b729b91c7447e4962a48fc7a8319ff90N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

b729b91c7447e4962a48fc7a8319ff90N.exe
Size

1.5MB
MD5

b729b91c7447e4962a48fc7a8319ff90
SHA1

d70157856b8ff56e0d77c2dd2cf1036848842260
SHA256

147cdcf138c8619cd519db7e39a8eeeee58504f56ba17c7fa6cb8eda356c4826
SHA512

6df1c1b456a1ad3f6baa959b129a89856d89a2127b9e7ebe73e9801cd71d7c6b790055ef72665dd7d01d1e2b257a305cd378f44ab501e35c5870e0612cac56d7
SSDEEP

24576:Gm3PdHvIu41WwHYKPYU91aBY9BNWulRkop3iN9n63tAF/GO:VdHIo5C3ibn4s/GO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b729b91c7447e4962a48fc7a8319ff90N.exe

Files

b729b91c7447e4962a48fc7a8319ff90N.exe
.dll windows:4 windows x86 arch:x86

90237ed5f7201fe7f24fb54fb3f9d447

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FindNextChangeNotification
WaitForMultipleObjects
FindFirstChangeNotificationA
FindCloseChangeNotification
lstrcatA
SetLastError
CompareStringA
FindNextFileA
GetLastError
GetVersionExA
GetPrivateProfileIntA
MultiByteToWideChar
WideCharToMultiByte
GetACP
InterlockedIncrement
InterlockedDecrement
FileTimeToSystemTime
lstrcpyA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FlushFileBuffers
lstrlenA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
IsDBCSLeadByte
GetDriveTypeA
SetFileAttributesA
WriteFile
GetFileAttributesA
DeleteFileA
SetFilePointer
CreateFileA
GetFileSize
GetSystemDefaultLCID
GetModuleHandleA
CloseHandle
GetTimeZoneInformation
SetCurrentDirectoryA
SetStdHandle
GetFileType
GetEnvironmentStringsW
ReadFile
GetEnvironmentStrings
FreeEnvironmentStringsA
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetPrivateProfileStringA
lstrcmpiA
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
CreateDirectoryA
GetCurrentDirectoryA
TerminateProcess
SetEnvironmentVariableA
CompareStringW
IsBadCodePtr
DisableThreadLibraryCalls
ReadProcessMemory
GetCurrentProcess
GetThreadSelectorEntry
GetCurrentThread
RtlUnwind
RaiseException
IsBadReadPtr
FreeEnvironmentStringsW
GetEnvironmentVariableA
GetStringTypeW
GetStringTypeA
LCMapStringW
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
GetCommandLineA
GetVersion
HeapSize
SetUnhandledExceptionFilter
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetStartupInfoA
GetCPInfo
GetOEMCP
LCMapStringA

user32

ReleaseDC
GetDC
DefWindowProcA
wsprintfA
CharUpperA
DestroyWindow
GetDesktopWindow
CreateWindowExA
RegisterClassA

gdi32

SetTextColor
SetBkColor
ExtTextOutA
EnumFontFamiliesExA
ExtTextOutW
GetFontData
SelectObject
CreateFontIndirectA
DeleteDC
CreateCompatibleDC
DeleteObject
SetBkMode
SetTextAlign
EnumFontFamiliesA
GetTextMetricsA
CreateBitmap
GetDeviceCaps
PatBlt
GetCharABCWidthsA
GetBitmapBits
GetTextExtentPointA
GetTextExtentPointW
GetCharABCWidthsW

advapi32

RegOpenKeyA
RegEnumValueA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA

shell32

SHGetFileInfoA

ole32

CoUninitialize
CoInitialize

winmm

timeGetTime

Exports

Exports

CTAddFontDirsAndConfig
CTAddFontsAndConfig
CTAddFontsInCurDirectory
CTAddFontsInInternetDirectory
CTBeginModalPurge
CTCMapIsAvailable
CTClearIncrGlyphList
CTComposeFont
CTConvertDesignVector
CTCreateFontContext
CTCreateFontInstance
CTCreateInternetFontContext
CTCreateOutlineIter
CTDefKeyVal
CTDeleteEncoding
CTDeleteFont
CTDeleteFontContext
CTDeleteFontInstance
CTDeleteInternetFontContext
CTDeleteOutlineIter
CTDeletePSFontStream
CTDeleteTempFontsHandle
CTDeleteTranslator
CTDeleteUniTranslator
CTEncodingIsValid
CTEndModalPurge
CTFindFont
CTFindFontPS
CTFindOrFauxFont
CTGet1GlyphID
CTGet1GlyphMetrics
CTGet1Kern
CTGetAGMFontServer
CTGetATCGlyphID
CTGetCIDEncoding
CTGetCharacterBoundaries
CTGetComponentGlyphID
CTGetContextType
CTGetFindOrFauxFontStatus
CTGetFontNamesFromMenuName
CTGetFontPolicy
CTGetFontScriptAndEncodingFromPSFontName
CTGetFontSetSeed
CTGetGlyphIDs
CTGetGlyphLocations
CTGetGlyphMaps
CTGetHintedGlyphLocations
CTGetIndexedFont
CTGetIndexedFontGroup
CTGetMenuName
CTGetNamedFontGroup
CTGetNumFontGroups
CTGetNumFontsInGroup
CTGetPSNameFromMenuName
CTGetPanoseMatchingPolicy
CTGetPreDefinedEncoding
CTGetSearchParam
CTGetShadowFont
CTGetSystemDefaultFont
CTGetTrueTypeEncoding
CTGetTrueTypeEncodingCodePage
CTGetType1Encoding
CTGetUnicodeProperty
CTGetUnicodeVersion
CTGetVal
CTGetValDataLength
CTHasKerningTable
CTInitAndConfig
CTInitialize
CTIsKeyDefed
CTMakeStringAtom
CTNewCIDTranslator
CTNewCMapUnicodeTranslator
CTNewCreateOutlineIter
CTNewEncoding
CTNewFauxFont
CTNewFont
CTNewPSFontStream
CTNewServer
CTNewTempFont
CTNewTempFontsHandle
CTNewTranslator
CTNewUIServer
CTNextOutlineSegment
CTOTAvailableFeatures
CTOTFeature
CTOTGlyphAccess
CTOTNumberOfAlternates
CTPSFontStreamDownloadIncr
CTPurgeNextBlock
CTRasterDevGetVal
CTRasterDevSetVal
CTReleaseGlyphMapLocks
CTRomanFauxFontAddWidths
CTSetCIDEncoding
CTSetFontPolicy
CTSetPanoseMatchingPolicy
CTSetSearchParam
CTSetSystemDefaultFonts
CTSetTrueTypeEncoding
CTSetTrueTypeEncodingCodePage
CTSetType1Encoding
CTShallowCopyFont
CTShareVal
CTStreamCMap
CTStreamFont
CTStreamPSFont
CTStreamPSProcSet
CTStreamRearrangement
CTTerminate
CTTranslateBaseline
CTTranslateEncoding
CTTranslateGlyphID
CTTranslateUnicode
CTUndefKey
CTVerifyPanose
CTVersion

Sections

.text
Size: 920KB - Virtual size: 918KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 100KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 372KB - Virtual size: 419KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

90237ed5f7201fe7f24fb54fb3f9d447

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

winmm

Exports

Exports

Sections

.text Size: 920KB - Virtual size: 918KB

.rdata Size: 100KB - Virtual size: 97KB

.data Size: 372KB - Virtual size: 419KB

.rsrc Size: 4KB - Virtual size: 1016B

.reloc Size: 96KB - Virtual size: 93KB

.text
Size: 920KB - Virtual size: 918KB

.rdata
Size: 100KB - Virtual size: 97KB

.data
Size: 372KB - Virtual size: 419KB

.rsrc
Size: 4KB - Virtual size: 1016B

.reloc
Size: 96KB - Virtual size: 93KB