bb568078e56104edea9b27dfe75759486d975c1253bcbaba11923699af758b80

Sharing

Copy URL Twitter E-mail

General

Target

bb568078e56104edea9b27dfe75759486d975c1253bcbaba11923699af758b80
Size

24KB
MD5

c1393e77773a48b1eea117a302138554
SHA1

5dd8f29caa4ea533837d7688f84d4a1fa1d4c053
SHA256

bb568078e56104edea9b27dfe75759486d975c1253bcbaba11923699af758b80
SHA512

04df453983ebd36f31655187066dc29cf0dbd5d85dca2fb5f96ce516b920029f43c381163cba43a86511c098e343b481120133d38b62558d76f1d54f60edb8c0
SSDEEP

384:41qWK8JD6K9uySsOJFup7uY8yoRHJQ9Qjq8c6fa4BsJLfJx2nWCl8hbW5:41QsO+N8ymHJCDZI+hT3h4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bb568078e56104edea9b27dfe75759486d975c1253bcbaba11923699af758b80

Files

bb568078e56104edea9b27dfe75759486d975c1253bcbaba11923699af758b80
.exe windows:4 windows x86 arch:x86

1159e3d90a3a5c52b16b37efcb74c07a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

HttpOpenRequestA
HttpAddRequestHeadersA
InternetConnectA
InternetSetOptionA
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetReadFile
HttpSendRequestA
InternetQueryOptionA

ws2_32

recv
inet_ntoa
gethostbyname
send

kernel32

ExitProcess
GetLastError
CloseHandle
TerminateProcess
FreeConsole
GetComputerNameExA
WaitForSingleObject
CreateThread
SetCurrentDirectoryA
GetWindowsDirectoryA
CreatePipe
Sleep
GetComputerNameA
WriteConsoleInputA
CreateFileA
AllocConsole
AttachConsole
CreateProcessA
GetConsoleDisplayMode
GetVersionExA
ReadFile
PeekNamedPipe
GetExitCodeProcess
SetStdHandle
GetVolumeInformationA
GetDriveTypeA
lstrcatA
GetLogicalDrives
Process32Next
Process32First
CreateToolhelp32Snapshot
OpenProcess
WriteFile
GetFileSize
CopyFileA
SetFileAttributesA
CreateDirectoryA
GetCurrentProcess
GetModuleFileNameA
VirtualFree
GetLocalTime
VirtualAlloc
GetSystemDirectoryA
GetStartupInfoA
ExitThread
GlobalFree
WinExec
GetCurrentProcessId

netapi32

NetApiBufferFree
NetUserEnum
DsGetDcNameA

urlmon

URLDownloadToFileA

psapi

GetModuleFileNameExA
EnumProcessModules

shlwapi

PathIsDirectoryA

userenv

GetUserProfileDirectoryA

secur32

GetUserNameExA

msvcrt

memset
__CxxFrameHandler
_EH_prolog
sscanf
strrchr
_mbscmp
free
strcmp
strtok
strncpy
malloc
strstr
strchr
printf
memcpy
__dllonexit
_onexit
_exit
_XcptFilter
exit
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
strcat
_strcmpi
atoi
sprintf
??2@YAPAXI@Z
strcpy
strlen
_stricmp
??3@YAXPAX@Z

mfc42

ord5683
ord533
ord5194
ord6407
ord1997
ord798
ord354
ord5186
ord5442
ord6385
ord1979
ord5583
ord3318
ord6010
ord665
ord860
ord2818
ord5710
ord858
ord4202
ord2915
ord5572
ord800
ord540

advapi32

AdjustTokenPrivileges
RegOpenKeyA
RegDeleteValueA
RegCloseKey
EnumServicesStatusA
LookupPrivilegeValueA
CloseServiceHandle
OpenProcessToken
StartServiceA
OpenServiceA
ControlService
OpenSCManagerA
EnumServicesStatusExA

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1159e3d90a3a5c52b16b37efcb74c07a

Headers

File Characteristics

Imports

wininet

ws2_32

kernel32

netapi32

urlmon

psapi

shlwapi

userenv

secur32

msvcrt

mfc42

advapi32

shell32

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 3KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB