08ba3fb622463f376e472cc4ad0cff95f31220bb474b1e905b1f1f8b61ebdffc[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

08ba3fb622463f376e472cc4ad0cff95f31220bb474b1e905b1f1f8b61ebdffc.exe
Size

348KB
MD5

e138f0c7e0bba7d2f38e8bd96a3c8b85
SHA1

5c33d778f8dbc9ed99aca4b22ba7d1f3aa407065
SHA256

08ba3fb622463f376e472cc4ad0cff95f31220bb474b1e905b1f1f8b61ebdffc
SHA512

865998548faa3589042dff7a17848a94f49c834b5c14f6430d43fe81c4e867f5bb31e3e0b98fe749610c26960678a8605869cc24499cf40bf3e513f2affd3d88
SSDEEP

6144:bDeUVJuo0tl4VJLofrFD68Y7LE8DO11bEVUNNaD:JuFl4VJ4D68YUQO1tEV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
08ba3fb622463f376e472cc4ad0cff95f31220bb474b1e905b1f1f8b61ebdffc.exe

Files

08ba3fb622463f376e472cc4ad0cff95f31220bb474b1e905b1f1f8b61ebdffc.exe
.exe windows:4 windows x86 arch:x86

4f7e80b12e14587fc3c198bdef27ceee

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE

PDB Paths

I:\VS70Builds\3077\vsbuilt\retail\Bin\i386\opt\mdm.pdb

Imports

ole32

CoRevokeClassObject
CoRegisterClassObject
CoTaskMemAlloc
CoTaskMemRealloc
StringFromGUID2
CoDisconnectObject
CoUninitialize
CoRevertToSelf
CoInitializeSecurity
CoCreateGuid
CLSIDFromString
CoGetClassObject
CoGetCallContext
StringFromIID
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
CoImpersonateClient
CoQueryProxyBlanket
StringFromCLSID
CoTaskMemFree

oleaut32

SysFreeString
SysAllocStringLen
SysAllocString
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
VarBstrCat
VariantClear
VariantInit
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysStringByteLen
SysAllocStringByteLen
SafeArrayCreate

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

rpcrt4

RpcStringFreeA
RpcBindingFromStringBindingA
RpcStringBindingComposeA
NdrClientCall
RpcBindingSetAuthInfoA

shlwapi

PathFindExtensionA

advapi32

RegOpenKeyExW
QueryServiceStatus
LookupAccountSidA
PrivilegeCheck
IsValidSecurityDescriptor
DuplicateTokenEx
AddAce
GetSecurityDescriptorLength
GetUserNameA
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorSacl
MakeAbsoluteSD
SetSecurityDescriptorDacl
MakeSelfRelativeSD
InitializeAcl
AddAccessAllowedAce
AddAccessDeniedAce
AllocateAndInitializeSid
FreeSid
RegConnectRegistryA
RegSetKeySecurity
LookupAccountNameA
GetAclInformation
GetAce
DuplicateToken
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
AccessCheck
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
EqualSid
GetSecurityDescriptorControl
GetLengthSid
CopySid
IsValidSid
LookupAccountSidW
RegCreateKeyA
RegEnumValueA
RegQueryValueExA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
ControlService
DeleteService
SetThreadToken
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
RegEnumKeyA
SetServiceStatus
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA
GetTokenInformation
OpenThreadToken
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
DeregisterEventSource
ReportEventA
RegisterEventSourceA
CloseServiceHandle
ChangeServiceConfigA
OpenServiceA
CreateServiceA
OpenSCManagerA
RegQueryValueExW

kernel32

HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlUnwind
IsBadWritePtr
HeapSize
GetOEMCP
GetCPInfo
HeapReAlloc
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
FlushFileBuffers
SetEndOfFile
GetProcessHeap
GetSystemTimeAsFileTime
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryW
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
RaiseException
InitializeCriticalSection
DeleteCriticalSection
GetVersion
lstrcmpiA
lstrlenW
lstrlenA
CloseHandle
OpenProcess
CompareStringA
CompareStringW
HeapAlloc
InterlockedIncrement
InterlockedDecrement
LoadLibraryA
GetModuleHandleA
WaitForSingleObject
CreateEventA
SetEvent
TerminateThread
CreateThread
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetComputerNameA
LocalFree
GetCurrentProcess
GetCurrentThread
lstrcpynA
lstrcpyA
GetModuleFileNameA
lstrcatA
IsDBCSLeadByte
FormatMessageA
GetFileAttributesA
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
SetUnhandledExceptionFilter
GetCommandLineA
GetCurrentProcessId
SetErrorMode
GetProcessTimes
GetPrivateProfileStringA
TerminateProcess
GetPrivateProfileSectionA
GetPrivateProfileIntA
CreateFileA
GetProfileStringA
CreateDirectoryA
WritePrivateProfileStringA
WriteProfileStringA
GetPrivateProfileSectionNamesA
GetTickCount
LocalAlloc
LockResource
CreateProcessA
InterlockedCompareExchange
SetEnvironmentVariableA
GetSystemDirectoryA
Sleep
GetModuleHandleW
LocalSize
ReadFile
SetFilePointer
SetLastError
ReadProcessMemory
FindClose
FindFirstFileA
FindResourceExA
UnmapViewOfFile
DuplicateHandle
GetModuleFileNameW
MapViewOfFile
CreateFileMappingA
CreateMutexA
ReleaseMutex
GetExitCodeProcess
CreateProcessW
GetStartupInfoA
ExitProcess
QueryPerformanceCounter

user32

wsprintfA
wsprintfW
EnumWindows
GetWindowThreadProcessId
IsWindowVisible
GetWindowTextA
DispatchMessageA
MessageBoxA
LoadStringA
CharNextA
PeekMessageA
SetTimer
GetMessageA
KillTimer
PostThreadMessageA
CharUpperA

Sections

.text
Size: 300KB - Virtual size: 297KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

7��>�u�
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4f7e80b12e14587fc3c198bdef27ceee

Headers

File Characteristics

PDB Paths

Imports

ole32

oleaut32

version

rpcrt4

shlwapi

advapi32

kernel32

user32

Sections

.text Size: 300KB - Virtual size: 297KB

.data Size: 12KB - Virtual size: 10KB

.rsrc Size: 12KB - Virtual size: 10KB

7��>�u� Size: 20KB - Virtual size: 20KB

.text
Size: 300KB - Virtual size: 297KB

.data
Size: 12KB - Virtual size: 10KB

.rsrc
Size: 12KB - Virtual size: 10KB

7��>�u�
Size: 20KB - Virtual size: 20KB