33488260248ca21e49453a2ed09aec01a77bf8c370cb30c94712cd44d6f5bb02

Sharing

Copy URL

Twitter E-mail

General

Target

33488260248ca21e49453a2ed09aec01a77bf8c370cb30c94712cd44d6f5bb02
Size

535KB
MD5

1bc5de3350d9567a75466d129d28d4ab
SHA1

2009b6b50393d1f562f5a0839720a2ad9f484f6e
SHA256

33488260248ca21e49453a2ed09aec01a77bf8c370cb30c94712cd44d6f5bb02
SHA512

dc0472ee11643c7e480ce5c7414f04188a9d6e39603f9b166f97d37d7b49603a53c71c624d0beee6187b53e3375d746edf2c7dec6e83734e58809014cd379216
SSDEEP

6144:04iM9cvZ96ZquA8Gza2h6D9yg1w6Q5YQKIk+5lUl3d3W2a3n0KJhRs3Jjhaq:04iM9E96ZxEa2h6fe53u+7Yd3WHnJaaq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
33488260248ca21e49453a2ed09aec01a77bf8c370cb30c94712cd44d6f5bb02

Files

33488260248ca21e49453a2ed09aec01a77bf8c370cb30c94712cd44d6f5bb02
.dll windows:5 windows x86 arch:x86

f351b99e01f18bb326e9df57466624f2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

P:\intermoutput\s\safehmpg__1_0_0\Release\Safehmpg.pdb

Imports

kernel32

GetCurrentProcess
WaitForSingleObject
IsBadReadPtr
SetLastError
GetCurrentThreadId
FlushInstructionCache
EnterCriticalSection
LeaveCriticalSection
GetPrivateProfileIntA
GetPrivateProfileStringA
GetPrivateProfileSectionA
lstrcpynA
GetModuleFileNameW
GetCurrentProcessId
DeviceIoControl
CreateFileA
CreateThread
Sleep
GetCurrentThread
TerminateProcess
CreateProcessW
OutputDebugStringW
LoadLibraryA
TlsAlloc
TlsFree
IsDebuggerPresent
WriteProcessMemory
lstrcmpiW
Process32Next
Process32First
CreateToolhelp32Snapshot
FindClose
FindNextFileA
FindFirstFileA
GetVersionExA
GetSystemInfo
VirtualProtect
LocalFree
LocalAlloc
VirtualFreeEx
VirtualAllocEx
UnmapViewOfFile
CreateFileMappingA
GetSystemDirectoryW
DeleteFileW
RaiseException
IsDBCSLeadByte
GetProcAddress
lstrcmpiA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
LoadLibraryExA
InitializeCriticalSectionAndSpinCount
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
HeapDestroy
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetStdHandle
HeapSize
ExitProcess
HeapReAlloc
GetTickCount
WriteFile
CreateFileW
GetFileSize
ReadFile
CloseHandle
MapViewOfFileEx
InitializeCriticalSection
FindResourceA
LoadResource
SizeofResource
FreeLibrary
WideCharToMultiByte
GetLastError
lstrlenW
MultiByteToWideChar
GetModuleFileNameA
lstrlenA
GetModuleHandleA
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
InterlockedCompareExchange
GetCPInfo
LCMapStringW
LCMapStringA
GetCommandLineA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
RtlUnwind
SuspendThread
SetThreadContext
GetThreadContext
ResumeThread
VirtualQuery
GetFileType
SetFilePointer
SystemTimeToFileTime
LocalFileTimeToFileTime
GetFileSizeEx
SetFilePointerEx
CreateMutexA
GetEnvironmentVariableA
SetEnvironmentVariableA
OpenThread
TlsSetValue
TlsGetValue
ReleaseMutex
GetSystemTimeAsFileTime
OutputDebugStringA
LoadLibraryW
FormatMessageW
GetSystemTime
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedExchange
GetConsoleCP

user32

RegisterClassExA
CharNextA
PostMessageA
IsWindow
SetWindowPos
UnregisterClassA
DestroyWindow
DefWindowProcA
CreateWindowExA
CharLowerA
EndPaint
BeginPaint
KillTimer
GetWindowTextW
SetWindowTextW
FindWindowExW
GetClassNameW
GetWindowRect
GetClientRect
GetSystemMetrics
IsWindowVisible
GetParent
CallWindowProcA
GetWindowLongA
LoadBitmapA
LoadCursorA
GetClassInfoExA
EnumChildWindows
GetClassNameA
LoadStringA
SetTimer
SetWindowLongA

gdi32

CreateCompatibleBitmap
SetViewportOrgEx
SelectObject
CreateCompatibleDC
BitBlt
DeleteDC
DeleteObject

advapi32

RegCreateKeyW
RegOpenKeyA
RegEnumKeyA
RegOpenKeyExW
RegQueryValueExW
RegQueryValueExA
RegQueryInfoKeyA
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyExW

shell32

SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
ord102
SHBindToParent
CommandLineToArgvW

ole32

CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoUninitialize
CoInitialize

oleaut32

VarUI4FromStr
SysFreeString

shlwapi

StrStrA
StrStrIA
PathMatchSpecW
PathUnquoteSpacesW
PathFileExistsW
PathAppendW
UrlGetPartA
StrStrIW
StrChrW
StrCmpNIA
StrCmpIW
SHGetValueA
StrStrW
PathCombineW
StrCmpNIW
PathFileExistsA
PathRemoveFileSpecA
PathCombineA
PathAppendA
PathFindFileNameA
SHGetValueW
UrlGetPartW
SHSetValueW
StrRetToBufW
AssocCreate

comctl32

_TrackMouseEvent

psapi

GetModuleBaseNameA
EnumProcessModules
GetModuleInformation

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

wininet

InternetCrackUrlA

Exports

Exports

SafehmpgHelper
SafehmpgHelper001
SafehmpgHelper002
SafehmpgHelper003
SafehmpgHelper004

Sections

.text
Size: 388KB - Virtual size: 387KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.share
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f351b99e01f18bb326e9df57466624f2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

psapi

version

wininet

Exports

Exports

Sections

.text Size: 388KB - Virtual size: 387KB

.rdata Size: 59KB - Virtual size: 58KB

.data Size: 27KB - Virtual size: 38KB

.share Size: 512B - Virtual size: 12B

.rsrc Size: 25KB - Virtual size: 24KB

.reloc Size: 28KB - Virtual size: 27KB

.text
Size: 388KB - Virtual size: 387KB

.rdata
Size: 59KB - Virtual size: 58KB

.data
Size: 27KB - Virtual size: 38KB

.share
Size: 512B - Virtual size: 12B

.rsrc
Size: 25KB - Virtual size: 24KB

.reloc
Size: 28KB - Virtual size: 27KB