03094c6e0bf56c045052e9c6ca0c9a80N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

03094c6e0bf56c045052e9c6ca0c9a80N.exe
Size

1.5MB
MD5

03094c6e0bf56c045052e9c6ca0c9a80
SHA1

a39ddcc4eebb974be632190b1ddc7b2c338e4d06
SHA256

931ac0756226bc45e205a8730d28ad29da16030b7e91908a418eca85c29abc4c
SHA512

d4cc0170ca70587aa35259608b47c246ccd95b80d9771d86b1119378fc687be9305030b8c231c99c0e9c7025def1a40ea484626fb685bb5d82f226342e7cb574
SSDEEP

24576:D0J77QDjuFkuJnqe4qRQhQePCd9l6kf/a80rjEuDK:AJ774fc5C7EuD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
03094c6e0bf56c045052e9c6ca0c9a80N.exe

Files

03094c6e0bf56c045052e9c6ca0c9a80N.exe
.dll windows:6 windows x86 arch:x86

e0895a0d7b74d346a64e786231f91470

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

FXSXP32.pdb

Imports

msvcrt

_initterm
_amsg_exit
??1type_info@@UAE@XZ
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
_ftol2_sse
_wcsnicmp
_callnewh
free
_mbscpy
memcpy
wcsstr
wcscat_s
_wcsdup
??0exception@@QAE@XZ
__CxxFrameHandler3
wcsncpy_s
strrchr
wcscpy_s
iswspace
iswcntrl
wcsncmp
_CxxThrowException
_wcsicmp
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
memmove_s
memcpy_s
_wsplitpath_s
iswalpha
swscanf
malloc
_XcptFilter
_wcsnset
memset
wcsrchr
wcschr
_vsnwprintf

fxsapi

FaxAccessCheckEx
FaxSendDocumentExW
FaxGetRecipientsLimit
FaxFreeSenderInformation
FaxConnectFaxServerW
FaxGetPersonalCoverPagesOption
FaxGetReceiptsOptions
FaxClose
FaxGetSenderInformation

kernel32

GetVersionExW
GetComputerNameW
lstrlenW
ExpandEnvironmentStringsW
FreeLibrary
GetProcAddress
CreateDirectoryW
GetFileAttributesW
ReadFile
HeapCreate
GetProcessHeap
HeapAlloc
HeapFree
WaitForSingleObject
GetModuleFileNameW
SetFilePointer
GetFileSize
OutputDebugStringW
SetEndOfFile
UnmapViewOfFile
GetFullPathNameW
MapViewOfFileEx
CreateFileMappingW
CopyFileW
GetCurrentThread
LocalFree
SetLastError
MulDiv
FindFirstFileW
GetLastError
FindNextFileW
FindClose
WideCharToMultiByte
MultiByteToWideChar
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
OutputDebugStringA
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
OpenMutexW
CreateMutexW
CreateEventW
SetEnvironmentVariableW
WaitForMultipleObjects
ReleaseMutex
CreateProcessW
MapViewOfFile
VirtualAlloc
VirtualFree
InterlockedCompareExchange
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
GetSystemTime
SystemTimeToFileTime
lstrlenA
GetTempFileNameW
GetTickCount
LoadLibraryW
DisableThreadLibraryCalls
CreateFileW
WriteFile
CloseHandle
MoveFileW
DeleteFileW
GetProfileIntW
GetTempPathW
GetFileType

advapi32

RegQueryValueW
GetTraceEnableFlags
GetSecurityDescriptorOwner
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
AllocateAndInitializeSid
SetEntriesInAclW
FreeSid
SetSecurityDescriptorDacl
GetTokenInformation
ReportEventW
GetTraceEnableLevel
GetTraceLoggerHandle
IsValidSid
GetLengthSid
CopySid
RegisterTraceGuidsW
OpenThreadToken
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
UnregisterTraceGuids
TraceMessage

winspool.drv

FindFirstPrinterChangeNotification
FindNextPrinterChangeNotification
FindClosePrinterChangeNotification
GetJobW
SetJobW
DocumentPropertiesW
EnumPrintersW
OpenPrinterW
GetPrinterW
ClosePrinter

gdi32

CreateDCW
GetObjectW
StartDocW
EndDoc
GetDeviceCaps
EndPage
StartPage
SetMapMode
DeleteObject
TextOutW
GetTextExtentExPointW
GetTextMetricsW
SetBkMode
SelectObject
GetStockObject
DeleteDC
StretchDIBits
CreateFontIndirectW

user32

MessageBoxW
WinHelpW
MessageBeep
DialogBoxParamW
CreateWindowExW
GetWindowTextW
InvalidateRect
UpdateWindow
EndDialog
CheckDlgButton
GetWindowContextHelpId
BeginPaint
EndPaint
SetWindowTextW
LoadStringW
SendMessageW
IsDlgButtonChecked
GetDlgItem
EnableWindow

shell32

SHGetFolderPathAndSubDirW
SHSetLocalizedName
SHGetFolderPathW
ShellExecuteExW

mapi32

ord62
ord17
ord140
ord75
ord82
ord185

comdlg32

ChooseFontW

tapi32

lineInitializeExW
lineSetCurrentLocation
lineGetTranslateCapsW
lineTranslateAddressW
lineShutdown
lineTranslateDialogW

Exports

Exports

ServiceEntry
XPProviderInit

Sections

.text
Size: 432KB - Virtual size: 432KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 151KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e0895a0d7b74d346a64e786231f91470

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

fxsapi

kernel32

advapi32

winspool.drv

gdi32

user32

shell32

mapi32

comdlg32

tapi32

Exports

Exports

Sections

.text Size: 432KB - Virtual size: 432KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 151KB - Virtual size: 151KB

.text
Size: 432KB - Virtual size: 432KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 151KB - Virtual size: 151KB