fcb8fd2e384b1d2232f7a28a054d3f0245821667718dfc9ed9c675be9789ad26

Sharing

Copy URL

Twitter E-mail

General

Target

fcb8fd2e384b1d2232f7a28a054d3f0245821667718dfc9ed9c675be9789ad26
Size

713KB
MD5

7f0deef3acf441b2cd596ebf494ea120
SHA1

81edc2f218c115af362d95ca63b59cfdd4a8913a
SHA256

fcb8fd2e384b1d2232f7a28a054d3f0245821667718dfc9ed9c675be9789ad26
SHA512

b94a3bea721e9fa9526245faf29b11231417927061a4484482240bcb21ac4399862ddef9999c473fd85e5a07107e88f56dcf3fcf6517ad3c57be10428a5dd3f2
SSDEEP

12288:rgw5ulv1AtcY8vwmCDA1viqRnQC36VslnyBD4wxoKAxdw:rghlv1AtcYDmEA1viAgVewx3Axq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fcb8fd2e384b1d2232f7a28a054d3f0245821667718dfc9ed9c675be9789ad26

Files

fcb8fd2e384b1d2232f7a28a054d3f0245821667718dfc9ed9c675be9789ad26
.exe windows:6 windows x86 arch:x86

2b99bd8ba4e250bc88271c196822ace9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLogicalDriveStringsA
GetDiskFreeSpaceExA
lstrcmpA
VirtualFree
RtlZeroMemory
InterlockedExchangeAdd
InterlockedIncrement
InterlockedDecrement
HeapDestroy
HeapCreate
lstrlenW
lstrcmpW
lstrcmpiW
CreateMutexA
WaitForSingleObject
ReleaseMutex
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateTimerQueue
GetSystemTimeAsFileTime
GetLocalTime
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
DeleteTimerQueueEx
HeapReAlloc
ExitProcess
GetModuleHandleA
IsBadReadPtr
GetModuleFileNameA
CreateDirectoryA
DeleteFileA
CreateProcessA
GetStartupInfoA
GetUserDefaultLCID
Sleep
WriteFile
SetFilePointer
GetFileSize
GetPrivateProfileStringA
GetTickCount
WritePrivateProfileStringA
FindClose
FindFirstFileA
FindNextFileA
CopyFileA
SetFileAttributesA
RemoveDirectoryA
FreeLibrary
GetProcAddress
Process32First
LCMapStringA
CreateFileW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapSize
SetFilePointerEx
lstrcpynA
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetFileType
DecodePointer
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
SetLastError
RaiseException
CreateToolhelp32Snapshot
WideCharToMultiByte
lstrlenA
GetCurrentThreadId
LocalSize
GetModuleHandleW
MultiByteToWideChar
HeapAlloc
GetLastError
ReadFile
CloseHandle
GetFileSizeEx
CreateFileA
CreateThread
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
GetTimeFormatA
GetDateFormatA
HeapFree
GetProcessHeap
RtlUnwind
GetCurrentProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
OpenProcess
Module32First
LCMapStringW
Process32Next
RtlMoveMemory
VirtualAlloc
LoadLibraryA
WriteConsoleW

user32

ShowWindow
RegisterClassExW
LoadCursorW
DefWindowProcW
SystemParametersInfoW
LoadIconW
CreateWindowExW
UpdateLayeredWindow
SetWindowsHookExW
TranslateMessage
DispatchMessageW
CallNextHookEx
MapVirtualKeyA
GetMessageW
CallWindowProcW
BeginPaint
GetClientRect
IntersectRect
EndPaint
GetFocus
SetFocus
SetCapture
ReleaseCapture
ScreenToClient
IsRectEmpty
IsZoomed
PtInRect
MessageBeep
MessageBoxA
wsprintfA
wvsprintfA
RemovePropA
InvalidateRect
ReleaseDC
GetDC
OffsetRect
GetWindowRect
DefWindowProcA
GetPropA
SetPropA
SetWindowLongW
GetWindowLongW
IsWindow

gdi32

DeleteDC
DeleteObject
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetObjectA
GetCurrentObject
BitBlt

advapi32

CryptHashData
CryptDestroyHash
CryptAcquireContextA
CryptGetHashParam
CryptReleaseContext
CryptDecrypt
CryptDestroyKey
CryptEncrypt
CryptDeriveKey
CryptCreateHash

ole32

CoUninitialize
CreateStreamOnHGlobal
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
OleRun
CoInitialize

oleaut32

SafeArrayAllocDescriptor
SafeArrayAllocData
RegisterTypeLi
SafeArrayGetElemsize
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit
SafeArrayGetDim
VariantTimeToSystemTime
SysAllocString
SysFreeString
SafeArrayCreate
SafeArrayDestroy
VariantClear
VariantCopy
VariantChangeType
VarR8FromCy
VarR8FromBool
LHashValOfNameSys
LoadTypeLi

ws2_32

WSAStartup
WSAGetLastError
WSACleanup

gdiplus

GdipCreateFromHDC
GdiplusStartup
GdipLoadImageFromStream
GdipDrawImageRect
GdipDisposeImage
GdiplusShutdown
GdipGetImageDimension
GdipDeleteGraphics

ntdll

RtlComputeCrc32
NtQueryInformationProcess
NtQuerySystemInformation
RtlGetCompressionWorkSpaceSize
RtlCompressBuffer
RtlDecompressBuffer

shlwapi

PathRemoveBackslashA
PathFileExistsA
StrToIntW
StrToIntExW
PathFindFileNameA
PathRemoveFileSpecA

shell32

ShellExecuteA

comdlg32

GetOpenFileNameW
GetSaveFileNameA

imm32

ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
ImmSetCandidateWindow

Sections

.text
Size: 571KB - Virtual size: 571KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 53KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2b99bd8ba4e250bc88271c196822ace9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

ws2_32

gdiplus

ntdll

shlwapi

shell32

comdlg32

imm32

Sections

.text Size: 571KB - Virtual size: 571KB

.rdata Size: 47KB - Virtual size: 46KB

.data Size: 53KB - Virtual size: 104KB

.rsrc Size: 18KB - Virtual size: 18KB

.reloc Size: 21KB - Virtual size: 21KB

.text
Size: 571KB - Virtual size: 571KB

.rdata
Size: 47KB - Virtual size: 46KB

.data
Size: 53KB - Virtual size: 104KB

.rsrc
Size: 18KB - Virtual size: 18KB

.reloc
Size: 21KB - Virtual size: 21KB