c7cc49d4cb8b7aaebee3448e6b8fef48ee83c574bc6018167c88d584a51e849c

Sharing

Copy URL Twitter E-mail

General

Target

c7cc49d4cb8b7aaebee3448e6b8fef48ee83c574bc6018167c88d584a51e849c
Size

420KB
MD5

cdd74b51b09f92da86a0e615f26a54ef
SHA1

ae193b4be8b34002ffc9595d83ae92a94435612c
SHA256

c7cc49d4cb8b7aaebee3448e6b8fef48ee83c574bc6018167c88d584a51e849c
SHA512

d34a7f50f3f6dba6ac9021963d0e418b5f7bbc82ac90121cae0f9517b92888a748a4438c8887b00677d84635df4183586a39e25e899d310aa9c1cf1d6696d73a
SSDEEP

6144:dMVxWs8tknTBhdxJ6jXd5ZW5VyepZVh+du1N:d5tkn9hdxJ6p5ZW5MepZXX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c7cc49d4cb8b7aaebee3448e6b8fef48ee83c574bc6018167c88d584a51e849c

Files

c7cc49d4cb8b7aaebee3448e6b8fef48ee83c574bc6018167c88d584a51e849c
.exe windows:1 windows x86 arch:x86

9d086c61f96e0470a25181254075238a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

claasc

ASCII

clados

DOS

claole

Cla$HookOle

clarun

Cla$ACCEPTED
Cla$ADDqueue
Cla$ADDqueueptr
Cla$ALERT
Cla$AssignLong2RefUfo
Cla$BEEP
Cla$BindG
Cla$BindV
Cla$CHOICE
Cla$CLEAR
Cla$clearstr
Cla$CLIPBOARD
Cla$CLOCK
Cla$CloneUfo
Cla$CLOSEwindow
Cla$code
Cla$comparestr
Cla$CopyFile
Cla$DecAdd
Cla$DecDistinct
Cla$DecDistinctR
Cla$DecMul
Cla$DecSub
Cla$DecSubR
Cla$DELETEqueue
Cla$DISPLAY
Cla$DPopDec
Cla$DPopLong
Cla$DPushDec
Cla$DPushLong
Cla$DPushReal
Cla$DStack2Stack
Cla$duplicate
Cla$EndEventLoop
Cla$EndEventLoops
Cla$ERRORCODE
Cla$EVENT
Cla$FIELD
Cla$FILEDIALOG
Cla$FileExists
Cla$FILE_APPENDf
Cla$FILE_CLEAR
Cla$FILE_CLOSE
Cla$FILE_CREATE
CLA$FILE_DESTROY
CLA$FILE_FREESTATE
Cla$FILE_GETfk
Cla$FILE_GETfl
CLA$FILE_GETSTATE
Cla$FILE_NEXT
Cla$FILE_OPEN
Cla$FILE_POSITIONf
Cla$FILE_POSITIONk
Cla$FILE_PREV
Cla$FILE_REGETf
Cla$FILE_RESETf
Cla$FILE_RESETk
CLA$FILE_RESTORESTATE
Cla$FILE_SETk
Cla$FILE_SETkk
Cla$FILE_SET_PROPERTY
Cla$FILE_WATCH
Cla$FREEqueue
Cla$FREEqueuea
Cla$freestr
Cla$FreeUfo
Cla$freewindow
Cla$GETINI
Cla$GETPOSITION
Cla$GetPropS
Cla$GETqueueptr
Cla$Group2Ufo
Cla$HALT
Cla$init
Cla$KEYCHAR
Cla$KEYCODE
Cla$loaddec
Cla$Mem2Ufo
Cla$MessageBox
Cla$OPENwindow
Cla$PopCString
Cla$PopReal
Cla$PopString
Cla$PopTemp
Cla$POPUP
Cla$POST
Cla$PushCString
Cla$PushLong
Cla$PushPictDec
Cla$PushReal
Cla$PushString
Cla$PUTINI
Cla$pwopen
Cla$realdistinct
Cla$RECORDSqueue
Cla$rterr
Cla$SELECT
Cla$SETCLIPBOARD
Cla$SETCURSOR
Cla$SETKEYCODE
Cla$SETPOSITION
Cla$SetPropS
Cla$SetPropV
Cla$SORTqueuekey
Cla$Stack2DStack
Cla$StackCLIP
Cla$StackCompareN
Cla$StackCompareNEQ
Cla$StackConcat
Cla$StackConcatR
Cla$StackErrstr
Cla$StackHeap
Cla$StackINSTRING
Cla$StackLEFT
Cla$StackLen
Cla$StackRotate
Cla$StackSUB
Cla$StackUPPER
Cla$StartEventLoop
Cla$STOP
Cla$storecstr
Cla$storestr
Cla$THREAD_FILE
Cla$TODAY
Cla$UPDATE
Cla$VIEW_SETvl
Cla$WHATqueue
Cla$YEAR
Cla$YIELD
THR$GetInstance
VIEWDRIVER
_exit
_free
_malloc
__sysinit
__sysstart

clatps

TOPSPEED

kernel32

GetEnvironmentVariableA

sf232

$GlobalRequest
$GlobalResponse
CALCULATOR@F
CALENDAR@F
CHECKACCESS@FlUcUcOUc
CHECKINISTANDARD@F
CHECKOPEN@FBfOUcOUc
CLOSEFILE@FRlBf
EVAL@FOsb
LOGIN@F
OBRADISELECTED@FRl
OBRADITIMERE@F
ODS@Fsb
OPENFILE@FRlBfOUcOUc
SETENVIRONMENT@F
STANDARDWARNING@FlOsbOsbOsbOsb

shell32

ShellExecuteA

user32

GetDesktopWindow

w_abc

$GLO:GROUP
$INI:STANDARD
$PATH:GROUP
$ThemeManager
CHECK@F16COPYPASTEMANAGER
CONSTRUCT@F12STRINGTHEORY
CONSTRUCT@F8PROFILER
DESTRUCT@F12STRINGTHEORY
DESTRUCT@F8PROFILER
INIT@F16COPYPASTEMANAGER
OBOJIQUEUE@F19VISUALTHEMESMANAGERlBqlll
POSTAVIFONT@F19VISUALTHEMESMANAGERBw
POSTAVITEMU@F19VISUALTHEMESMANAGER
POSTAVIVISINUPROZORA@F19VISUALTHEMESMANAGERl
REGISTERPROCEDURE@F8PROFILERsbsb
TYPE$COPYPASTEMANAGER
TYPE$PROFILER
VMT$COPYPASTEMANAGER
VMT$PROFILER
VMT$STRINGTHEORY

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 188KB - Virtual size: 250KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cwtls
Size: 66KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9d086c61f96e0470a25181254075238a

Headers

DLL Characteristics

File Characteristics

Imports

claasc

clados

claole

clarun

clatps

kernel32

sf232

shell32

user32

w_abc

Sections

.text Size: 81KB - Virtual size: 81KB

.data Size: 188KB - Virtual size: 250KB

.cwtls Size: 66KB - Virtual size: 1.2MB

.idata Size: 5KB - Virtual size: 5KB

.rsrc Size: 56KB - Virtual size: 55KB

.reloc Size: 22KB - Virtual size: 22KB

.text
Size: 81KB - Virtual size: 81KB

.data
Size: 188KB - Virtual size: 250KB

.cwtls
Size: 66KB - Virtual size: 1.2MB

.idata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 56KB - Virtual size: 55KB

.reloc
Size: 22KB - Virtual size: 22KB