1b0f5275e7ccd79b12a038cab8e1a340N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

1b0f5275e7ccd79b12a038cab8e1a340N.exe
Size

1.2MB
MD5

1b0f5275e7ccd79b12a038cab8e1a340
SHA1

c6fbe0728f97dd7a4be19ddddd4df90407f0a073
SHA256

5fa98e76f85ce6e63149ceb1af918f7525f223fa3ef4b2256f4742cc0fed93b0
SHA512

14581fa4281ca1695a43662f5f2584409dcdfcee7d97b862ee950fef5826dd4e274ad677ba328597c8887b00b0e46f9aac4382d34efe2078aa25db67a8228cfe
SSDEEP

24576:AD/buZrFWtqfle2e/8G7Dy/ajQgCvZhR1V:AD6qqte2e0G7DhIRhR1V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b0f5275e7ccd79b12a038cab8e1a340N.exe

Files

1b0f5275e7ccd79b12a038cab8e1a340N.exe
.dll windows:4 windows x86 arch:x86

e5f40cccdb3b89a364a5d633478c58a4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ole32

GetHGlobalFromILockBytes
GetHGlobalFromStream
IsAccelerator
CreateILockBytesOnHGlobal
CreateStreamOnHGlobal
OleSave
StgCreateDocfileOnILockBytes

mfolecl

ord209
ord214
ord215
ord211
ord206
ord213
ord208
ord210
ord216
ord217
ord212
ord218

filters

ord2

shell32

ShellExecuteA

msvcrt

_setjmp3
_adjust_fdiv
_initterm
rand
malloc
free
memset
_isctype
strcpy
_ftol
sin

mfdhtml

isJustifyFullEnabledForTextRange
invalidateFilteredCache
MFFGetNextToken
MFFGetNextValue
MFFDeleteUnicode
MFFToUnicode
GetCountryCode
convertALXFiles
getFormatContainerFromElement
AdjustXYForSelectingEnd
GetBodyWidthHeight
GetMFFlag
GetPrimaryTextRange
InsertTextIntoTextRange
MoveTextRangeEnd
GetInnerText
FrameElementFromDocument
CreateTextRangeFromElementCollapseEnd
GetInnerHTML
GetPrimarySelectedElement
isForeColorEnabledForTextRange
isAnchorEnabledForTextRange
isJustifyFullForTextRange
isJustifyRightForTextRange
isJustifyRightEnabledForTextRange
isJustifyCenterForTextRange
isJustifyCenterEnabledForTextRange
isJustifyLeftForTextRange
isJustifyLeftEnabledForTextRange
isUnderlineForTextRange
isUnderlineEnabledForTextRange
isItalicForTextRange
isItalicEnabledForTextRange
isBoldForTextRange
isBoldEnabledForTextRange
isFontSizeEnabledForTextRange
getFontNameForTextRange
InsertHTMLAfter
InsertIntoElement
InsertHTMLAtBody
InsertIntoTextRange
setFontSizeForTextRange
getFontSizeForTextRange
setFontNameForTextRange
setFormatContainer
getFormatContainer
CheckHTTPHeader
setBoldForTextRange
setJustifyCenterForTextRange
setJustifyFullForTextRange
removeAnchorForTextRange
setJustifyRightForTextRange
setItalicForTextRange
setJustifyLeftForTextRange
setUnderlineForTextRange
hasFramesFromFilename
hasFrames
ClearLocalURLCache
SetElementProplist
SetOuterHTML
RemoveActiveX
OnDocumentComplete
ObjectsEqual
OnNavigateComplete2
GetSelectedElements
EditMode
ReleaseElement
RemoveScripts
GetOuterHTML
setAnchorForTextRange
getAnchorForTextRange
setForeColorForTextRange
getForeColorForTextRange
RemoveHTMLAttribute
displayElement
CreateTextRangeFromElementText
GetElementXY
InsertIntoTextRangeWithElement
GetElementsChildren
validateAttributesFromSource
CopyToClipboard
PasteFromClipboard
CollapseRange
isRangeEmpty
GetDocumentObject
GetDocument
CutToClipboard
CreateTextRangeSelectingElement
GetElementsAll
SetMFFlag
ScrollIntoView
SelectTextRange
ReleaseTextRange
ParentElementFromTextRange
ElementFromXYOrTextRange
ElementFromXY
SetScrollOffset
GetScrollOffset
HasScrollbars
SubclassBrowserWindow
convertObjectsForLoad
SetInnerHTML
UnMarshallDocument
MarshallDocument
RemoveStyleAttribute
ReleaseDocument
AddRef
SetDocumentObject
GetFirstChild
SetStyleAttributeValue
GetElementWidthHeight
GetElementAbsXY
SetInnerText
GetParentElement
CanElementBeIdentifiedBy
convertM2FormToDHTML
convertM2JavaScript
convertM3PageToDHTML
CopyBody
howManyTablesToConvert
RemoveCOBOLComments
GetVariables
GetFunctions
GetFunctionEventScript
cleanUpProperties
GetParentDocument
TidyScripts
GetDocumentTitle
SetDocumentTitle
AddFunctionToDocument
deleteFunction
removeScript
createNewScript
getStoredScripts
GetChildDocuments
GetDocumentsChildren
GetElementFromID
GenerateUniqueID
GetBody
GetAllElementsWithTag
GetAllElements
GetElementProplist
SaveDocument
GetDocumentURL

propedit

ord38

cblrtsm

_mFgprogunchain
ord968
_mFginitdat_dll
CBL_THREAD_PROG_LOCK
CBL_THREAD_PROG_UNLOCK
ord2040
ord2006
_mFgWinMain2
ord1578
ord1304
ord1145
ord1155
CBL_WRITE_FILE
CBL_DELETE_FILE
CBL_CLOSE_FILE
CBL_READ_FILE
CBL_CREATE_FILE
CBL_OPEN_FILE
CBL_TOUPPER
_mFgF806
CBL_FN_UPPER0CASE
ord1585
ord1593
ord1565
ord1021
ord1156
ord1244
ord1015
CBL_FREE_MEM
CBL_ALLOC_MEM
CBL_FILENAME_CONVERT
ord1250
ord1269
ord733
ord1581
ord1271
ord1569
ord1563
_mFgprogthreaddata
ord1463
ord1462
ord1333
CBL_REF_EXT_DATA
ord1341
_mFgF805
_mFgF804
_mFgtypecheck
CBL_COPY_FILE
CBL_CHECK_FILE_EXIST
CBL_JOIN_FILENAME
_mFfindp
mF_eloc
_mFgprogchain
_mFgprogcheckexit
_mFgAE
ord2038
_mFerr
ord969

oopsm

oopsresolvestatic
oopsextendclass
oopsgrow
oopsresolveself
oopsresolve
oops
oopsgetsuperclass
oopssetparaminfo
oopsresolvetosuper
oopsgetclassobject
oopsnewclass

kernel32

DisableThreadLibraryCalls
SetEvent
WaitForSingleObject
CloseHandle
GlobalUnlock
FormatMessageA
LoadLibraryA
GetProcAddress
GetCommandLineA
LocalFree
GetTempFileNameA
SetFileAttributesA
GetTickCount
IsDBCSLeadByte
SetFilePointer
GetSystemDirectoryA
WriteFile
DeleteFileA
GlobalLock
GlobalSize
GetFileSize
CreateFileA
GetModuleHandleA
CreateEventA

user32

FillRect
LoadBitmapA
GetDlgItem
ClientToScreen
GetCursor
SetCursor
EndPaint
GetUpdateRect
GetClassNameA
GetCapture
SendMessageA
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
RegisterClipboardFormatA
OpenClipboard
PostThreadMessageA
GetWindowThreadProcessId
UpdateWindow
DestroyWindow
WinHelpA
GetDesktopWindow
DispatchMessageA
GetMessageA
FindWindowA
LoadAcceleratorsA
LoadCursorA
ReleaseDC
CreateIconIndirect
DrawIcon
GetIconInfo
GetDC
MessageBoxA
GetClientRect
DefWindowProcA
KillTimer
TranslateMessage
CreateWindowExA
GetSystemMetrics
RegisterClassA
GetSysColor
PostMessageA
BeginPaint
ScreenToClient
SetTimer
PeekMessageA

gdi32

ExtSelectClipRgn
ExcludeClipRect
IntersectClipRect
SetPixel
CreateRectRgn
SetTextAlign
DeleteObject
CreatePalette
CreatePen
LineTo
CreateFontIndirectA
SetSystemPaletteUse
GetTextMetricsA
SetTextColor
SetBkColor
MoveToEx
TextOutA
CreateBitmap
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
CreateSolidBrush
CreateCompatibleBitmap
AnimatePalette
RealizePalette
SelectPalette
GetStockObject

advapi32

RegQueryValueA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA

Exports

Exports

CreateACursor
CreateMouseCursor
CreateMouseCursorNo
CyclePalette
DisplayMessage
DoBorderLine
DoGangScreen
DoSleep
MemoryAlloc
MemoryFree
PROPLIST
REPCLLN
SSEBanner
SetPalette
T1Timer
_mFdllinfo
browserwindow
cookedit
cookef
cptstrm
editanch
editeval
editform
editgrid
elemcoll
elementundoitem
espstart
esptbar
esptbbut
esptrig
evobjtree
fderrmgr
fdformcreatepromptdb
fdresmgr
fdselsty
fdtvfilt
fdtvfiltlistviewitem
fdtvlist
formfile
framesetwindow
g_hInstance
hidsite
hidwnd
htmlddoc
htmldoc
htmltreeview
inscell
insrowcl
litedoc
litesite
m2load
m2progress
namefld
navigate2
nwframe
oleobj
oleperst
ooctrlp
optsedit
painter
prgrsdlg
propertyundocallback
proplist
repclln
rubie5
rubnew
scratchsite
splittervdocksite
srcedit
stackitm
tabbar
tabrenam
tbdialog
tmpdoc
tmpsite
treevdlg
undocallback
undoclbk
undoitem
undomgr
valef

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e5f40cccdb3b89a364a5d633478c58a4

Headers

File Characteristics

Imports

ole32

mfolecl

filters

shell32

msvcrt

mfdhtml

propedit

cblrtsm

oopsm

kernel32

user32

gdi32

advapi32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 29KB - Virtual size: 172KB

.idata Size: 9KB - Virtual size: 9KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 64KB - Virtual size: 63KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 29KB - Virtual size: 172KB

.idata
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 64KB - Virtual size: 63KB