632c11a1ace15911120d6f2bd80277988af0fa7b08b6d6a67b0f0816345e32a9

Sharing

Copy URL Twitter E-mail

General

Target

632c11a1ace15911120d6f2bd80277988af0fa7b08b6d6a67b0f0816345e32a9
Size

13.3MB
MD5

5953fb9a03f09e61a64505d69ea43534
SHA1

31a60a8c57e4c9186fc99c662a533b53eb461609
SHA256

632c11a1ace15911120d6f2bd80277988af0fa7b08b6d6a67b0f0816345e32a9
SHA512

3684b865826cd2520fbe268265fc5e4195cb8fdc56ffabd64f7ae54e22f5da5106ada624d3ebf09c2a979902e9f5b39190871e7073b35c0f37af8cedbbbf409a
SSDEEP

393216:NWBGj+c1ONPSh6BJrSoYl4KiyOwyBa6vz9t6ZWC3:NWBGqo6BJYxvOvBr68C3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
632c11a1ace15911120d6f2bd80277988af0fa7b08b6d6a67b0f0816345e32a9

Files

632c11a1ace15911120d6f2bd80277988af0fa7b08b6d6a67b0f0816345e32a9
.exe windows:5 windows x86 arch:x86

da6c8985e0b6cd0655952d37f0c7d4fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\works\10820.6\UniAccess3_1\src\UniAccessAgent\Prometheus2\lva_setup_exe\Release\lva_setup_exe.pdb

Imports

kernel32

MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
CreateDirectoryW
RemoveDirectoryW
GetFileAttributesExW
FindFirstFileW
FindNextFileW
CopyFileW
GetLogicalDrives
GetDriveTypeW
ReleaseMutex
CreateMutexA
GetVersionExW
OpenFileMappingW
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
SystemTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetVolumeInformationW
LockResource
LoadResource
SizeofResource
LoadLibraryExW
FindResourceW
GetCommandLineW
lstrcmpiA
OpenEventA
GetVolumeNameForVolumeMountPointW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateThread
IsBadReadPtr
QueryPerformanceFrequency
QueryPerformanceCounter
GetEnvironmentVariableA
FindFirstFileA
FindNextFileA
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
FindFirstFileExW
SetStdHandle
EnumSystemLocalesW
GetTimeFormatW
GetDateFormatW
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetACP
GetStdHandle
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
ExitProcess
GetTimeZoneInformation
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
RtlUnwind
OutputDebugStringW
GetCPInfo
LCMapStringW
CompareStringW
SwitchToThread
EncodePointer
GetStringTypeW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
QueryDosDeviceW
GetCurrentDirectoryW
FindClose
LocalAlloc
MoveFileW
DeleteFileW
GetUserDefaultUILanguage
HeapSize
GetLocaleInfoW
GetTempPathW
GetSystemDirectoryW
GetModuleFileNameW
LoadLibraryW
TryEnterCriticalSection
SetLastError
DuplicateHandle
ResumeThread
SuspendThread
LocalFree
FormatMessageW
CreateSemaphoreW
ReleaseSemaphore
SetFilePointerEx
SetEndOfFile
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoA
WideCharToMultiByte
IsValidCodePage
GetFullPathNameW
ExpandEnvironmentStringsW
GetLongPathNameW
GetModuleHandleA
TerminateProcess
FlushFileBuffers
CreateProcessW
SetFileAttributesW
GetFileAttributesW
CreateMutexW
MultiByteToWideChar
DeviceIoControl
GetNativeSystemInfo
CreateEventW
WaitForMultipleObjects
FreeLibrary
LoadLibraryA
InterlockedCompareExchange
CreateIoCompletionPort
GetProcessHeap
HeapAlloc
GetQueuedCompletionStatus
HeapFree
CancelIo
GetTickCount
InterlockedIncrement
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetExitCodeProcess
GetSystemTimeAsFileTime
GetModuleHandleW
ReadFile
GetProcAddress
GetDiskFreeSpaceExW
Sleep
OpenProcess
GetCurrentProcess
GetSystemWindowsDirectoryW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
InterlockedDecrement
EnterCriticalSection
CreateEventA
ResetEvent
SetEvent
WaitForSingleObject
GetFileSizeEx
GetFileTime
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
CloseHandle
CreateFileA
GetLastError
CreateFileW
SetFilePointer
WriteFile
HeapReAlloc
WriteConsoleW

user32

PeekMessageW
MsgWaitForMultipleObjects
SendMessageW
MessageBoxW
EndPaint
BeginPaint
ReleaseDC
InvalidateRect
UpdateWindow
PtInRect
SystemParametersInfoW
PostQuitMessage
KillTimer
UpdateLayeredWindow
GetClientRect
SetCursor
LoadCursorW
LoadIconW
TranslateMessage
TranslateAcceleratorW
SetTimer
DispatchMessageW
ShowWindow
LoadStringW
LoadAcceleratorsW
RegisterClassExW
ScreenToClient
CreateWindowExW
SetWindowPos
GetDC
DefWindowProcW
GetMessageW
GetCursorPos
ClientToScreen
RegisterDeviceNotificationW
UnregisterDeviceNotification

gdi32

SetBkMode
DeleteDC
CreateCompatibleDC
CreateDIBSection
SelectObject
DeleteObject

advapi32

ConvertSidToStringSidW
RegQueryValueExA
StartServiceW
QueryServiceStatusEx
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfigW
SetSecurityInfo
AddAccessAllowedAce
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SetNamedSecurityInfoW
GetNamedSecurityInfoW
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetFileSecurityW
GetSecurityDescriptorSacl
SetSecurityDescriptorControl
GetSecurityDescriptorControl
AddAccessAllowedAceEx
AddAce
InitializeAcl
GetUserNameW
ConvertStringSidToSidW
DuplicateTokenEx
CreateProcessWithLogonW
CreateProcessAsUserW
GetLengthSid
IsValidSid
SetTokenInformation
AllocateAndInitializeSid
LogonUserW
FreeSid
GetTokenInformation
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
GetAclInformation
GetAce
EqualSid
GetFileSecurityW
InitializeSecurityDescriptor
LookupAccountNameW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext

shell32

SHFileOperationW
ShellExecuteExW

ws2_32

freeaddrinfo
getaddrinfo
WSACleanup
WSAStartup
gethostname
ntohl
WSASetLastError
select
inet_addr
WSAGetLastError
socket
connect
htons
__WSAFDIsSet
WSAStringToAddressA
shutdown
getsockname
send
ntohs
inet_ntoa
getsockopt
ioctlsocket
setsockopt
closesocket
recv

gdiplus

GdipGetImageWidth
GdipCreateBitmapFromFile
GdipDeleteStringFormat
GdipGetFontSize
GdipSetStringFormatAlign
GdipCreatePen1
GdipDrawImageI
GdipCreateBitmapFromScan0
GdipDeleteGraphics
GdiplusStartup
GdiplusShutdown
GdipCreateStringFormat
GdipDeleteFontFamily
GdipGetImageHeight
GdipGetFamily
GdipCreateFontFamilyFromName
GdipDrawImageRectRect
GdipCloneImage
GdipDeleteBrush
GdipAlloc
GdipDisposeImageAttributes
GdipDeletePath
GdipDisposeImage
GdipSetSmoothingMode
GdipCreatePath
GdipSetStringFormatLineAlign
GdipCreateFont
GdipCreateSolidFill
GdipGetFontStyle
GdipFillPath
GdipAddPathStringI
GdipCreateImageAttributes
GdipFree
GdipDrawPath
GdipSetImageAttributesWrapMode
GdipSetPenLineJoin
GdipCreateFromHDC
GdipCloneBrush
GdipGetImageGraphicsContext
GdipDeletePen

comctl32

_TrackMouseEvent

rpcrt4

UuidCreate
UuidToStringA
RpcStringFreeA

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

setupapi

SetupDiEnumDeviceInfo
CM_Get_Device_Interface_List_SizeW
CM_Get_Device_Interface_ListW
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_ListW
CM_Get_Device_IDW
SetupDiRemoveDevice
CM_Get_DevNode_Status
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList

dnsapi

DnsQuery_W
DnsFree

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Exports

Exports

CloseZipU
FormatZipMessageU
GetZipItem
OpenZip
SetUnzipBaseDir
UnzipItem

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 283KB - Virtual size: 282KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 670KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 512B - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 794KB - Virtual size: 793KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

lva.man
Size: 443KB - Virtual size: 443KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

lva.x64
Size: 238.9MB - Virtual size: 238.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

lva.ini
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

da6c8985e0b6cd0655952d37f0c7d4fc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ws2_32

gdiplus

comctl32

rpcrt4

userenv

setupapi

dnsapi

version

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 283KB - Virtual size: 282KB

.data Size: 26KB - Virtual size: 670KB

Shared Size: 512B - Virtual size: 1B

.rsrc Size: 794KB - Virtual size: 793KB

.reloc Size: 49KB - Virtual size: 48KB

lva.man Size: 443KB - Virtual size: 443KB

lva.x64 Size: 238.9MB - Virtual size: 238.9MB

lva.ini Size: 8KB - Virtual size: 8KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 283KB - Virtual size: 282KB

.data
Size: 26KB - Virtual size: 670KB

Shared
Size: 512B - Virtual size: 1B

.rsrc
Size: 794KB - Virtual size: 793KB

.reloc
Size: 49KB - Virtual size: 48KB

lva.man
Size: 443KB - Virtual size: 443KB

lva.x64
Size: 238.9MB - Virtual size: 238.9MB

lva.ini
Size: 8KB - Virtual size: 8KB