1a1f200a8ba81af738986ab237dd22a0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

1a1f200a8ba81af738986ab237dd22a0N.exe
Size

6.1MB
MD5

1a1f200a8ba81af738986ab237dd22a0
SHA1

319722022bc89c478d794659e77da69b343018a5
SHA256

239f46a3e93bdf9ea705eb8308847eaba3ee3a38863386725ebe1e0091b89a09
SHA512

cdf4c0eb9978092c3d102a3373364bc844af84506cd7759d0b7861a5229e0b9e62c518b0e950d5fbcecf3990cf6f8877e0ed118bde3bbd476d9a91cde6d94cec
SSDEEP

196608:lLelMT0R5H2ATYqHRGbHzFVdGUBwZ7Tbc3/39qR7Lin72VpZ:lLdU/mHTgpZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a1f200a8ba81af738986ab237dd22a0N.exe

Files

1a1f200a8ba81af738986ab237dd22a0N.exe
.exe windows:4 windows x86 arch:x86

bd96b55f39cd7f93e9b35b96e13621b3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

AdjustTokenPrivileges
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
DeregisterEventSource
GetTokenInformation
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegisterEventSourceA
ReportEventA

gdi32

CreateCompatibleBitmap
DeleteObject
GetDIBits
GetDeviceCaps
GetObjectA

iphlpapi

GetAdaptersAddresses

kernel32

AreFileApisANSI
CloseHandle
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateMutexW
CreateProcessW
CreateSemaphoreW
DeleteCriticalSection
DeleteFileA
DeleteFileW
DeviceIoControl
EnterCriticalSection
ExitProcess
ExpandEnvironmentStringsA
FindClose
FindFirstFileA
FindNextFileA
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FormatMessageW
FreeLibrary
GetCommandLineW
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFileSizeEx
GetFileType
GetFullPathNameA
GetFullPathNameW
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetTickCount
GetTimeZoneInformation
GetVersion
GetVersionExA
GetVersionExW
GetWindowsDirectoryA
GlobalMemoryStatus
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitializeCriticalSection
InterlockedCompareExchange
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MoveFileExW
MultiByteToWideChar
OpenProcess
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
ReadFile
ReleaseSemaphore
SetConsoleCtrlHandler
SetConsoleTextAttribute
SetEndOfFile
SetFilePointer
SetFilePointerEx
SetFileValidData
SetLastError
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnlockFile
UnlockFileEx
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
WriteFile

msvcrt

__argv
__dllonexit
__doserrno
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__pioinfo
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthreadex
_cexit
_endthreadex
_errno
_exit
_filelengthi64
_fileno
_fmode
_fstat64
_getch
_initterm
_iob
_lock
_lseeki64
_onexit
_setmode
_snprintf
_snwprintf
_stat
_stricmp
_strnicmp
_wstati64
time
localtime
gmtime
exit
fclose
feof
ferror
fflush
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
fseek
fsetpos
ftell
fwprintf
fwrite
getc
getenv
getwc
isalnum
islower
isspace
isupper
iswctype
isxdigit
ldiv
localeconv
log10
malloc
memchr
memcmp
memcpy
memmove
memset
perror
printf
putc
putwc
qsort
raise
rand
realloc
rewind
setlocale
setvbuf
signal
sprintf
sscanf
strcat
strchr
strcmp
strcoll
strcpy
strerror
strftime
strlen
strncat
strncmp
strncpy
strrchr
strtol
strtoul
strxfrm
_unlock
_wfopen
_wfsopen
_wgetcwd
_wgetenv
_wmkdir
_wopen
_write
_wrmdir
_wsopen
_wunlink
_wutime
abort
asctime
atoi
time
tolower
towlower
towupper
ungetc
ungetwc
vfprintf
wcscoll
wcscpy
wcsftime
wcslen
wcsstr
wcstombs
wcsxfrm
calloc
_vsnprintf
_tzname
_write
_tzset
_strnicmp
_strdup
_read
_open
_lseek
_isatty
_fileno
_fdopen
_dup
_close

shell32

CommandLineToArgvW

user32

GetDC
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
MessageBoxW
ReleaseDC

ws2_32

WSASend
WSASetLastError
freeaddrinfo
getaddrinfo
gethostname
getnameinfo
inet_addr

wsock32

WSACleanup
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
getpeername
getsockname
getsockopt
htonl
htons
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

Sections

.text
Size: 5.3MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 646KB - Virtual size: 645KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 72KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bd96b55f39cd7f93e9b35b96e13621b3

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

gdi32

iphlpapi

kernel32

msvcrt

shell32

user32

ws2_32

wsock32

Sections

.text Size: 5.3MB - Virtual size: 5.3MB

.data Size: 47KB - Virtual size: 47KB

.rdata Size: 646KB - Virtual size: 645KB

.bss Size: - Virtual size: 21KB

.idata Size: 9KB - Virtual size: 8KB

.CRT Size: 512B - Virtual size: 52B

.tls Size: 72KB - Virtual size: 76KB

.text
Size: 5.3MB - Virtual size: 5.3MB

.data
Size: 47KB - Virtual size: 47KB

.rdata
Size: 646KB - Virtual size: 645KB

.bss
Size: - Virtual size: 21KB

.idata
Size: 9KB - Virtual size: 8KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 72KB - Virtual size: 76KB