e64f8b48e802e5321699ae46781fcaf1d75a44a7de3e98a78903849cd4473cfd

Sharing

Copy URL Twitter E-mail

General

Target

e64f8b48e802e5321699ae46781fcaf1d75a44a7de3e98a78903849cd4473cfd
Size

2.4MB
MD5

44b597d1df78d065934a2e40f7edca36
SHA1

17fcd56478ef3aa011cab74b00cd89acbfcc9204
SHA256

e64f8b48e802e5321699ae46781fcaf1d75a44a7de3e98a78903849cd4473cfd
SHA512

6dc59ce0586ee5060ec2a9bb553c196bdaad64dfcaf6850047bc9704c41172598788d9bdfb3b3e27d8aedfa8634c53aef50c14fc5623a450d7eec2d6eaeefd95
SSDEEP

49152:8+3vKMBp8+F+DMOEgMvHLik2TBjS+HASrXZxDEMML7UMOEpdv4Fe3kGaIbPFuCeQ:B3vKMBGAkEFvriZBj5ASrpxDbenF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e64f8b48e802e5321699ae46781fcaf1d75a44a7de3e98a78903849cd4473cfd

Files

e64f8b48e802e5321699ae46781fcaf1d75a44a7de3e98a78903849cd4473cfd
.exe windows:5 windows x86 arch:x86

90c5112cc0c5f98f59d0cd8bf2af7e3a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Code\git\icshg\Release\AD-ESS.pdb

Imports

kernel32

FreeEnvironmentStringsW
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
InitializeCriticalSectionAndSpinCount
CreatePipe
GetStartupInfoA
SetHandleCount
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
GetStdHandle
LCMapStringW
LCMapStringA
IsValidCodePage
GetACP
GetCPInfo
GetFileType
SetStdHandle
RaiseException
RtlUnwind
HeapValidate
ExitThread
GetDateFormatA
GetTimeFormatA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapCreate
GetFileAttributesA
HeapDestroy
GetSystemTimeAsFileTime
UnlockFileEx
WaitForSingleObjectEx
LockFile
FlushViewOfFile
UnlockFile
SetEndOfFile
TryEnterCriticalSection
HeapCompact
CreateMutexW
HeapReAlloc
GetFullPathNameA
GetFullPathNameW
SetFileAttributesW
SuspendThread
VirtualProtect
FlushInstructionCache
VirtualQuery
SetThreadContext
VirtualProtectEx
CreateProcessA
VirtualQueryEx
AreFileApisANSI
GetLastError
WritePrivateProfileStringA
lstrcpynA
GetVolumeInformationA
GetLogicalDrives
LoadLibraryExA
FormatMessageA
ExpandEnvironmentStringsA
IsBadStringPtrW
GlobalMemoryStatusEx
GetDiskFreeSpaceW
GetProcessTimes
GetLogicalDriveStringsW
GetDriveTypeW
GetSystemDirectoryA
VirtualAlloc
VirtualFree
GetCurrentThread
GetThreadContext
GetFileAttributesW
ReadDirectoryChangesW
GetNativeSystemInfo
ReadFile
LoadLibraryA
FindNextFileW
FindClose
GetPrivateProfileIntW
GetTempPathW
GetPrivateProfileStringW
FindFirstFileW
GetModuleFileNameA
GetPrivateProfileStringA
GetOEMCP
GetExitCodeProcess
GetComputerNameA
ResumeThread
GetTempPathA
GetLocaleInfoW
GetVersion
InterlockedIncrement
LocalAlloc
lstrcmpW
lstrcpynW
GetSystemTime
GetWindowsDirectoryW
QueryPerformanceFrequency
GetFileTime
CreateToolhelp32Snapshot
GetModuleHandleA
Process32NextW
GetSystemInfo
DeviceIoControl
CompareStringA
GlobalFlags
GetFileSizeEx
TlsFree
Process32FirstW
MoveFileW
TerminateProcess
GetVersionExW
ReadProcessMemory
GetSystemDirectoryW
InterlockedCompareExchange
CreateDirectoryW
QueryPerformanceCounter
InterlockedDecrement
SystemTimeToFileTime
CreateFileA
ExitProcess
FileTimeToLocalFileTime
ProcessIdToSessionId
FileTimeToSystemTime
LoadLibraryW
GetFileSize
OutputDebugStringA
GetCurrentThreadId
DeleteCriticalSection
IsDebuggerPresent
GetLocalTime
DeleteFileA
GetVersionExA
GetFileAttributesExW
GetDiskFreeSpaceA
CreateFileMappingA
LockFileEx
FreeLibrary
HeapSize
EnterCriticalSection
FlushFileBuffers
WritePrivateProfileStringW
CreateFileW
LeaveCriticalSection
FormatMessageW
InitializeCriticalSection
WriteFile
GetTickCount
OutputDebugStringW
SetFilePointer
GetCurrentProcessId
DeleteFileW
WinExec
SetProcessShutdownParameters
OpenEventW
CreateEventW
LockResource
GlobalFree
GetProcAddress
SetLastError
GlobalUnlock
lstrlenW
MultiByteToWideChar
SizeofResource
CopyFileW
WideCharToMultiByte
GlobalAlloc
OpenProcess
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
lstrcmpA
GetModuleHandleW
SetThreadExecutionState
SetEvent
GlobalLock
GetCurrentProcess
LoadResource
FindResourceW
lstrlenA
CreateThread
CloseHandle
CreateFileMappingW
InterlockedExchange
GetModuleFileNameW
Sleep
TerminateThread
GetProcessHeap
WaitForSingleObject
HeapFree
HeapAlloc
CreateProcessW
UnmapViewOfFile
MapViewOfFile
LocalFree
GetStartupInfoW
SetEnvironmentVariableA
GetEnvironmentStrings
FreeEnvironmentStringsA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetCommandLineW
GlobalAddAtomW
GlobalFindAtomW
DuplicateHandle
GetVolumeInformationW
CompareStringW
GlobalDeleteAtom
GetEnvironmentStringsW

user32

SetForegroundWindow
SetMenu
GetKeyState
MapWindowPoints
PeekMessageW
GetMessagePos
GetMessageTime
GetTopWindow
GetDlgItem
GetLastActivePopup
GetForegroundWindow
GetWindowTextW
RemovePropW
GetPropW
SetPropW
GetClassNameW
GetClassLongW
CallNextHookEx
SetWindowsHookExW
GetCapture
WinHelpW
SetWindowTextW
GetSysColorBrush
ReleaseDC
GetDC
ClientToScreen
DestroyMenu
ValidateRect
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
PostMessageW
GetClientRect
DispatchMessageW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
GetDlgCtrlID
CallWindowProcW
CopyRect
MessageBoxA
PtInRect
GetMenu
GetWindowLongW
SetWindowLongW
GetSystemMetrics
FindWindowW
SystemParametersInfoW
GetWindowThreadProcessId
wsprintfW
EndPaint
DestroyWindow
TranslateAcceleratorW
GetMessageW
PostQuitMessage
LoadCursorW
SendMessageW
GetParent
EnableWindow
IsWindow
IsWindowEnabled
GetFocus
UnhookWindowsHookEx
GetSubMenu
BeginPaint
TranslateMessage
LoadAcceleratorsW
RegisterClassExW
LoadIconW
DefWindowProcW
UpdateWindow
MessageBoxW
CreateWindowExW
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
RegisterWindowMessageW
CharUpperW
GetMenuState
GetMenuItemID
GetMenuItemCount
ShowWindow
LoadStringW

advapi32

LookupAccountSidW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
AllocateAndInitializeSid
AddAccessAllowedAce
FreeSid
GetLengthSid
CreateServiceW
CloseServiceHandle
OpenProcessToken
DeleteService
OpenSCManagerW
OpenServiceW
RegisterServiceCtrlHandlerExW
LookupPrivilegeValueW
ChangeServiceConfig2W
StartServiceW
QueryServiceStatus
SetServiceStatus
ControlService
AdjustTokenPrivileges
GetTokenInformation
RegCreateKeyExW
RegQueryValueExW
CreateProcessAsUserW
SetTokenInformation
LookupAccountNameW
DuplicateTokenEx
RegOpenKeyExW
CheckTokenMembership
RegCloseKey
RegSetValueExW
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyW
RegEnumKeyExA
RegQueryInfoKeyA
ProcessTrace
ControlTraceW
CloseTrace
StartTraceW
OpenTraceW
EnableTrace
ControlTraceA
OpenTraceA
StartTraceA
IsValidAcl
GetFileSecurityW
GetSecurityDescriptorOwner
IsValidSid
IsValidSecurityDescriptor
ConvertSecurityDescriptorToStringSecurityDescriptorW
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
RegEnumValueA
ImpersonateLoggedOnUser
RevertToSelf
GetUserNameA
OpenEventLogW
GetOldestEventLogRecord
GetNumberOfEventLogRecords
ReadEventLogW
ReadEventLogA
CloseEventLog
RegQueryInfoKeyW
RegEnumKeyExW
RegSetKeySecurity
RegDeleteValueW
RegEnumValueW
StartServiceCtrlDispatcherW

shell32

CommandLineToArgvW
SHCreateDirectoryExW
ord165
SHCreateDirectoryExA
ShellExecuteExW
ShellExecuteW

ole32

CoCreateInstance
CoInitialize
CoSetProxyBlanket
StringFromGUID2
CoInitializeSecurity
CoInitializeEx
CoUninitialize

oleaut32

VariantChangeType
VariantInit
SafeArrayGetElement
SafeArrayDestroy
SysFreeString
VariantClear
SysAllocString

shlwapi

StrStrA
PathIsUNCW
PathFindFileNameW
wnsprintfW
PathAppendA
PathRemoveFileSpecA
PathRemoveFileSpecW
StrCpyNW
StrStrW
PathIsDirectoryW
StrCmpIW
PathAppendW
PathFileExistsW
PathStripToRootW
StrStrIW
PathFileExistsA

wtsapi32

WTSQuerySessionInformationA
WTSQuerySessionInformationW
WTSEnumerateProcessesW
WTSEnumerateSessionsW
WTSFreeMemory

iphlpapi

GetUdpTable
GetIpNetTable
GetIfEntry
GetIpAddrTable
GetIpForwardTable
GetAdaptersInfo
GetTcpTable

ws2_32

sendto
WSACleanup
setsockopt
shutdown
htons
WSAGetLastError
WSASocketW
htonl
inet_addr
recvfrom
bind
inet_ntoa
gethostname
WSAAddressToStringW
ntohl
send
WSASetLastError
recv
getsockname
ntohs
select
connect
WSAIoctl
ioctlsocket
socket
closesocket
WSAStartup
gethostbyname

netapi32

NetWkstaGetInfo
NetUserEnum
NetUserGetInfo
NetApiBufferFree

psapi

EnumProcessModules
GetModuleBaseNameA

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

setupapi

SetupDiGetDeviceRegistryPropertyA
SetupDiGetClassDevsA
CM_Get_Device_IDA
SetupDiGetDeviceInstallParamsW
SetupDiEnumDeviceInterfaces
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status
SetupDiCallClassInstaller
SetupDiGetDeviceInterfaceDetailW
SetupDiChangeState
SetupDiSetClassInstallParamsW
SetupDiGetClassDevsW

secur32

LsaEnumerateLogonSessions
LsaGetLogonSessionData
LsaFreeReturnBuffer

oleacc

LresultFromObject
CreateStdAccessibleObject

gdi32

GetStockObject
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutW
RectVisible
PtVisible
SetMapMode
RestoreDC
SaveDC
ExtTextOutW
DeleteObject
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
GetDeviceCaps

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

comdlg32

GetFileTitleW

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 550KB - Virtual size: 549KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 136KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

90c5112cc0c5f98f59d0cd8bf2af7e3a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

wtsapi32

iphlpapi

ws2_32

netapi32

psapi

userenv

setupapi

secur32

oleacc

gdi32

winspool.drv

comdlg32

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 550KB - Virtual size: 549KB

.data Size: 136KB - Virtual size: 164KB

.detourc Size: 4KB - Virtual size: 4KB

.detourd Size: 512B - Virtual size: 12B

.rsrc Size: 134KB - Virtual size: 134KB

.reloc Size: 91KB - Virtual size: 91KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 550KB - Virtual size: 549KB

.data
Size: 136KB - Virtual size: 164KB

.detourc
Size: 4KB - Virtual size: 4KB

.detourd
Size: 512B - Virtual size: 12B

.rsrc
Size: 134KB - Virtual size: 134KB

.reloc
Size: 91KB - Virtual size: 91KB