32442464e7b609679e738325958fea60N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

32442464e7b609679e738325958fea60N.exe
Size

702KB
MD5

32442464e7b609679e738325958fea60
SHA1

8b7015d4ce5bbe3cb8cbcbada59ebd76c603c742
SHA256

82d15858aab33a389d4ecb308d56193f74652c18af67131419c896005230c6d5
SHA512

e46786ad80030525068f7d29f8c06335d2923ae17c4be908c8ff8409651f44e2e5c0fd66e485015685b64170925f0b64967e931727fc38b5a06d49d88084b4e9
SSDEEP

12288:6LOgdHclMwRJI7XHgZQKhJgeCmCGHeCp8cldQX7A8Xr3pejr9IiX1zjWAqB:6KgdhwR2LHgZpJEdGB8claX7A8Xr3p20

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
32442464e7b609679e738325958fea60N.exe

Files

32442464e7b609679e738325958fea60N.exe
.dll windows:4 windows x86 arch:x86

fd66a6e0820072277a8b1cae1f84f73c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

t:\sps\x86\ship\0\portalconnectcore.pdb

Imports

shlwapi

PathRemoveFileSpecW
wnsprintfA

shell32

SHGetDesktopFolder
SHGetSpecialFolderPathW

kernel32

EnumSystemLocalesW
EnumUILanguagesW
IsProcessorFeaturePresent
ReleaseSemaphore
GlobalMemoryStatus
GetCurrentThread
lstrcmpiW
GetLastError
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
VirtualProtect
QueryPerformanceCounter
GetTempFileNameA
GetTempPathA
InterlockedCompareExchange
GetModuleFileNameW
DisableThreadLibraryCalls
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
CompareStringW
LoadLibraryW
GetLocaleInfoW
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
CreateDirectoryW
IsValidCodePage
GetStringTypeExW
IsDBCSLeadByte
GlobalAlloc
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
Sleep
CreateProcessA
GlobalFree
LocalAlloc
LocalFree
GetUserDefaultLangID
GetUserDefaultLCID
GetSystemInfo
GetDiskFreeSpaceExW
GetTimeZoneInformation
GetVersionExW
GetSystemDirectoryW
GetModuleFileNameA
GetShortPathNameA
CreateSemaphoreA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
GetProcAddress
GetFileAttributesW
GetVersion
WideCharToMultiByte
SetLastError
OutputDebugStringA
InitializeCriticalSectionAndSpinCount
TlsAlloc
GetSystemDefaultLCID
TlsSetValue
VirtualFree
TlsGetValue
TlsFree
WaitForSingleObject
ReleaseMutex
CloseHandle
GetSystemTimeAsFileTime
GetTickCount
WriteFile
SetFileAttributesW
OpenMutexA
FlushFileBuffers
DeleteFileW
GetSystemDefaultLangID
IsValidLocale
GetProcessHeap
HeapFree
HeapSize
HeapValidate
HeapAlloc
HeapReAlloc
VirtualAlloc
GetFileType
CreateFileW
ExpandEnvironmentStringsW
GetProcessTimes
GetCurrentProcess
CreateMutexA

user32

ReleaseDC
GetDC
GetSystemMetrics
SystemParametersInfoA
GetMenuCheckMarkDimensions
GetKeyboardLayout
GetMonitorInfoA
EnumDisplayMonitors
GetSysColor
CharNextW
MessageBoxW
LoadStringW
UnregisterClassA

advapi32

OpenThreadToken
RegEnumValueA
RegEnumKeyW
RegEnumValueW
RegQueryInfoKeyA
RegOpenKeyExA
GetLengthSid
AddAccessAllowedAce
AddAccessDeniedAce
InitializeAcl
AllocateAndInitializeSid
CopySid
GetTokenInformation
OpenProcessToken
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidA
CheckTokenMembership
IsValidSid
RegQueryValueExA
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegDeleteValueA

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

secur32

GetUserNameExW

ole32

CoCreateFreeThreadedMarshaler
CreateBindCtx
CoTaskMemAlloc
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree

oleaut32

SysStringByteLen
SysAllocStringByteLen
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
VarBstrCmp
LoadRegTypeLi
VarUI4FromStr
LoadTypeLi
SysAllocString
VariantClear
VariantInit
SysFreeString
SysStringLen

wininet

InternetCrackUrlW

activeds

ord9

rpcrt4

UuidCreate

gdi32

CreateSolidBrush
CreateDCA
DeleteDC
GetDeviceCaps
DeleteObject

msvcr80

fgetws
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_encode_pointer
fopen_s
fwprintf_s
vsprintf_s
vswprintf_s
wcsrchr
_wcsicmp
_vsnprintf
_CIsqrt
memmove
_wfopen
_malloc_crt
fclose
memcpy
_vsnwprintf
memset
_recalloc
__CxxFrameHandler3
wcsncpy_s
wcscpy_s
_CxxThrowException
memcpy_s
free
malloc

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 249KB - Virtual size: 248KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 198KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 248KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd66a6e0820072277a8b1cae1f84f73c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

shell32

kernel32

user32

advapi32

version

secur32

ole32

oleaut32

wininet

activeds

rpcrt4

gdi32

msvcr80

Exports

Exports

Sections

.text Size: 249KB - Virtual size: 248KB

.data Size: 198KB - Virtual size: 223KB

.rsrc Size: 5KB - Virtual size: 5KB

.reloc Size: 248KB - Virtual size: 252KB

.text
Size: 249KB - Virtual size: 248KB

.data
Size: 198KB - Virtual size: 223KB

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 248KB - Virtual size: 252KB