5a54d25576ba7ef1d1b15af3786a4450N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

5a54d25576ba7ef1d1b15af3786a4450N.exe
Size

2.0MB
MD5

5a54d25576ba7ef1d1b15af3786a4450
SHA1

8af0c40c893fa9b7e38e1fee882795573943a5a4
SHA256

9f9bc780c014ef7ad1ed50412ede7d8af315672e511e3ea536086ef4f03c148a
SHA512

dc709b4a68b1c48bf3b073f35024cae9f6eac5f61f1a7f0278d12593e9e59307a2b36ed33556767efc62e070d8a8de6b04602996b3bf198f605b26dd63ed6b80
SSDEEP

49152:WvznZj/WzlRAOv5hjedV4aV4mjaogAH+694RS+UQiw/rKroWBJhUmWR:WvbZyJRAO6PyogAH+O4RdUQEokhWR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5a54d25576ba7ef1d1b15af3786a4450N.exe

Files

5a54d25576ba7ef1d1b15af3786a4450N.exe
.dll windows:5 windows x86 arch:x86

7dbf1ca4cc66f9aa3da8d2a808e56884

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscms

IsColorProfileValid

rasapi32

RasGetAutodialAddressA
RasSetCredentialsW

secur32

DeleteSecurityContext
EnumerateSecurityPackagesW
GetUserNameExA
AcquireCredentialsHandleA

urlmon

CopyBindInfo

ws2_32

WSACleanup

lz32

LZClose
LZOpenFileW

ole32

WriteClassStm
HDC_UserUnmarshal
HDC_UserFree
OleCreate
OleCreateFromData
StgOpenStorage

gdi32

StartDocW
BeginPath
RestoreDC
CreateDIBitmap
SetBrushOrgEx
GetCharABCWidthsFloatA
DeleteDC
DeleteColorSpace
AddFontResourceExW
SetICMProfileA
SetROP2
Ellipse
CombineRgn
SetDCBrushColor

wininet

SetUrlCacheEntryInfoW
HttpSendRequestExW
InternetErrorDlg

opengl32

glTranslated

oleaut32

VarR8FromUI4
VarR8FromUI1
VarBoolFromStr
VarBoolFromDate

advapi32

StartServiceCtrlDispatcherA
CryptEncrypt
CryptEnumProvidersW
CryptReleaseContext
GetOldestEventLogRecord
CryptHashData
GetExplicitEntriesFromAclW
RegQueryValueExA
StartServiceW
RegOpenCurrentUser
CreateServiceW
StartServiceA
EqualDomainSid
LogonUserA
DuplicateEncryptionInfoFile
AllocateAndInitializeSid
GetFileSecurityW
CreateServiceA
ReportEventA
SetNamedSecurityInfoW
AddAuditAccessObjectAce

kernel32

ExitProcess
WriteFile
CloseHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
WideCharToMultiByte
LCMapStringW
GetStringTypeA
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
VerLanguageNameA
IsBadStringPtrW
Process32Next
GetProcessId
GetFileTime
CreateDirectoryA
WriteConsoleInputW
CreateEventA
GetDriveTypeW
GetConsoleMode
OpenMutexA
LCMapStringA
BuildCommDCBW
SetComputerNameExW
BeginUpdateResourceA
GetSystemWow64DirectoryA
EnumSystemLocalesA
FindResourceExA
SetMailslotInfo
GetEnvironmentStringsW
Sleep
Process32FirstW
GetConsoleFontSize
MulDiv
GetStringTypeW
GetTapeParameters
WaitForMultipleObjectsEx
GetCommTimeouts
SetConsoleScreenBufferSize
TryEnterCriticalSection
CreateFileMappingA
GetLargestConsoleWindowSize
OutputDebugStringA
IsDBCSLeadByteEx
CreatePipe
GetModuleFileNameW
GetModuleFileNameA
GetBinaryTypeA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetLocaleInfoW
HeapSize
FlushFileBuffers
GetConsoleCP
SetStdHandle
SetFilePointer
GetTimeZoneInformation
GetCommandLineA
LoadLibraryA
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
RtlUnwind
CompareStringW
CompareStringA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
IsValidLocale
MultiByteToWideChar
GetTickCount
QueryPerformanceCounter
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FatalAppExitA
HeapFree
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
GetCurrentThread
GetCurrentThreadId
SetLastError
TlsFree
HeapDestroy
GetModuleHandleA
TlsSetValue
TlsAlloc
TlsGetValue
GetProcAddress
GetModuleHandleW
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
MoveFileA
GetLastError
HeapAlloc
ReadFile
CreateFileA
GetProcessAffinityMask
SetEnvironmentVariableA
InitializeCriticalSectionAndSpinCount

comctl32

ImageList_ReplaceIcon

winmm

waveOutGetDevCapsW
mmioRead
waveInGetNumDevs
midiOutLongMsg
waveInStart
midiOutShortMsg
mciGetErrorStringW
mmioSeek

winscard

SCardDisconnect
g_rgSCardRawPci
SCardReleaseContext

setupapi

SetupSetFileQueueAlternatePlatformW
SetupDiDestroyClassImageList
SetupDiGetClassImageList
CM_Setup_DevNode
SetupGetIntField
SetupGetFileCompressionInfoW
SetupGetFileQueueCount
CM_Get_DevNode_Custom_PropertyW
SetupDiGetWizardPage
CM_Get_Sibling
SetupGetFieldCount
SetupFindNextLine
CM_Get_DevNode_Registry_PropertyA

msvfw32

ICImageDecompress

crypt32

CertSetCTLContextProperty
CertCreateSelfSignCertificate
CertOIDToAlgId
CryptHashPublicKeyInfo
CertAlgIdToOID
CertCompareIntegerBlob
CertVerifyTimeValidity
CryptMsgClose
CertGetCRLFromStore
CryptSIPRemoveSignedDataMsg

esent

JetSetIndexRange
JetSeek

imm32

ImmIsIME

shell32

DragAcceptFiles
SHLoadNonloadedIconOverlayIdentifiers
ShellExecuteExW

shlwapi

StrCSpnW
PathIsUNCA
StrRChrIA
UrlGetPartA
StrSpnW
SHSkipJunction
StrToIntW
UrlGetLocationW
PathFindOnPathW
PathRenameExtensionW

clusapi

OpenCluster
ClusterResourceEnum

mprapi

MprConfigTransportGetHandle
MprAdminInterfaceTransportAdd
MprAdminInterfaceSetInfo
MprConfigInterfaceGetInfo
MprAdminMIBServerConnect

winspool.drv

GetPrinterDriverDirectoryW

user32

CreateCursor
IsWindow
MapVirtualKeyW
CreateWindowExW
CreateAcceleratorTableW
GetForegroundWindow
SetMenuItemInfoW
LoadCursorA
UnhookWinEvent
CopyRect
VkKeyScanExA
GetCursorInfo
CopyAcceleratorTableA
InvalidateRgn
ShowWindow
DrawStateA
wvsprintfW
OemToCharBuffA
IsWindowVisible
DlgDirListA
MapWindowPoints
SetSysColors
GetDlgItemTextW
GetWindowDC
GetLastInputInfo
FindWindowW
GetProcessWindowStation
CreateIconFromResourceEx

rpcrt4

RpcBindingSetAuthInfoW
RpcBindingFromStringBindingW
NdrConvert2
NdrUserMarshalMarshall
NdrAsyncServerCall

msacm32

acmFormatTagEnumW

netapi32

NetGroupDel
NetGetAnyDCName
NetLocalGroupGetMembers
NetLocalGroupAddMember
NetUserGetGroups

Exports

Exports

EhckewmiraarldeQnd

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.qdata
Size: 796KB - Virtual size: 792KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7dbf1ca4cc66f9aa3da8d2a808e56884

Headers

DLL Characteristics

File Characteristics

Imports

mscms

rasapi32

secur32

urlmon

ws2_32

lz32

ole32

gdi32

wininet

opengl32

oleaut32

advapi32

kernel32

comctl32

winmm

winscard

setupapi

msvfw32

crypt32

esent

imm32

shell32

shlwapi

clusapi

mprapi

winspool.drv

user32

rpcrt4

msacm32

netapi32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.qdata Size: 796KB - Virtual size: 792KB

.rdata Size: 20KB - Virtual size: 17KB

.data Size: 44KB - Virtual size: 51KB

.rsrc Size: 4KB - Virtual size: 1024B

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.qdata
Size: 796KB - Virtual size: 792KB

.rdata
Size: 20KB - Virtual size: 17KB

.data
Size: 44KB - Virtual size: 51KB

.rsrc
Size: 4KB - Virtual size: 1024B

.reloc
Size: 16KB - Virtual size: 15KB