596d978a224683678c409e9412b247e0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

596d978a224683678c409e9412b247e0N.exe
Size

732KB
MD5

596d978a224683678c409e9412b247e0
SHA1

29a6d0be1d2121acdf81e465c0f634500d1fa616
SHA256

3fb0a559d4c0c20371fe761c51b13fb84cecf437f06c4557459954bb41f8338f
SHA512

30c6131c6e96fdc641721dc3c9a39c371ca72894d8f96c1dc977c5bb20c763e57d6fcf9ddea6deabf0099e636a5a2524b7e3cd3405aaea489e368edcde10dbd2
SSDEEP

12288:1gqfub3HICEx6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYeS:1Nuz4x6J17W8CX32+KJNA80T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
596d978a224683678c409e9412b247e0N.exe

Files

596d978a224683678c409e9412b247e0N.exe
.exe windows:5 windows x86 arch:x86

5b859053c7a5d6260b6f8565c66e68e1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

dexplore.pdb

Imports

kernel32

FreeLibrary
IsDBCSLeadByte
GetUserDefaultLCID
FindClose
FindNextFileW
FindFirstFileW
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
GetSystemDefaultLCID
LoadLibraryExA
GetFileAttributesExW
CopyFileW
GetModuleHandleW
FindAtomW
DeleteAtom
AddAtomW
CreateFileMappingA
MapViewOfFile
CreateEventA
CreateMutexA
DuplicateHandle
OpenProcess
LoadLibraryA
GetProcAddress
WaitForSingleObject
SetEvent
ReleaseMutex
GetUserDefaultUILanguage
UnmapViewOfFile
GetFileAttributesA
OutputDebugStringW
VirtualFree
VirtualAlloc
lstrcpynW
SystemTimeToFileTime
GetSystemTime
LoadLibraryExW
WriteFile
GetStdHandle
LoadLibraryW
CreateDirectoryW
MoveFileW
GetFileAttributesW
GetModuleFileNameW
CreateFileW
CloseHandle
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetThreadLocale
GetLocaleInfoA
GetACP
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleA
GetVersionExA
LeaveCriticalSection
FindResourceExA
LoadResource
LockResource
SizeofResource
FindResourceA
GetLastError
EnterCriticalSection
GetModuleFileNameA
lstrcmpiA
lstrlenW
GetEnvironmentVariableA
InterlockedExchange
RaiseException
WideCharToMultiByte
MultiByteToWideChar
CreateProcessA
lstrlenA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
LocalAlloc
QueryPerformanceCounter
GetStartupInfoA
InterlockedCompareExchange
Sleep

msvcr80

_except_handler4_common
_callnewh
??3@YAXPAX@Z
free
memcpy_s
_resetstkoflw
wcscpy_s
_mbscmp
_wtol
sprintf_s
_vsnprintf_s
_vswprintf_c_l
strrchr
isprint
_ultow_s
_strlwr_s
strcpy_s
wcsncat_s
_set_purecall_handler
wcsstr
wcspbrk
memmove
wcschr
wcsncpy_s
wcscat_s
_vsnwprintf_s
_wmakepath_s
_wsplitpath_s
swprintf_s
memset
memmove_s
_wcsicmp
wcsrchr
_vscwprintf
vswprintf_s
_wcsnicmp
??_V@YAXPAX@Z
_recalloc
calloc
strncpy_s
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_crt_debugger_hook
_controlfp_s
_invoke_watson
malloc

user32

CharNextW
LoadStringW
MessageBoxW
LoadIconA
LoadImageA
DestroyWindow
UnregisterClassA
CharNextA
GetSystemMetrics

advapi32

CryptVerifySignatureA
CryptHashData
CryptCreateHash
CryptImportKey
CryptAcquireContextA
CryptReleaseContext
CryptDestroyKey
CryptDestroyHash
RegQueryValueExA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegDeleteKeyW

ole32

OleUninitialize
CoInitializeSecurity
StringFromCLSID
OleInitialize
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
IIDFromString
CoCreateInstance

oleaut32

SysAllocString
GetErrorInfo
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
SysStringLen
VarBstrCat
SysAllocStringByteLen
VariantClear
VariantInit
SysStringByteLen
SysFreeString
SysAllocStringLen

shlwapi

PathAddBackslashW

mscoree

CorBindToRuntimeEx
LockClrVersion

custsat

ord5
ord4

Sections

.text
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 652KB - Virtual size: 656KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5b859053c7a5d6260b6f8565c66e68e1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcr80

user32

advapi32

ole32

oleaut32

shlwapi

mscoree

custsat

Sections

.text Size: 77KB - Virtual size: 76KB

.data Size: 2KB - Virtual size: 8KB

.rsrc Size: 652KB - Virtual size: 656KB

.text
Size: 77KB - Virtual size: 76KB

.data
Size: 2KB - Virtual size: 8KB

.rsrc
Size: 652KB - Virtual size: 656KB