a8866d4564ce3c0e09e31a128020b2b0N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

a8866d4564ce3c0e09e31a128020b2b0N.exe
Size

300KB
MD5

a8866d4564ce3c0e09e31a128020b2b0
SHA1

95f11dda4a540f03cb95054f1e1acd9dc81f57f6
SHA256

aaf14d94ecaca71e03230f0e0e13706b9f9e7ff2b8424f82a0b98a8b8fcb35be
SHA512

f6dee3e60dd707ca1c41f3e0d538eaa263c8aebcd9a78d48a191b8cd3c8392d294680a19dc24fbda89f598d0f35f984479ca27bb8646e4a4bcbdc37bc8c9826f
SSDEEP

6144:knqV1by82bT5fEkFwyu4wYAf0X9MlX/46doX:knqy35vw34wYAf0NMw6doX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a8866d4564ce3c0e09e31a128020b2b0N.exe

Files

a8866d4564ce3c0e09e31a128020b2b0N.exe
.exe windows:4 windows x86 arch:x86

73258790800f53fccfc2e3c341e7ee0a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Releases\v5-2\cactus_build\win32\i386\bin\release\compile.pdb

Imports

shfolder

SHGetFolderPathW

user32

MessageBoxA
LoadStringA
GetSystemMetrics

kernel32

GetLocalTime
GetCurrentThreadId
FlushFileBuffers
InitializeCriticalSection
LeaveCriticalSection
CreateFileW
EnterCriticalSection
GetModuleFileNameW
ReadFile
WriteFile
GetSystemTimeAsFileTime
GetCurrentProcess
SetFilePointer
GetEnvironmentVariableW
FormatMessageW
LocalFree
GetModuleHandleA
GetShortPathNameW
GetCurrentProcessId
DeleteFileW
ReleaseMutex
CreateMutexA
InterlockedDecrement
GetStdHandle
TerminateProcess
GetExitCodeProcess
ReadProcessMemory
Sleep
WaitForSingleObject
MoveFileExW
CreateProcessW
CreateMutexW
lstrcmpiW
GetSystemInfo
ExpandEnvironmentStringsW
SetLastError
GetLastError
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
GetVersionExW
GlobalMemoryStatus
ExitProcess
DeleteCriticalSection
QueryDosDeviceW
QueryPerformanceCounter
GetProcAddress
GetVersionExA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
CloseHandle
OpenProcess
GetTickCount
FreeLibrary
LoadLibraryA
lstrcpyW
GetDriveTypeW
GetLogicalDrives

ws2_32

gethostbyname
ntohs
gethostbyaddr
WSAStartup
gethostname
WSAGetLastError
htons
inet_ntoa
htonl
ntohl
inet_addr

advapi32

OpenProcessToken
ReportEventW
RevertToSelf
GetSidIdentifierAuthority
GetSidSubAuthority
GetSidSubAuthorityCount
RegOpenKeyW
IsValidSid
RegDeleteValueW
RegSetValueExW
ImpersonateLoggedOnUser
DeregisterEventSource
RegisterEventSourceW
LookupAccountNameW
RegSetValueExA
RegQueryValueExA
RegQueryValueExW
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyExW
RegCloseKey

libuser

inet_pton
ResolveRegistryPattern
OK_SHA1_Update
wgetopt
OkTempNam
strlcat
OkenaTime
join_path_hhh
OK_SHA1HashFileChainHex
OK_SHA1_Init
optind
wcslcpy
GetComputerShareName
get_system_language
OK_SHA1_Final
inet_v6toa
wcslcat
get_user_language
woptarg
syslogLog
deflate
deflateParams
inflateEnd
inflate
inflateReset
inflateInit2_
deflateEnd
OK_snwprintf
pthread_once
crc32
hoststring_to_codepage_encoding
free_hoststring
codepage_encoding_to_hoststring
LengthenFilename
EventSendCentral
get_system_langid
map_langid_to_name
paths_init
get_okena_pending_bindir
get_mutex_attribs_with_secure_dacl
SwitchBack
SwitchToSecure
localtime_safe
get_okena_regpath
OkenaFormatMessageA
get_okena_bindir
get_apache_dir
OkenaGetPrivateProfileAnsiString
OkenaGetPrivateProfileInt
get_sysvars_filename
RBExactQuery
OK_snprintf
RBTreeDestroy
strlcpy
RBTreeInsert
RBTreeCreate
get_agent_vars_filename
OkenaGetPrivateProfileLangString
get_okena_configdir
deflateInit2_

libeay32

ord811
ord464
ord796
ord808
ord188
ord197
ord1804
ord181

iphlpapi

GetAdaptersInfo
GetIpAddrTable
GetNetworkParams

rpcrt4

UuidCreate
UuidToStringA
RpcStringFreeA

psapi

GetModuleFileNameExW
GetModuleInformation
EnumProcessModules
GetModuleBaseNameW

csadiagnostic

SetCrashHandlerFilter
GetRegisterString
GetFirstStackTraceString
GetNextStackTraceString
GetFaultReason

msvcr71

_onexit
_c_exit
_exit
_XcptFilter
_cexit
strstr
_dup
__p___winitenv
_amsg_exit
time
__wgetmainargs
_initterm
__setusermatherr
setvbuf
_wstat
_adjust_fdiv
__p__commode
__p__fmode
_dup2
__CxxFrameHandler
iswspace
wcstombs
__set_app_type
_except_handler3
??1type_info@@UAE@XZ
strtol
_controlfp
?terminate@@YAXXZ
sscanf
isalnum
strtoul
__dllonexit
??3@YAXPAX@Z
wcscmp
wcstol
_set_security_error_handler
atof
atoi
_wgetenv
??2@YAPAXI@Z
fgets
_snprintf
strncmp
mbstowcs
_waccess
wcsncmp
fputws
wcscat
swscanf
strtok
wprintf
_wcsnicmp
_wopen
_wcsicmp
toupper
_strnicmp
_stricmp
_wcsdup
_strdup
_isatty
_fileno
_fstat
_read
wcsstr
_close
tolower
wcschr
_lseek
_CxxThrowException
memset
__security_error_handler
_get_osfhandle
strcmp
?swprintf@@YAHPAGIPBGZZ
abort
sprintf
strncat
memmove
free
calloc
malloc
wcslen
printf
strrchr
fputc
strncpy
fprintf
_iob
fwrite
realloc
putchar
fseek
exit
puts
_wfopen
fgetc
iswctype
_vsnprintf
isupper
fclose
_errno
isspace
rewind
wcsncpy
swprintf
strchr
wcsrchr
fread
_wunlink
ftell
atol
wcscpy
towlower

ole32

CoUninitialize
CoSetProxyBlanket
OleInitialize
CLSIDFromProgID
CoCreateInstance
CoInitialize

oleaut32

SysStringLen
SysFreeString
VariantInit
SysAllocString
VariantClear

Sections

.text
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 76KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

73258790800f53fccfc2e3c341e7ee0a

Headers

File Characteristics

PDB Paths

Imports

shfolder

user32

kernel32

ws2_32

advapi32

libuser

libeay32

iphlpapi

rpcrt4

psapi

csadiagnostic

msvcr71

ole32

oleaut32

Sections

.text Size: 168KB - Virtual size: 167KB

.rdata Size: 76KB - Virtual size: 74KB

.data Size: 28KB - Virtual size: 110KB

.rsrc Size: 4KB - Virtual size: 848B

.reloc Size: 20KB - Virtual size: 17KB

.text
Size: 168KB - Virtual size: 167KB

.rdata
Size: 76KB - Virtual size: 74KB

.data
Size: 28KB - Virtual size: 110KB

.rsrc
Size: 4KB - Virtual size: 848B

.reloc
Size: 20KB - Virtual size: 17KB