01ee34a94927edc38d1947a06e990450N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

01ee34a94927edc38d1947a06e990450N.exe
Size

113KB
MD5

01ee34a94927edc38d1947a06e990450
SHA1

053170c2c2f4358990075597faabbf57b1e73fe4
SHA256

29e7dc056f0cee28784681dc839ccbc6f851e4d3d5126ad5d7423ca600531763
SHA512

a70af5a90b6b88b5b98fa9f0fcf1313474315bead05e8ded0ac6a6cc6ea38d0a1b3e06ada45ff9c536965eb39d904865e3394edfa15b04d0e07d23f4567a9835
SSDEEP

3072:BPX4aPQeau594EB3RUN46ILJ9+ZB5yOJst:BsKErts

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01ee34a94927edc38d1947a06e990450N.exe

Files

01ee34a94927edc38d1947a06e990450N.exe
.dll windows:4 windows x86 arch:x86

be4d6a983725b90d3e2ee2ce20d76b89

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msi

ord46
ord48
ord34
ord145
ord118
ord103
ord170
ord120
ord73
ord171
ord74
ord163
ord160
ord159
ord121
ord125
ord17
ord8
ord114
ord67
ord70
ord147
ord47
ord144
ord31
ord158
ord20
ord117
ord58
ord204
ord112
ord189
ord124
ord32
ord49

kernel32

CreateProcessW
InterlockedExchange
SetEndOfFile
TerminateProcess
OpenProcess
lstrcmpiA
FreeLibrary
lstrcmpW
OpenMutexA
Sleep
lstrcatW
FindClose
lstrcmpiW
FindNextFileA
FindNextFileW
FindFirstFileA
FindFirstFileW
RemoveDirectoryA
lstrcatA
lstrcpyA
lstrcpynA
GetLocaleInfoA
GetLastError
UnlockFile
WriteFile
LockFile
SetFilePointer
ReadFile
GetExitCodeProcess
CloseHandle
WaitForSingleObject
DeleteFileA
DeleteFileW
CreateProcessA
RaiseException
GetStdHandle
GetCurrentProcess
LocalAlloc
LocalFree
WideCharToMultiByte
lstrlenA
GetVersionExA
LoadLibraryA
GetProcAddress
lstrcmpA
GetTempPathW
GetTempFileNameW
CreateFileW
GetTempPathA
GetTempFileNameA
CreateFileA
DuplicateHandle

user32

GetWindowThreadProcessId
PostMessageA
IsWindow
GetWindowTextW
EnumWindows
GetWindowLongA
wsprintfW
wsprintfA
GetForegroundWindow
MessageBoxW
EnumChildWindows
SendMessageA
GetClassNameA

comdlg32

GetOpenFileNameA

ole32

CoCreateInstance
CoInitialize
CoTaskMemFree
CoUninitialize

Exports

Exports

AI_AuthorSinglePackage
AI_ResolveKnownFolders
AI_SearchOfficeAddins
ActiveInternetConnection
AddCaspolSecurityPolicy
BrowseForFile
CheckFreeTCPPort
CheckIfUserExists
CloseApplication
ComputeReplaceProductsList
CreateExeProcess
DeleteEmptyDirectory
DeleteFromComboBox
DeleteFromListBox
DeleteShortcuts
DetectProcess
DetectService
EnumStartedServices
ExtractComboBoxData
ExtractListBoxData
GetArpIconPath
GetFreeTCPPort
GetVideoMemory
IsRunningOnVM
JoinFiles
LaunchApp
LaunchLogFile
LoadShortcutDirs
LogOnAsAService
MsgBox
MsmTrialMessage
PlayAudioFile
PopulateComboBox
PopulateListBox
PrepareUpgrade
PreserveInstallType
PrintRTF
RemoveCaspolSecurityPolicy
RequiredJdkExists
RequiredJreExists
ResolveKnownFolder
ResolveServiceProperties
RestoreLocation
RunAsAdmin
RunFinishActions
SetLatestVersionPath
StopProcess
TrialMessage
UninstallPreviousVersions
UpdateInstallMode
UpdateMsiEditControls
ViewReadMe
WarningMessageBox

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 721B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

be4d6a983725b90d3e2ee2ce20d76b89

Headers

DLL Characteristics

File Characteristics

Imports

msi

kernel32

user32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 16KB - Virtual size: 16KB

.data Size: 1024B - Virtual size: 721B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 1024B - Virtual size: 721B

.reloc
Size: 2KB - Virtual size: 2KB