a70c1f480bcb59830d89797c82036f941ee9fd02009d3441c58801b3fea146bc

Sharing

Copy URL Twitter E-mail

General

Target

a70c1f480bcb59830d89797c82036f941ee9fd02009d3441c58801b3fea146bc
Size

2.5MB
MD5

daecb9b0490a2732b0dc87491fea6fb5
SHA1

b96766688193218fddca9740e8f1fc04c4017168
SHA256

a70c1f480bcb59830d89797c82036f941ee9fd02009d3441c58801b3fea146bc
SHA512

5b5f9c9c999543f1eabd43032a9b25abbe4ea3e352abd1803dc59294042fd32f9484bf02386e8a808a03e38edc159df27bc7abe60103877998d7bf857b99e0e8
SSDEEP

49152:cKrzqS1TP1mqjDbGtcMK3ATPwN1nSiQXsv5eVJJCatm:xzqS1BmqjmtYR5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a70c1f480bcb59830d89797c82036f941ee9fd02009d3441c58801b3fea146bc

Files

a70c1f480bcb59830d89797c82036f941ee9fd02009d3441c58801b3fea146bc
.exe windows:5 windows x86 arch:x86

5b5fde18743d2574c831576534ae07e4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

aeroadmin.pdb

Imports

kernel32

WTSGetActiveConsoleSessionId
GetCommandLineW
AttachConsole
GetCurrentProcessId
ProcessIdToSessionId
WriteFile
GetTickCount
Sleep
ReadFile
GetFileSize
FreeLibrary
GetModuleFileNameW
GetVersionExW
CreateFileW
CloseHandle
LoadLibraryW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
DecodePointer
GetProcAddress
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetCurrentProcess
OpenProcess
TerminateProcess
DeleteFileW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
HeapSize
GetTimeZoneInformation
HeapReAlloc
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
GetStdHandle
GetModuleFileNameA
ExitThread
GetModuleHandleExW
ExitProcess
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualProtect
VirtualAlloc
LoadLibraryExW
GetModuleHandleA
FreeLibraryAndExitThread
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
GetModuleHandleW
GetLastError
RaiseException
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
FormatMessageW
QueryPerformanceCounter
QueryPerformanceFrequency
DuplicateHandle
WaitForSingleObjectEx
SwitchToThread
GetCurrentThread
GetCurrentThreadId
GetExitCodeThread
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
EncodePointer
SetLastError
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
SleepEx
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetExitCodeProcess
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
OpenFileMappingW
GetUserGeoID
GetGeoInfoW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
SetThreadExecutionState
GetConsoleWindow
WaitForSingleObject
CreateDirectoryW
CompareFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SetCurrentDirectoryW
LocalAlloc
LocalFree
GetFileAttributesW
OutputDebugStringA
FormatMessageA
FreeConsole
SetConsoleCtrlHandler
GenerateConsoleCtrlEvent
GetThreadTimes
DeviceIoControl
SetPriorityClass
HeapAlloc
GetProcessHeap
HeapFree
GetComputerNameW
GetUserDefaultUILanguage
FindResourceW
LockResource
LoadResource
SizeofResource
MoveFileW
GetLogicalDriveStringsW
GetVolumeInformationW
GetDiskFreeSpaceExW
FindFirstFileW
FindNextFileW
FindClose
RemoveDirectoryW
GetFileAttributesExW
SetFileTime
SetFilePointer
SetEndOfFile
SetEvent
ResetEvent
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
VirtualQuery

user32

ShowWindow
SetForegroundWindow
DestroyWindow
GetCursorPos
CreatePopupMenu
InsertMenuW
SendMessageW
DestroyMenu
FindWindowW
GetSystemMetrics
RegisterClassExW
CreateWindowExW
DrawMenuBar
LoadImageW
GetGuiResources
SetWindowTextW
PostMessageW
MessageBoxW
TranslateMessage
PeekMessageW
PostQuitMessage
DispatchMessageW
TrackPopupMenu
DefWindowProcW
GetScrollPos
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
LoadCursorW
SetCursor
SetClassLongW
wsprintfW
ExitWindowsEx
ChangeDisplaySettingsW
LockWorkStation
SendInput
GetDC
ReleaseDC
mouse_event
EnumDisplayDevicesW
EnumDisplaySettingsW
ChangeDisplaySettingsExW
GetClipboardData
OpenDesktopW
SetThreadDesktop
CloseDesktop
MapVirtualKeyW
SystemParametersInfoW
EnableWindow
GetDlgItem
GetWindowRect
GetAsyncKeyState
SetMenu
GetClientRect
InvalidateRect
AdjustWindowRect
SetFocus
GetKeyState
SetWindowPos
EnableMenuItem
GetSystemMenu
GetWindowTextW
MoveWindow
FillRect
UpdateWindow
ScreenToClient
DrawTextW
CallNextHookEx
ClientToScreen
SetWindowsHookExW
BroadcastSystemMessageW
UnhookWindowsHookEx
SetWindowTextA
GetWindowTextA
GetScrollInfo
SetScrollInfo
IsDlgButtonChecked
GetMenu
DrawEdge
DrawTextExW
DrawFrameControl
GetParent
GetKeyboardState
ToAscii
SetScrollPos
ShowScrollBar
SetScrollRange
HideCaret
ShowCaret
MessageBeep
SetCaretPos
GetWindowLongW
BeginPaint
EndPaint
GetFocus
RegisterClassW
GetScrollRange
CreateCaret
DestroyCaret
GetWindowPlacement
DrawIconEx
DestroyIcon
GetDesktopWindow
GetMonitorInfoW
OpenWindowStationW
SetProcessWindowStation
CloseWindowStation
OpenInputDesktop
GetUserObjectInformationW
EnumDisplayMonitors
GetCursorInfo
GetIconInfo
GetWindowDC
DestroyCursor
CreateIconIndirect
InsertMenuItemW
CreateMenu
SetMenuItemInfoW
RemoveMenu
GetMenuBarInfo
GetDCEx
SetWindowLongW
LoadIconW
MapWindowPoints
CallWindowProcW

gdi32

GetDIBits
GetDeviceCaps
DeleteDC
CreateCompatibleBitmap
CreatePatternBrush
CreateDIBitmap
GetTextMetricsW
GetTextExtentPoint32W
SetROP2
GetROP2
CreatePen
GetStockObject
GetObjectW
Rectangle
SetTextColor
CreateFontIndirectW
SetBkMode
SetBrushOrgEx
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteObject
CreateSolidBrush
CreateFontW
SaveDC
StretchBlt
ExtTextOutW
SetBkColor
CreateBitmap
GetBitmapBits
RestoreDC

shell32

ShellExecuteW
SHGetSpecialFolderPathW
SHGetMalloc
Shell_NotifyIconW
CommandLineToArgvW
ShellExecuteExW
ord47
SHGetFolderPathW
SHGetFileInfoW
SHBrowseForFolderW
SHGetPathFromIDListW

ole32

CoInitialize
CreateStreamOnHGlobal
CoInitializeEx
CoUninitialize
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
VariantInit
SysStringLen
VariantClear

urlmon

URLOpenBlockingStreamW
URLDownloadToFileW

winmm

waveInClose
waveInUnprepareHeader
waveInReset
waveInStart
waveInPrepareHeader
waveInOpen
waveInGetDevCapsW
waveInGetNumDevs
waveInAddBuffer
waveOutClose
timeEndPeriod
waveOutOpen
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
timeBeginPeriod

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory
WTSQuerySessionInformationW

userenv

DestroyEnvironmentBlock
GetUserProfileDirectoryW
CreateEnvironmentBlock

winhttp

WinHttpConnect
WinHttpOpen
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpWriteData
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpCloseHandle
WinHttpReadData

iphlpapi

GetBestInterface
IcmpSendEcho
IcmpCreateFile
GetAdaptersAddresses

ws2_32

ntohl
WSACleanup
WSAConnect
getaddrinfo
socket
WSAStartup
gethostname
freeaddrinfo
bind
closesocket
ioctlsocket
listen
accept
getpeername
setsockopt
send
select
recv
gethostbyname
inet_ntoa
WSASocketW
WSAGetLastError

wininet

HttpOpenRequestA
InternetOpenA
HttpSendRequestA
InternetCloseHandle
InternetReadFile
InternetConnectW

mpr

WNetEnumResourceW
WNetOpenEnumW
WNetCloseEnum

gdiplus

GdipAlloc
GdipFree
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToStream

msimg32

AlphaBlend

comctl32

InitCommonControlsEx
ord17

comdlg32

GetOpenFileNameW

advapi32

SetSecurityDescriptorDacl
LogonUserW
CreateProcessWithLogonW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegDeleteValueW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
SetTokenInformation
AdjustTokenPrivileges
CreateProcessAsUserW
SetServiceStatus
RegisterServiceCtrlHandlerExW
OpenSCManagerW
CreateServiceW
ChangeServiceConfig2W
CloseServiceHandle
RegCreateKeyExW
OpenServiceW
DeleteService
StartServiceW
StartServiceCtrlDispatcherW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
SetEntriesInAclW
LookupAccountSidW
GetTokenInformation
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
SetFileSecurityW
InitializeSecurityDescriptor
SetSecurityInfo

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 625KB - Virtual size: 840KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5b5fde18743d2574c831576534ae07e4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

urlmon

winmm

wtsapi32

userenv

winhttp

iphlpapi

ws2_32

wininet

mpr

gdiplus

msimg32

comctl32

comdlg32

advapi32

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 320KB - Virtual size: 320KB

.data Size: 625KB - Virtual size: 840KB

.rsrc Size: 33KB - Virtual size: 32KB

.reloc Size: 80KB - Virtual size: 80KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 320KB - Virtual size: 320KB

.data
Size: 625KB - Virtual size: 840KB

.rsrc
Size: 33KB - Virtual size: 32KB

.reloc
Size: 80KB - Virtual size: 80KB