrlenA
GetEnvironmentVariableW
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
OutputDebugStringA
VerifyVersionInfoW
VerSetConditionMask
GetVersionExW
ExpandEnvironmentStringsW
CreateThread
WaitForSingleObject
FindClose
FindNextFileW
FindFirstFileExW
CreateDirectoryW
OpenEventW
GetCurrentThread
SetEvent
GetTickCount64
RegNotifyChangeKeyValue
DuplicateHandle
CreateEventW
RegEnumValueW
RegDeleteKeyExW

user32

MsgWaitForMultipleObjects
PeekMessageW
UnregisterClassA
UnregisterDeviceNotification
RegisterDeviceNotificationW
LoadStringW
CharNextW
DispatchMessageW

msvcrt

_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
realloc
_exit
_cexit
__getmainargs
calloc
wcsncpy_s
malloc
memmove_s
memcpy
wcsrchr
swscanf_s
_wcsicmp
free
_wcsnicmp
wcsncmp
memcpy_s
_vsnwprintf
memset
__CxxFrameHandler3
_CxxThrowException
_errno
_controlfp
fprintf
wcsstr
wcspbrk
_vscwprintf
vswprintf_s
qsort
towupper
bsearch
_XcptFilter
wcschr
iswspace
_wtol
swscanf
_vsnprintf
strncmp
_iob

ntdll

NtOpenFile
RtlInitUnicodeString
RtlNtStatusToDosError
WinSqmAddToStream
WinSqmIncrementDWORD
WinSqmSetDWORD
WinSqmIsOptedIn

ole32

CoUninitialize
CoInitializeEx
CoTaskMemFree
CoCreateInstance
CoRevertToSelf
CoTaskMemAlloc
CoTaskMemRealloc
CoRevokeClassObject
CoRegisterClassObject
CoInitializeSecurity
CoImpersonateClient

oleaut32

SysFreeString
SysAllocString
SysStringLen
VarBstrCat
SysAllocStringLen
SysAllocStringByteLen
SysStringByteLen
VariantInit
VariantClear
VarUI4FromStr
LoadRegTypeLi
LoadTypeLi

tquery

?ciDelete@@YGXPAX@Z
?ciNewNoThrow@@YGPAXI@Z
?ciNew@@YGPAXI@Z

shlwapi

PathIsUNCServerShareW
SHGetValueW
SHSetValueW
PathAddBackslashW
SHCopyKeyW
PathRemoveBackslashW
SHDeleteKeyW
ord154
PathIsDirectoryW
PathStripToRootW
PathCanonicalizeW
PathFindNextComponentW
PathSkipRootW
PathFileExistsW
SHRegGetValueW
SHStrDupW
PathAppendW
PathIsUNCW
PathIsUNCServerW
PathIsRootW

mssrch

??0CSearchServiceObj@@QAE@XZ
?Cleanup@CSearchServiceObj@@SGHXZ
??1CSearchServiceObj@@QAE@XZ

imm32

ImmDisableIME

Sections

.text
Size: 291KB - Virtual size: 291KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 45KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bcce0d2b7ed723cd121dc97cc8a48b0c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

ntdll

ole32

oleaut32

tquery

shlwapi

mssrch

imm32

Sections

.text Size: 291KB - Virtual size: 291KB

.data Size: 7KB - Virtual size: 7KB

.rsrc Size: 100KB - Virtual size: 99KB

.reloc Size: 45KB - Virtual size: 46KB

.text
Size: 291KB - Virtual size: 291KB

.data
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 100KB - Virtual size: 99KB

.reloc
Size: 45KB - Virtual size: 46KB