00c5430f67426784c35816c7762f2cd0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

00c5430f67426784c35816c7762f2cd0N.exe
Size

790KB
MD5

00c5430f67426784c35816c7762f2cd0
SHA1

5e54e4fe4dfcff5be4dea789cbee4c079eb9ba64
SHA256

b5e185d633b692ba5e45d1729637db6c1e06be3e3f9285e21b55b8dc72f4e8b1
SHA512

541005339cfe856f2c73e050a73b8d67fb9016161b616a0c9a439c109182f12a2162c7b8478dd08ecbd55acfed2449a74f0c6bb5862ee6de20fb6229dac33d22
SSDEEP

24576:ORzeQzzXqXdx6UtBebA9jKTwBKDaNZiuKx35V8+uxrEH7jrT:Orzi1tU+jrkAZiV3n

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00c5430f67426784c35816c7762f2cd0N.exe

Files

00c5430f67426784c35816c7762f2cd0N.exe
.dll windows:5 windows x86 arch:x86

2a820ae000dc0e6753a7683cf8a15fac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\GWCommon\NeoRebirth\스크랩핑\GWExitWindow\Release\GWExitWindow.pdb

Imports

mfc90u

ord820
ord6013
ord1552
ord5770
ord5535
ord663
ord404
ord938
ord6659
ord4494
ord4519
ord4405
ord1607
ord285
ord3220
ord1599
ord1211
ord286
ord811
ord2537
ord799
ord1239
ord1137
ord1152
ord391
ord2697
ord2703
ord5852
ord316
ord601
ord899
ord280
ord5851
ord2702
ord600
ord296
ord266
ord265
ord1254
ord6079
ord813
ord801

msvcr90

__CppXcptFilter
?terminate@@YAXXZ
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
malloc
memmove_s
_purecall
strchr
memmove
wcsncpy
strstr
_strupr
wcstombs_s
floor
strncpy
_gmtime64_s
_gmtime32_s
sprintf
realloc
_msize
strncmp
memset
_CxxThrowException
__CxxFrameHandler3
_mkgmtime64
_mkgmtime32
?what@exception@std@@UBEPBDXZ
mbstowcs_s
_localtime64_s
_mktime64
_wtol
_wtoi
_swprintf
_wsplitpath
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
ceil
rand_s
_endthreadex
_beginthreadex
memcpy

kernel32

AreFileApisANSI
LocalFree
GetTempPathA
GetVersionExA
OutputDebugStringA
GetFileAttributesExW
GetSystemInfo
GetDiskFreeSpaceA
CreateFileMappingA
LoadLibraryA
GetDiskFreeSpaceW
LockFileEx
HeapSize
GetProcAddress
FlushFileBuffers
GetFileAttributesW
HeapValidate
HeapCreate
GetFileAttributesA
HeapDestroy
GetVersionExW
FormatMessageW
LoadLibraryW
DeleteFileA
UnlockFileEx
OutputDebugStringW
WaitForSingleObjectEx
LockFile
UnlockFile
WaitForSingleObject
HeapAlloc
FreeLibrary
HeapCompact
CreateFileA
HeapReAlloc
GetFullPathNameA
GetFullPathNameW
GetProcessHeap
HeapFree
lstrlenA
InterlockedDecrement
GetModuleHandleW
GetModuleFileNameW
GetLocalTime
GetCurrentProcess
CreateMutexW
TryEnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
InterlockedCompareExchange
DeleteCriticalSection
WideCharToMultiByte
FormatMessageA
GetLastError
CloseHandle
Sleep
GetSystemDirectoryW
CreateFileW
GetFileSize
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedExchange
WriteFile
UnmapViewOfFile
FlushViewOfFile
MapViewOfFile
CreateFileMappingW
SetEndOfFile
SetFilePointer
DeleteFileW
GetTempPathW
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTime
GlobalFree
ReadFile
GlobalAlloc
MultiByteToWideChar

user32

SetWindowLongW
SendMessageW
CreateWindowExW
GetWindowLongW
DefWindowProcW
RegisterWindowMessageW
FindWindowW
PostMessageW
ExitWindowsEx
DestroyWindow
GetClassInfoW
RegisterClassW

advapi32

InitiateSystemShutdownW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
OpenProcessToken

shell32

ShellExecuteW

ole32

OleRun
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

SysAllocStringByteLen
SysStringByteLen
SysFreeString
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocString
VariantClear
GetErrorInfo

msvcp90

?deallocate@?$allocator@_W@std@@QAEXPA_WI@Z
?allocate@?$allocator@_W@std@@QAEPA_WI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

wsock32

ntohs
getsockname
bind
listen
accept
inet_addr
sendto
WSACleanup
setsockopt
WSAStartup
inet_ntoa
shutdown
WSAGetLastError
select
closesocket
recvfrom
recv
send
connect
gethostbyname
ioctlsocket
htons
socket
htonl
ntohl

wininet

InternetQueryDataAvailable
HttpQueryInfoW
InternetCloseHandle
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetOpenW
InternetReadFile

Exports

Exports

??0CGWExitWindow@@QAE@XZ
??1CGWExitWindow@@QAE@XZ
??4CGWExitWindow@@QAEAAV0@ABV0@@Z
?CheckScrapSch@CGWExitWindow@@QAEXXZ
?GetCurTime@CGWExitWindow@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?IsSchScrapToday@CGWExitWindow@@QAEHXZ
?ShutDownWindows@CGWExitWindow@@QAEXH@Z

Sections

.text
Size: 618KB - Virtual size: 617KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 46KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2a820ae000dc0e6753a7683cf8a15fac

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfc90u

msvcr90

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcp90

wsock32

wininet

Exports

Exports

Sections

.text Size: 618KB - Virtual size: 617KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 46KB - Virtual size: 48KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 15KB - Virtual size: 15KB

.text
Size: 618KB - Virtual size: 617KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 46KB - Virtual size: 48KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 15KB - Virtual size: 15KB