de2be63a68a8bc2d0a828c9b2556cfbfcd698da360cda5a2f5d941f67386e076

Sharing

Copy URL Twitter E-mail

General

Target

de2be63a68a8bc2d0a828c9b2556cfbfcd698da360cda5a2f5d941f67386e076
Size

260KB
MD5

023113571cce339c88e61126c58ac04b
SHA1

1bbd3fb5ff7f4a4cac7b403430058b0308423d55
SHA256

de2be63a68a8bc2d0a828c9b2556cfbfcd698da360cda5a2f5d941f67386e076
SHA512

e5aaef5f3d6b612dee6e570d8c78e87a00babf2b2e06d465bdb8163d7b0a4754756c2ff67f575da42c889ee11d57cd82b24990e68c98ba231bba91b63d41d7e0
SSDEEP

6144:1nAlB3fb80wZ+JfAG6CEnKWZWmpi7oEqEZqcCHK:1A7cZIAGcKQWmU7LZ1CHK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de2be63a68a8bc2d0a828c9b2556cfbfcd698da360cda5a2f5d941f67386e076

Files

de2be63a68a8bc2d0a828c9b2556cfbfcd698da360cda5a2f5d941f67386e076
.exe windows:4 windows x86 arch:x86

dc10ce74da3de7f2825a147192680d0b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_iob
?terminate@@YAXXZ
_onexit
__CxxFrameHandler
__dllonexit
??1type_info@@UAE@XZ
_endthreadex
_beginthreadex
_except_handler3
sprintf
isdigit
printf
perror
_errno
strerror
fflush
sscanf
calloc
strcat
toupper
fputc
wcscat
strtok
_ftol
rand
srand
__set_app_type
fseek
ftell
malloc
free
exit
strncmp
atof
memcmp
strchr
strncat
vsprintf
fprintf
system
atoi
strcpy
_memccpy
_stricmp
fgets
fopen
fread
strcmp
fclose
time
gmtime
strftime
memmove
memcpy
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
_CxxThrowException
??0exception@@QAE@ABV0@@Z
_vsnprintf
strlen
strncpy
memset
strstr
??2@YAPAXI@Z
??3@YAXPAX@Z
_purecall
_EH_prolog
_controlfp
fwrite
_strdup

msvcp60

?_Xran@std@@YAXXZ
?_Xlen@std@@YAXXZ

kernel32

GetStartupInfoA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
TlsGetValue
SetLastError
TlsFree
TlsAlloc
GetExitCodeThread
ReleaseSemaphore
CreateSemaphoreA
GetCurrentProcessId
SetThreadPriority
RaiseException
TlsSetValue
DeleteCriticalSection
InitializeCriticalSection
WaitForMultipleObjects
CreateEventA
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
DuplicateHandle
InterlockedIncrement
GetThreadPriority
EnterCriticalSection
LeaveCriticalSection
ResumeThread
WaitForSingleObject
ResetEvent
InterlockedDecrement
CreateThread
TransactNamedPipe
MultiByteToWideChar
GetLastError
GetSystemDirectoryA
CopyFileA
GetModuleFileNameA
OpenProcess
GetModuleHandleA
OutputDebugStringA
FreeConsole
AllocConsole
GetStdHandle
WriteFile
CreateNamedPipeA
WaitNamedPipeA
CreateFileA
TerminateProcess
GetTickCount
Sleep
FreeLibrary
GetProcAddress
LoadLibraryA
DeleteFileA
CreateProcessA
ExpandEnvironmentStringsA
GetComputerNameA
GetVersionExA
GlobalMemoryStatus
ReadFile
CloseHandle

user32

ExitWindowsEx
wsprintfA

advapi32

CloseServiceHandle
RegQueryValueExA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceA
OpenServiceA
ControlService
DeleteService
OpenSCManagerA
CreateServiceA
RegSetValueExA
ChangeServiceConfig2A
RegDeleteValueA
RegCreateKeyExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetUserNameA
RegOpenKeyExA
RegCloseKey

shell32

ShellExecuteA

ws2_32

WSAGetLastError
recv
send
getsockname
getpeername
ioctlsocket
gethostbyname
inet_ntoa
gethostbyaddr
ntohs
select
gethostname
htonl
sendto
setsockopt
WSASocketA
WSASetLastError
getsockopt
getservbyname
shutdown
inet_addr
__WSAFDIsSet
accept
bind
listen
closesocket
socket
htons
connect
WSACleanup
WSAIoctl
WSAStartup

mpr

WNetCancelConnection2W
WNetAddConnection2W

psapi

GetModuleBaseNameA
EnumProcessModules
EnumProcesses

dnsapi

DnsQuery_A

Sections

.text
Size: 164KB - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.diabloz
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

dc10ce74da3de7f2825a147192680d0b

Headers

File Characteristics

Imports

msvcrt

msvcp60

kernel32

user32

advapi32

shell32

ws2_32

mpr

psapi

dnsapi

Sections

.text Size: 164KB - Virtual size: 162KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 52KB - Virtual size: 60KB

.diabloz Size: 16KB - Virtual size: 16KB

.text
Size: 164KB - Virtual size: 162KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 52KB - Virtual size: 60KB

.diabloz
Size: 16KB - Virtual size: 16KB