cfcd279d198224aa8b1afd5d52fa7e60N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

cfcd279d198224aa8b1afd5d52fa7e60N.exe
Size

179KB
MD5

cfcd279d198224aa8b1afd5d52fa7e60
SHA1

da6b5e7ae7f8fb4dd6be0ef030179ca0868e27f8
SHA256

6588bd25e8fb2c18623e6505b3351f80c90d0bd7dc0dd98ec3e63e49a8103faf
SHA512

5e05df2bad8272329171bc6e000d577e1c62732bdf4ad92353c1014d3f60fb9d59418c7a01712e49e203dd61b25ddb8069a4454c815421ff29a217e79ad03426
SSDEEP

3072:mwNmK0znJITPhYRbSYFi+eccEYCmoicihpdg5IIsXBJqMc9iFtiQ1:mwNHy6DyWDoihpd+qqO1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cfcd279d198224aa8b1afd5d52fa7e60N.exe

Files

cfcd279d198224aa8b1afd5d52fa7e60N.exe
.dll windows:6 windows x86 arch:x86

d30bafadd7eee1c6a34f078e258ea68b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

FXSEXT32.pdb

Imports

msvcrt

free
_initterm
_amsg_exit
_XcptFilter
??2@YAPAXI@Z
wcschr
??3@YAXPAX@Z
_wsplitpath_s
memcpy
_stricmp
_except_handler4_common
_wcsnset
memset
wcsrchr
malloc
_vsnwprintf
wcsncmp
_wcsicmp
iswalpha
??_V@YAXPAX@Z
??_U@YAPAXI@Z
__CxxFrameHandler3

fxsapi

FaxConnectFaxServerW
FaxClose
FaxGetReceiptsOptions
FaxGetPersonalCoverPagesOption

kernel32

Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetVersionExW
InterlockedExchange
GetComputerNameW
lstrlenW
ExpandEnvironmentStringsW
FreeLibrary
GetProcAddress
LoadLibraryW
CreateDirectoryW
GetFileAttributesW
CloseHandle
ReadFile
DisableThreadLibraryCalls
HeapCreate
GetProcessHeap
HeapAlloc
HeapFree
GetModuleFileNameW
OutputDebugStringW
GetFileType
CreateFileW
FindFirstFileW
GetLastError
FindNextFileW
FindClose

advapi32

UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
TraceMessage
RegCloseKey
RegisterTraceGuidsW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW

user32

MessageBoxW
EnableWindow
GetDlgItem
IsDlgButtonChecked
LoadStringW
SendMessageW
GetWindowContextHelpId
CheckDlgButton
EndDialog
EnableMenuItem
DialogBoxParamW
AppendMenuW
MessageBeep
WinHelpW

mapi32

ord140
ord13
ord15
ord75
ord139
ord17

winspool.drv

EnumPrintersW
GetPrinterW
ClosePrinter
OpenPrinterW

shell32

SHSetLocalizedName
SHGetFolderPathW
SHGetFolderPathAndSubDirW

Exports

Exports

ExchEntryPoint

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 145KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d30bafadd7eee1c6a34f078e258ea68b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

fxsapi

kernel32

advapi32

user32

mapi32

winspool.drv

shell32

Exports

Exports

Sections

.text Size: 31KB - Virtual size: 30KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 145KB - Virtual size: 144KB

.text
Size: 31KB - Virtual size: 30KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 145KB - Virtual size: 144KB