e852ee4fcce8d63a8f1db7ae36ac6600N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

e852ee4fcce8d63a8f1db7ae36ac6600N.exe
Size

26KB
MD5

e852ee4fcce8d63a8f1db7ae36ac6600
SHA1

b0efd0317680ce5ec3b89e958d3de83f04e4cb37
SHA256

039955ba56892bd883fd8e13092c6e135be8a41dbb46942c5e3dcf84190b8445
SHA512

767ee667607902543fc4641dc34ec5716de3f3b8d4af4517b1a568f506010face8ed322b23a35bf483c9dfc4240ec990e5a8e918e7fcd5cc8f8054d1f8b5aef9
SSDEEP

768:U3yxIVx2g76wImw7NGUV6XOgJipkEgg58:U3yxIVx2BwIm03V8OgmFgO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e852ee4fcce8d63a8f1db7ae36ac6600N.exe

Files

e852ee4fcce8d63a8f1db7ae36ac6600N.exe
.dll windows:4 windows x86 arch:x86

f4b85981fb48ce21a63487ab6369cf4e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

dum_checkfile

?CheckFile@CDUM_CheckFile@@UAEKV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
??0CDUM_CheckFile@@QAE@XZ
??1CDUM_CheckFile@@UAE@XZ

mfc80

ord5104
ord2783
ord5286
ord995
ord5107
ord2804
ord655
ord1151
ord421
ord1024
ord1486
ord3934
ord1175
ord371
ord1098
ord1084
ord578
ord764
ord297
ord876
ord2322
ord2131
ord5287
ord5661
ord2206
ord3997
ord2910
ord4108
ord2272
ord5284
ord310
ord784
ord380
ord3201
ord2702
ord2703
ord5493
ord266
ord781
ord762
ord1917
ord1452
ord3787
ord6295
ord744
ord556

msvcr80

_unlock
__dllonexit
_lock
_onexit
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
_except_handler4_common
?terminate@@YAXXZ
free
_CxxThrowException
_time64
_localtime64_s
_mbsrchr
_access_s
fopen_s
_vfprintf_p
fclose
atoi
__CxxFrameHandler3
_initterm_e

kernel32

GetThreadLocale
GetLocaleInfoA
GetACP
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetVersionExA

Exports

Exports

??0CDUM_Download@@QAE@ABV0@@Z
??0CDUM_Download@@QAE@XZ
??1CDUM_Download@@UAE@XZ
??4CDUM_Download@@QAEAAV0@ABV0@@Z
??_7CDUM_Download@@6B@
?CancelDownload@CDUM_Download@@UAEKXZ
?CheckFile@CDUM_Download@@UAEKV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?CopyDLFile@CDUM_Download@@AAEKXZ
?Download@CDUM_Download@@UAEKH@Z
?DownloadFileFromFTP@CDUM_Download@@AAEKPAVCInternetSession@@@Z
?DownloadFileFromHTTP@CDUM_Download@@AAEKPAVCInternetSession@@@Z
?DownloadWorker@CDUM_Download@@AAEKXZ
?Empty@CDUM_Download@@AAEXXZ
?FileErrorProc@CDUM_Download@@AAEKH@Z
?GetDownloadFile@CDUM_Download@@UAEXPAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@0@Z
?GetDownloadStatus@CDUM_Download@@UAEKPAK0@Z
?GetDownloaderName@CDUM_Download@@UAEXPAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?GetErrCode@CDUM_Download@@QAEKXZ
?GetErrMsg@CDUM_Download@@AAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetFileCheckSum@CDUM_CheckFile@@QAEKPAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?GetFileName@CDUM_CheckFile@@QAEKPAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?GetFilePath@CDUM_CheckFile@@QAEKPAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?GetFileSize@CDUM_CheckFile@@QAEKPAK@Z
?GetFileSize@CDUM_CheckFile@@QAEKPAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?GetFileSize@CDUM_Download@@AAEKXZ
?GetFileTime@CDUM_CheckFile@@QAEKPAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?GetFileVersion@CDUM_CheckFile@@QAEXPAK0@Z
?GetMatchKey@CDUM_CheckFile@@QAEXPAK@Z
?GetNewLocation@CDUM_Download@@AAEHXZ
?OpenTemplateFile@CDUM_Download@@AAEKPAVCStdioFile@@V?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@I@Z
?RequestPassword@CDUM_Download@@AAEHXZ
?SetDownloadFile@CDUM_Download@@UAEKV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@0@Z
?SetDownloaderName@CDUM_Download@@UAEXV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?SetFileCheckSum@CDUM_CheckFile@@QAEKV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?SetFileName@CDUM_CheckFile@@QAEKV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?SetFileSize@CDUM_CheckFile@@QAEXV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?SetFileTime@CDUM_CheckFile@@QAEKV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?SetMatchKey@CDUM_CheckFile@@UAEXK@Z
CreateCDUM_Download

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f4b85981fb48ce21a63487ab6369cf4e

Headers

File Characteristics

Imports

dum_checkfile

mfc80

msvcr80

kernel32

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 12KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB